Commit graph

16120 commits

Author SHA1 Message Date
Jouni Malinen
e4eb009d98 DPP2: Add Connector and C-sign-key in psk/sae credentials for reconfig
If the Enrollee indicates support for DPP R2 or newer, add Connector and
C-sign-key in psk/sae credentials (i.e., cases where DPP AKM is not
enabled) for reconfiguration. Extend processing of such credentials in
wpa_supplicant network profile addition to handle this new case
correctly by not setting key_mgmt=DPP based on Connector being present,
but by looking at the actual akm value in the config object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-02 21:34:49 +03:00
Jouni Malinen
08ac6f807d wlantest: Update PTK after rekeying even if EAPOL-Key msg 4/4 is missing
Update TPTK to PTK if a valid EAPOL-Key msg 2/4 and 3/4 are available,
but 4/4 is missing. This avoids certain cases where the new TK could be
derived, but it was not being used to try to decrypt following encrypted
frames.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 18:46:14 +03:00
Jouni Malinen
0dc58cfa95 wlantest: Do not report decryption keys when checking only zero TK
All the "Failed to decrypt frame" debug prints were confusing since
those were not supposed to be shown unless there were one or more real
TKs available. The recently added check for zero TK added these notes
for that case which is not really correct, so get rid of them.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 18:30:33 +03:00
Jouni Malinen
1dcfbab254 DPP2: Clear requirement for QR Code mutual authentication for chirping
The chirping cases are not really targeting interactive operations, so
clear the requirement for mutual authentication when DPP_CHIRP command
is used. This avoids testing isues where an earlier DPP_LISTEN command
has used qr=mutual parameter and that seting not getting cleared before
the next DPP_CHIRP command is used.

This fixes a test case failure in the following test sequence:
dpp_auth_resp_status_failure dpp_controller_relay_chirp

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 17:19:10 +03:00
Jouni Malinen
a371164f88 Process received WNM Notification Request for beacon protection failures
Report received notifications for beacon protection failures in syslog
and control interface.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 16:30:12 +03:00
Jouni Malinen
0e794989e5 Beacon frame protection event for incorrect protection
Define a driver interface event for Beacon frame protection failures.
Report such events over the control interface and send a
WNM-Notification Request frame to the AP as well.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 16:22:48 +03:00
P Praneesh
7c8f540ee0 wpa_supplicant: Add HE override support
Add HE override support under the build parameter CONFIG_HE_OVERRIDES=y.
The disable_he=1 network profile parameter can be used to disable HE.
This requires a fallback to VHT on the 5 GHz band and to HT on the 2.4
GHz band.

There is no nl80211 support for configuring the driver to disable HE, so
for now, this applies only to IBSS and mesh cases.

Signed-off-by: P Praneesh <ppranees@codeaurora.org>
2020-03-30 12:55:01 +03:00
Sriram R
e149051ced hostapd: Validate the country_code parameter value
cfg80211/regulatory supports only ISO 3166-1 alpha2 country code and
that's what this parameter is supposed to use, so validate the country
code input before accepting the value. Only characters A..Z are
accepted.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
2020-03-30 12:37:54 +03:00
Jouni Malinen
d4f5d1f0c7 DPP: Add some more details on how to use DPP
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 23:24:45 +03:00
Jouni Malinen
66e20bb1a7 Fix the dpp_configurator_sign example command
The mandatory ssid parameter was forgotten from this command when it was
added to the dpp_auth_init examples.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 23:07:42 +03:00
Jouni Malinen
4e9cfc3eb8 tests: DFS channel switch
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
91498a1225 hostapd: DFS for channel switch in repeater mode
In repeater mode remote AP may request channel switch to a new channel.
Check if DFS is required for the new channel before proceeding with
normal AP operations. Start CAC procedure if radar detection is required
and channel is not yet marked as available.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
c60717f839 hostapd: Add support for DFS channels in CHAN_SWITCH
Enable support for DFS channels in the CHAN_SWITCH command. Perform CAC
instead of CSA if DFS channel is selected. Then restart normal AP
operations.

