Commit graph

19113 commits

Author SHA1 Message Date
Shivani Baranwal
8b36248cd2 Add QCA vendor command to get the monitor mode status
Add a new vendor command QCA_NL80211_VENDOR_SUBCMD_GET_MONITOR_MODE to
get the local packet capture status in the monitor mode. Add required
attributes to respond with status of the monitor mode. The monitor mode
can be started/configured by using the
QCA_NL80211_VENDOR_SUBCMD_SET_MONITOR_MODE subcommand.

Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
2022-12-19 21:00:44 +02:00
Kiran Kumar Lokere
0dd8bcef83 QCA vendor attributes for MLO and EHT capabilities
Add new QCA vendor attributes to configure the driver for EHT
capabilities and multi link configuration.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-12-19 19:10:53 +02:00
Kiran Kumar Lokere
e5602989cf QCA vendor attributes to configure EHT capabilities
Add new QCA vendor attributes to configure the driver for EHT
capabilities. These attributes are used for testing purposes.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-12-19 19:02:39 +02:00
Jouni Malinen
2377d817da tests: DPP QR Code and hostapd as initiator/Configurator (offchannel)
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 21:07:56 +02:00
Michal Kazior
d9d5e55c54 DPP: Respond to GAS on the same channel it was received on
When I was testing dpp_auth_init on an AP with Enrollee on a different
channel from the AP I was getting failures. This happened on hwsim in
UML with time-travel for me. I don't recall seeing this with real
devices, presumably because of lax offchan implementation.

The DPP authentication would succeed. However the station would then try
to get configuration through a GAS request and fail.

The AP reported the following logs (grepped):

> 1614762426.860212: RX_ACTION category 4 action 10 sa 02:00:00:00:01:00 da 02:00:00:00:00:00 len 227 freq 2412
> 1614762426.860212: wlan0: GAS: GAS Initial Request from 02:00:00:00:01:00 (dialog token 239)
> 1614762426.860233: DPP: Wait for Configuration Result
> 1614762426.860234: nl80211: Send Action frame (ifindex=5, freq=2462 MHz wait=0 ms no_cck=0 offchanok=0)
> 1614762428.861186: DPP: Timeout while waiting for Configuration Result
> 1614762428.861186: wlan0: DPP-CONF-FAILED

While the STA reported the following logs (grepped):

> 1614762426.860193: wlan1: DPP-AUTH-SUCCESS init=0
> 1614762426.860195: DPP: Stop listen on 2412 MHz
> 1614762426.860202: wlan1: GAS-QUERY-START addr=02:00:00:00:00:00 dialog_token=239 freq=2412
> 1614762428.861185: GAS: No response received for query to 02:00:00:00:00:00 dialog token 239
> 1614762428.861189: DPP: GAS query did not succeed
> 1614762428.861189: wlan1: DPP-CONF-FAILED

AP would still receive the GAS request on ch1 but would then try to
respond on ch11 while STA was waiting on ch1.

Signed-off-by: Michal Kazior <michal@plume.com>
2022-12-18 21:07:56 +02:00
Jouni Malinen
651c9e9578 Add new status code strings
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 21:07:56 +02:00
Jouni Malinen
6bc9ce67b2 tests: HE on 6 GHz and automatic security settings on STA
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 21:07:56 +02:00
Jouni Malinen
3a2d275522 Make MFPR value from an associated STA available as hostapdMFPR
This can be helpful for testing purposes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 21:07:56 +02:00
Jouni Malinen
546debd5ef Force MFPR=1 to be used on the 6 GHz band
IEEE Std 802.11ax-2021, 12.12.2 requires this, so force MFPR=1 when
associating on the 6 GHz band so that ieee80211w=1 (i.e., MFPC=1 MFPR=0)
configuration can be used to get MFPC=1 behavior on other bands and
MFPR=1 on the 6 GHz band.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 21:07:48 +02:00
Matthew Wang
f9c6ab834d P2P: Support preferred GO band based optimization for scanning
Allow specifying preferred GO band in addition to frequency. If a band
is specified, the first two scans will be limited to only non-DFS
channels to shorten scan times, and the next two will scan the entire
band.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2022-12-18 18:33:44 +02:00
Matthew Wang
093bedc059 P2P: Allow persistent group join retry limit to be configured via D-Bus
Android and ChromeOS use this to limit retries for auto GO join
operation.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2022-12-18 17:37:08 +02:00
Jouni Malinen
007a43ac59 tests: Per-ESS MAC address and PMKSA caching
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:33:16 +02:00
Jouni Malinen
8717110db1 Do not flush PMKSA cache on restoring dedicated per-ESS MAC address
Now that we check in PMKSA cache code whether the entry was created for
the same local address, it is fine to leave the old entries in the cache
even if we have changed addresses. This allows a valid PMKSA cache entry
to be used when restoring the same MAC address for the same ESS.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:33:16 +02:00
Jouni Malinen
1d4027fdbe Make random MAC address style parameters use common enum values
This makes the implementation more readable by sharing the same set of
enum values for all the parameters related to what kind of random MAC
addresses are used.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:33:16 +02:00
Jouni Malinen
681856c355 Check both sec and usec values to see if MAC address was changed
wpa_s->last_mac_addr_change.sec might be zero in the special case of UML
testing with time travel since it would be possible to complete the test
case steps within one second of the system start.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:33:16 +02:00
Andrzej Ostruszka
bdbb6e0035 wpa_supplicant: Handle MAC address randomization changes for same ESS
When MAC address randomization settings change we should use a new MAC
address even if we are associating to the same ESS.

