Commit graph

18359 commits

Author SHA1 Message Date
Jouni Malinen
b700a56e14 OpenSSL 3.0: Determine the prime length for an EC key group using EVP_PKEY
EVP_PKEY_get0_EC_KEY() and EC_KEY_get0_group() were deprecated in
OpenSSL 3.0. Add a version of this by determining the group without
fetching the EC_KEY itself from an EVP_PKEY.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-03-13 11:26:55 +02:00
Jouni Malinen
3c61f4db4c OpenSSL: Replace EC_GROUP_get_curve_GFp() calls with EC_GROUP_get_curve()
EC_GROUP_get_curve_GFp() was deprecated in OpenSSL 3.0.
EC_GROUP_get_curve() can be used to do the exact same thing. Add a
backwards compatibility wrapper for older OpenSSL versions to be able to
use this newer function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-03-13 11:26:47 +02:00
Jouni Malinen
e2cb0ca1ac OpenSSL 3.0: Implement crypto_ec_key_group() with new API
Get rid of the now deprecated EVP_PKEY_get0_EC_KEY() and
EC_KEY_get0_group() calls.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-03-13 11:26:36 +02:00
Jouni Malinen
7c8fcd6baf tests: Fix sigma_dut_cmd() processing for the return value
The first sock.recv() may return both the status,RUNNING and the
following status line if the sigma_dut process ends up being faster in
writing the result than the test script is in reading the result. This
resulted in unexpected behavior and odd error messages when parsing the
result in the test cases. Fix this by dropping the status,RUNNING line
from the result in case the buffer includes multiple lines.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-03-12 19:00:36 +02:00
Jouni Malinen
f6a53f64af OpenSSL: Replace EVP_PKEY_cmp() with EVP_PKEY_eq() when available
OpenSSL 3.0 deprecated EVP_PKEY_cmp() and replaced it with EVP_PKEY_eq()
which is not available in older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-03-12 10:54:48 +02:00
Lubomir Rintel
5b093570dc D-Bus: Add 'wep_disabled' capability
Since commit 200c7693c9 ('Make WEP functionality an optional build
parameter'), WEP support is optional and, indeed, off by default.

The distributions are now catching up and disabling WEP in their builds.
Unfortunately, there's no indication prior to an attempt to connect to a
WEP network that it's not going to work. Add a capability to communicate
that.

Unlike other capabilities, this one is negative. That is, it indicates
lack of a WEP support as opposed to its presence. This is necessary
because historically there has been no capability to indicate presence
of WEP support and therefore NetworkManager (and probably others) just
assumes it's there.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Davide Caratti <davide.caratti@gmail.com>
2022-03-12 10:40:01 +02:00
Nicolas Escande
56a14cc720 DFS: Don't let cac_time_left_seconds overflow
There can be some discrepancy between the theorical dfs cac end (as
computed with the cac duration and cac start) and the actual cac end as
reported by the driver. During that window, the value of remaining time
outputed by the status command on the socket control interface will
display an overflowed, invalid value.
To mitigate this lets compute the remaining time as signed and display
it only when positive, otherwise defaulting it to 0.

Status command shows something like that when polling every seconds:

state=DFS
cac_time_seconds=60
cac_time_left_seconds=1
...
state=DFS
cac_time_seconds=60
cac_time_left_seconds=0
...
state=DFS
cac_time_seconds=60
cac_time_left_seconds=4294967294
...
state=DFS
cac_time_seconds=60
cac_time_left_seconds=4294967293
...
state=DFS
cac_time_seconds=60
cac_time_left_seconds=4294967292
...
state=ENABLED
cac_time_seconds=60
cac_time_left_seconds=N/A

Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
2022-03-12 10:39:43 +02:00
Alasdair Mackintosh
ae512c30a1 DPP: Fix uninitialised variable on error path
The current code generates a warning when compiled by Clang, because if
we goto 'fail:', password_len can be uninitialised when we pass it in to
bin_clear_free().

Note that the actual usage is safe, because bin_clear_free() ignores
the second argument if the first argument is NULL, but it still seems
worth cleaning up.

