Commit graph

17720 commits

Author SHA1 Message Date
Jouni Malinen
f5c711c855 OpenSSL: Unload providers only at process exit
The previous mechanism of unloaded the providers from tls_deinit() did
not work correctly for some cases. In particular, it was possible for
hostapd to end up unloading both providers and not being able to recover
from this if TLS server was not enabled.

Address this more cleanly by introducing a new crypto_unload() function
that will be called when the process is exiting.

Fixes: 097ca6bf0b ("OpenSSL: Unload providers on deinit")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 18:51:32 +03:00
John Crispin
33c4dd26cd BSS coloring: Handle the collision and CCA events coming from the kernel
This commit activates the functionality of the previous commits by
handling the actual events that will trigger the CCA process.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:30:30 +03:00
John Crispin
27b4cc712f nl80211: Handle driver events for BSS coloring
Process the color collision and color change related events.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:30:30 +03:00
John Crispin
399d6e64d9 nl80211: Add the switch_color() handler for BSS color changes
To start the CCA process we need to send NL80211_CMD_COLOR_CHANGE to the
kernel. This commit adds the required code.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:30:09 +03:00
John Crispin
86bd90eb37 BSS coloring: Disable BSS color during CCA
While we are doing CCA the BSS Color Disabled field inside the HE
Operation Parameters field needs to be set.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:13:51 +03:00
John Crispin
f7d0b740e7 BSS coloring: BSS Color Change Announcement element generation
This information element is similar to the CSA one. It contains a
counter and the target color. Once the counter expired, the change to
the new color happens.

Just note the current implementation is based on CCA counter attributes
that only take Beacon and Probe Response framesinto account.
(Re)Association Response frames do not currently have kernel APIs to
decrement the CCA counter since mediatek mcu firmware does not support
it yet and it will be added in future firmware release.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:13:08 +03:00
John Crispin
654d2395dd BSS coloring: Handling of collision events and triggering CCA
Add the core code for handling BSS color collision events and triggering
CCA inside the kernel. The caller of hostapd_switch_color() will be
added in the following commits.

Tested-by: Peter Chiu <chui-hao.chiu@mediatek.com>
Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
2022-04-16 17:06:06 +03:00
Johannes Berg
2f336ca580 tests: Pretend the RNG is initialized withinthe VM
We don't particularly care about the quality of random numbers
during the test. So far, there hasn't been an issue with the
RNG not being initialized completely, we only get a few prints
about uninitialized reads from urandom. However, if some tool
were to actually use /dev/random, it might get stuck. Call the
RNDADDTOENTCNT ioctl to unblock this.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2022-04-16 16:51:54 +03:00
Yegor Yefremov
52e2516f1d wpa_supplicant: Add the CONFIG_HE_OVERRIDES option to the defconfig
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2022-04-16 16:48:35 +03:00
Jouni Malinen
698c05da2b tests: Update server and user certificates (2022)
The previous versions are going to be expiring soon, so need to re-sign
these to avoid EAP test case failures. This contains updates from
running tests/hwsim/auth_server/update.sh.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 13:22:16 +03:00
Jouni Malinen
6a2a60f1db OpenSSL: Do not use the deprecated RSAPrivateKey function
Comment out the call to SSL_use_RSAPrivateKey_ASN1() function when using
OpenSSL 3.0 since that function was deprecated and there does not seem
to be any significant use case for supporting DER encoded RSAPrivateKey
structure in the private key blob.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 12:45:32 +03:00
Jouni Malinen
ebb3055e13 OpenSSL: Generate DH parameters automatically if not set with dh_file
This is the recommended way of using DH in OpenSSL TLS handshake.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 11:38:44 +03:00
Jouni Malinen
bcd299b326 OpenSSL: Convert DH/DSA parameter loading to new API
OpenSSL 3.0 has deprecated low-level DH/DSA functions. Convert this
loading of the dh_file parameter to use newer API.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 11:32:21 +03:00
Jouni Malinen
28c1c91d03 Remove unused dh_blob parameter
This was used earlier in the wpa_supplicant configuration, but there was
no real use for that, so remove the now completely unused parameter to
simplify implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-16 10:45:17 +03:00
Jouni Malinen
4a774cf317 Remove useless DH file configuration from TLS library wrappers
These operations do not really have any effect since
tls_connection_set_params() is used only in the TLS client case and the
client receives the DH parameters from the server instead of local
configuration.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 23:42:15 +03:00
Jouni Malinen
86877bbc32 tests: Remove unused DH file from TLS client fuzzer
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 23:42:15 +03:00
Jouni Malinen
65652c67f5 Remove DH file configuration from TLS client functionality
The DH file parameters are applicable only for the TLS server, so this
parameter did not really have any impact to functionality. Remove it to
get rid of useless code and confusing documentation for the network
block configuration.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 23:42:15 +03:00
Jouni Malinen
b08d100de6 tests: Remove test cases for wpa_supplicant dh_file parameter
This parameter has no impact to TLS client functionality, so these is
not really any point to maintain these test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 23:42:15 +03:00
Jouni Malinen
b94371af84 RADIUS attributes for EAPOL-Key message details
Use vendor specific RADIUS attributes for sending ANonce and EAPOL-Key
msg 2/4 for the wpa_psk_radius=3 case. The vendor specific attributes
for this are defined in FreeRADIUS as follows:

