Commit graph

4139 commits

Author SHA1 Message Date
Jouni Malinen
c427ac9211 P2P: Set Invitation Type to 1 for GO inviting to a persistent group
When a GO is operating a persistent group and invites a peer that has
been a P2P client in that persistent group, the Invitation Type in the
Invitation Request frame can be set to 1 to indicate that this is a
reinvocation of a persistent group. Do this based on the maintained
list of P2P clients that have been provided the credentials to this
group.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-06 21:54:36 +02:00
Jouni Malinen
f63b854215 P2P: Wait for PD-before-join response
Even though the Provision Discovery Response frame from PD-before-join
does not really provide any additional information, it can be better to
wait for it before starting the join operation. This adds a minimal
extra latency in the most common case and cleans up the sequence of
driver operations and debug log by avoiding potential processing of the
Provision Discovery Response while already running a scan for the actual
connection.

If transmission of Provision Discovery Request fails, join operation is
started without the additional wait. In addition, a new timeout is used
to start the join if Provision Discovery Response is lost for any
reason.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-05 20:52:24 +02:00
Jouni Malinen
c19316354e P2P: Skip event notification on PD Response in join-group case
Provision Discovery is used as a notification to the GO in the case we
are about join a running group. In such case, there is not much point in
indicating the provision discovery response events to external programs
especially when the PIN-to-be-displayed was different from the one
returned for the p2p_connect command. Skip this confusing event
completely for join-a-running-group case.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-05 20:20:36 +02:00
Johannes Berg
e12b85d324 P2P: Remove unneeded go_neg_peer check from PD
When the GO negotiation peer is assigned, the state also cannot be IDLE,
SEARCH, or LISTEN_ONLY.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2012-02-05 19:05:45 +02:00
Paul Stewart
87343c2017 bgscan_simple: Refinements to fast-scan backoff
These changes account for situations where the CQM threshold
might be approximately the same as the currently received signal,
and thus CQM events are triggered often due to measurement
error/small fluctuations.  This results in scanning occurring
too frequently.

Firstly, inhibit the immediate scan when the short-scan count
is at the maximum.  This keeps bursts of CQM toggling from
causing a torrent of back-to-back scans.  This does not inhibit
immediate scans if the CQM triggers a second time (if the signal
falls lower past the hysteresis).  This reduces the scan rate in
the worst case (fast-rate toggling high/low CQM events) to the
short scan interval.

Secondly, change the behavior of the short scan count so it acts like
a "leaky bucket".  As we perform short-scans, the bucket fills until
it reaches a maximal short-scan count, at which we back-off and
revert to a long scan interval.  The short scan count decreases by
one (emptying the bucket) every time we complete a long scan interval
without a low-RSSI CQM event.

This reduces the impact of medium-rate toggling of high/low CQM
events, reducing the number of short-interval scans that occur before
returning to a long-interval if the system was recently doing
short scans.
2012-02-05 18:43:06 +02:00
Dan Williams
0f4668ceac Try fallback drivers if global init for preferred drivers fails
Driver global init was considered a hard failure. Thus if, for example,
you used the Broadcom STA driver and didn't have nl80211 or cfg80211
loaded into the kernel, and specified a driver value of "nl80211,wext",
the nl80211 driver's global init would fail with the following message:

nl80211: 'nl80211' generic netlink not found
Failed to initialize driver 'nl80211'

but since global init was a hard failure, creating the supplicant
interface would fail and the WEXT driver would not be tried.
Give other drivers a chance instead.

Signed-hostap: Dan Williams <dcbw@redhat.com>
intended-for: hostap-1
2012-02-04 20:09:51 +02:00
Todd Previte
4bb70bd80d P2P: Fix the setter function for DBus group properties
The setter function uses the same hostapd_data structure as the getter
which causes it to crash if called on a P2P client. To overcome this
issue, the role is checked to ensure it is called on a group owner and
the pointer is examined for validity. The function will return an error
if called on a non-GO system.

