Commit graph

3782 commits

Author SHA1 Message Date
Jouni Malinen
3bff59f857 TLS: Do not enforce in-place processing in tlsv1_record_send()
In preparation for record layer format changes, modify
tlsv1_record_send() to use separate buffers for payload
and the output message.
2011-09-25 17:11:52 +03:00
Jouni Malinen
85b7187ffc TLS: Add protection against record layer CBC attacks
Instead of using separate bad_record_mac and decryption_failed alerts,
use only bad_record_mac alert regardless of how the CBC decryption
failed. This provides less information to attackers that could modify
packets. In addition, instead of returning immediately on error, run
through the MAC check to make timing attacks more difficult.
2011-09-25 16:57:35 +03:00
Jouni Malinen
26296a8a7c TLS: Avoid unnecessary copying of encrypted data at record layer
When the received data will be decrypted, there is no need to first
copy it and then handle decryption in-place when decryption step can
take care of both operations.
2011-09-25 16:52:46 +03:00
Jouni Malinen
61f1ed911d TLS: Fix record layer protocol version validation
TLS v1.0 and v1.1 RFCs were not exactly clear on the use of the
protocol version in record later. As such, accept any {03,xx} value
to remain compatible with existing implementations and new protocol
versions.
2011-09-25 16:48:06 +03:00
Jouni Malinen
54b8f99454 P2P: Fix a race condition in some P2P command sequencies
The p2p->drv_in_listen variable is used to track Listen state operations
in the driver. This is cleared when the driver reports that the Listen
state has ended (p2p_listen_end() gets called). However, it is possible
that the driver does not indicate that if the Listen state is canceled.
This can apparently happen in some cases where p2p_connect command is
issues while the Listen state is in progress.

Work around this issue by clearing p2p->drv_in_listen when Listen state
is stopped as part of p2p_stop operation. This allows the P2P module to
process CONNECT_LISTEN timeout in p2p_timeout_connect_listen() to move
to CONNECT state, e.g., when starting GO Negotiation after Device
Discoverability mechanism.
2011-09-22 22:49:21 +03:00
Subrat Dash
6a5200e699 atheros: Fix WEXT SIOCGIWESSID use with WE-21 and newer
The "too long" buffer (32+1 octets) prevented AP from starting up with
32 octet SSID with WE-21 and newer. Fix this by reducing the
SIOCGIWESSID buffer length.
2011-09-22 15:42:03 +03:00
Reinette Chatre
97a8cbb88d D-Bus/P2P: Treat PIN as string
wpa_supplicant returns the PIN in reply to the connect method. Treating
this value as an integer runs the risk of not returning the correct
value if the first digit(s) happens to be a zero(es). To return the
correct PIN it needs to be returned as a string.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Angie Chinchilla <angie.v.chinchilla@intel.com>
2011-09-22 01:17:09 +03:00
Janusz Dziedzic
a57db49c32 wpa_supplicant: AP mode, set drv_flags
In AP/P2P_GO mode we should have correct hostapd drv_flags.
2011-09-22 01:05:01 +03:00
Reinette Chatre
1755b61679 D-Bus/P2P: Support all discovery types
The default discovery type is to search for devices only on social
channels. Expand this to also support an initial full scan followed by the
scan of social channels as well as the progressive scan that scans through
all the channels in the Search state rounds. This does not change the
default of scanning only social channels although there is currently a
discrepancy wrt the default used by wpa_cli, which is the full scan first.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Angie Chinchilla <angie.v.chinchilla@intel.com>
2011-09-22 01:01:20 +03:00
Reinette Chatre
af9d709019 D-Bus: Fix memory leak when using array of array of bytes
When parsing a dict entry which is an array of an array of bytes the entry
representing the dict entry has DBUS_TYPE_ARRAY as its type and
WPAS_DBUS_TYPE_ARRAY as its array_type. The function freeing this parsed
data incorrectly tested the entry type for WPAS_DBUS_TYPE_ARRAY while doing
no testing of this value for array_type. This results in a memory leak
whenever a D-Bus message with this type of data is parsed.

