Commit graph

18076 commits

Author SHA1 Message Date
Vinay Gannevaram
78c5bb7f50 PASN: Move responder functionality into a separate file
PASN responder validates auth 1 frame and sends auth 2 frame to the
initiator. It analyses the auth 3 frame and verifies successful
authentication. Wi-Fi Aware modules can reuse this functionality through
a shared library libpasn.so generated from this code. Move the PASN
functionality that is now decoupled from the hapd context into a
separate file in a common directory to make it easier to build such a
library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
c7edfce79a PASN: Move initiator changes into a separate file
PASN initiator functionality builds auth 1 and auth 3 frames, and
processes auth 2 frame received from the responder. Wi-Fi Aware modules
can reuse this functionality through a shared library libpasn.so
generated from this code. Move the PASN functionality that is now
decoupled from the wpa_s context into a separate file in a common
directory to make it easier to build such a library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
975b7a02cb Move SAE comeback token functionality into a separate file
This is helpful in being able to get the functionality needed for SAE
into a separate library (libpasn.so) without needing all of the
ieee802_11.c functionality.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1711fe9121 PASN: Compute MIC from RSNE and RSNXE of the frame for Wi-Fi Aware
Wi-Fi Aware R4 specification defines Beacon RSNE/RSNXE to be same as
RSNE/RSNXE present in Auth2 frame. So, MIC validation should be done
with the RSNE and RSNXE received in Auth2 frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
6f80014b10 PASN: Allow custom PMKID in Authentication frames for Wi-Fi Aware
Wi-Fi Aware R4 specification introduces a custom PMKID derived from
Nonce and TAG. This custom PMKID is included in PASN Authentication
frames during pairing verification. So, allow use of a custom PMKID in
PASN frames and validate it using a function handler. Wi-Fi Aware
component that uses libpasn.so should take care of validating the custom
PMKID.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
e99047da2b PASN: Add a handler func to send mgmt frames to the driver from AP
Introduce a function handler to transmit PASN Authentication frames to
the driver. This removes the hapd dependency for sending the frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
4022ffc5db PASN: Store AKMP in the PTKSA cache
PTK is stored in the PTKSA cache following a successful PASN handshake,
however AKMP is removed upon a WPA PASN reset. The PASN handshake is
used in the Wi-Fi Aware R4 specification to define the pairing setup
process. KDK is used to generate a new set of keys, while AKMP is
required for key derivation for pairing. So, keep AKMP in the PTKSA
cache.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
c55eadede7 PASN: Remove hapd dependency in processing PASN Authentication frames
Remove hapd dependency in processing PASN M1/M3 frames and build PASN M2
frame. Initialize required pasn parameters from hapd before passing
Authentication frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
6dc833bc5c PASN: Remove hapd dependency for PASN and SAE comeback
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1861f57162 PASN: Remove hapd dependency for pasn_derive_keys()
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1fa266e99d PASN: Remove hapd dependency for SAE and FILS wrapped data
This makes hostapd use the struct defines from pasn_common.h so that the
same struct is shared with wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
bc9fbe1b24 PASN: Common wpas_pasn structure for initiator and responder
Make struct wpas_pasn common for both the initiator and the responder by
adding required parameters for responder to the existing struct
wpas_pasn. This makes both hostapd and wpa_supplicant share the same
structure definitions in preparation for allowing PASN functionality to
be built into a separate library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
14b5ebce73 PASN: Add a common header file for initiator and responder
This is a step towards decoupling the PASN initiator and responder
implemenentation is decoupled from the wpa_s and hapd contexts and
moving to a common folder for better abstraction. Move the struct
wpas_pasn definition to a common file for initiator and responder. The
idea is to provide a library libpasn.so from PASN common code. Include
C++ compatibilty wrapper to extend libpasn.so support for modules using
cpp code base.