BEGIN-VENDOR    FreeRADIUS      format=Extended-Vendor-Specific-5
ATTRIBUTE       FreeRADIUS-802.1X-Anonce        1       octets[32]
ATTRIBUTE       FreeRADIUS-802.1X-EAPoL-Key-Msg 2       octets
END-VENDOR      FreeRADIUS

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 18:40:55 +03:00
Jouni Malinen
24763e3cd0 RADIUS: Attributes with Extended Types (RFC 6929)
Supported extended types for RADIUS attributes for the cases defined in
RFC 6929.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 18:40:55 +03:00
Jouni Malinen
6c9e76e58a tests: Fix ap_wpa2_eap_fast_eap_vendor to check EAP-FAST support in build
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:49:19 +03:00
Jouni Malinen
e9078209c4 tests: Use group 20 instead of 25 in some SAE test cases
BoringSSL does not support group 25, so replace these cases with a
supported group 20 to meet the real testing need here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:47:58 +03:00
Jouni Malinen
ae301fd37a tests: Skip sigma_dut_suite_b_rsa DHE case with BoringSSL
BoringSSL is known not to support this option, so skip it to allow rest
of the test case to be performed without known failures.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:43:30 +03:00
Jouni Malinen
26dd47f1d1 tests: Skip sae_pwe_group_25 with BoringSSL
BoringSSL does not support this 192-bit EC group, so do not try to run
the test case that is known to fail.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:36:35 +03:00
Jouni Malinen
feed2f9e75 BoringSSL: Use accessor functions for X509 key usage flags
BoringSSL commit dddb60eb9700110835ff6e2b429de40a17006429 ("Make most of
crypto/x509 opaque.") broke the direct access to these variables, so use
the accessor functions instead.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:00:26 +03:00
Jouni Malinen
80be88a089 BoringSSL: Replace stack-allocated X509_STORE_CTX with heap one
BoringSSL commit dddb60eb9700110835ff6e2b429de40a17006429 ("Make most of
crypto/x509 opaque.") broke the stack-allocated version, so move to
using X509_STORE_CTX_new() to get an opaque pointer to X509_STORE_CTX
instead.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:00:26 +03:00
Jouni Malinen
3f94dcdd1a tests: Build with LibreSSL 3.4
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:00:26 +03:00
Jouni Malinen
b95ed17f6b OpenSSL: Fix build with BoringSSL and LibreSSL 3.3.x and older
Define the EC_GROUP_get_curve() wrapper for the older versions.

Fixes: 3c61f4db4c ("OpenSSL: Replace EC_GROUP_get_curve_GFp() calls with EC_GROUP_get_curve()")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 13:00:08 +03:00
Jouni Malinen
ae0f6ee97e OpenSSL: CMAC using the OpenSSL library for non-FIPS cases as well
Commit 0b5e98557e ("FIPS: Use OpenSSL CMAC implementation instead of
aes-omac1.c") added this implementation initially only for the FIPS
builds. However, there does not seem to be any remaining need to avoid
depending on the OpenSSL library implementation for builds, so move to
that implementation unconditionally to reduce the binary size a bit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 12:00:10 +03:00
Jouni Malinen
0c61f6234f OpenSSL: Implement CMAC using the EVP_MAC API
OpenSSL 3.0 deprecated the low-level CMAC functions, so use the new
EVP_MAC API for this. Maintain the CMAC API variant for older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 12:00:10 +03:00
Jouni Malinen
4fcd296608 OpenSSL: Extend CMAC to support 192-bit AES
This is used with DPP and SAE when using P-384, so prepare the OpenSSL
implementation to support these cases to allow the internal CMAC
implementation in aes-omac1.c to be replaced.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 12:00:10 +03:00
Jouni Malinen
1176178437 OpenSSL: Remove now unused compatibility wrapper for RSA_bits()
This function is not used anymore, but the compatibility wrapper for
older OpenSSL versions was forgotten to be removed.

Fixes: 09c62aaf11 ("OpenSSL: Determine RSA key size without low-level routines")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-15 11:58:34 +03:00
Chenming Huang
a2dbb25583 Android: Compile hs20-osu-client to /vendor/bin in test builds
hs20-osu-client compilation fails on Android O onwards because of
undefined reference for __android_log_print/__android_log_vprint.