Messages affected are:
fi.w1.wpa_supplicant1.Interface.P2PDevice
	using RequestedDeviceTypes with Find method
	using SecondaryDeviceTypes or VendorExtension with P2PDeviceProperties

fi.w1.wpa_supplicant1.Group
	using WPSVendorExtensions with Properties property

All of the above messages are parsed with the same function,
wpa_dbus_dict_get_entry, so the assignment of the entry's type and
array_type is consistent. The parsed data is also consistently freed with
the same function, wpa_dbus_dict_entry_clear, so we can use the same checks
to free the data correctly.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Angie Chinchilla <angie.v.chinchilla@intel.com>
2011-09-22 01:01:20 +03:00
Johannes Berg
3a26a2c9df P2P: Fix action done handling for driver-based off-channel TX
The action done handling needs to abort an off-channel period since one
might have been used for example for GO negotiation and after action
done the code assumes it can start a new off-channel period.

This fixes a bug I introduced when adding support for
in-kernel off-channel transmissions.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2011-09-22 00:57:27 +03:00
Pavel Roskin
ffbf1eaa26 Fix typos found by codespell
Signed-off-by: Pavel Roskin <proski@gnu.org>
2011-09-22 00:43:59 +03:00
Pavel Roskin
d2f93d3706 doc: Use correct path for kerneldoc2doxygen.pl
Refer to kerneldoc2doxygen.pl as doc/kerneldoc2doxygen.pl since doxygen
is run in the top-level source directory.

Signed-off-by: Pavel Roskin <proski@gnu.org>
2011-09-22 00:41:21 +03:00
Pavel Roskin
a776b19cda wext: Remove write-only variable ap_num
Signed-off-by: Pavel Roskin <proski@gnu.org>
2011-09-22 00:41:17 +03:00
Jouni Malinen
c36d52427a nl80211: Support PMKSA candidate events
This adds support for RSN pre-authentication with nl80211 interface and
drivers that handle roaming internally (i.e., wpa_supplicant is not
responsible for requesting scan results that provide the needed
information without these events).
2011-09-21 16:14:41 +03:00
Jouni Malinen
c8c71b395c Sync with wireless-testing.git linux/nl80211.h 2011-09-21 16:14:00 +03:00
Jouni Malinen
6908d459e2 wlantest: Verify that comeback assoc resp includes correct type
The Timeout Interval element needs to use Association Comeback time
for the case when (Re)Association Response frame uses Status Code 30.
Verify this before incrementing the (re)assocresp_comeback counters.
2011-09-20 20:13:18 +03:00
Jouni Malinen
20f5a4c24c nl80211: Work around EALREADY from connect command
cfg80211 does not currently allow NL80211_CMD_CONNECT when there
is already an association. This can result in wpa_supplicant being
unable to request a connection if the interface is already in
connected state. Work around this by requesting disconnection if
the connect command fails with EALREADY error. This allows
wpa_supplicant to recover from the unexpected state and complete
the connect request on next attempt.
2011-09-18 21:26:55 +03:00
Jouni Malinen
1b414f59fc eapol_test: Add option for writing server certificate chain to a file
eapol_test command line argument -o<file> can now be used to request
the received server certificate chain to be written to the specified
file. The certificates will be written in PEM format. [Bug 391]
2011-09-17 22:42:54 +03:00
Jouni Malinen
8a55f56453 RSN: Add a debug message when considing addition of OKC entry 2011-09-16 18:45:15 +03:00
Jouni Malinen
7c444f3c12 Fix proactive_key_caching configuration to WPA code
The proactive_key_caching parameter was missed in mapping the
config_ssid data into the WPA state machine configuration. This
prevented addition of PMKSA cache entries based on PMKSA caching
candidate events.
2011-09-16 18:44:06 +03:00
Jouni Malinen
a8b8379adf Sync with wireless-testing.git linux/nl80211.h 2011-09-16 17:13:08 +03:00
Jouni Malinen
6bcb1c2ba5 wpa_supplicant AP: Set static WEP keys if configured
This is needed to configure static WEP keys to the driver through the
hostapd configuration structures.
2011-09-15 15:04:46 +03:00
Jouni Malinen
697cd03fc2 AP: Set pairwise/group cipher for non-WPA modes
This is needed to avoid confusing configuration in some nl80211
drivers that the new AP mode configuration alternatives for
setting security policy.
2011-09-15 15:02:59 +03:00
Jouni Malinen
633d4469e8 Fix AP build without CONFIG_WPS=y
Make the WPS processing of (Re)Association Request frame IEs conditional
on WPS support. This fixes a build issue with wps_is_20() not being
defined and makes the non-WPS build a bit smaller.
2011-09-12 22:23:45 +03:00
Jouni Malinen
531e420dd7 Remove time.h include from utils/includes.h
os_*() wrappers should be used instead of functions from time.h.
Removing the header from includes.h enforces this. os_unix.c can
include this its uses are valid wrapper calls. wps_upnp.c uses
gmtime() for which there is no os_*() wrapper available yet, so
allow it to use time.h, too. Similarly, allow dump_state.c to
use time.h for ctime().
2011-09-12 22:19:26 +03:00
Per Ekman
3d9e2e6615 Remove references to time_t/time()
Use os_time() in AP mode instead of direct time() calls.
2011-09-12 22:14:30 +03:00
Johannes Berg
531f0331a1 nl80211: Cancel not yet started r-o-c
Currently, the following can happen:

1) P2P state machine requests R-O-C
2) user changes their mind and aborts
3) P2P state machine aborts R-O-C
4) driver_nl80211 rejects abort since there
   was no notification about the start yet
5) R-O-C period start notification from kernel
6) P2P state machine requests new R-O-C
7) this overlaps with old R-O-C -- iwlwifi driver
   can't handle that and returns -EBUSY
8) state machine stops dead in its tracks

The reason is that the abort isn't going through properly. Instead of
tracking whether a R-O-C is active in driver_nl80211, track whether one
was requested to avoid this scenario.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2011-09-10 22:57:41 +03:00
Rajkumar Manoharan
47185fc788 P2P: Remove CCK supported rates when running P2P scan
This allows drivers to disable CCK rates from Probe Request frames.
For nl80211, this is currently applying only to the supported rates
element(s), but this mechanism could be extended to address TX rate
control masking, too, to lessen need for global rate disabling.

Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
2011-09-10 22:40:30 +03:00
Johannes Berg
7626850dd6 nl80211: Automatically use concurrent P2P if possible
Since the kernel can now advertise P2P concurrent support by advertising
interface combinations, we can take advantage of that and automatically
use P2P_CONCURRENT / P2P_MGMT_AND_NON_P2P for drivers that advertise
support.

Keep driver_param=use_p2p_group_interface=1 for anyone not advertising
interface combinations in their drivers yet.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2011-09-10 21:52:21 +03:00
Edward Lu
cf546f1a03 Make sure wpa_proto gets cleared for WPS and non-WPA connections
This is needed to fix the wpa_proto association parameter for drivers
that select AP based on security parameters internally.
2011-09-08 17:51:08 +03:00
Jouni Malinen
25e5d5bc08 P2P: Allow advertisement config methods to be limited
The default config methods was hardcoded to claim support for
PushButton, Display, and Keypad. While these are supported by
most P2P devices, there may be some cases where it is convenient
to be able to disable a specific config method. Use config_methods
configuration parameter to set the default values for Config Methods
in the P2P Device Info attribute.
2011-09-08 16:48:06 +03:00
Jouni Malinen
07fecd3915 P2P: Remove Label config method
The P2P specification (3.1.4.3) disallows use of the Label configuration
method between two P2P devices. This was previously enforced at upper
level, but the obsolete code can be removed from wpa_supplicant. This
adds a bit more strict enforcement of the policy, but should not result
in practical differences since no known P2P implementation uses Label
config method.
2011-09-08 16:40:03 +03:00
Jouni Malinen
d8a790b922 Flush PMKSA cache entries and invalidate EAP state on network changes
If a network configuration block is removed or modified, flush
all PMKSA cache entries that were created using that network
configuration. Similarly, invalidate EAP state (fast re-auth).

The special case for OKC on wpa_supplicant reconfiguration
(network_ctx pointer change) is now addressed as part of the
PMKSA cache flushing, so it does not need a separate mechanism
for clearing the network_ctx values in the PMKSA cache.
2011-09-07 17:46:00 +03:00
Jouni Malinen
f3857c2e6a Call wpas_notify_network_removed() on REMOVE_NETWORK
This was done for the case where all networks are being removed,
but the case where a single network is removed was forgotten.
2011-09-07 17:44:00 +03:00
Jouni Malinen
734baae0af Clear driver PMKSA cache entry on PMKSA cache expiration
If the driver maintains its own copy of the PMKSA cache, we need to
clear an entry from the driver whenever wpa_supplicant is dropping
an old PMKSA cache entry.
2011-09-07 16:31:09 +03:00
Jouni Malinen
5e67037b3a Fix SIM/USIM simulator build to include AES encryption function 2011-09-07 16:17:08 +03:00
Jouni Malinen
cc28ad8cdf Fix Deauth/Disassoc callback handling with test frames
The Deauth/Disassoc TX status callbacks were ending up kicking the
station entry from kernel driver when test functionality was used to
inject Deauth/Disassoc frames from the AP with the purpose of leaving
the local association in place. Fix this by using STA flags to figure
out whether there was a pending callback for the frame that we need
to act on.

