Commit graph

17256 commits

Author SHA1 Message Date
Veerendranath Jakkam
c903257fb1 DSCP: Parse WFA Capabilities element in (Re)Association Response frame
Add support to parse WFA Capabilities element from the (Re)Association
Response frame. Also register a timeout for the station to wait before
sending a new DSCP query if requested by AP.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-09-29 17:18:48 +03:00
Veerendranath Jakkam
a4aae9f9b8 DSCP: Indicate DSCP Policy support in (Re)Association Request frame
Indicate DSCP Policy capability by including a WFA Capabilities element
containing the relevant bit set to 1 in the (Re)Association Request
frames when enabled by user.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-09-29 17:09:01 +03:00
Veerendranath Jakkam
d57456c1ff DSCP: Allow DSCP Policy Response Action frame to be sent
Add support to prepare and send DSCP response action frame to the
connected AP in response to a new control interface command DSCP_RESP.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-09-29 17:01:34 +03:00
Veerendranath Jakkam
2033e318e6 DSCP: Parsing and processing of DSCP Policy Request frames
Add support to parse received DSCP Policy Request frames and send the
request details as control interface events.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-09-29 00:20:42 +03:00
Veerendranath Jakkam
fe2a44485e DSCP: DSCP policy capability configuration
The DSCP policy capability is disabled by default. The user frameworks
which have support for handling DSCP policy request messages need to
enable this capability explicitly to allow wpa_supplicant to advertise
the capability to the AP and allow the related frames to be processed.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-09-28 11:07:21 +03:00
Jouni Malinen
8471d940e3 Move pmf_in_use() into a more generic file
This function is not specific to GAS, so make it available throughout
wpa_supplicant without requiring CONFIG_GAS.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-28 11:07:21 +03:00
Hu Wang
41ec97cd09 HE: Use a random BSS Color if not defined in the config file
Commit 0cb39f4fd5 ("HE: Extend BSS color support") sets the BSS Color
default value to 1 as "Interoperability testing showed that stations
will require a BSS color to be set even if the feature is disabled."

A new interop issue was observed with hardcoded BSS color value of 1:
- REF device using one interface (e.g., wlan0) to connect to an HE
  AP, whose BSS color is enabled and value is 1.
- REF device using another interface (e.g., p2p0) to connect to a
  P2P GO using BSS color default settings.
  (i.e., BSS color disabled and value is 1).
- REF device checks both AP's and P2P GO's BSS Color values even though
  GO's BSS color is disabled. This causes collision of the BSS
  color somehow causing RX problems.

For DUT as a P2P GO, its firmware uses default BSS color value 1 from
wpa_supplicant, then triggers a timer (e.g., 120 s) to update its BSS
color values based on its neighboring BSSes. To reduce the likelihood of
BSS color collision with REF device before that, use a random BSS Color
if not defined in the config file.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-28 11:04:08 +03:00
Sunil Dutt
1518638b70 QCA vendor command to configure the parameters for monitor mode
This new vendor command aims to indicate the driver to enable the
monitor mode for an interface on which this command is issued. Once
enabled, the frames (both TX and RX) on this interface are sent to an
active coexisting monitor interface.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-24 18:30:55 +03:00
Vikram Kandukuri
8f7b2c898d Add attributes to support MBSSID multi groups notifications
Add new attributes for supporting MBSSID multi groups notifications
to qca_wlan_vendor_attr_mbssid_tx_vdev_status
(QCA_NL80211_VENDOR_SUBCMD_MBSSID_TX_VDEV_STATUS).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-20 12:03:42 +03:00
Aleti Nageshwar Reddy
a75fdcdcd1 Extend the roam reason codes in QCA vendor attribute
Add new reason codes to the existing enum qca_roam_reason.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-09 18:43:53 +03:00
Aleti Nageshwar Reddy
9ff0c8af5c Correct the documentation in enum qca_roam_reason
QCA_ROAM_REASON_USER_TRIGGER was wrongly documented as
QCA_ROAM_REASON_EXPLICIT_REQUEST, so correct it.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-09 18:38:56 +03:00
Hu Wang
ce267f4da9 P2P: DFS offload for the autonomous GO
Enhance the P2P_GROUP_ADD command to support DFS channel with 80 and 160
MHz bandwidth to be used for autonomous GO when using offloaded DFS.

