The return value from nl80211_send_monitor() is not suitable for use
with strerror(). Furthermore, nl80211_send_monitor() itself is printing
out a more detailed error reason.
Signed-off-by: Jouni Malinen <j@w1.fi>
send_and_recv_msgs() returns a negative number as the error code and
that needs to be negated for strerror().
Fixes: 8759e9116a ("nl80211: Control port over nl80211 helpers")
Signed-off-by: Jouni Malinen <j@w1.fi>
wpa_tdls_set_key() did set the key_id to -1 to avoid a useless
NL80211_CMD_SET_KEY call that the updated nl80211 driver no longer
carries out. Remove the no longer required workaround.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Migrate nl80211 driver to key_flag API and add additional sanity checks.
I'm still not sure why we install unicast WEP keys also as default
unicast keys. Based on how I understand how mac80211 handles that it
should be pointless. I just stuck to how we do things prior to the patch
for WEP keys to not break anything. After all other drivers may need it.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Always report an error when NL80211_CMD_SET_KEY can't set a key to
default.
The old ioctl-based design used a single command to add, set, and delete
a key and had to ignore ENOENT for key deletions. It looks like that
special handling was also ported for NL80211_CMD_NEW_KEY and
NL80211_CMD_SET_KEY instead only for NL80211_CMD_DEL_KEY.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Calling NL80211_CMD_NEW_KEY with NL80211_KEY_DEFAULT_TYPES attributes is
pointless. The information is not expected and therefore the kernel
never forwards it to the drivers. That attribute is used with
NL80211_CMD_SET_KEY.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Allow to abort key installations with different error codes and fix one
misleading return code.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Turns out we are sometime providing a seq when deleting the key. Since
that makes no sense on key deletion let's stop forwarding that to the
driver at least.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
PASN authentication can be performed while a station interface is
connected to an AP. To allow sending PASN frames while connected, extend
the send_mlme() driver callback to also allow a wait option. Update the
relevant drivers and wpa_supplicant accordingly.
hostapd calls for send_mlme() are left unchanged, since the wait option
is not required there.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
If the driver requires external SAE authentication, it would result in
registration for all Authentication frames, so even non-SAE
Authentication frames might be forwarded to user space instead of being
handled internally. Fix this by using a more strict match pattern,
limiting the registration to the SAE authentication algorithm only.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Add a new capability flag based on the nl80211 feature advertisement and
start using the new default key type for Beacon protection. This enables
AP mode functionality to allow Beacon protection to be enabled. This is
also enabling the previously added ap_pmf_beacon_protection_* hwsim test
cases.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
nla_nest_start() might fail, so need to check its return value similarly
to all the other callers.
Fixes: a84bf44388 ("HE: Send the AP's OBSS PD settings to the kernel")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Previously only couple of AKM suite selectors were converted into
NL80211_ATTR_AKM_SUITES. Add rest of the AKM suites here. However, since
the current kernel interface has a very small limit
(NL80211_MAX_NR_AKM_SUITES = 2), add the attribute only when no more
than that limit entries are included. cfg80211 would reject the command
with any more entries listed.
This needs to be extended in cfg80211/nl80211 in a backwards compatible
manner, so this seems to be the best that can be done for now in user
space. Many drivers do not use this attribute, so must not reject the
configuration completely when larger number of AKM suites is configured.
Such cases may not work properly with drivers that depend on
NL80211_ATTR_AKM_SUITES value.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
SM Power Save was described in somewhat unclear manner in IEEE Std
802.11n-2009 as far the use of it locally in an AP to save power. That
was clarified in IEEE Std 802.11-2016 to allow only a non-AP STA to use
SMPS while the AP is required to support an associated STA doing so. The
AP itself cannot use SMPS locally and the HT Capability advertisement
for this is not appropriate.
Remove the parts of SMPS support that involve the AP using it locally.