Signed-hostap: Todd Previte <toddx.a.previte@intel.com>
Signed-hostap: Angie Chinchilla <angie.v.chinchilla@intel.com>
intended-for: hostap-1
2012-02-04 13:13:59 +02:00
Todd Previte
aa89df5699 P2P: Fix DBus crash and return additional P2P group properties
When using DBus to get group properties, a segmentation fault is
generated on P2P clients due to a NULL pointer for the ap_iface struct.
The current implementation only returns vendor extensions when called on
a P2P group owner.

The code now checks the P2P role which allows for role-specific
information to be provided. This also fixes the crash issue by only
looking for the correct structures based on the current P2P role.

Signed-hostap: Todd Previte <toddx.a.previte@intel.com>
Signed-hostap: Angie Chinchilla <angie.v.chinchilla@intel.com>
intended-for: hostap-1
2012-02-04 13:08:12 +02:00
Jouni Malinen
96efeeb66b Use PMKSA cache entries with only a single network context
When looking for PMKSA cache entries to use with a new association, only
accept entries created with the same network block that was used to
create the cache entry.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-04 12:32:35 +02:00
Jouni Malinen
d93dfbd588 Delay scan request on select_network if disconnecting
The disconnection command results in disassociation and deauthentication
events which were previously processed during the scan in case of
select_network command being used while associated with another network.
While this works in most cases, it can result in confusing event
messages in ctrl_iface and debug log. Avoid this by using a short delay
between the disconnection and scan request to allow the disconnection
events to be processed prior to starting the new scan.

Signed-hostap: Jouni Malinen <j@w1.fi>
intended-for: hostap-1
2012-02-04 12:28:16 +02:00
Jouni Malinen
c7bce24dc9 Clear EAPOL authenticator authFail for PMKSA caching/FT
This fixes a corner case where a STA that has PMKSA cache entry (or
valid FT keys) could try to use full EAPOL/EAP authentication and fail.
If the STA will then try to use the still valid PMKSA cache entry (or
FT) before the STA entry has been cleared, authFail could have been left
to TRUE. That will make EAPOL authenticator PAE state machine enter HELD
state even though authSuccess was already forced to TRUE. This results
in the STA getting disconnected even though it should be allowed to
continue with 4-way handshake. While this is unlikely to happen in
practice, it is better to get this fixed by clearing authFail when
setting authSuccess.

Signed-hostap: Jouni Malinen <j@w1.fi>
intended-for: hostap-1
2012-02-04 12:21:42 +02:00
Jouni Malinen
d9a38716cc Ignore TX status for Data frames from not associated STA
The TX status event may be received after a stations has been
disassociated in cases where the disassociation is following a
transmission of a Data frame. Ignore such events if the STA is not
associated at the moment the event is being processed. This avoids
confusing debug entries and rescheduling of the EAPOL TX timeouts for
STAs that are still in the STA table, but are not really in active EAPOL
session.

Signed-hostap: Jouni Malinen <j@w1.fi>
intended-for: hostap-1
2012-02-04 12:18:56 +02:00
Jouni Malinen
d3f57d0ff1 Interworking: Fix EAP-TTLS/MSCHAP configuration
Copy-paste error ended up using CHAP when MSCHAP was supposed to be
set.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-31 16:20:43 +02:00
Jouni Malinen
32cdcf15b2 WPS: Disable AP PIN after 10 consecutive failures
While the exponential increase in the lockout period provides an
efficient mitigation mechanism against brute force attacks, this
additional trigger to enter indefinite lockout period (cleared by
restarting hostapd) will limit attacks even further by giving maximum of
10 attempts (without authorized user action) even in a very long term
attack.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-30 17:36:14 +02:00
Ben Greear
80e8a5eef1 Support HT capability overrides
This allows HT capabilities overrides on kernels that
support these features.

MCS Rates can be disabled to force to slower speeds when using HT.
Rates cannot be forced higher.

HT can be disabled, forcing an 802.11a/b/g/n station to act like
an 802.11a/b/g station.

HT40 can be disabled.

MAX A-MSDU can be disabled.
A-MPDU Factor and A-MPDU Density can be modified.

Please note that these are suggestions to the kernel. Only mac80211
drivers will work at all. The A-MPDU Factor can only be decreased and
the A-MPDU Density can only be increased currently.

Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 21:01:31 +02:00
Jouni Malinen
499e7286b0 Remove duplicated TERMINATING event
Now that CTRL-EVENT-TERMINATING even is sent at the end of interface
removal in case wpa_supplicant process is going to terminate, there
is no need for this duplicated event in the signal handler.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-29 20:23:07 +02:00
Dmitry Shmidt
f08115165b Move ctrl_iface deinit into the end of interface deinit
This allows TERMINATING ctrl_iface event to be sent at the end of the
deinit sequence to avoid race conditions with new operations that this
event may trigger while wpa_supplicant would still be running through
the deinitialization path.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2012-01-29 20:21:07 +02:00
Dmitry Shmidt
2523ff6ea4 Deinit driver before notifying interface has been removed
This avoids issues with some external program starting to use the
interface based on the interface removal event before wpa_supplicant
has completed deinitialization of the driver interface.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2012-01-29 20:18:48 +02:00
Dmitry Shmidt
df509539d4 Let wpa_supplicant_deinit_iface() know that process is terminating
This will be needed to be able to move ctrl_iface TERMINATING event to
the end of interface removal.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2012-01-29 20:15:48 +02:00
Jouni Malinen
ad612c2ace nl80211: Sync with linux/nl80211.h in wireless-testing.git
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-29 19:53:34 +02:00
Nicolas Cavallari
40d00d2bfe wpa_auth: Fix race in rejecting 4-way handshake for entropy
When there is not enough entropy and there are two station associating
at the same time, one of the stations will be rejected, but during
that rejection, the "reject_4way_hs_for_entropy" flag gets cleared. This
may allow the second station to avoid rejection and complete a 4-Way
Handshake with a GTK that will be cleared as soon as more entropy is
available and another station connects.

This reworks the logic to ban all 4-way handshakes until enough entropy
is available.

Signed-hostap: Nicolas Cavallari <cavallar@lri.fr>
2012-01-29 18:11:43 +02:00
Eyal Shapira
1193dc8fd7 SME: Fix processing of Authentication timeout and failure
current_bss and pending_bssid weren't cleaned up so BSS
kept appearing in the scan results even when it was actually gone.
Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context
instead of just dropping wpa_state back to DISCONNECTED.

Reported-by: Vishal Mahaveer <vishalm@ti.com>
Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 17:44:31 +02:00
Eyal Shapira
b3aa456b3e Interleave wildcard and specific SSID scans when max_ssids=1
For drivers limited to scan a single SSID at a time, this prevents
waiting too long for a wildcard scan in case there are several
scan_ssid networks in the configuration.

Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 17:39:08 +02:00
Jouni Malinen
ea5cb06ef9 Install only the binaries into BINDIR
There is no point in installing *.service files into BINDIR.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-29 14:20:41 +02:00
Grant Erickson
b111764384 build: Fix install target parent directory prerequisites
This changes the install target such that parent directories of
installed paths area created and each path is only installed
on a dependency basis.

Signed-off-by: Grant Erickson <marathon96@gmail.com>
2012-01-29 14:18:22 +02:00
Jouni Malinen
9013edc300 dbus: Remove unused D-Bus version defines
These have not been used since commit
8ddef94bd4.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-29 12:53:12 +02:00
Yogesh Ashok Powar
3dd1d8906d nl80211: Subscribe management frames for WPA_IF_AP_BSS types
In multiple BSSes scenario for the drivers that do not use
monitor interface and do not implement AP SME, RX MGMT
frame subscription happens only for the default bss (first_bss).

Subscribe for RX MGMT frames for such BSSes.

Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
2012-01-29 12:34:38 +02:00
Yogesh Ashok Powar
a7a6af4cba nl80211: Derive frequency for BSSes other than the first
Commit e4fb216769 moved frequency
storage from driver struct to bss struct and is assigned in
wpa_driver_nl80211_set_freq. As this wpa_driver_nl80211_set_freq is
triggered only on the first_bss, bss->freq for other BSSes is never
being set to the correct value. This sends MLME frames on frequency zero
(initialized value of freq) for BSSes other than the first.

To fix this derive frequency value from first_bss.

Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
2012-01-29 12:34:32 +02:00
Antonio Quartulli
fa7187bfde IBSS RSN: Provide ibss_rsn_get_peer() helper function
This is a useful function that simplifies some code and can eventually
be used somewhere else in future.