For example, consider this scenario:
- hardware MAC is being used,
- we disconnect from the network,
- policy/style is changed via D-Bus to turn randomization on,
- we reconnect to the same network.

In the last step a randomized MAC address should be used.

Changes to the randomization settings include both changes to the
policy/style to be used and changes to the pregenerated MAC address
value in case of mac_addr==3.

Signed-off-by: Andrzej Ostruszka <amo@semihalf.com>
2022-12-18 12:33:02 +02:00
Jouni Malinen
823cf218e4 tests: Use different mechanism for failing random MAC address change
gas_failures was using an invalid preassoc_mac_addr value 1111 to
trigger a failure. That won't work once wpa_supplicant starts validating
the range of the configuration parameter. Use a different mechanism to
force a failure in the actual random MAC address change functionality.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:33:02 +02:00
Jouni Malinen
317adf2359 tests: Set address lifetime to be sufficiently large for the test
sta_dynamic_random_mac_addr and sta_dynamic_random_mac_addr_keep_oui
assumed that the same random MAC address remains in use even though it
set the lifetime to 0 seconds. This might have worked in the past by
accident, but set this properly to configure a longer lifetime.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-18 12:24:32 +02:00
Jintao Lin
4bd1efe073 dbus: Do not bring down primary interface when removing created AP interface
If the CreateInterface command was used to create a virtual AP
interface, deleting this interface using the RemoveInterface command was
also bringing down the primary interface.

wpa_supplicant never uses hostapd style multi-BSS setup with
type=WPA_IF_AP_BSS and setup_ap=1 to if_add() when creating an AP
interface in wpa_driver_nl80211_if_add(), so it should not go through
the multi-BSS tear down procedure in wpa_driver_nl80211_if_remove(). The
virtual AP resources init and deinit are well handled in
wpa_driver_nl80211_init() and wpa_driver_nl80211_deinit().

Collapse the interface type to WPA_IF_STATION for the D-Bus interface to
skip the multi-BSS cleanup procedure. This is inline with the control
interface design. Add comments before the code to avoid confusion.

Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2022-12-18 11:04:18 +02:00
Jouni Malinen
3b4a5e58b7 tests: EHT with SAE
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-17 21:07:42 +02:00
Jouni Malinen
f4096e7cd5 EHT: Update EHT Operation element to P802.11be/D2.3 in AP settings
IEEE P802.11be/D2.0 added a 4-octet Basic EHT-MCS And Nss Set field into
the EHT Operation element. cfg80211 is now verifying that the EHT
Operation element has large enough payload and that check is failing
with the previous version. This commit does not really set the correct
Basic EHT-MCS And Nss Set values, but the IE length check is now passing
to allow initial mac80211_hwsim testing to succeed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-17 20:32:15 +02:00
Andrei Otcheretianski
e869fdfeef wpa_supplicant: Use MLD address in SAE authentication
Use MLD address in SAE commit derivation and PMKSA storing.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-17 17:47:34 +02:00
Andrei Otcheretianski
8c0f83ae88 SME: Accept Authentication frame from an MLD AP
The driver is expected to translate the link addresses to MLD addresses
when processing an Authentication frame from a MLD AP. Thus, accept
Authentication frame when the peer matches the expected MLD address.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-17 17:38:03 +02:00
Andrei Otcheretianski
23039f5e4a SME: Add support for handling association with MLD
In case both the local driver and the AP support MLD, request an MLD
association from the driver.