For example, 'P2P_GROUP_ADD freq=5500 max_oper_chwidth=80 ht40 vht'

- Previous behavior: AP fallback to channel 100 using 20 MHz with
  "No VHT higher bandwidth support for the selected channel 100"
- Enhanced behavior: AP starts on channel 100 using 80 MHz with
  "VHT center channel 106 for 80 or 80+80 MHz bandwidth"

This functionality is on top of the driver's capability to offload DFS,
which is advertized through WPA_DRIVER_FLAGS_DFS_OFFLOAD.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-07 17:40:25 +03:00
Vamsi Krishna
6ba665c5c3 Reserve QCA vendor sub command id 201
This is reserved for QCA use.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-03 21:46:15 +03:00
Aleti Nageshwar Reddy
51d73d9914 Add QCA vendor interface to configure background scan parameters
Add QCA vendor interface support for configuring background scan related
parameters to the driver/firmware.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-03 16:36:30 +03:00
Ben Wang
61c0757618 EDMG: Validate pri channel lookup result before using it
At least in theory, hw_get_channel_freq() could return NULL, so add
error handling for that.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-02 18:45:09 +03:00
Hu Wang
a95144cf34 Add frequency to operating class determination for 5 GHz channel 144
Commit 45c3e72952 ("Add frequency to operating class determination
for 5 GHz 100..140") extends ieee80211_freq_to_channel_ext() with
knowledge of the operating classes for the 5 GHz channels 100..140.

Per "Table E-4 - Global operating classes" in IEEE Std 802.11-2020, 5
GHz channel 144 also maps to same operating classes, so update hostapd
code to reflect the change.

This issue is found when OCV enabled and 4-way-handshake failed due
to client OCI includes op_class 0 for channel 144. This showed
up in following manner in the debug log:

WPA: OCI KDE in EAPOL-Key - hexdump(len=9): dd 07 00 0f ac 0d 00 90 00
Error interpreting OCI: unrecognized opclass/channel pair (0/144)

Signed-off-by: Hu Wang <huw@codeaurora.org>
2021-09-02 18:43:10 +03:00
Sreeramya Soratkal
e5173e8b12 P2P: Enable multiple channel widths for P2P in 6 GHz band
Enable support for P2P connection in 6 GHz with the channel width of 40
MHz, 80 MHz, and 160 MHz. The flag max_oper_chwidth is used to configure
the maximum channel width for P2P connection in 6 GHz with the commands
P2P_CONNECT, P2P_INVITE, and P2P_GROUP_ADD.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-09-02 18:41:12 +03:00
Sreeramya Soratkal
f725254cc1 P2P: Enhance determination of secondary offset to support 6 GHz channels
Current definition of wpas_p2p_get_ht40_mode() determines secondary
offset in the 5 GHz band. Enhance the functionality of this function to
determine offset to support 6 GHz channels also.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-09-02 18:19:33 +03:00
Sreeramya Soratkal
575a8e6ca3 P2P: Clone 6 GHz related parameters to new group interface config
Clone pmf and p2p_6ghz_disable configuration values when creating a new
P2P group interface. PMF is required in 6 GHz band operation.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-09-02 18:07:58 +03:00
Nirav Shah
f184337605 Add TWT attribute to send Responder PM Mode value to userspace
Add QCA_WLAN_VENDOR_ATTR_TWT_SETUP_RESPONDER_PM_MODE
TWT attribute to send Responder PM Mode value to userspace.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-01 23:56:00 +03:00
Yu Ouyang
11a3427757 Add time slice duty cycle attribute into QCA vendor command
Add a new attribute into qca_wlan_vendor_attr_ll_stats_results to
support getting interface time slicing duty cycle info.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-09-01 20:50:20 +03:00
Aditya Kodukula
d408e3d19a Update QCA mDNS Offload vendor command
Update kernel documentation of mDNS offload vendor command.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-08-31 22:55:08 +03:00
David Bauer
2341585c34 ACS: Fix channel 100 frequency
Channel 100 is a valid channel to choose for 80 MHz operation. However,
it was converted to 5500 MHz, not 5550 MHz, for the 80 MHz case while
the conversion to other bandwidths was done correctly. In fact, there is
no channel assigned to this frequency 5550 MHz.

Fix this obvious typo to allow ACS to select channel 100 for 80 MHz
operation again.

Fixes: bef5eee4f7 ("Convert channel to frequency based selection for AP mode ACS")
Signed-off-by: David Bauer <mail@david-bauer.net>
2021-08-26 16:10:26 +03:00
Cedric Izoard
ed369613f4 P2P: Align p2p_buf_add_pref_channel_list() prototype with definition
Align the p2p_buf_add_pref_channel_list() prototype and definition in
p2p_build.c and p2p_i.h. Use unsigned int over u32 as it is actully
called with an unsigned int parameter.

This removes compilation warning on platform where u32 != unsigned int.

Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2021-08-26 16:04:58 +03:00
Cedric Izoard
75a6d44a4a hostapd: Allow HT40 on 5 GHz channels 173 and 177
IEEE Std 802.11ax-2021 added channel 177 into global operating class 125
and consequently channel 173 in global operating class 126 (HT40+) and
channel 177 in global operating class 127 (HT40-).

Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2021-08-26 16:01:13 +03:00
Cedric Izoard
7dd2e23696 hostapd: Always allow HE AP with a 20 MHz channel width
Skip the test of HE PHY capability bit "Support for a 40 MHz and 80 MHz
channel width" when starting an AP with a 20 MHz channel on the 5 GHz
band.

Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2021-08-26 15:58:10 +03:00
Sreeramya Soratkal
9f2217c513 P2P: Consider p2p_no_go_freq for GO preferred frequency
Currently while selecting a preferred frequency when no preference is
known, p2p_no_go_freq is not considered for 5 GHz and 60 GHz channels.
This results in starting GO on the channels that are configured not to
allow the local device as GO.

Use wpas_p2p_supported_freq_go api to check if the p2p_no_go_freq
configuration before selecting the preferred frequency for GO.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-08-26 15:46:58 +03:00
Sreeramya Soratkal
882c53be50 P2P: Avoid integer overflow in channel
For some 6 GHz operating class like 134, there is a possibility where
the ch variable used for channel iterator overflows when it is
incremented. Fix this by updating the datatype of ch variable to
avoid integer overflow while incrementing.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-08-26 15:32:56 +03:00
Vinita S. Maloo
a58f7e61c1 Add QCA vendor interface to configure allowed bands for roaming
Add a QCA vendor attribute to configure the driver/firmware the allowed
bands for roaming by userpace. This attribute is also used to get the
configured roam bands from the driver.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-08-26 15:27:51 +03:00
Mathew Hodson
be81bbdc3b doc: Fix grammar in wpa_supplicant overview
Signed-off-by: Mathew Hodson <mathew.hodson@gmail.com>
2021-08-25 16:20:17 +03:00
Johannes Berg
fde38cac8a tests: test_fst_config: Convert FstLauncher to context manager
Using __del__ for any kind of cleanup is not a good idea
as it's not guaranteed to be called at any particular time,
it's only called whenever the next garbage collect cycle
kicks in.

Use a context manager instead, which basically removes the
need for the try/finally and fixes the reliance on __del__.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-08-25 16:20:17 +03:00
Johannes Berg
c8e2fc1fd5 tests: fst_test_common: Remove dead code from HapdRegCtrl
Since refcnt is never incremented, this is dead code, just remove it.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-08-25 16:20:17 +03:00
Cy Schubert
362d9a49d4 utils: FreeBSD supports fdatasync(2)
FreeBSD supports fdatasync(2). Enable it in os_unix.c.

Signed-off-by: Cy Schubert <cy@FreeBSD.org>
2021-08-25 16:20:17 +03:00
Ajay Singh
9bd9434108 nl80211: Fix send_mlme to use monitor interface only for AP interface
Use monitor interface to send_mlme only when the interface is configured
in AP mode. In multiple interface setup, one interface can be configured
in AP mode using monitor interface and another interface in station
mode. The station interface may also require sending the management
frames without using monitor interface, e.g., support external SAE
authentication to send Authentication frames without monitor interface.
This change allows sending management frames to the driver for a station
interface where the AP interface uses monitor interface.

Additionally, the monitor interface is only valid for AP mode
(nl80211_create_monitor_interface() is called in nl80211_setup_ap) so
interface type check ensures to use monitor interface only when required
by the specific interface.

Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Peter Reen <peter.reen@microchip.com>
2021-08-25 16:20:17 +03:00
Shay Bar
f02ac5140c HE: Option to disable HE ER SU in HE operation in AP mode
Add option to disable 242-tone HE ER SU PPDU reception by the AP
in HE operation IE.

Signed-off-by: Shay Bar <shay.bar@celeno.com>
2021-08-25 12:45:14 +03:00
Gokul Sivakumar
63f043f4fd Generalize the function name as it is not dealing with only TX & RX params
For the function hostapd_get_sta_tx_rx(), the name
hostapd_get_sta_info() is more appropriate as it is also responsible for
getting many other STA specific params like RSSI, inactive milliseconds
along with TX and RX bytes.

Signed-off-by: Gokul Sivakumar <gokulkumar792@gmail.com>
2021-08-25 12:27:17 +03:00
Jouni Malinen
0cc9d7fb12 tests: connected_time for mesh peer
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-08-25 12:26:30 +03:00
Gokul Sivakumar
3cdc6d381a mesh: Show peer connected time in the wpa_cli STA cmd output for Mesh mode
When a Mesh interface is managed by wpa_supplicant, include the peer
link connected time (secs) in the output of "sta <addr>", "all_sta"
wpa_cli cmds for each peer. This will be helpful to find when the peer
link connection got established. The NL80211_STA_INFO_CONNECTED_TIME
netlink attribute data is used for this purpose if available.