Signed-hostap: Antonio Quartulli <ordex@autistici.org>
2012-01-29 12:23:27 +02:00
Nicolas Cavallari
f31e19df3a wpa_debug: Support outputting hexdumps into syslog
This patch allows to log hexdumps into syslog.

This is useful when testing, as syslog's network logging
helps to collect debug outputs from several machines.

Signed-hostapd: Nicolas Cavallari <cavallar@lri.fr>
2012-01-29 12:13:43 +02:00
Simon Baatz
4ac384c596 EAP-AKA peer: Append realm when learning the pseudonym
The pseudonym identity should use a realm in environments where a realm is
used. Thus, the realm of the permanent identity is added to the pseudonym
username sent by the server.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-28 19:41:19 +02:00
Simon Baatz
a6689be84f EAP-SIM peer: Append realm when learning the pseudonym
The pseudonym identity should use a realm in environments where a realm is
used. Thus, the realm of the permanent identity is added to the pseudonym
username sent by the server.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-28 19:38:46 +02:00
Sylvestre Gallon
3d0a843823 dbus: Fix endianness bug in Frequency and Signal properties
These properties did not work on big endian PowerPC (always 100% for
Signal and 0 for Frequency) due to endianness problem (u32 to u16 data
loss).

Signed-off-by: Sylvestre Gallon <ccna.syl@gmail.com>
2012-01-28 17:57:48 +02:00
Jouni Malinen
6897ce14a4 Rename systemd template files to avoid @ in the file name
Perforce does not like @ in the file name and since these template files
do not really need to have that in the name, make the files in
repository friendlier to Perforce. The generated *.service file will
maintain their old names.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-28 17:12:30 +02:00
Nicolas Cavallari
913e3cf794 nl80211: Add IBSS BSSID fixing support
If a BSSID and fixed-bssid are requested, fix the BSSID, so
the driver does not attempt to merge.

Signed-hostap: Nicolas Cavallari <cavallar@lri.fr>
2012-01-28 11:35:32 +02:00
Nicolas Cavallari
9e2af29f9b Support fixing the BSSID in IBSS mode
When the "bssid=" option is set for an IBSS network and ap_scan = 2,
ask the driver to fix this BSSID, if possible.

Previously, any "bssid=" option were ignored in IBSS mode when ap_scan=2.

Signed-hostap: Nicolas Cavallari <cavallar@lri.fr>
2012-01-28 11:33:47 +02:00
Paul Stewart
a4bbb6066d dbus: Create DBus getter/setter for FastReauth
Provide a means over DBus to set the conf->fast_reauth
property, which controls whether TLS session resumption
should be attempted for EAP-TLS 802.1X networks.

Signed-off-by: Paul Stewart <pstew@chromium.org>
2012-01-28 11:21:37 +02:00
Jouni Malinen
ce7b56afab WPS: Fix an interoperability issue with mixed mode and AP Settings
It looks like Windows 7 WPS implementation does not like multiple
Authentication/Encryption Type bits to be set in M7 AP Settings
attributes, i.e., it refused to add a network profile if the AP
was configured for WPA/WPA2 mixed mode and AP PIN was used to
enroll the network.

Leave only a single bit set in the Authentication/Encryption Type
attributes in M7 when the AP is acting as an Enrollee to avoid this
issue.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-27 22:32:15 +02:00
Jouni Malinen
b21ff9cb20 P2P: Fix WSC IE inclusion for P2P disabled case
wpas_wps_in_use() was forcing WPS to be enabled unconditionally if P2P
support was included in the build. This is not really the correct
behavior for the case when P2P has been disabled at runtime. Change the
code here to verify runtime configuration of P2P before forcing WPS to
be enabled. This allows WSC IE to be left out from Probe Request frames
when scanning for APs without P2P or WPS being in use.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-27 21:09:34 +02:00
Jouni Malinen
552310680c nl80211: Fix send_action on off-channel in P2P GO role
A P2P Action frame may need to be sent on another channel than the GO's
operating channel. This information was lost in
wpa_driver_nl80211_send_action() in the case the interface was in AP
mode. Pass the frequence and related parameters to send_mlme mechanism
to allow the correct frequence to be used with the send frame command in
AP (P2P GO) mode.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-26 17:44:11 +02:00
Jouni Malinen
ceb997f394 Fix ap_sta_disconnect() to clear EAPOL/WPA authenticator state
Number of places in hostapd use ap_sta_disconnect() instead of
ap_sta_disassociate() or ap_sta_deauthenticate(). There are some
differences between these functions, e.g., in the area how quickly
the EAPOL state machines get deinitialized. This can result in
somewhat unexpected events since the EAPOL/WPA authenticator
state machines could remain running after deauthentication.