Note that the current implementation provides a simplified approach. It
does not check if the selected DFS channel block is already in the
HOSTAPD_CHAN_DFS_AVAILABLE state. CAC procedure is restarted anyway.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
683e7c7559 DFS: Add new hostapd_is_dfs_overlap() helper
Add a new hostapd_is_dfs_overlap() helper function to DFS module. This
function tells whether the selected frequency range overlaps with DFS
channels in the current hostapd configuration. Selected frequency reange
is specified by its center frequency and bandwidth.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
7988767393 DFS: Rename and export hostapd_config_dfs_chan_available helper
Rename DFS helper hostapd_config_dfs_chan_available() to
hostapd_is_dfs_chan_available(). Enable access to this helper function
from other hostapd components.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
30b6d4bb7d hostapd: Basic channel check for CHAN_SWITCH parameters
Implement channel sanity check for the CHAN_SWITCH command. Verify
provided values for bandwidth, frequencies, and secondary channel
offset. Reject requested channel switch operation if basic constraints
on frequencies and bandwidth are not fulfilled.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
af6a2b727c tests: Use complete CHAN_SWITCH parameters in ap_vht_csa_vht40_disable
Specify the secondary channel offset and correct center_freq1 value to
make the parameters complete for a 40 MHz channel.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Alexander Wetzel
3f88d2ba0d AP: Drop not needed condition to delete PTK ID 1
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-29 21:15:16 +03:00
Thomas Pedersen
34708b4893 tests: Include UML defconfig
Include a defconfig for building kernel as UML. Also update the README
with a few notes related to UML.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-03-29 21:15:16 +03:00
Thomas Pedersen
eedf08f7a9 tests: Convert kernel-config to defconfig
Make the included kernel-config a little more minimal by checking in the
defconfig instead.

Generate the defconfig by checking out a linux at tag wt-2020-03-17,
copy kernel-config to .config, run
'yes "" | make oldconfig && make savedefconfig',
and copy resulting defconfig to kernel-config.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
80914e9eb2 DPP2: Fix build with OpenSSL 1.0.2 (EVP_PKEY_get0_EC_KEY() wrapper)
EVP_PKEY_get0_EC_KEY() was added in OpenSSL 1.1.0, so add a
compatibility wrapper for it when building with OpenSSL 1.0.2.

Fixes: c025c2eb59 ("DPP: DPPEnvelopedData generation for Configurator backup")
Fixes: 7d9e320054 ("DPP: Received Configurator backup processing")
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Johannes Berg
478bc00b5f tests: Assume --long for UML
If we use user-mode-linux, we have time-travel, and then the --long
argument doesn't really make a difference, so just assume that's the
case.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
6f291896b9 tests: FT roaming cases with authorized STA entry remaining
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Jouni Malinen
54e2961f80 Add a hostapd testing option for skipping association pruning
The new skip_prune_assoc=1 parameter can be used to configure hostapd
not to prune associations from other BSSs operated by the same process
when a station associates with another BSS. This can be helpful in
testing roaming cases where association and authorization state is
maintained in an AP when the stations returns.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 20:39:19 +02:00
Jouni Malinen
1a18f8df63 nl80211: Allow full AP client state capability to be disabled
The new driver param full_ap_client_state=0 can be used to test
functionality with the driver capability for full AP client state being
forced to be disabled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 20:38:11 +02:00
Jouni Malinen
7b156a3c5a wpa_auth: Use printf format %zu instead of type casts
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:54:10 +02:00
Jouni Malinen
f83d3491b9 wpa_auth: Do not split strings into multiple lines
Avoid unnecessary splitting of long string constants into multiple
lines.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:48:32 +02:00
Jouni Malinen
9385f03feb wpa_auth: Coding style cleanup for pointer is NULL comparisons
Use !ptr instead of ptr == NULL.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:36:00 +02:00
Jouni Malinen
62e12afcf1 wpa_auth: Clean up pointer dereferences
Use local variables to avoid sm->wpa_auth->conf type of dereferences
where multiple instances within a function can be cleaned up.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:29:12 +02:00
Veerendranath Jakkam
bbf94a0958 nl80211: Configure PMKSA lifetime and reauth threshold timer to driver
Drivers that trigger roaming need to know the lifetime and reauth
threshold time of configured PMKSA so that they can trigger full
authentication to avoid unnecessary disconnection. To support this, send
dot11RSNAConfigPMKLifetime and dot11RSNAConfigPMKReauthThreshold values
configured in wpa_supplicant to the driver while configuring a PMKSA.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-03-28 17:27:42 +02:00
Jouni Malinen
1f4e9946bc Sync with mac80211-next.git include/uapi/linux/nl80211.h
This brings in nl80211 definitions as of 2020-02-20.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 17:27:42 +02:00
Jouni Malinen
e96d319140 tests: DPP PFS
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 17:27:42 +02:00
Jouni Malinen
5058f771d9 DPP2: Allow station to require or not allow PFS
The new wpa_supplicant network profile parameter dpp_pfs can be used to
specify how PFS is applied to associations. The default behavior
(dpp_pfs=0) remains same as it was previously, i.e., try to use PFS if
the AP supports it. PFS use can now be required (dpp_pfs=1) or disabled
(dpp_pfs=2).