Modify hs20-osu-client's Android.mk to include liblog library and
use tag 'hs20-osu-client' in logcat logs. Additionally, compile
hs20-osu-client to /vendor/bin in non-production builds.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 17:10:03 +03:00
Jouni Malinen
364022ddef tests: sigma_dut DPP URI curves list override
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 17:06:02 +03:00
Jouni Malinen
339aef0980 tests: DPP URI supported curves
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 16:59:15 +03:00
Jouni Malinen
b0769ce61c DPP: Allow a list of supported curves to be used in bootstrapping URI
The new DPP_BOOTSTRAP_GEN command parameter supported_curves can be used
to specify a colon separated list of supported curves. Information from
a parsed URI shows this information with a new supp_curves line in the
DPP_BOOTSTRAP_INFO output.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 16:57:11 +03:00
Jouni Malinen
73b41762d0 tests: Fetch commitid on the host when running tests in a VM
git has started rejecting repositories owned by other users and refusing
to run the "git rev-parse HEAD" command in this type of cases. That
resulted in issues with the VM testing model where the VM is practically
running everything as root while the host is a normal development
environment and likely a non-root user owned files.

Fix this by fetching the commitid on the host and pass it to the VM so
that no git operations need to be run within the VM itself.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 11:59:22 +03:00
Jouni Malinen
58701128e8 tests: Handle git rev-parse failures more robustly
Do not add the --commit argument if the current git commitid cannot be
determined. This prevents complete failure to run the tests if the git
command cannot be used for some reason (like a recent change that
stopped allowing root user within the VM from running the git operation
for the case where the host system uses non-root account).

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-14 11:50:41 +03:00
Sumit Agre
ef85328a67 QCA vendor command support to reset configuration for eLNA bypass
Add support to reset eLNA bypass configuration to default behavior.
If value of 2 is configured, the driver can choose either to
disable/enable eLNA bypass control and there is no enforcement
from userspace.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-11 23:25:48 +03:00
Jouni Malinen
7008c50fa9 OpenSSL: Implement DH using the EVP API
OpenSSL 3.0 deprecated the low-level DH functions, so use the EVP API
for this. Maintain the DH API variant for older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-10 18:19:58 +03:00
Jouni Malinen
e31500adea OpenSSL: Implement HMAC using the EVP_MAC API
OpenSSL 3.0 deprecated the low-level HMAC functions, so use the EVP_MAC
API for this. Maintain the HMAC API variant for older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-10 00:39:43 +03:00
Jouni Malinen
097ca6bf0b OpenSSL: Unload providers on deinit
This frees up the allocated resources and makes memory leak detection
more convenient without the known allocations being left behind.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-10 00:19:54 +03:00
Jouni Malinen
092efd45a6 OpenSSL: Implement AES keywrap using the EVP API
OpenSSL 3.0 deprecated the low-level encryption functions, so use the
EVP API for this. Maintain the previous version for BoringSSL and
LibreSSL since not all versions seem to have the EVP_aes_*_wrap()
functions needed for the EVP API.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-09 21:11:10 +03:00
Jouni Malinen
7e4984d9ca OpenSSL: Use a correct EVP_CIPHER_CTX freeing function on an error path
aes_encrypt_init() used incorrect function to free the EVP_CIPHER_CTX
allocated within this function. Fix that to use the OpenSSL function for
freeing the context.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-09 20:42:36 +03:00
Jouni Malinen
658296ea5b tests: Use build_beacon_request() to make beacon request more readable
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-09 19:37:58 +03:00
Jouni Malinen
060a522576 tests: Beacon request - active scan mode and NO_IR channel
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-09 19:17:00 +03:00
Avraham Stern
8e0ac53660 RRM: Include passive channels in active beacon report scan
When receiving a beacon report request with the mode set to active,
channels that are marked as NO_IR were not added to the scan request.
However, active mode just mean that active scan is allowed, but not
that it is a must, so these channels should not be omitted.
Include channels that are marked as NO_IR in the scan request even
if the mode is set to active.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2022-04-09 19:16:35 +03:00
Naïm Favier
0adc67612d wpa_supplicant: Use unique IDs for networks and credentials
The id and cred_id variables are reset to 0 every time the
wpa_config_read() function is called, which is fine as long as it is
only called once. However, this is not the case when using both the -c
and -I options to specify two config files.

This is a problem because the GUI, since commit eadfeb0e93 ("wpa_gui:
Show entire list of networks"), relies on the network IDs being unique
(and increasing), and might get into an infinite loop otherwise.

This is solved by simply making the variables static.

Signed-off-by: Naïm Favier <n@monade.li>
2022-04-09 18:47:01 +03:00
Jouni Malinen
dacb6d278d Update IEEE P802.11ax draft references to published amendment
Get rid of the old references to drafts since the amendment has been
published.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-08 19:50:32 +03:00
Pradeep Kumar Chitrapu
8128ea76af Add Transmit Power Envelope element in 6 GHz
Add Transmit Power Envelope element for 6 GHz per IEEE Std
802.11ax-2021.

Currently, this uses hard coded EIRP/PSD limits which are applicable to
6 GHz operation in United states, Japan, and Korea. Support to extract
power limits from kernel data will be added after complete regulatory
support is added for the 6 GHz band.

Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
2022-04-08 19:50:26 +03:00