Address this by forcing EAPOL/WPA authenticator state machines
to disabled state whenever ap_sta_disconnect() is called instead
of waiting for the deauthentication callback or other timeout
to clear the STA.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 22:32:58 +02:00
Jouni Malinen
1e49ccebf7 pcsc: Fix compiler warning on signed vs. unsigned comparison
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-25 17:41:59 +02:00
Jouni Malinen
b1aebbc427 P2P: Do not expire peer entry if we are connected to the peer
Even though we may not update P2P peer entry while connected to the
peer as a P2P client, we should not be expiring a P2P peer entry while
that peer is the GO in a group where we are connected as a P2P client.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 17:27:47 +02:00
Jouni Malinen
1d277f0260 P2P: Do not expire peer entry if peer is connected as a client
Even though we may not receive a Probe Response from the peer during
the connection, we should not be expiring a P2P peer entry while that
peer is connected to a group where we are the GO.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 17:00:59 +02:00
Deepthi Gowri
d8d6b32eec nl80211: P2P: Pass cookie parameter in send action frame
The cookie value needs to be fetched in GO mode, too, to be able to
indicate TX status callbacks with drivers that handle AP mode SME
functionality internally. This fixes issues with client discoverability
where TX status callback for GO Discoverability Request is needed to
trigger the GO to send Device Discoverability Response.
2012-01-23 20:12:06 +02:00
Jouni Malinen
433cd2ce65 Stop sched_scan in number of cases where it should not be running
When a P2P group is removed, we better not leave possibly started
sched_scan running. This could happen when a separate group interface
was not used.

In addition, it looks safer to explicitly stop sched_scan before
starting P2P Listen or Find operations to make sure the offloaded
scanning is not running when doing similar P2P operations.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-23 18:26:09 +02:00
Sujith Manoharan
cd2f4ddfb9 Update WPA/RSN IE properly for driver based BSS selection
This patch fixes an issue with roaming for drivers that set
WPA_DRIVER_FLAGS_BSS_SELECTION (currently ath6kl). On moving to an AP
with a different BSSID, an EVENT_ASSOC is received and the subsequent
4-way handshake may fail because of a mismatch between the RSN IE in
message 3/4 and in Beacon/Probe Response. This happens only when the APs
use different RSN IE contents and ap_scan is set to 1, since
wpa_supplicant fails to update its cached IEs.

Initial association may fail, too, in case of multiple APs with
the same SSID, since BSSID selection is done by the driver and again
a mismatch could be seen.

Fix these two issues by clearing and updating the cached IEs on
receiving an Association event from the driver. Also, retrieve the
scan results when the new BSS information is not present locally.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2012-01-23 17:34:39 +02:00
Jouni Malinen
e6c6274947 Add preliminary MNC length determination based on IMSI
Some SIM cards do not include MNC length with in EF_AD. Try to figure
out the MNC length based on the MCC/MNC values in the beginning of the
IMSI. This covers a prepaid Elisa/Kolumbus card that would have ended
up using incorrect MNC length based on the 3-digit default.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 21:54:24 +02:00
Jouni Malinen
a3e0105692 Avoid unnecessary memory allocation in building of SIM realm
The temporary IMSI buffer can be used for this without needing the
extra memory allocation. In addition, the implementation is easier
to understand when the extra identity prefix value for EAP-SIM/AKA
is not included while fetching MCC/MNC from the IMSI.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 21:54:24 +02:00
Simon Baatz
2d7d0ab307 EAP-SIM/EAP-AKA peer: Support realms according to 3GPP TS 23.003
If the identity is derived from the SIM, use a realm according
to 3GPP TS 23.003.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-22 21:54:24 +02:00