Signed-off-by: Alasdair Mackintosh <alasdair at google.com>
2022-03-12 10:36:03 +02:00
ArisAachen
3a157fe92f dbus: Set CurrentAuthMode to INACTIVE only if network is not selected
CurrentAuthMode should be set as a real auth type when authentication is
in progress. wpa_supplicant has a property "State" which indicates the
authentication stage already. I think setting auth mode as "INACTIVE" in
all auth progress stages is not a good idea, because sometimes we need
to handle this connection according to the auth type even when
authentication is not complete. For example, NetworkManager may recall
ask-password-dialog when auth mode is "wpa-psk" and "sae", try next
access point when auth mode is "EAP-xx" when password is incorrect.
Since "CurrentAuthMode" is set as "INACTIVE" in all not fully completed
situations, we do not know how to handle it.

Signed-off-by: Aris Aachen <chenyunxiong@unionitech.com>
Signed-off-by: ArisAachen <chenyunxiong@uniontech.com>
2022-03-12 10:30:26 +02:00
Jouni Malinen
0ce8d55a2e hs20-osu-client: Allow EST server to use different host name
The EST server does not have to be sharing the same host name with the
OSU server. Use the host name from the EST URL instead of the SPP server
URL when validating the EST server certificate.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-11 19:47:30 +02:00
Jouni Malinen
5eaf596e14 HTTP: Make URL available to the cert_cb
This makes it easier for non-SOAP cases to validate HTTP server name
(from the URL) match against the certificate.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-11 19:46:23 +02:00
Jouni Malinen
abed7978f6 HS 2.0 server: Event log entry on missing configuration for the realm
Make the error reason clearer in the event log for the case where the
requested realm has not been configured.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-11 19:44:58 +02:00
Purushottam Kushwaha
1192d5721b Android: Compile hs20-osu-client to /vendor/bin in test builds
hs20-osu-client compilation fails on Android O onwards because of
undefined reference for __android_log_print/__android_log_vprint.