This library can be used in applications implementing protocols based on
the PASN handshake.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:15 +02:00
Vinay Gannevaram
af5eec3b37 PASN: Function handler to transmit Authentication frames
Introduce a function handler to transmit PASN Authentication frames to
the driver. This removes the wpa_s dependency from PASN functionality
for sending the frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
629bbc91b1 PASN: Remove dependency of wpa_ssid for initiator
Get ssid and derive required information for SAE and FILS tunneled PASN
authentication to remove struct wpa_ssid dependency for PASN initiator.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
e7f45ca11d PASN: Remove wpa_s dependency for wpas_pasn_start()
Before invoking wpas_pasn_start(), derive KDK and secure LTF flags.
Instead of using network id for pasn_start(), use a pointer to the
struct wpa_ssid.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
0be131265a PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1()
Obtain RSNXE capabilities from the driver flags as well and save them in
the wpas_pasn structure.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
086ccdc598 PASN: Remove wpa_s dependency for the functions processing RX frames
Remove wpa_s dependency for processing PASN M2 frame and preparing M3
frame. To hold the context of wpa_s when transmitting M3 frame, add cb
ctx.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
e2e87b90bf PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status()
This is a step towards allowing the PASN implementation to be used
outside the context of wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
de4b73a36a PASN: Remove wpa_s dependency for FILS wrapped data
To avoid reuse without struct wpa_supplicant, add new parameters to
struct wpas_pasn for FILS.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
90bb73c518 PASN: Remove wpa_sm dependency to add an entry to PMKSA cache
Store PMKSA cache entry in wpas_pasn and remove wpa_sm dependency to add
an entry to PMKSA cache. This is a step towards allowing the PASN
implementation to be used outside the context of wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:56 +02:00
Vinay Gannevaram
5313e5a790 PASN: Remove unused wpa_s parameter for wpas_pasn_sae_setup_pt()
This removes unnecessary struct wpa_supplicant dependency for
wpas_pasn_sae_setup_pt().

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:19:14 +02:00
Vinay Gannevaram
f636cbd048 PASN: Remove wpa_s dependency for SAE wrapped data functions
Use struct wpas_pasn (i.e., &wpa_s->pasn) as the function argument for
the SAE functionality that does not need the full struct wpa_supplicant
context. This is a step towards allowing PASN to be used outside the
context of wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:19:14 +02:00
Vinay Gannevaram
5535fbcfac PASN: Add wpa_pasn_reset() to eliminate need for struct wpa_supplicant
Split wpas_pasn_reset() so that the main reset steps can be used without
an instance of struct wpa_supplicant. This is needed to allow PASN
implementation to be used for additional purposes outside the context of
wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:19:14 +02:00
Vinay Gannevaram
10e455c44a Enable use of PMKSA caching independent of RSN supplicant state machine
Allow PMKSA caching functionality to be used even if sm, current_cb, and
free_cb are uninitialized. This makes RSN supplicant state machine
independent PMKSA caching possible for other modules, enabling
functional reuse.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:19:14 +02:00
Jouni Malinen
1d0ee1908b Fix the vendor ID assignment for configuring periodic sounding
This was supposed to update the requested value to the next available
one, not to duplicate the already assigned value.

Fixes: b17b86da47 ("QCA vendor attribute to configure periodic sounding")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 19:22:53 +02:00
Kiran Kumar Lokere
b17b86da47 QCA vendor attribute to configure periodic sounding
Add a new QCA vendor attribute to configure the periodic sounding
for Tx beamformer functionality.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 17:53:32 +02:00
Qiwei Cai
6f3efa21c2 MLD STA: Fix crash caused by NULL wpa_s->current_ssid
For wpa_supplicant_get_new_bss(), wpa_s->current_ssid can be NULL in
some cases. Add a NULL check before accessing it to avoid NULL pointer
dereference errors.

Fixes: 7784964cbe ("MLD STA: Fetch MLO connection info into core wpa_supplicant")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 17:39:49 +02:00
Vinay Gannevaram
ef5a9a009d nl80211: Fix parsing PASN peer and src addresses from vendor nl attributes
Need to copy the actual data of the attribute, not the beginning of the
data structure pointing to the attribute.

Fixes: de3b91a172 ("nl80211: Define vendor interface functions to offload PASN authentication")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 17:37:38 +02:00
Jouni Malinen
2c55c9273c More debug prints for EAPOL-Key message generation (Authenticator)
AES-WRAP(KEK) protection of the Key Data field did not include all the
details in the log. Extend that to cover the details that were already
present for the AES-SIV case to make the debug log more useful for
analyzing issues in this area. Furthermore, print the full EAPOL-Key
frame in the log.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-03 12:38:06 +02:00
Jouni Malinen
90cef4f211 MLD STA: Fully clear MLO info to avoid use of uninitialized members
The initial wpa_drv_get_mlo_info() implementation cleared only the
valid_links information within struct driver_sta_mlo_info before trying
to fetch the information from the driver. While this is likely going to
work fine in practice, this can result in static analyzer warnings on
use of uninitialized memory (e.g., mlo.assoc_link_id could have been
read if wpa_s->valid_links was set to a nonzero value). In any case, it
is better to avoid such unnecessary warnings by clearing the full data
structure before using it.