In practice, this reverts the following commits:
04ee647d58 ("HT: Let the driver advertise its supported SMPS modes for AP mode")
8f461b50cf ("HT: Pass the smps_mode in AP parameters")
da1080d721 ("nl80211: Advertise and configure SMPS modes")
Signed-off-by: Jouni Malinen <j@w1.fi>
When external authentication is used, the station send mlme frame (auth)
to the driver may not be able to get the frequency (bss->freq) after
hostap.git commit b6f8b5a9 ("nl80211: Update freq only when CSA
completes"). Use the assoc_freq to send the MLME frame when SAE external
authentication is used to avoid this issue.
Signed-off-by: Ouden <Ouden.Biz@gmail.com>
This is the function that actually uses the parameters, so pass the full
parameter struct to it instead of hiding the struct from it in the
simple wrapper.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add indication for driver VLAN offload capability and configuration of
the VLAN ID to the driver.
Signed-off-by: Gurumoorthi Gnanasambandhan <gguru@codeaurora.org>
This makes it more convenient to add, remove, and modify the parameters
without always having to update every single driver_*.c implementation
of this callback function.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This is mainly for testing purposes to allow wpa_supplicant and hostapd
functionality to be tested both with and without using the nl80211
control port which is by default used whenever supported by the driver.
control_port=0 driver parameter will prevent that from happening.
Signed-off-by: Jouni Malinen <j@w1.fi>
In order to correctly encrypt rekeying frames, wpa_supplicant now checks
if a PTK is currently installed and sets the corresponding encrypt
option for tx_control_port().
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Linux kernel v4.17 added the ability to request sending controlled port
frames (e.g., IEEE 802.1X controlled port EAPOL frames) via nl80211
instead of a normal network socket. Doing this provides the device
driver with ordering information between the control port frames and the
installation of keys. This empowers it to avoid race conditions between,
for example, PTK replacement and the sending of frame 4 of the 4-way
rekeying handshake in an RSNA. The key difference between the specific
control port and normal socket send is that the device driver will
certainly get any EAPOL frames comprising a 4-way handshake before it
gets the key installation call for the derived key. By flushing its TX
buffers it can then ensure that no pending EAPOL frames are
inadvertently encrypted with a key that the peer will not yet have
installed.
Add a CONTROL_PORT flag to the hostap driver API to report driver
capability for using a separate control port for EAPOL frames. This
operation is exactly like an Ethernet send except for the extra ordering
information it provides for device drivers. The nl80211 driver is
updated to support this operation when the device reports support for
NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211. Also add a driver op
tx_control_port() for request a frame to be sent over the controlled
port.
Signed-off-by: Brendan Jackman <brendan.jackman@bluwireless.co.uk>
Since NL80211_CMD_FRAME does not allow encryption to be disabled for the
frame, add a monitor interface temporarily for cases where this type of
no-encrypt frames are to be sent. The temporary monitor interface is
removed immediately after sending the frame.
This is testing functionality (only in CONFIG_TESTING_OPTIONS=y builds)
that is used for PMF testing where the AP can use this to inject an
unprotected Robust Management frame (mainly, Deauthentication or
Disassociation frame) even in cases where PMF has been negotiated for
the association.
Signed-off-by: Jouni Malinen <j@w1.fi>
I saw a case where the kernel's cfg80211 rejected hostapd's attempt to
send a neighbor report response because nl80211 flagged the frame as
offchannel-OK, but kernel rejects because channel was 100 (DFS) and so
kernel failed thinking it was constrained by DFS/CAC requirements that
do not allow the operating channel to be left (at least in FCC).
Don't set the packet as off-channel OK if we are transmitting on the
current operating channel of an AP to avoid such issues with
transmission of Action frames.
Signed-off-by: Ben Greear <greearb@candelatech.com>
This is to match the NL80211_CMD_ACTION renaming to NL80211_CMD_FRAME
that happened long time ago. This command can be used with any IEEE
802.11 frame and it should not be implied to be limited to Action
frames.