Modify hs20-osu-client's Android.mk to include liblog library and use
tag 'hs20-osu-client' in logcat logs. Additionally, compile
hs20-osu-client to /vendor/bin in non-production builds.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 19:40:08 +02:00
Sumit Agre
1fee1c40c3 Enhance QCA vendor interface to indicate TWT required capability of AP
Add QCA_WLAN_TWT_NOTIFY command type to send event to userspace when AP
changes TWT required bit field in its capabilities.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 19:36:37 +02:00
Jhalak Naik
a192305a41 Add QCA vendor attributes for AFC support in external ACS
Add support for new QCA nested attributes to pass the AFC channel
information as part of the external ACS request command,
EXTERNAL_ACS_EVENT_CHAN_INFO.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 19:31:49 +02:00
Jouni Malinen
0c51cf624c tests: sigma_dut DPP Configurator (MUD URL, NAK change)
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 18:29:34 +02:00
Jouni Malinen
e792f38db8 tests: DPP PKEX with netAccessKey curve change
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 01:30:33 +02:00
Jouni Malinen
5ce5ed88a9 tests: Fix dpp_own_config_curve_mismatch to match implementation
This test case was assuming the Configurator would change the
netAccessKey curve every time based on the protocol keys, but that is
not the case anymore, so force that change here for a negative test.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 01:30:33 +02:00
Jouni Malinen
c4a36d050a tests: Fix dpp_intro_mismatch to match implementation
This test case was assuming the Configurator would change the
netAccessKey curve every time based on the protocol keys, but that is
not the case anymore, so force that change here for a negative test.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 01:30:33 +02:00
Jouni Malinen
de5939ef52 DPP: Allow Configurator net_access_key_curve to be changed
This is mainly for testing purposes to allow a Configurator to the curve
between provisioning cases. This would not work for real deployement
cases unless every Enrollee were reconfigured.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-10 01:30:33 +02:00
Jouni Malinen
9638452a62 DPP: Update Configurator to require same netAccessKey curve to be used
DPP network introduction requires all devices to use the same curve for
netAccessKey. Enforce that this happens based on hardcoding the curve
based on the first successful configuration object generation if no
explicit configuration of the curve was used.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 23:08:06 +02:00
Jouni Malinen
800ae647df tests: Check DPP3 support in the build for netAccessKey curve changes
These test cases need to be skipped if CONFIG_DPP3=y is not defined in
the build.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 21:26:28 +02:00
Jouni Malinen
2b406eecee DPP: Update Auth-I derivation operations
This is not properly defined in the technical specification and will
need to be clarified there. Change the implementation to use a design
that is more likely to be used in the cleaned up tech spec.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 20:50:56 +02:00
Jouni Malinen
77ae98511d tests: sigma_dut and DPP netAccessKey curve change
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 01:20:49 +02:00
Jouni Malinen
117dc4ea41 tests: DPP curve change for netAccessKey
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 01:07:59 +02:00
Jouni Malinen
de64dfe98e DPP: Curve change for netAccessKey
Allow the Configurator to be configured to use a specific curve for the
netAccessKey so that it can request the Enrollee to generate a new key
during the configuration exchange to allow a compatible Connector to be
generated when the network uses a different curve than the protocol keys
used during the authentication exchange.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-09 01:07:59 +02:00
Jouni Malinen
fd2eb7a41e DPP: Fix a memory leak on error path
The encoded CSR could have been leaked if another memory allocation were
to fail in this function. Use a shared return path to free the allocated
temporary buffers to avoid this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-08 00:28:10 +02:00
Jouni Malinen
1d4cd24d0b tests: sigma_dut and DPP Reconfig Auth Req error cases
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-08 00:06:00 +02:00
Jouni Malinen
e9551efe05 DPP: Missing/invalid Protocol Version in Reconfig Auth Req
Extend dpp_test testing functionality to allow the Protocol Version
attribute to be removed or modified to invalid value in Reconfig
Authentication Request.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-07 23:40:27 +02:00
Jouni Malinen
fc78c13550 tests: sigma_dut and DPP PKEXv1 responder
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-07 21:38:25 +02:00
Jouni Malinen
eeb72e7c9a DPP: Extend DPP_PKEX_ADD ver=<1/2> to cover Responder role
Allow PKEX v1-only or v2-only behavior to be specific for the Responder
role. This is mainly for testing purposes.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-07 21:37:40 +02:00
Jhalak Naik
6c3c431bbd Add QCA vendor attribute to enable Spectral FFT recapture
Add a QCA vendor attribute to enable FFT recapture on user trigger.
Enable FFT recapture only when spectral scan period is greater than 52
us.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-04 22:35:33 +02:00
Jouni Malinen
c34b35b54e tests: WPA3 with SAE password from RADIUS
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-04 12:25:47 +02:00
Mario Hros
fcbdaae8a5 SAE: Add support for RADIUS passphrase as the SAE password
Allow the first Tunnel-Password RADIUS entry to be used for SAE in
addition to the sae_password entries and wpa_passphrase parameters from
the static configuration file.

Signed-off-by: Mario Hros <git@reversity.org>
2022-03-04 12:25:14 +02:00
Baligh Gasmi
3d86fcee07 cleanup: Remove unreachable code
There is no need for unreachable code in these places, so remove it.

Signed-off-by: Baligh Gasmi <gasmibal@gmail.com>
2022-03-04 12:07:46 +02:00
Yegor Yefremov
9683195ee5 qca-vendor: Fix typos
Fix typos found with codespell utility.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2022-03-04 12:04:54 +02:00
Yegor Yefremov
4c9ef9322a brcm_vendor: Fix typos
Fix typos found with codespell utility.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2022-03-04 12:04:54 +02:00
Yegor Yefremov
d65285ab8f src/drivers: Fix typos
Fix typos found with codespell utility.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2022-03-04 12:04:51 +02:00
Lorenzo Bianconi
203a027b28 nl80211: Report background radar/CAC detection capability
Report background radar/CAC detection capability if supported
by the underlying driver/hardware.

