Commit graph

15047 commits

Author SHA1 Message Date
Alexei Avshalom Lazar
a19913c170 IEEE P802.11ay/D4.0 defines for EDMG
Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
2019-10-07 16:06:01 +03:00
Jouni Malinen
656b07c189 tests: sigma_dut DPP/QR responder status query
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-04 17:03:47 +03:00
Jouni Malinen
1743ddce76 tests: sigma_dut DPP AP as Relay to Controller
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-04 16:33:36 +03:00
Jouni Malinen
b472fe2973 tests: Update server and user certificates (2019)
The previous versions expired, so need to re-sign these to fix number of
the EAP test cases. This contains updates from running
tests/hwsim/auth_server/update.sh.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-04 16:03:04 +03:00
Ankita Bajaj
c349174035 MBO/OCE: Update disable_mbo_oce flag after association
After roaming to an AP, update disable_mbo_oce flag based on the current
BSS capabilities. This flag is used to check whether STA should support
MBO/OCE features and process BTM request received from the current
connected AP.

When a STA roams from a WPA2 MBO/OCE AP with PMF enabled to a
misbehaving WPA2 MBO/OCE AP without PMF, or if the driver chooses a BSS
in which PMF is not enabled for the initial connection, BTM requests
from such APs should not be processed by STA.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 16:45:15 +03:00
Jouni Malinen
cefcbcdba4 tests: sigma_dut with DPPConfIndex 9 and 10
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
b719a1568a DPP2: Parse AKM suite selector version of akm node
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
68fea96038 DPP2: Allow Configurator to use AKM suite selectors in Config Object
The new use_akm_selector=1 value to Configurator parameters can now be
used to request a list of AKM suite selectors to be used in the
Configuration Object if the Enrollee supports version 2 or newer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
52d469de11 DPP2: Support multiple Config Objects in Enrollee
Process all received DPP Configuration Object attributes from
Configuration Result in Enrollee STA case. If wpa_supplicant is
configured to add networks automatically, this results in one network
being added for each included Configuration Object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
7eb06a3369 DPP2: Allow multiple Config Objects to be build on Configurator
Special @CONF-OBJ-SEP@ string can now be used as a DPP configuration
string value to split the string into two different components to
configure two Config Objects for an Enrollee.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
99918e069a DPP: Cleaned up netrole indication for config object building
Include netrole as part of struct dpp_configuration to make config
object building more flexible.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
e0d22c842a FILS+FT: Fix MFPR flag in RSNE during FILS exchange for FT
Commit e820cf952f ("MFP: Add MFPR flag into station RSN IE if 802.11w
is mandatory") added indication of MFPR flag in non-FT cases and was
further extended to cover FT protocol in commit ded56f2faf ("FT: Fix
MFPR flag in RSNE during FT protocol"). Similar fix is needed for
FILS+FT as well.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-01 14:21:51 +03:00
Jouni Malinen
be907f7220 tests: SAE in wpa_supplicant AP mode
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-21 16:30:40 +03:00
Jouni Malinen
d0a4ed6a1b Allow SAE to be used in wpa_supplicant AP mode
SAE password configuration for AP mode requires additional steps
compared to PSK cases. Previous implementation allowed SAE to be
configured, but all authentication attempts would fail due to no
password being available. Now both psk and sae_password/sae_password_id
parameters are translated properly to the hostapd configuration
structures to fix this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-21 16:30:35 +03:00
Roy Marples
7846e8d608 NetBSD: Fix compile
On NetBSD the ethernet header is net/if_ether.h

This also pulls in net/if.h which defines if_type, which in turn
conflicts with an enum in wpa_supplicant. As such we need to
include this at the bottom rather than at the top.

Signed-off-by: Roy Marples <roy@marples.name>
2019-09-21 13:38:32 +03:00
Jouni Malinen
d0d303ae91 tests: MBO and WPA2 without PMF on misbehaving AP
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-21 12:56:19 +03:00
Vamsi Krishna
2e06cef80a MBO/OCE: Work around misbehaving MBO/OCE APs that use RSN without PMF
The MBO and OCE specification require the station to mandate use of PMF
when connecting to an MBO/OCE AP that uses WPA2. The earlier
implementation prevented such misbehaving APs from being selected for
connection completely. This looks like the safest approach to take, but
unfortunately, there are deployed APs that are not compliant with the
MBO/OCE requirements and this strict interpretation of the station
requirements results in interoperability issues by preventing the
association completely.

