The Michael MIC TX and RX keys needs to be swapped in the FT case just
like in all other TKIP key configuration cases. This fixes issues where
TKIP as group cipher resulted in Michael MIC failures being detected for
each received group-addressed frame after FT protocol use.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This is needed to get wpa_supplicant into clean state during testing if
a test case triggers countermeasures.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This cleans up debug log by not including comments about failed
operations in case the operation is known to fail due to not being
supported by the driver.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Enable MAC address based ACL for the drivers which advertise
this capabilty with NL80211_ATTR_MAC_ACL_MAX. Either of blacklist
or whitelist is supported, though, not simultaneously.
Signed-hostap: Vivek Natarajan <nataraja@qca.qualcomm.com>
Enable tab completion for the cases where ifname= prefix is used in
interactive mode by skipping over that prefix before running through the
per-command completion routines. The ifname= prefix itself is also
covered by adding the possible interface names to the command list.
Signed-hostap: Jouni Malinen <j@w1.fi>
Strip out the IFNAME=<ifname> prefix from commands before parsing them
through the normal processing and then add the prefix back to the
beginning of the actual control interface command to make per-interface
commands work through the global control interface without having to use
the 'raw' command.
Signed-hostap: Jouni Malinen <j@w1.fi>
Define a proper event prefix and include additional information to allow
ESS Dissassociation Imminent event to be used in a wpa_cli action
script.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This was previously claimed to be in ms, but the field in BSS Transition
Management Request frame is in number of TBTTs (beacon interval). Use
that unit in the ESS_DISASSOC control interface command to be able to
specify any value and just modify the timeout value to be calculated
based on beacon interval.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This is needed to avoid allowing the STA to reconnect using a cached
PMKSA. ESS disassoc imminent notification is normally used to indicate
that the STA session will be terminated and as such, requiring full
authentication through the authentication server after this is needed.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This makes ENABLE_NETWORK behave similarily to SELECT_NETWORK by
allowing a scan to be skipped if recent scan results are available.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
wpa_s->pending_bssid is all zeros during connection attempt when
driver-based BSS selection is used. Take this into account when
determining whether new scan results should trigger a connection based
on wpa_s->current_ssid, i.e., a connection attempt with the selected
network instead of selected BSS.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
When STA interface is connected and P2P interface gets invited in a
different channel from previous P2P group, the invitiation would fail
because of no common channel found. Fix this by using different logic
when device support multi channel concurrency.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Commit c3fea27274 added a call to clear
all other PMKSA cache entries for the same network if the PMKSA cache
entry of the current AP changed. This was needed to fix OKC cases since
the other APs would likely use the new PMK in the future. However, this
ended up clearing entries in cases where that is not desired and this
resulted in needing additional full EAP authentication with networks
that did not support OKC if wpa_supplicant was configured to try to use
it.
Make PMKSA cache entry flushing more limited so that the other entries
are removed only if they used the old PMK that was replaced for the
current AP and only if that PMK had previously been used successfully
(i.e., opportunistic flag was already cleared back to 0 in
wpa_supplicant_key_neg_complete()). This is still enough to fix the
issue described in that older commit while not causing problems for
standard PMKSA caching operations even if OKC is enabled in
wpa_supplicant configuration.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
TDLS responder STA used to retransmit the TDLS Setup Response after 5
seconds if the TDLS Setup Confirm is not received. The initiator would
have enabled the TDLS link and started transmitting the data to the peer
on the TDLS link after transmitting the TDLS Setup Confirm frame. If the
TDLS Setup Confirm frame is not received by the receiver, the
transmissions from the initiator on the direct link would get failed for
the TDLS link not getting enabled on the receiver. This commit reduces
the data delivery failure duration by shortening the retry time of the
TDLS Setup Response frames. The retry limit of the TDLS Response frame
also is increased to ensure that the peer does not miss the frames in
the reduced time period.
Signed-hostap: Sunil Dutt <duttus@codeaurora.org>
The hostapd_cli ess_disassoc command now takes three arguments (STA MAC
address, timeout in ms, URL) and the STA is disconnected after the
specified timeout.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The five second timeout for GAS queries is excessive and can result in
long waits in cases where APs are either misconfigured or frames are
lost.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This makes the design more robust against unexpected duplicates since
each new GAS exchange gets a different dialog token compared to the
previous one.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
It looks like it may be possible for an older GAS response to get retransmitted
even after the first copy has been processed. While this should not really come
up all the way to wpa_supplicant due to sequence number being same (i.e.,
duplicate detection should from the frame), some cases have been observed where
this did cause issues. Drop such a frame silently without dropping the ongoing
GAS session to allow a frame with the next frag_id to be processed after this.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This can be useful for some test cases, so allow wpa_supplicant to be
built with special test functionality to expose the current (last
configured) GTK. This is disabled by default and can be enabled by
adding following line into .config:
CFLAGS += -DCONFIG_TESTING_GET_GTK
The GTK can then be fetched with "wpa_cli get gtk".
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The P2P management operations like P2P_FIND and P2P_CONNECT are not
really specific to any network interface. These are P2P Device level
operations that are in more global device context. Allow those to be
sent through the global control interface without IFNAME parameter.