Signed-off-by: Jouni Malinen <j@w1.fi>
Replace a separate cookie_out pointer argument with save_cookie boolean
since drv->send_action_cookie is the only longer term storage place for
the cookies. Merge all nl80211_send_frame_cmd() callers within
wpa_driver_nl80211_send_mlme() to use a single shared call to simplify
the function.
Signed-off-by: Jouni Malinen <j@w1.fi>
Merge this function into wpa_driver_nl80211_send_mlme() that is now the
only caller for the previously shared helper function. This is a step
towards cleaning up the overly complex code path for sending Management
frames.
Signed-off-by: Jouni Malinen <j@w1.fi>
All the previous users have now been converted to using send_mlme() so
this unused send_frame() callback can be removed.
Signed-off-by: Jouni Malinen <j@w1.fi>
This allows send_mlme() to be used to replace send_frame() for the test
cases where unencrypted Deauthentication/Disassociation frames need to
be sent out even when using PMF for the association. This is currently
supported only when monitor interface is used for AP mode management
frames.
Signed-off-by: Jouni Malinen <j@w1.fi>
Call nl80211_send_monitor() directly instead of going through
wpa_driver_nl80211_send_frame() for the case where monitor interface is
used for AP mode management purposes. drv->use_monitor has to be 1 in
this code path, so wpa_driver_nl80211_send_frame() was calling
nl80211_send_monitor() unconditionally for this code path and that extra
function call can be removed here to simplify the implementation.
Signed-off-by: Jouni Malinen <j@w1.fi>
Netlink dump message may be interrupted if an internal inconsistency is
detected in the kernel code. This can happen, e.g., if a Beacon frame
from the current AP is received while NL80211_CMD_GET_SCAN is used to
fetch scan results. Previously, such cases would end up not reporting an
error and that could result in processing partial data.
Modify this by detecting this special interruption case and converting
it to an error. For the NL80211_CMD_GET_SCAN, try again up to 10 times
to get the full response. For other commands (which are not yet known to
fail in similar manner frequently), report an error to the caller.
Signed-off-by: Jouni Malinen <j@w1.fi>
libnl functions return a library specific error value in libnl 2.0 and
newer. errno is not necessarily valid in all error cases and strerror()
for the returned value is not valid either.
Use nl_geterror() to get the correct error string from the returned
error code.
Signed-off-by: Jouni Malinen <j@w1.fi>
This simplifies code by not having to maintain and come up with new
backwards compatibility wrappers for a library release from 12 years
ago.
Signed-off-by: Jouni Malinen <j@w1.fi>
Add function that returns whether WoWLAN has been enabled for the device
or not.
Signed-off-by: Alfonso Sanchez-Beato <alfonso.sanchez-beato@canonical.com>
Normally nl80211 driver will attempt to strictly control what bridge
given interface is put in. It'll attempt to remove it from an existing
bridge if it doesn't match the configured one. If it's not in a bridge
it'll try to put it into one. If any of this fails then hostapd will
bail out and not set up the BSS at all.
Arguably that's reasonable since it allows to set the BSS up coherently
with regard to EAPOL handling as well as allows extra interactions with
things like FDB. However, not all hostapd drivers interact with bridge=
the same way. One example is atheros. Therefore it's not clear what the
desired behavior should be if consistency across drivers is considered.
There's a case where one might want to use a non-native Linux bridge,
e.g., openvswitch, in which case regular ioctls won't work to put an
interface into a bridge, or figure out what bridge an interface is in.
The underlying wireless driver can still be an ordinary nl80211 driver.
This change relaxes the bridge setup failure so that hostapd still
starts even if it fails to add an interface into a configured bridge
name. It still sets up all the necessary sockets (including the
configured bridge=) so EAPOL handling should work fine. This then leaves
it to the system integrator to manage wireless interface as bridge ports
and possibly fdb hints too.
