The USD passive subscriber and solicited transmission only publisher
require receiving multicast NAN action frames in order to work.
Currently, we are not requesting to receive multicast when
registering NAN action frames. As a result, USD passive subscribe or
solicited only publish may not work.
The NL80211_ATTR_RECEIVE_MULTICAST attribute corresponds to wiphy
ext feature NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS, which
requires driver support and only a few drivers in the kernel tree
support it. Namely ath9k, ath9k_htc, ath10k and hwsim. We should
fall back to register non multicast action frames if the driver
has no support.
It was confirmed that ath9k_htc starts to work after the changes.
Note that even without requesting to receive multicast Action
frames, some drivers would still upload them. For example, rtl8192cu
and hwsim. This is why test cases like test_nan_usd_match would not
fail.
Tested-on: TP-LINK TL-WN821N v3(AR7010+AR9287, ath9k_htc)
Signed-off-by: Chien Wong <m@xv97.com>
The Wi-Fi Aware Specification v4.0 only defines unsolicited
transmissions only, solicited transmissions only and both unsolicited
and solicited transmissions publish. The other possibility is undefined
so we should reject it.
Signed-off-by: Chien Wong <m@xv97.com>
The 'req_instance' parameter in transmit command should be
'req_instance_id'.
Fixes: e3f9ab3c3a ("NAN: USD in wpa_supplicant")
Signed-off-by: Chien Wong <m@xv97.com>
When the first link is deleted and there are still remaining links,
drv->ctx should be updated to the new default link on the bss.
Otherwise, drv->ctx points to the address that has already been freed
and makes hostapd crash.
Fixes: d2b62b3fe5 ("AP MLD: Support link removal before removing interface")
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
Clear scan results at the beginning of the test case to avoid incorrect
behavior if there are multiple entries for the same BSS. In addition,
use a bit longer wait for receiving an updated Beacon frame in scan
results.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Instead of checking the latest scan results every second indefinitely,
add more latency between the checks in case the driver does not update
the time stamp value (i.e., does not report new Beacon frames during an
association).
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
In the case that the AP MLD is disabled and enabled again, flush
the wpa_supplicant BSS table before reconnecting as otherwise
the previous AP MLD BSSs would be in the BSS table and the wpa_supplicant
would try to connect to them.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Using just sta_find() won't work for any link addresses
but the assoc link, use sta_find_mlo() instead.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
The test assumes that STA will try to reconnect with the same SAE group
after the first authentication attempt is rejected due to unsupported
group. Since this behaviour is fixed in the previous patch, configure
two different groups to trigger the second authentication attempt.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Make sure that sme_set_sae_group() doesn't select a group that was
previously rejected during this instance of SAE authentication.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
SAE rejected groups were not cleared in case of re-association to the
same ESS. Since new BSS can support different groups, keeping rejected
groups doesn't make sense and may result in AP rejecting the
authentication. Fix it.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Currently, when the ACS is updating the puncturing bitmap, the function
acs_update_puncturing_bitmap() sets the primary channel bitmap to 0.
This leads to a potential issue where the primary channel could be
punctured if ACS selects a different best channel within the same
segment.
To fix this issue, ensure that the primary channel bitmap is correctly
set by calculating the index of the primary channel based on the
frequency difference between the current channel and the best channel in
the segment, and is then passed to acs_update_puncturing_bitmap().
Fixes: af0f60e7dd ("EHT: Calculate puncturing bitmap for ACS")
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
The current ACS algorithm incorrectly returns success even when there is
no survey list, leading to improper interference factor calculation.
This leads to treating 0 as a valid interference factor, which affects
channel selection judgment.
Fix the issue by ensuring success is only returned when the survey list
is not empty, thereby ignoring non-zero values in the interference
factor calculation.
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
Update the documentation to reflect the ACS algorithm used in the code.
No functionality change.
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
While TKIP should not really be used at all anymore and is not allowed
for WPA3 (which is required for Wi-Fi 7), there are some deployed APs
that allow WPA2 PSK to be used with MLO and even allowing WPA+WPA2 mode
with TKIP as the group cipher). IEEE P802.11be/D5.0 does not seem to
explicitly disallow this combination, so handle the MLO GTK KDE key
processing similarly to the way GTK KDE is processed, i.e., including
swapping of Michael MIC Tx and Rx keys for TKIP.
This fixes issues with Michael MIC failures if TKIP is used as a group
cipher for a multi-link association.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
hostapd_cli chan_switch command fails in 2.4 GHz band for HE and EHT
modes if the user does not explicitly specify 'ht' option in the
command.
For example:
"hostapd_cli -i wlan2 chan_switch 10 2412 sec_channel_offset=0 \
center_freq1=2412 bandwidth=20 blocktx he"
Fix this by enabling HT by default if HE is enabled in the 2.4 GHz and 5
GHz bands. Similarly, enable VHT by default when HE is enabled in the 5
GHz band.
Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
When the wiphy supports multiple bands and reports different capability
values between 5 GHz and 6 GHz channels, the 6 GHz mesh interface is
unable to correctly map the channel width in function
ibss_mesh_setup_freq(). This issue arises because the modes of 5 GHz and
6 GHz interfaces are the same (HOSTAPD_MODE_IEEE80211A) in supported
modes.
To address this, use function get_mode() to determine the appropriate
mode during mesh setup. This will iterates through all the hw_features
sets and ensures compatibility with the band of the channel supported in
hw_features set.
Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
If SSID was not verified during the initial setup of an association, but
beacon protection was negotiated, try verify the SSID based on Beacon
frames that have been received after the first BIGTK has been
configured.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a variant of wpa_bss_get_ie() to allow IEs to be checked from
only Beacon frames similarly to how wpa_bss_get_vendor_ie_beacon()
behaves for vendor specific elements.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
The new "bigtk_set=1" entry in the control interface STATUS command
output indicates that a BIGTK has been successfully configured. This
shows that beacon protection has been enabled for the current
association.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Add a new "ssid_verified=1" entry into the control interface STATUS
command output if the SSID has been verified for the current
association. This verification may have been done implicitly (e.g., with
SAE H2E and FT protocol binding in the SSID into key derivation or with
FILS protecting the SSID element in the (Re)Association Request frame)
or explicitly with the recently added SSID protection mechanism during
the 4-way handshake.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
On the AP responder side, KDK was derived if the driver advertises
WPA_DRIVER_FLAGS2_SEC_LTF_AP. That is not correct, i.e., this needs to
also depend on the initiator indicating support for this in the RSNXE of
PASN authentication frame 1.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
In case the scan request handling fails, exit cleanly, i.e., without
setting internal state such as the 'scan_res_handler' pointer.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
wpa_supplicant will generally never allocate a memory block of that
size. We can therefore assume that it belongs to ASAN and we need to
ignore it.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The matching code currently only tests whether the prefix of a function
matches. Make this more strict by ensuring that the function name is not
longer.
However, as this breaks some tests (due to inlining), add the ability to
do an explicit prefix match by appending a '*' to the function name. Use
this to change the eap_eke_prf match to eap_eke_prf_* in order to match
one of the actual implementations.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The functions specified by the user might be longer than the function in
the backtrace, potentially overflowing the memcmp(). In practice, it
should not be a relevant out-of-memory read. However, we can use
strncmp() instead.
Note that, as before, this is only a prefix match. If a function name is
longer in the backtrace it will still match.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
It seems that sha256_prf may not always be in the stack trace for
failure checking, possibly due to tail call optimization as it simply
calls sha256_prf_bits with updated parameters. Simply match against
sha256_prf_bits directly to avoid issues due to optimizations.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The wpas_p2p_nfc_handover failure test and the more specific
wps_build_nfc_handover_req_p2p were effectively the same as the matching
currently does a prefix match. The code-path tested in these two cases
only hit a single TEST_FAIL macro in openssl_digest_vector.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The test here is triggering the allocation failure in the static
wpa_config_parse_password() helper. Use this and decrease the count
instead of matching both wpa_config_set_quoted() and wpa_config_set()
and counting down based on that.
This is in preparation to fix the failure function matching to not do a
prefix match.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The test expects rsn_pmkid_suite_b_192() to fail but specified only
rsn_pmkid_suite_b without the _192 postfix. Add the postfix so that the
function matching can be fixed later.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
If the kck_len is 0 then the pointer may be NULL. If that happens UBSAN
complains about the NULL pointer as memcpy() has the arguments declared
to never be NULL even if the copied number of bytes were zero.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The consumer of the link_bssid array assumes it is a NULL terminated
array of BSSIDs. As such, add one to the maximum number of links to
ensure that there is always a sentinel value.
Fixes: 5af986c75a ("MLD: Also mark links as failed after association failure")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
When ignoring a link BSSID the multi-link information was parsed out
into a struct ml_sta_link_info on the stack. However, this stack
variable went out of scope before it was used by passing the link_bssids
pointer array to another function.
Fixes: 5af986c75a ("MLD: Also mark links as failed after association failure")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Explicitly free the previously allocated copy if ServiceDiscoveryRequest
or Service DiscvoveryResponse parsing loop finds multiple instances of
the same dict entry.
Signed-off-by: Jouni Malinen <j@w1.fi>
Using D-Bus it is possible to request an invalid SD response where
"tlvs" is specified and there is an unknown key (e.g. "bar": "foo"). In
this case, "tlv" is allocated and then never used nor freed. Valgrind
complains as follows:
36 bytes in 1 blocks are definitely lost in loss record 20 of 74
at 0x484C214: calloc (vg_replace_malloc.c:1675)
by 0x41C673: wpabuf_alloc (wpabuf.c:124)
by 0x41C673: wpabuf_alloc_copy (wpabuf.c:162)
by 0x54FB94: wpas_dbus_handler_p2p_service_sd_res (dbus_new_handlers_p2p.c:3016)
by 0x53B9A2: msg_method_handler (dbus_new_helpers.c:356)
by 0x53B9A2: message_handler (dbus_new_helpers.c:412)
by 0x4EAB4B8: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.19.13)
by 0x5495DF: dispatch_data (dbus_common.c:37)
by 0x5495DF: process_watch (dbus_common.c:73)
by 0x5495DF: process_watch_read (dbus_common.c:89)
by 0x41EE8E: eloop_sock_table_dispatch.part.0 (eloop.c:603)
by 0x41FA46: eloop_sock_table_dispatch (eloop.c:597)
by 0x41FA46: eloop_run (eloop.c:1233)
by 0x56A3EE: wpa_supplicant_run (wpa_supplicant.c:8074)
by 0x40DB06: main (main.c:393)
Fix it ensuring that "tlv" is freed both in the error and non-error path
of wpas_dbus_handler_p2p_service_sd_res(). Also, add a test case in
test_dbus.py to verify correct behavior.