In addition, add forgotten functionality for the Disassoc TX status
callback to match the behavior with Deauth.
2011-09-06 21:03:02 +03:00
Jouni Malinen
98aa7ca5d8 WPS: Add 'wpa_cli wps_pin get' for generating random PINs
This can be used, e.g., in a UI to generate a PIN without
starting WPS (or P2P) operation.
2011-09-02 21:29:06 +03:00
Jouni Malinen
64fa840a97 nl80211: Fix WPA_VERSIONS attribute for Connect command
The previous code was trying to figure out which WPA version is
used based on the extra IEs requested for Association Request. That
did not work properly in cases where non-WPA networks are used with
some extra IEs. Fix this by using more robust mechanism for passing
the WPA versions from core wpa_supplicant to the driver_ops
associate().
2011-09-02 20:40:23 +03:00
Jouni Malinen
bf9d5518d5 Android: Include libcrypto and libssl only if CONFIG_TLS=openssl 2011-09-02 16:51:00 +03:00
Jouni Malinen
83180479f0 Android: Modify wireless_copy.h to fix Android build 2011-09-02 16:50:43 +03:00
Jouni Malinen
f4a0a82ca6 Reduce debug verbosity on global ctrl_iface PING command
This matches with the earlier change that did the same for the
per-interface ctrl_iface commands.
2011-09-01 18:16:37 +03:00
Bharat Chakravarty
a9355fac5f WPS: Set Probe Request config methods based on configuration
Instead of hardcoding the Config Methods attribute value in Probe
Request frames, set this based on the configured parameter
config_methods to allow correct set of methods to be advertised.
2011-09-01 15:24:45 +03:00
Bharat Chakravarty
6fb6d842bb WPS: Set RF bands based on driver capabilities
Instead of hardcoding support for both 2.4 GHz and 5 GHz bands,
use driver capabilities to figure out which bands are supported.
2011-08-31 17:53:55 +03:00
Jouni Malinen
ae9c400358 WPS ER: Fix UPnP XML Device Description parser to find correct device
The device description file may include multiple devices. Improve the
simplistic parser by first trying to find the WFADevice:1 device before
fetching the device parameters. While this is still far from complete
XML parsing, this should address the most common root device
specifications.
2011-08-31 13:56:03 +03:00
Jouni Malinen
86957e6298 nl80211: Support AP mode probe/action frame TX/RX without monitor iface
This allows non-mac80211 drivers to report received Probe Request
frames to user space and Probe Response and Action frames to be sent
from user space when using AP/P2P GO mode.
2011-08-29 14:26:55 +03:00
Jouni Malinen
4dc03726de Delay STA entry removal until Deauth/Disassoc TX status in AP mode
This allows the driver to use PS buffering of Deauthentication and
Disassociation frames when the STA is in power save sleep. The STA
entry (and PTK) will be removed from the kernel only after the
Deauth/Disassoc has been transmitted (e.g., when the STA wakes up).
A hardcoded two second timeout is used to limit the length of this
window should the driver fail to deliver the frame (e.g., the STA
is out of range and does not wake up). The kernel STA entry is
marked unauthorized during the wait to avoid accepting Data
frames from the STA that we have decided to disconnect.

This behavior is available only with drivers that provide TX status
events for Deauth/Disassoc frames (nl80211 at this point). Other
drivers continue to use the previous behavior where the STA entry
is removed immediately.
2011-08-28 23:07:02 +03:00
Jouni Malinen
49a191a142 EAP: Add "expanded" EAP type to get_name functions 2011-08-28 19:23:16 +03:00
Jouni Malinen
02b915f689 wlantest: Allow injection of unprotected frames to unknown BSS 2011-08-28 19:19:38 +03:00