Relax the approach by allowing noncompliant MBO/OCE APs to be selected
for RSN connection without PMF to avoid the main impact of this
interoperability issue. However, disable MBO/OCE functionality when PMF
cannot be negotiated to try to be as compliant as practical with the
MBO/OCE tech spec requirements (i.e., stop being an MBO/OCE STA for the
duration of such workaround association). Also disable support for BTM
in this workaround state since MBO would expect all BTM frames to be
protected.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-21 00:58:33 +03:00
Jouni Malinen
722c7d1958 wlantest: Process VLAN tagged Data frames
This allows Data frames to be fully processed for the case where VLAN
tags are used on the wireless link.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-20 23:54:05 +03:00
Alexander Wetzel
83b83b461d nl80211: Migrate to current netlink key message format
Linux 2.6.32 (December 2009) introduced alternate netlink messages
for setting and installing keys, deprecating the older ones.

To allow hostapd/wpa_supplicant to use new features only provided via
the new API this patch migrates all netlink messages to the current ones.

Since the nl80211 driver was sometimes already using the new format this
is only unifying the netlink API usage and not changing the minimal
kernel requirement.

The following netlink attributes have been retired for key installs:

  NL80211_ATTR_KEY_DATA
  NL80211_ATTR_KEY_TYPE
  NL80211_ATTR_KEY_SEQ
  NL80211_ATTR_KEY_IDX
  NL80211_ATTR_KEY_CIPHER
  NL80211_ATTR_KEY_DEFAULT
  NL80211_ATTR_KEY_DEFAULT_MGMT
  NL80211_ATTR_KEY_DEFAULT_TYPES

And replaced by the following attributes nested in NL80211_ATTR_KEY:

  NL80211_KEY_DATA
  NL80211_KEY_TYPE
  NL80211_KEY_SEQ
  NL80211_KEY_IDX
  NL80211_KEY_CIPHER
  NL80211_KEY_DEFAULT
  NL80211_KEY_DEFAULT_MGMT
  NL80211_KEY_DEFAULT_TYPES

When getting Michael MIC failure notifications or querying a key
sequence number the kernel continues to use the old attributes:
  NL80211_ATTR_KEY_TYPE
  NL80211_ATTR_KEY_SEQ
  NL80211_ATTR_KEY_IDX

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2019-09-19 12:48:37 +03:00
Alexander Wetzel
7a4b01c879 AP: Provide correct keyid to wpa_send_eapol() for EAPOL-Key msg 3/4
PTKINITNEGOTIATING in the WPA state machine calls wpa_send_eapol() and
hands over the GTK instead of the PTK keyid.

Besides a confusing debug message this does not have any negative side
effects: The variable is only set to a wrong value when using WPA2 but
then it's not used.

With this patch PTKINITNEGOTIATING sets the PTK keyid unconditionally to
zero for EAPOL-Key msg 3/4 and differentiates more obviously between GTK
and PTK keyids.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2019-09-19 12:34:21 +03:00
Roy Marples
a3ebf71751 BSD: Add support for route(4) message filtering
hostapd is only interested in RTM_IEEE80211.
wpa_supplicant is only interested in RTM_IEEE80211, RTM_IFINFO and
RTM_IFANNOUNCE.

This supports the NetBSD RO_MSGFILTER interface and the alternative
DragonFlyBSD/OpenBSD interface ROUTE_MSGFILTER.

Signed-off-by: Roy Marples <roy@marples.name>
2019-09-19 12:16:49 +03:00
Jouni Malinen
c532abb158 tests: Automatic channel selection with invalid chanlist
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 12:14:04 +03:00
Neo Jou
d9286d0997 ACS: Stop before scan if no channels in chanlist are available
When we set "channel=0" in hostapd.conf to enable ACS function, and set
a wrong channel list, e.g., chanlist=222-999 on purpose, hostapd would
still start ACS process to compute the ideal channel, even when there
are no available channels with such configuration.

Though there is no problem since hostapd fails to initialize interface,
it spends time going through the scan and the debug log entries may make
it more difficult to tell what was behind the failure.