This is also working around an interoperability issue of DPP R2 STA with
certain hostapd builds that included both OWE and DPP functionality.
That issue was introduced by commit 09368515d1 ("OWE: Process
Diffie-Hellman Parameter element in AP mode") and removed by commit
16a4e931f0 ("OWE: Allow Diffie-Hellman Parameter element to be
included with DPP"). hostapd builds between those two commits would
reject DPP association attempt with PFS. The new wpa_supplicant default
(dpp_pfs=0) behavior is to automatically try to connect again with PFS
disabled if that happens.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 17:23:22 +02:00
Jouni Malinen
7c021dec3a DPP2: Allow AP to require or reject PFS
The new hostapd configuration parameter dpp_pfs can be used to specify
how PFS is applied to associations. The default behavior (dpp_pfs=0)
remains same as it was previously, i.e., allow the station to decide
whether to use PFS. PFS use can now be required (dpp_pfs=1) or rejected
(dpp_pfs=2).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 12:33:48 +02:00
Jouni Malinen
ca57d5f553 Return an enum from wpa_validate_wpa_ie()
This is more specific then returning a generic int and also allows the
compiler to do more checks.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 12:30:46 +02:00
Sathishkumar Muruganandam
2b4f9ce287 hostapd: Add HE bit in BSSID Information field of own Neighbor Report
Add definition for HE bit in neighbor report BSSID Information field
from IEEE P802.11ax/D6.0, 9.4.2.36 Neighbor Report element.

Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
2020-03-27 23:52:24 +02:00
Jouni Malinen
a3eda98c22 tests: Skip background scans in beacon loss tests
bgscan_learn_beacon_loss was failing quite frequently and it looks like
the background scans were related to those failures. Since those scans
are not really relevant to testing beacon loss, get rid of them in these
test cases to avoid incorrect failures.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 21:05:44 +02:00
Jouni Malinen
ef46f143bc tests: dpp_controller_rx_failure to match implementation changes
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
80d0e50dc5 DPP2: Use a helper function for encapsulating TCP message
This functionality was repeated for multiple different frames. Use a
shared helper function to avoid such duplication.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
f1732b4d1a tests: DPP chirping
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
fa5143feb3 DPP2: Presence Announcement processing in Controller
Process the received Presence Announcement frames in Controller. If a
matching bootstrapping entry for the peer is found, initiate DPP
authentication to complete provisioning of the Enrollee.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
db1ef82538 DPP2: Presence Announcement processing in AP/Relay
Process the received Presence Announcement frames in AP/Relay. If a
matching bootstrapping entry for the peer is found in a local
Configurator, that Configurator is used. Otherwise, the frame is relayed
to the first configured Controller (if available).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
06dd32903d DPP2: Presence Announcement processing at Configurator
Process received Presence Announcement frames and initiate
Authentication exchange if matching information is available on the
Configurator.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
6f5bc15bec DPP2: Configurator Connectivity indication
Add a new hostapd configuration parameter
dpp_configurator_connectivity=1 to request Configurator connectivity to
be advertised for chirping Enrollees.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
562f77144c DPP2: Chirping in wpa_supplicant Enrollee
Add a new wpa_supplicant control interface command "DPP_CHIRP own=<BI
ID> iter=<count>" to request chirping, i.e., sending of Presence
Announcement frames, to be started.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 20:05:25 +02:00
Jouni Malinen
1f0226770c DPP2: Add a helper function for building Presence Announcement frame
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 17:44:06 +02:00
Jouni Malinen
7cba35b0ed DPP2: New identifier definitions
Add new identifier definitions for presence announcement,
reconfiguration, and certificate enrollment.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 17:44:06 +02:00
Jouni Malinen
547dc7eaa3 DPP: Add DPP_BOOTSTRAP_SET command
"DPP_BOOTSTRAP_SET <ID> <configurator parameters..>" can now be used to
set peer specific configurator parameters which will override any global
parameters from dpp_configurator_params.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 17:44:06 +02:00
Jouni Malinen
804fc268af DPP: Allow per-peer configurator parameters to be set
This is a more convenient way of addressing cases where a
Configurator/Controller may store a large number of peer bootstrapping
information instances and may need to manage different configuration
parameters for each peer while operating as the Responder.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 17:44:06 +02:00
Jouni Malinen
514cc49ba5 DPP: Store global pointers in struct dpp_authentication
Set the global pointer and msg_ctx when allocating struct
dpp_authentication instead of needing to pass these to
dpp_set_configurator().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-27 17:44:06 +02:00