When processing the association event from the driver verify that the
multi link information in the (Re)Association Response frame ML element
matches the links on which the association was expected.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-17 17:33:11 +02:00
Andrei Otcheretianski
8f89661df5 SME: Add support for handling authentication with MLD
In case both the local driver and the AP support MLD, request an MLD
authentication from the driver. When processing the authentication event
from the driver verify that the MLD address in the authentication data
matches that of the requested AP.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-17 17:31:41 +02:00
Andrei Otcheretianski
694a1c6873 SAE: Make sme_sae_auth() return IE offset
Authentication frames include several fixed body parts (see Table 9-68
(Authentication frame body) and Table 9-69 (Presence of fields and
elements in Authentication frames) in IEEE P802.11-REVme/D2.0).

To be able to parse the IE part, these fields need to be skipped. Since
SAE logic already implements this parsing, change SAE authentication
handling functions to return the offset to the IE part. This preparation
is needed for future MLD patches that need to parse out the ML related
elements in the Authentication frames.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-17 17:11:16 +02:00
Vinayak Yadawad
870edfd67e WPA3: Update transition disable bitmap based on port authorized event
In case of drivers that offload the 4-way handshake to the driver, there
was no way of updating wpa_supplicant about the transition disable
bitmap received as a part of EAPOL-Key msg 3/4.

With latest provisions in cfg80211_port_authorized(), the TD bitmap can
be sent to the upper layer. Parse that as a part of the port authorized
event and set the transition disable information accordingly.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2022-12-17 14:21:54 +02:00
Jouni Malinen
8fdf3c4473 Sync with wireless-next.git include/uapi/linux/nl80211.h
This brings in nl80211 definitions as of 2022-10-07.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-17 14:12:39 +02:00
Jouni Malinen
c58178b922 tests: More coverage for D-Bus CreateInterface() parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-12-17 12:11:15 +02:00
Jintao Lin
f9804e3067 nl80211: Enforce unique address for AP iftype
Some Wi-Fi SoCs do not ensure unique MAC address for the new virtual
interface. Enforce unique address is used for the created AP interface
similarly to other previously address interface types.

Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2022-12-17 12:11:15 +02:00
Jintao Lin
87bad8afad dbus: Pass in MAC address in CreateInterface method
chromeOS uses random generated MAC address for AP interface so that the
device could remain anonymous and untrackable. Add an address parameter
for CreateInterface method to pass in OS managed MAC address.

Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2022-12-17 12:11:15 +02:00
Jintao Lin
b0722cf75e dbus: Fix a memory leak on error path in CreateInterface method
Fix a potential memory leak in CreateInterface method.

Fixes: 0ba266d86c ("dbus: Add virtual interface create/remove logic to be inline with ctrl_iface")
Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2022-12-17 12:11:15 +02:00
Micha Hashkes
a7f6b85180 crypto: Check if crypto_bignum_to_bin() is successful
Return value of crypto_bignum_to_bin() wasn't always checked, resulting
in potential access to uninitialized values. Fix it, as some analyzers
complain about it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Micha Hashkes <micha.hashkes@intel.com>
2022-12-17 12:11:13 +02:00
David Ruth
2749a2c6bf nl80211: Actually get and store TX retries
Fix an issue that results in TX failures being stored where TX retries
belongs.

Fixes: ad4fa5dd3c ("Add more nl80211 info to struct wpa_signal_info")
Signed-off-by: David Ruth <druth@chromium.org>
2022-12-16 22:50:48 +02:00
Andrei Otcheretianski
998aeca3c8 crypto: Clear secrets from stack in hmac_sha256_vector()
k_pad and tk were not cleared in internal HMAC-SHA256 implementation.
Clear them to avoid leaving secret material in temporary stack
variables.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 22:49:07 +02:00
Ilan Peer
909864ab1e HS 2.0: Restore ifdef for DEFINE_STACK_OF in est.c
DEFINE_STACK_OF() was only introduced in OpenSSL 1.1.0 and newer, but
the ifdef directive that wrapped it was wrongly removed when cleaning
some BoringSSL definitions. Use ifdef confistently for defining and
using AttrOrOID.

