Add a mechanism to allow special incorrect behavior to be requested from
OSU server by adding an optional parameter test=<value> to the initial
signup URL. This is for protocol testing purposes for the OSU client.
This commit adds two special behavior cases: corrupt_aaa_hash and
corrupt_subrem_hash. These can be used to generate PPS MO with invalid
CertSHA256Fingerprint values for AAAServerTrustRoot and
SubscriptionUpdate nodes.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Previously, this was done only for the subscription remediation/update
trust root. The other downloaded files were also verified, but the OSU
server was not notified if the files were found to be invalid.
Modify hs20-osu-client behavior to explicitly notify the OSU server if
any of the three trust root types cannot be successfully downloaded.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add support for user remediation to request a new password from the user
for username/password credentials that have been configured not use use
machine managed password.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Order the rows based on identity and use a bit smaller font for some of
the fields to make the table fit on the screen more easily.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Instead of defaulting to machine remediation, reject a request to do
subscription remediation if that has not been configured to be required.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
The Single SSID case can only use OSEN, so reject the case where OSU_NAI
is not set and open OSU connection would be used since that connection
cannot succeed.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Extend hs20-osu-client to support the new osu_nai2 value for OSU
connection with the shared BSS (Single SSID) case.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This was used during initial EST development time testing, but the same
information is available in the debug log and since this separate file
is deleted automatically, just remove its generation completely to
simplify implementation.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
It was possible for the wait loop to exit early due to the $row[0] == 1
check returning false if the database value was not yet set. Fix this by
updated the $waiting default value only if the database actually has a
value for this field.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This allows hs20-osu-client to be requested to select a specific OSU
SSID with the new command line argument (-o<OSU_SSID>). This is useful
for testing single SSID transition mode cases.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
When the AP is detected to have single BSS shared for RSN and OSEN, use
that BSS for OSU by default instead of the one based on the OSU_SSID in
the OSU Providers list.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Use explode() instead of split() because split() has been removed from
PHP 7.0.0 and there is no need for using full regular expression here.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This node was mapped to a SET_CRED roaming_consortium command with
quotation marks even though this is a hexdump of the OI. Remove the
quotation marks to allow this to be set correctly in the wpa_supplicant
credential.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
When OSEN is used in the BSS that is shared both for production data and
OSU uses, the group cipher might be either GTK_NOT_USED (like in Rel 2
OSEN) or CCMP. Modify hs20-osu-client to allow both these group ciphers
to be used when requesting OSEN connection.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This extends the terms.php implementation of Hotspot 2.0 Terms and
Conditions server to allow it to interact with hostapd(AS) to clear the
filtering rules from the AP. After requesting hostapd to send out the
CoA-Request, terms.php waits for up to 10 seconds to see whether the
current_sessions table gets an update to indicate that filtering has
been successfully disabled.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This allows hs20-osu-client to configure wpa_supplicant credential with
a specific EAP method so that roaming consortium OI -based matching can
be used.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add minimal Terms and Conditions server for testing purposes. This can
be used to test user interaction for Terms and Conditions acceptance.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This adds mapping of the PPS MO HomeSP/RoamingConsortiumOI leaf node
value into the wpa_supplicant cred block parameter roaming_consortiums.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit adds additional permission to 'SP' and 'Cert' folders
which is needed to copy certificates from Cert to SP. Additionally,
this associates AID_WIFI group id with these folders.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This patch hides a compiler warning:
osu_client.c: In function ‘cmd_osu_select’:
osu_client.c:2200:2: warning: ‘osu_count’ may be used uninitialized in this function [-Wmaybe-uninitialized]
for (i = 0; i < osu_count; i++) {
^
osu_count is actually initialized in parse_osu_providers() if non-NULL
value is returned.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
This command was documented as having the Server URL parameter as
optional, but the implementation did not match that. Allow this
parameter to be left out.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The error print could not have been reached since the exact same
condition was verified above and exit(0) is called if the command line
is invalid.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The libcrypto and libssl modules (and their respective static and host
versions) use LOCAL_EXPORT_C_INCLUDE_DIRS thus just including the module
is sufficient.
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
This commit allows any process running with group id of AID_WIFI to
read/write files to osu-info directory. Also, it allows other users to
read and search the osu-info directory.
This fixes issues with hs20-osu-client creating a directory for
wpa_supplicant use without wpa_supplicant actually having privileges to
write there on Android where the wpa_supplicant process does not run as
root.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This is an array, so the pointer is never NULL; need to check that the
first character is not '\0' instead.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These were restored into BoringSSL in June 2015, but not all Android
branches include those changes. To fix the build, comment these call out
on Android for now if hs20-osu-client is built against BoringSSL. These
are used only for debugging purposes, so this is fine for Hotspot 2.0
functionality.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds one more step in completing hs20-osu-client support when using
BoringSSL instead of OpenSSL. EST client can now parse the cacerts file.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds experimental support for using OCSP with libcurl that is built
against BoringSSL. This needs small modifications to libcurl to allow
CURLOPT_SSL_VERIFYSTATUS to be used to call
SSL_enable_ocsp_stapling(connssl->handle) in ossl_connect_step1().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
BoringSSL has dropped OpenSSL functionality that was used in the EST
implementation. For now, disable EST with BoringSSL to allow
hs20-osu-client to be built.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
fqdn was not freed before return in case the server uses an unsupported
location for the PPS MO in the addMO command.