For now, these commands are directed within wpa_supplicant to the
network interface that initialized the global P2P context. This may
change in the future if a special context is added for P2P operations.
Anyway, such changes can now be done internally within wpa_supplicant
without affecting this global control interface design from external
view point.
Signed-hostap: Jouni Malinen <j@w1.fi>
These events are sent as a special case to both the group interface and
"parent interface" (i.e., the interface that was used for managing P2P
negotiation). The latter is not really correct event, so get rid of it
with the new global control interface design where there is no need to
support legacy upper layer implementations.
Signed-hostap: Jouni Malinen <j@w1.fi>
This removes the "IFNAME=<ifname> " prefix from P2P events that are
received through the global control interface since these events are not
really specific to any network interface, but the full device.
Signed-hostap: Jouni Malinen <j@w1.fi>
Replace direct wpa_msg() calls with p2p_dbg(), p2p_info(), and p2p_err()
calls that use a new debug_print() callback to handle actual debug
printing outside the P2P module.
Signed-hostap: Jouni Malinen <j@w1.fi>
This removes wpa_ctrl.h dependency from src/p2p/* and makes the P2P
events more consistent, i.e., everything that is aimed for upper layer
processing from the wpa_supplicant control interfaces is generated in
p2p_supplicant.c.
Signed-hostap: Jouni Malinen <j@w1.fi>
This function can be used instead of wpa_msg() and wpa_msg_ctrl() to
indicate that an event is not specific to a network interface.
Signed-hostap: Jouni Malinen <j@w1.fi>
The ATTACH/DETACH mechanism to request event messages from
wpa_supplicant can now be used through the global control interface,
too. This results in events from all interfaces being delivered through
a single monitor socket. "IFNAME=<ifname> " prefix is used on events
that are specific to an interface.
Signed-hostap: Jouni Malinen <j@w1.fi>
This can be used to implement filtering of channels for scan and based
on that, for connection, purposes.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This updates hostapd to build using the new keystore header file
location and adds a note that the old frameworks/base/cmds/keystore can
be removed at some point in the future when old Android releases do not
need to be supported.
Signed-hostap: Jouni Malinen <j@w1.fi>
The wpa_supplicant global control interface parameter can now be used to
explicitly specify an abstract UNIX domain socket (Linux specific
extension) with "@abstract:" prefix and an Android control socket with
"@android:" prefix.
Signed-hostap: Jouni Malinen <j@w1.fi>
This is mostly a corner case at this point, but if wpa_cli was started
with global control interface connection (-g) and interactive mode,
per-interface control interface was tried to be opened with the
previously opened global ctrl_iface connection gettign leaked.
Signed-hostap: Jouni Malinen <j@w1.fi>
The optional -G<group> command line argument can be used to specify the
group that can access the global control interface.
Signed-hostap: Jouni Malinen <j@w1.fi>
"IFNAME=<ifname> " prefix can now be used on the wpa_supplicant global
control interface to direct a command to a specific interface instead of
having to use an interface specific control interface for this. This
allows a single socket to be used for controlling multiple virtual
interfaces.
Signed-hostap: Jouni Malinen <j@w1.fi>
Allow invitation exchange to update operating channel selection after
peer channel list has been received similarly to how GO negotiation was
handled.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Commit 21d996f775 added p2p_pref_chan as a
configuration file parameter, but included only the case of dynamically
setting this at runtime through the control interface SET command.
Complete this functionality by taking this value into use directly from
the configuration file, too.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
By default, dbus_connection_dispatch() will call _exit() if the bus
connection has been closed. This caused wpa_supplicant to terminate
without properly cleaning up after itself.
To ensure that we terminate cleanly when the messagebus terminates,
override the exit_on_disconnect behavior and install a filter to handle
libdbus's "Disconnected" signal.
[Bug 474]
Signed-hostap: Daniel Gnoutcheff <daniel@gnoutcheff.name>
The new control interface command can be used to send a
BSS Transition Management Query frame to the current AP.
Signed-hostap: Vinayak Kamath <vkamat@codeaurora.org>
The WPS provisioning case does not result in successful connection by
design and as such, this can result in networks getting temporarily
disabled. Avoid this by clearing the failure counts on WPS success.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Instead of just adding the new network, prefer the network learnt from a
configuration token during the first connection attempt. This makes the
WPS NFC case behave similarly to the in-band provisioning cases if there
are more preferred networks in the scan results.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The HIST_ENTRY and its variables are allocated within libreadline, so
they won't have the WPA_TRACE special header and cannot be freed with
os_free(). Use free() to avoid issues during wpa_cli termination if any
of the new commands added to the history are to be removed (e.g.,
set_network could include a password).
Signed-hostap: Jouni Malinen <j@w1.fi>
Commit 97279d8d1a started filtering MLME
frame events based on Address 1 (destination) field. This works fine for
frames sent to us, but it did filter out some corner cases where we
actually want to process an event based on a frame sent by us. The main
such case is deauthentication or disassociation triggered by something
external to wpa_supplicant in the system. Fix this by accepting events
for frames where either Address 1 or 2 (transmitter) matches the
interface address.
Signed-hostap: Jouni Malinen <j@w1.fi>