Fixes: 7784964cbe ("MLD STA: Fetch MLO connection info into core wpa_supplicant")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-02 11:56:46 +02:00
Veerendranath Jakkam
496a1ced16 MLD STA: Use MLD addresses for sending non-Public Action frames
The Linux kernel expects to use the AP MLD address as destination and
BSSID addresses for non-Public Action frames when the current
association is MLO capable. Use the MLD addresses to support this.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 17:24:29 +02:00
Veerendranath Jakkam
17ae988736 MLD STA: Support processing of M1 received before association event
EAPOL-Key msg 1/4 indication can be received before association
indication from the driver. For MLO connection, the source address check
of such frames should be against the AP MLD address instead of the
associated link BSSID.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 17:18:31 +02:00
Veerendranath Jakkam
9dafad1ea3 EHT: Definitions for STA Control fields of Basic Multi-Link element
Define subelement IDs and Per-STA Profile STA control fields of Basic
Multi-Link element as described in IEEE P802.11be/D2.2. Also add define
for Multi-Link Control field length.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 17:07:38 +02:00
Veerendranath Jakkam
1fbea7d432 EHT: Multi-Link element defragmentation
Add support for element defragmentation of different types of Multi-Link
elements.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 16:54:45 +02:00
Veerendranath Jakkam
ec03b71ee9 common: Refactor element defragmentation
Instead of saving the pointers to the fragment elements during parsing
of the frame, append all fragments found right after the element to the
element length. Defragmentation of the element can be done by parsing
appended fragment elements. This approach removes the limit on the
maximum number of fragmented elements supported in a frame.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 12:36:21 +02:00
Veerendranath Jakkam
347ea8f0a5 EHT: Parse Multi-Link elements
Parse and store pointers to different types of Multi-Link elements
received in Management frames.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 12:10:17 +02:00
Veerendranath Jakkam
73f540b6a7 MLD STA: Fetch MLO association Link ID info to core wpa_supplicant
Fetch the MLO association Link ID info from the driver to the
wpa_supplicant instance of the corresponding MLD STA interface. This
info is needed when setting the MLO connection info to wpa_sm.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 12:07:41 +02:00
Veerendranath Jakkam
ee46b7d6d3 nl80211: Check MLO link status info in NL80211_CMD_CONNECT
NL80211_CMD_CONNECT event indicates MLO links status info with kernel
commit 53ad07e9823b ("wifi: cfg80211: support reporting failed links").
Consider MLO links as valid links only if the status is success (or was
not indicated).

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-31 12:01:30 +02:00
Morten Brørup
6e015cd454 RADIUS: Add Filter-Id attribute
Add Filter-Id to the list of RADIUS attributes.

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
2022-10-31 11:56:57 +02:00
Jhalak Naik
06800f612f Add QCA vendor attributes for EHT support in external ACS
Add support for new vendor sub-command attributes for 320 MHz
channel width and puncturing information as part of the
external ACS.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-17 11:27:04 +03:00
Amarnath Hullur Subramanyam
0423686639 Vendor attribute to configure QoS/AC upgrade for UDP frames
Introduce a new attribute to configure access category
override for UDP frames of BE/BK category. Unlike, the
earlier attribute QCA_WLAN_VENDOR_ATTR_CONFIG_UDP_QOS_UPGRADE
which will override for all UDP frames, this attribute is
for overriding only for BE/BK based UDP frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-17 11:26:56 +03:00
Jouni Malinen
e5d15e2254 EHT: Allow EHT to be disabled using disable_eht=1 in wpa_supplicant
This is similar to the previously added disable_ht/vht/he parameters.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-17 11:13:09 +03:00
Jouni Malinen
041f6cea94 SAE: Accept FT and -EXT-KEY AKMs for external auth
Use a full list of AKM suite selectors that can use SAE authentication
when checking for authentication trigger from the driver.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 18:35:51 +03:00
Matthew Wang
b72922796a P2P: Get cached scan results on iface creation to avoid scan
This allows the P2P client to fast associate if the GO is already in the
scan cache without doing a full scan.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2022-10-16 18:27:33 +03:00
Jouni Malinen
8392ea9e75 SAE: Fix AKM suite selector check for external authentication
AKM suite selector check was initially implemented with incorrect byte
swapping of the value from the driver (nl80211). Fix this and leave a
workaround option for any potentially deployed device where the driver
might be using the swapped byte order.

Fixes: 5ff39c1380 ("SAE: Support external authentication offload for driver-SME cases")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 18:25:11 +03:00
Jouni Malinen
ab22b676a5 tests: FT-SAE-EXT-KEY
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:43:38 +03:00
Jouni Malinen
ebe6a7c948 FT: Cover variable length KCK in function documentation
FT can use different KCK length based on the AKM and PMK-R0 length.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:43:15 +03:00
Jouni Malinen
eda4ba081c FT: Reassociation Response frame validation for FT-SAE-EXT-KEY
Cover the variable length MIC field when validating the Reassociation
Response frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:43:15 +03:00
Jouni Malinen
0f7253d35d FT: Response processing for FT-SAE-EXT-KEY
Cover the variable length MIC field when processing the response from an
AP.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:43:15 +03:00