Tested-by: Owen Peng <owen.peng@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
2022-03-04 01:17:02 +02:00
Lorenzo Bianconi
0a73649b64 DFS: Add capability to select radar-only channels
Introduce type parameter to dfs_get_valid_channel() routine to allow
selection of a radar-only channel where the CAC detection has not been
performed yet. This is a preliminary patch to enable background
radar/CAC detection.

Tested-by: Owen Peng <owen.peng@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
2022-03-04 01:16:01 +02:00
Lorenzo Bianconi
f39765369a DFS: Introduce dfs_set_valid_channel() utility routine
This is a preliminary change to introduce radar/CAC background detection
support.

Tested-by: Owen Peng <owen.peng@mediatek.com>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
2022-03-04 00:22:15 +02:00
Jouni Malinen
d001b301ba Fix removal of wpa_passphrase on 'make clean'
Fixes: 0430bc8267 ("build: Add a common-clean target")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-03 13:26:42 +02:00
Sergey Matyukevich
cb41c214b7 build: Re-enable options for libwpa_client.so and wpa_passphrase
Commit a41a29192e ("build: Pull common fragments into a build.rules
file") introduced a regression into wpa_supplicant build process. The
build target libwpa_client.so is not built regardless of whether the
option CONFIG_BUILD_WPA_CLIENT_SO is set or not. This happens because
this config option is used before it is imported from the configuration
file. Moving its use after including build.rules does not help: the
variable ALL is processed by build.rules and further changes are not
applied. Similarly, option CONFIG_NO_WPA_PASSPHRASE also does not work
as expected: wpa_passphrase is always built regardless of whether the
option is set or not.

Re-enable these options by adding both build targets to _all
dependencies.

Fixes: a41a29192e ("build: Pull common fragments into a build.rules file")
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
2022-03-03 13:22:55 +02:00
Jouni Malinen
08cd7a75bf tests: HE AP and capability parsing
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-03 01:51:56 +02:00
Jouni Malinen
dec626109e HE: Fix invalid length checking for HE Capability element
Do not use the first octet of the PPE Thresholds field without
explicitly confirming that that octet was included in the element.
Furthermore, allow the received element to have additional octets in the
end since IEEE Std 802.11ax-2021 defines this to be an extensible
element and new fields could be added to the end of it in the future.

Fixes: 0497e41481 ("HE: Fix HE Capabilities element size")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-03-03 01:31:39 +02:00
Shiva Sankar Gajula
53be64f7d9 HE: Fix calculation of the PPE Threshold field length
The previously used calculation was not correct for the cases where the
extra padding field was needed. Fix this by properly calculating the
number of full octets in the field.

Fixes: 0497e41481 ("HE: Fix HE Capabilities element size")
Signed-off-by: Shiva Sankar Gajula <quic_sgajula@quicinc.com>
2022-03-03 01:31:39 +02:00
Jouni Malinen
a201ab385e tests: Fetch all event messages in wpas_ctrl_many_networks
Do not leave a large number of network added/removed events remaining
for the following test case to handle. This removes some possible
failure test case sequences like the following one:
wpas_ctrl_many_networks dbus_ap_scan_2_ap_mode_scan

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-02-26 19:12:11 +02:00
Jouni Malinen
a038e6dea4 tests: wpa_supplicant AP mode and PSK/PTK lifetime in memory"
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-02-26 19:12:11 +02:00
Jouni Malinen
738fef2f0b Clear PSK explicitly from memory in couple more cases on deinit
Couple of the WPS/P2P/RADIUS-PSK cases were freeing heap memory
allocations without explicitly clearing the PSK value. Add such clearing
for these to avoid leaving the PSK in memory after it is not needed
anymore.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-02-26 19:12:11 +02:00
Jouni Malinen
567b9764fb Clear PMK explicitly even without FT support in AP build
Unlike the other keys that were cleared here, the PMK is available
without FT support built into hostapd and as such, should be cleared in
all cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-02-26 19:12:11 +02:00