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
Using D-Bus it is possible to trigger a valid UPnP SD request where
"tlv" is specified: in this case "tlv" is allocated, and then not used
nor freed. Valgrind complains as follows:
72 bytes in 2 blocks are definitely lost in loss record 46 of 68
at 0x484C214: calloc (vg_replace_malloc.c:1675)
by 0x41C673: wpabuf_alloc (wpabuf.c:124)
by 0x41C673: wpabuf_alloc_copy (wpabuf.c:162)
by 0x54F8B5: wpas_dbus_handler_p2p_service_sd_req (dbus_new_handlers_p2p.c:2928)
by 0x53B9A2: msg_method_handler (dbus_new_helpers.c:356)
by 0x53B9A2: message_handler (dbus_new_helpers.c:412)
by 0x4EAB4B8: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.19.13)
by 0x5495DF: dispatch_data (dbus_common.c:37)
by 0x5495DF: process_watch (dbus_common.c:73)
by 0x5495DF: process_watch_read (dbus_common.c:89)
by 0x41EE8E: eloop_sock_table_dispatch.part.0 (eloop.c:603)
by 0x41FA46: eloop_sock_table_dispatch (eloop.c:597)
by 0x41FA46: eloop_run (eloop.c:1233)
by 0x56A3CE: wpa_supplicant_run (wpa_supplicant.c:8074)
by 0x40DB06: main (main.c:393)
Fix it ensuring that "tlv" is freed, both in the error and non-error
path of wpas_dbus_handler_p2p_service_sd_req(). Also, add a test case in
test_dbus.py to verify correct behavior.
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
Since 0ce1545dcb ("nl80211: Determine maximum number of supported
AKMs") we get the maximum number of supported AKMs from the kernel.
Let's use that instead of the legacy NL80211_MAX_NR_AKM_SUITES when
setting up AP mode operation.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Some deployed STAs that advertise SecureLTF support in the RSNXE in
(Re)Association Request frames, do not derive KDK during PTK generation.
Since the correct key calculations in the AP includes an additional KDK
generation in such cases, this causes different PTK-KCK being derived
and the AP ultimately discarding EAPOL-Key message 2/4 due to MIC
validation failure.
Try to derive a PTK without KDK as a workaround in such cases and allow
the 4-way handshake to continue if this results in a matching MIC.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
wpa_s_setup_sae_pt() derived SAE PT even when the configured key
management options did not include SAE if the global sae_pwe
configuration parameter had been changed to enable H2E. This adds
unnecessary extra delay, so derive PT only if SAE is actually enabled in
the network profile.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Currently color change test is supported only on the first link of the
AP MLD. Extend the support to test on non-first link as well.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
When an HE BSS color event is received from the driver, the event was
delevered to the first link BSS ctx. To support HE BSS color with MLO,
there is a need to identify the correct link for which the event is
intended.
Add link ID parsing support in the event handler and pass the link ID
(if included) down to the event handler so that appropriate link can be
selected.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Almost same logic is there in handling four different commands related
to color collision. Later when link ID needs to be parsed, it would be
more duplicate logic at four different places. Hence refactor and bring
it in a single function.
No functionality changes.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
In function handle_assoc(), ieee802_11_update_beacons() was used to
update the Beacon frames. However, with commit a5d0bb42a2 ("Reduce
delay between Association Request and Association Response"), it was
changed to ieee802_11_set_beacons() which basically overturned what
commit e59d2a31cf ("hostapd: Fix premature beacon set during
association handling") did which is not correct.
Fix this and use ieee802_11_update_beacons() instead of
ieee802_11_set_beacons().
Fixes: a5d0bb42a2 ("Reduce delay between Association Request and Association Response")
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
There is no need to depend on all uses (i.e., both hostapd and
wpa_supplicant) to verify that the length of the Rejected Groups field
in the Rejected Groups element is valid (i.e., a multiple of two octets)
since the common parser can reject the message when detecting this.
Signed-off-by: Jouni Malinen <j@w1.fi>
Instead of practically ignoring an odd octet at the end of the element,
check for such invalid case explicitly. This is needed to avoid a
potential group downgrade attack.
Fixes: 444d76f74f ("SAE: Check that peer's rejected groups are not enabled")
Signed-off-by: Jouni Malinen <j@w1.fi>