Thus, check if there are any available channels in acs_request_scan(),
and return -1 if no available channel, then it will fail at acs_init(),
without doing ACS computation. It will show the following in the log:
    Could not select hw_mode and channel. (-3)
    wlan0: interface state UNINITIALIZED->DISABLED

Then we can know the setting is incorrect already in
hostapd_select_hw_mode(), instead of waiting for scan callback function
to know if the setting is ok for ACS or not. This can save time and help
to tell if the setting is correct at the initial function at the first.
This will also allow the ENABLE control interface command to return FAIL
when adding an interface dynamically.

Signed-off-by: Neo Jou <neojou@gmail.com>
2019-09-19 12:09:47 +03:00
Jouni Malinen
f32aa244ef DPP: Debug print configRequest bandSupport on Configurator
Go through the received bandSupport JSON array and print its contents in
the debug log. This information might be exposed to upper layer
configuration generation/use somehow in the future.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
8f8c423a51 DPP: Add bandSupport JSON array into config request
Indicate supported global operating classes when wpa_supplicant is
operating as an Enrollee.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Thomas Winter
6d3dc9ba1e mka: Check OLPN for exhaustion on SAKuse decode
Most of the time is spent in the CP state machine RETIRE state where LKI
is not set and OKI is the currently used SAK so OLPN needs to be checked
for PN exhaustion.

hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.

Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
2019-09-19 00:21:47 +03:00
Thomas Winter
84851007d9 mka: Check OLPN for exhaustion on SAKuse encode
Most of the time is spent in the CP state machine RETIRE state where LKI
is not set and OKI is the currently used SAK, so OLPN needs to be
checked for PN exhaustion.

hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.

Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
2019-09-19 00:21:47 +03:00
Thomas Winter
547ba732d3 mka: Clear out old/latest key values on CHANGE in CP state machine
The associated SAs have been deleted and the key server has changed so
there's no point in keeping the key values.

Note that this isn't specified in IEEE Std 802.1X-2010.

Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
2019-09-19 00:21:47 +03:00
Thomas Winter
536a7cfcf7 mka: Don't set newSAK to FALSE on ABANDON in CP state machine
Previously the ABANDON->RECEIVE state change was impossible and did not
match the CP state machine in IEEE Std 802.1X-2010 Figure 12-2.

Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
2019-09-19 00:21:47 +03:00
Thomas Winter
0fedfba2e2 mka: Change RECEIVE and RETIRE states to match the standard
The RECEIVE and RETIRE states were incorrect which can result in
incorrect information being advertised in SAKuse MKPDUs. Change these to
match IEEE Std 802.1X-2010, Figure 12-2 (CP state machine).

hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.

Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
2019-09-19 00:21:47 +03:00
Jouni Malinen
1f8fc6bebb tests: Fix p2p_stop_find() calls in discovery
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
a378fe5d45 tests: wpa_supplicant build for EAP-SIM and PC/SC
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
3f2641e7ad Fix wpa_supplicant build with CONFIG_PCSC=y
This code block with dependency on PCSC_FUNCS was missed when conf->pin
was moved to conf->cert.pin. Fix this to get rid of compilation issues
with CONFIG_PCSC=y builds.

Fixes: b99c4cadb7 ("EAP peer: Move certificate configuration params into shared struct")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
11bbb7ecb8 tests: DPP MUD URL
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
5a5639b068 DPP: Allow name and mudurl to be configured for Config Request
The new hostapd and wpa_supplicant configuration parameters dpp_name and
dpp_mud_url can now be used to set a specific name and MUD URL for the
Enrollee to use in the Configuration Request. dpp_name replaces the
previously hardcoded "Test" string (which is still the default if an
explicit configuration entry is not included). dpp_mud_url can
optionally be used to add a MUD URL to describe the Enrollee device.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-19 00:21:47 +03:00
Jouni Malinen
91a0703157 tests: Layer 2 Update frame behavior in mac80211
This verifies mac80211 behavior for Layer 2 Update frame use and other
unexpected frames from a not fully authentication station.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-09-17 12:39:03 +03:00
Jouni Malinen
9840532377 tests: PMF and Data frame injection
Verify driver/mac80211 behavior for unexpected A2 in Data frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-09-17 12:39:01 +03:00
Jouni Malinen
1ccde13b86 tests: Extend ap_pmf_inject_auth coverage for addresses/frames
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-09-17 12:38:15 +03:00
Jouni Malinen
3394def5a8 More consistent SA check for unexpected Data frames
Use the same rules for dropping driver notifications for Data frames
from unassociated stations as were added for Management frame reception.
This results in more consistent behavior in sending out Deauthentication
frames with Reason Code 6/7.