Signed-off-by: Michal Kazior <michal@plume.com>
Clean up do_acs interface to not pass ch_list to drivers as the same
information is available in freq_list. The channel numbers are
duplicated between 2.4 GHz and 5 GHz bands and the 6 GHz band. So, use
the QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST to populate only 2.4 GHz and 5 GHz
channels to ensure backwards compatibility with old drivers which do not
have support to decode the newer QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST
attribute.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Addi STA node details in AP through QCA vendor subcommand
QCA_NL80211_VENDOR_SUBCMD_ADD_STA_NODE vendor when processing FT
protocol roaming.
Signed-off-by: Shiva Sankar Gajula <sgajula@codeaurora.org>
In the SME-in-driver case, wpa_supplicant used only the selected SAE
auth_alg value as the trigger for enabling external authentication
support for SAE. This prevented the driver from falling back to full SAE
authentication if PMKSA caching was attempted (Open auth_alg selected)
and the cached PMKID had been dropped.
Enable external auth based on SAE/FT-SAE key_mgmt, rather than doing
this based on SAE auth_alg, so that the driver can go through full SAE
authentication in cases where PMKSA caching is attempted and it fails.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
IEEE P802.11ay defines Enhanced Directional Multi-Gigabit (EDMG) STA and
AP which allow channel bonding of 2 channels and more.
nl80211 provides the driver's EDMG capabilities from the kernel
using two new attributes:
NL80211_BAND_ATTR_EDMG_CHANNELS - bitmap field that indicates the 2.16
GHz channel(s) that are supported by the driver.
NL80211_BAND_ATTR_EDMG_BW_CONFIG - represents the channel bandwidth
configurations supported by the driver.
The driver's EDMG capabilities are stored inside struct hostapd_hw_modes.
As part of the connect request and starting AP, EDMG parameters are
passed as part of struct hostapd_freq_params.
The EDMG parameters are sent to the kernel by using two new attributes:
NL80211_ATTR_WIPHY_EDMG_CHANNEL and NL80211_ATTR_WIPHY_EDMG_BW_CONFIG
which specify channel and bandwidth configuration for the driver to use.
This implementation is limited to CB2 (channel bonding of 2 channels)
and the bonded channels must be adjacent.
Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
Linux 2.6.32 (December 2009) introduced alternate netlink messages
for setting and installing keys, deprecating the older ones.
To allow hostapd/wpa_supplicant to use new features only provided via
the new API this patch migrates all netlink messages to the current ones.
Since the nl80211 driver was sometimes already using the new format this
is only unifying the netlink API usage and not changing the minimal
kernel requirement.
The following netlink attributes have been retired for key installs:
NL80211_ATTR_KEY_DATA
NL80211_ATTR_KEY_TYPE
NL80211_ATTR_KEY_SEQ
NL80211_ATTR_KEY_IDX
NL80211_ATTR_KEY_CIPHER
NL80211_ATTR_KEY_DEFAULT
NL80211_ATTR_KEY_DEFAULT_MGMT
NL80211_ATTR_KEY_DEFAULT_TYPES
And replaced by the following attributes nested in NL80211_ATTR_KEY:
NL80211_KEY_DATA
NL80211_KEY_TYPE
NL80211_KEY_SEQ
NL80211_KEY_IDX
NL80211_KEY_CIPHER
NL80211_KEY_DEFAULT
NL80211_KEY_DEFAULT_MGMT
NL80211_KEY_DEFAULT_TYPES
When getting Michael MIC failure notifications or querying a key
sequence number the kernel continues to use the old attributes:
NL80211_ATTR_KEY_TYPE
NL80211_ATTR_KEY_SEQ
NL80211_ATTR_KEY_IDX
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
This allows us to send the OBSS PD settings to the kernel, such that the
driver can propagate them to the hardware/firmware.
Signed-off-by: John Crispin <john@phrozen.org>