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
Allow user to specify the path to the spp.xsd file for hs20-osu-client
instead of requiring this to be spp.xsd in the current working
directory.
Signed-off-by: Ben Greear <greearb@candelatech.com>
This gives more flexibility when generating keys so that users do not
have to edit files to generate their own specific keys.
Update HS 2.0 OSU server notes as well.
Signed-off-by: Ben Greear <greearb@candelatech.com>
The command line option 'i' is not handled, so I assume it should
not be in the short-options list.
Fix missing word in error message as well.
Signed-off-by: Ben Greear <greearb@candelatech.com>
In case someone is compiling their own libcurl and wants to link it
statically, for instance, the new CUST_CURL_LINKAGE parameter can be
used to override the default -lcurl argument.
Signed-off-by: Ben Greear <greearb@candelatech.com>
In some error cases, pointers were dereferenced before NULL check is
done. Fix this by adding checks before the dereference.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These hs20-osu-client parameters were never applicable for Android
builds and were just copied from the non-Android Makefile as a reminder,
but not removed once rest of the Android build was fixed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These need to be done in the libxml2 build, not in hs20-osu-client. This
workaround was previously used to allow parts of the build to go
through, but that was not a complete fix and resulted in warnings now
that external/libxml2 in Android 5.0 is defining the same parameters.
Remove these from hs20-osu-client Android.mk to avoid that warning.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Numbers of hs20-osu-client functions do not use all of the parameters
currently. This makes the compiler output difficult to read due to
undesired warning messages. Get rid of those specific warnings for now.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The LOCAL_EXPORT_C_INCLUDE_DIRS from ICU did not seem to fully resolve
the build (e.g., "mm -B" failed to build, but following that with "mm"
allowed the build to complete). For now, add the include directory
manually here for Android 5.0.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
As part of OSU, the AAA TrustRoot cert is downloaded into SP/<fqdn>
directory. On Android, wpa_supplicant runs with Wifi uid privileges, and
hence might not have read access to the AAA TrustRoot present SP/<fqdn>
directory. Hence, make AID_WIFI as the group owner of SP/<fqdn>
directory and allow the members of AID_WIFI group to read files present
in this directory.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add password and machine_managed flag to database in case of machine
managed subscription to fix EAP-TTLS connection failure to production
AP. In case of user managed subscription, the entered password is added
to DB from the PHP script. However in machine managed subscription,
machine generated password is added only in SOAP messages and PPS MO. So
connection to production will fail as the generated password is not
present in the database used by AAA server.
Signed-off-by: Sreenath Sharma <sreenath.mailing.lists@gmail.com>
Incorrect TrustRoot path "PolicyUpdate/TrustRoot" was used. The
TrustRoot path is required to be "Policy/PolicyUpdate/TrustRoot" as
defined in Section 9.1 of Hotspot 2.0 (Release 2) specification. Fix the
path to "Policy/PolicyUpdate/TrustRoot".
Signed-off-by: ASHUTOSH NARAYAN <ashutoshx.narayan@intel.com>
Previously, both failure and success cases used same return value 0.
Indicate failures differently to make hs20-osu-client return value more
useful for subscription remediation cases.
Signed-off-by: ASHUTOSH NARAYAN <ashutoshx.narayan@intel.com>
Use an explicit memset call to clear any hs20-osu-client configuration
parameter that contains private information like keys or identity. This
brings in an additional layer of protection by reducing the length of
time this type of private data is kept in memory.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is meant mainly for testing purposes and as a reference
implementation showing how OSU SPP server could be implemented. This is
not suitable for any real production use in its current form.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
deinit_ctx() may print debug information, so do not call
wpa_debug_close_file() before deinit_ctx().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
OCSP validation is required only for the OSU operations and since the
EST server may use a different server certificate, it may not
necessarily support OCSP.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
There is no requirement for the EST server to use an OSU server
certificate, so do not require friendly name and icon hash matches for
EST cases.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Some of the code paths could have ended up ignoring CA file name from
command line due to overly complex way of setting ctx->ca_fname.
Configure this more consistently in osu_client.c as soon as the CA file
name has been determined.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This hs20-osu-client client command can be used to parse a DER encoded
X.509v3 certificate with the logotype extensions and
id-wfa-hotspot-friendlyName values shown in detail.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds a reference implementation of Hotspot 2.0 Release 2 OSU
client. While this implements all of the required functionality, it is
likely that a significant extensions would be used to integrate this
with user interfaces and operating system configuration components.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