This case was already checking for unexpected multicast addresses, so
there was no issue for the PMF protections for unexpected disconnection.
Anyway, better avoid unnecessary Deauthentication frames consistently.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-09-17 12:38:15 +03:00
Jouni Malinen
c404cd8c7d tests: Avoid race conditions in couple of Hotspot 2.0 test cases
Wait hostapd to complete key setup before asking it to send a frame that
may need PMF. This is needed especially with UML time-travel.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-16 18:09:54 +03:00
Jouni Malinen
b256d9393d tests: DPP2 connection status result
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-16 17:25:34 +03:00
Jouni Malinen
16ef233bf1 DPP2: Connection status result (Enrollee)
Add support for reporting connection status after provisioning if the
Configurator requests this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-16 17:25:34 +03:00
Jouni Malinen
b10e01a795 DPP2: Connection status result (Configurator)
A new argument to the DPP_AUTH_INIT command (conn_status=1) can now be
used to set Configurator to request a station Enrollee to report
connection result after a successfully completed provisioning step. If
the peer supports this, the DPP-CONF-SENT event indicates this with a
new argument (wait_conn_status=1) and the Configurator remains waiting
for the connection result for up to 16 seconds.

Once the Enrollee reports the result, a new DPP-CONN-STATUS-RESULT event
is generated with arguments result, ssid, and channel_list indicating
what the Enrollee reported. result=0 means success while non-zero codes
are for various error cases as specified in the DPP tech spec. If no
report is received from the Enrollee, the event with "timeout" argument
is generated locally.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-16 17:13:46 +03:00
Jouni Malinen
e501a2eb59 DPP2: Connection status result defines
Add defines for the connection status result mechanism.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-15 17:03:04 +03:00
Jouni Malinen
530b31ea88 tests: Fix DPP wait_auth_success() check for Configurator success
This looked like a copy-paste error in the event message check and once
that was fixed, couple of test cases needed fixes to expect a success
from the Configurator.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-15 17:01:59 +03:00
Jouni Malinen
cc8399528b DPP2: Move dpp_build_conf_result() to be within ifdef block
This is more consistent with the use of CONFIG_DPP2 since the
Configuration Result message is sent only when using version 2 or newer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-15 16:45:16 +03:00
Jouni Malinen
3a6736fe87 DPP2: Fix a memory leak on error path for Config Result
If only one of the allocations fails, the successful allocation needs to
be freed on the error path.

Fixes: 22f90b32f1 ("DPP2: Configuration Result message generation and processing")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-15 16:30:40 +03:00
Sujay Patwardhan
21dc1627f6 wpa_supplicant: Don't return an error when successfully parsing WMM rules
The config file parser previously would fall through into an error if
CONFIG_AP is defined and it hit a wmm_ac_* rule with a valid value. Add
a return to prevent incorrectly printing an error message and returning
a non-zero exit code.

Signed-off-by: Sujay Patwardhan <sujay@eero.com>
2019-09-13 16:35:16 +03:00
Hu Wang
8214b45ba0 P2P: Use latest BSS entry if multiple P2P Device Addr matches found
If an AP (P2P GO) has changed its operating channel or SSID recently,
the BSS table may have multiple entries for the same BSSID.

Commit 702621e6dd ('WPS: Use latest updated BSS entry if multiple
BSSID matches found') fetches latest updated BSS entry based on
BSSID. Do the same when fetching an entry based on the P2P Device
Address.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-13 16:22:05 +03:00
Alexei Avshalom Lazar
dc6c3be4e2 wpa_supplicant: Add support for 60 GHz band channels 5 and 6
The previous support in the 60 GHz band was for channels 1-4.
Add support for channels 5 and 6.

Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
2019-09-13 16:14:17 +03:00