Fixes: faf9c04cb5 ("Remove a host of unnecessary OPENSSL_IS_BORINGSSL ifdefs")
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 22:42:16 +02:00
Ilan Peer
24b4c3abef tests: Extend SAE-EXT-KEY testing
Extend the SAE-EXT-KEY testing to also cover GCMP-256.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 22:37:31 +02:00
Andrei Otcheretianski
af0ab435af PASN: Use the assigned status code from IEEE P802.11az/D7.0
Use more specific status code values to report error cases.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 22:36:10 +02:00
Andrei Otcheretianski
3d798ff2a4 PASN: Align RSNXE with IEEE P802.11az/D7.0 definitions
RSNXE bits were modified, so update the relevant places accordingly.
Please note, WLAN_RSNX_CAPAB_PROT_RANGE_NEG was renamed to
WLAN_RSNX_CAPAB_URNM_MFPR and the bit position is changed to 15 instead
of 10, while BIT 10 is used for WLAN_RSNX_CAPAB_URNM_MFPR_X20 and is not
supported yet.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 22:35:19 +02:00
Jouni Malinen
6cc0a885c8 tests: require_he=1
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-12-16 20:31:14 +02:00
Jouni Malinen
ab2cb379db Define all assigned BSS membership selector values
Add the assigned values based on IEEE P802.11-REVme/D2.0. In addition,
sort these definitions in ascending order.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-12-16 20:31:14 +02:00
Johannes Berg
ed0a7b4809 wpa_supplicant: Implement HE membership selector check
Check the HE membership selector and don't use the BSS
if required but not supported by HW.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 20:31:14 +02:00
Johannes Berg
054fcfab6f hostapd: Add require_he configuration
Add the ability to require HE, advertising that via the
BSS membership selector as well as rejecting association
without HE.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-16 20:31:14 +02:00
Qiwei Cai
c46351d10e DFS: Clear cac_started when AP is disabled
When AP is started on a DFS channel and DFS is offloaded to the driver,
AP setup will be separated to two stages. In the first stage, hostapd
will set frequency and initialize BSS, then waits the driver CAC to
complete. Once CAC done, in the second stage,
hostapd_setup_interface_complete() will be called again from a callback
to continue AP/channel setup.

But the driver will fail to restart AP if it is disabled/reenabled
during a driver CAC procedure because some steps such as setting
freq/beacon in the first stage are skipped due to cac_started not
cleared when the AP is disabled.

Avoid this by clearing cac_started when the AP is disabled.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-12-15 18:43:43 +02:00
Aloka Dixit
3df42cf3c7 EHT: Use HE operating channel width in MCS length calculation
Channel width in HE Capabilities element added to management frames is
calculated in hostapd_eid_he_capab() by intersecting the driver
capabilities and the operating channel width. Kernel uses this value
from the Beacon frames to verify EHT capabilities length. However, EHT
MCS length calculation uses only the driver capabilities which results
in EHT AP bring up failure in some cases dues to different lengths.

Modify the EHT code to use the HE operating channel width as well to
determine matching length for the information.

Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
2022-12-15 18:41:31 +02:00
Veerendranath Jakkam
23e31eb68e SAE: Support cross AKM roaming between SAE AKMs in external auth case
Add support to handle external authentication request with a different
SAE AKM suite compared to the current connection AKM suite. This is
needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM
suites.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-12-15 18:36:26 +02:00
Vinay Gannevaram
a170267076 PASN: Avoid clearing secure context for the PASN deauthentication event
PASN deauthentication event is sent by the underlying driver to delete
the keys in wpa_supplicant PTKSA cache. So don't send clear secure
context command to the driver again as it is already aware of it.

Fixes: 74d894a2 ("PASN: Offload handshake for multiple peers from the driver")
Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-12-15 18:30:04 +02:00
Harsh Kumar Bijlani
75a9c4bd4d Add new attributes in SCS rule config QCA vendor subcommand
Add new attributes for the destination MAC address and netdev index in
SCS rule config subcommand.

Signed-off-by: Harsh Kumar Bijlani<quic_hbijlani@quicinc.com>
2022-12-15 18:12:53 +02:00
Andrei Otcheretianski
7d8b96dcfd wpa_supplicant: Apply same restrictions for MLD as for 6 GHz BSS
Though not explicitely forced by IEEE 802.11be draft yet, it makes sense
to apply the same logic for MLD as for 6 GHz BSSs. Change
wpa_supplicant_ssid_bss_match() accordingly.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-03 17:43:46 +02:00
Andrei Otcheretianski
7216f79b94 nl80211: Support get_sta_mlo_info for SME-in-wpa_supplicant drivers
Query updated MLO information using NL80211_CMD_GET_INTERFACE command.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-03 17:31:50 +02:00