$ wpa_cli -i mesh0 all_sta
02:00:00:00:02:00
flags=[ASSOC][WMM][HT]
aid=1
capability=0x0
listen_interval=0
supported_rates=82 84 8b 96 8c 12 98 24 b0 48 60 6c
timeout_next=NULLFUNC POLL
rx_packets=77
tx_packets=3
rx_bytes=8510
tx_bytes=284
inactive_msec=104
signal=-30
rx_rate_info=65 mcs 0
tx_rate_info=65 mcs 0
ht_mcs_bitmask=ffff0000000000000000
connected_time=24
ht_caps_info=0x103c

The connected_time field in the output of "hostapd_cli -i ap0 all_sta"
cmd is not affected and it will continue to show the connected time
maintained by hostapd for each STA.

Signed-off-by: Gokul Sivakumar <gokulkumar792@gmail.com>
2021-08-25 12:26:25 +03:00
Masashi Honma
eddcd27534 Fix some compiler warnings on 32 bit platform
../src/ap/ieee802_11.c: In function ‘pasn_wd_handle_sae_commit’:
../src/ap/ieee802_11.c:2401:60: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
   wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%lu",
                                                          ~~^
                                                          %u
       buf_len);
       ~~~~~~~
../src/ap/ieee802_11.c: In function ‘pasn_wd_handle_sae_confirm’:
../src/ap/ieee802_11.c:2477:60: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
   wpa_printf(MSG_DEBUG, "PASN: SAE buffer too short. len=%lu",
                                                          ~~^
                                                          %u
       buf_len);
       ~~~~~~~
../src/ap/ieee802_11.c: In function ‘pasn_wd_handle_fils’:
../src/ap/ieee802_11.c:2707:62: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
   wpa_printf(MSG_DEBUG, "PASN: FILS: Buffer too short. len=%lu",
                                                            ~~^
                                                            %u
       buf_len);
       ~~~~~~~

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2021-08-25 12:03:02 +03:00
Masashi Honma
4c80937c7f nl80211: Reduce the number of nlctrl name resolution calls
The number of nlctrl name resolution calls required to connect to a
WPA2-PSK AP is 12. And each nlctrl name resolution call spends 55 micro
seconds on a lower spec CPU like Intel Atom N270. Reduce the number of
nctrl name resolution calls from 12 to 1 by caching the results of nctrl
name resolution calls on int size memory to speed up the connection
process a little bit.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2021-08-25 12:01:06 +03:00
Jouni Malinen
2bbc5a2b09 tests: wpa_supplicant config blobs and PEM encoding
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-08-19 17:41:13 +03:00
Wolfgang Steinwender
cce33c7e7a openssl: Support private_key blob in PEM encoded PKCS#8 format
Try to parse the private_key blob as private key in PEM format encoded
PKCS#8. PEM format is already supported for private_key file and is now
also supported for private_key blob.

Signed-off-by: Wolfgang Steinwender <wsteinwender@pcs.com>
2021-08-19 17:40:58 +03:00
Andrew Beltrano
0030590fb3 Generate an event when a network is added or removed
Generate an event on the control socket interface when a network is
added or removed. The event name CTRL-EVENT-NETWORK-<ADDED|REMOVED>
is followed by the network entry identifier. The event matches the
corresponding Network<Added|Removed> signal on the d-bus interface.

Signed-off-by: Andrew Beltrano <anbeltra@microsoft.com>
2021-08-19 17:21:06 +03:00
Nick Porter
f238610616 Add a --conf option to eapol_test.py
The --conf option specifies a file containing a list of options
to configure the network used for running the test which will be
used in place of the defaults built into the script.

Signed-off-by: Nick Porter <nick@portercomputing.co.uk>
2021-08-19 16:58:45 +03:00
Michael Braun
99c1789ab1 PASN: Fix ASAN error in ptksa_cache_add()
==19798==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110000663f8 at pc 0x55a2c485a232 bp 0x7ffeb42dcaf0 sp 0x7ffeb42dcae0
READ of size 8 at 0x6110000663f8 thread T0
Connect STA wlan0 to AP
    #0 0x55a2c485a231 in ptksa_cache_add ../src/common/ptksa_cache.c:310
    #1 0x55a2c4398045 in hostapd_store_ptksa ../src/ap/wpa_auth_glue.c:943
    #2 0x55a2c4430980 in wpa_auth_store_ptksa ../src/ap/wpa_auth.c:232
    #3 0x55a2c44578e1 in sm_WPA_PTK_PTKINITDONE_Enter ../src/ap/wpa_auth.c:3650
    #4 0x55a2c44578e1 in sm_WPA_PTK_Step ../src/ap/wpa_auth.c:3798
    #5 0x55a2c44578e1 in wpa_sm_step ../src/ap/wpa_auth.c:4437
    #6 0x55a2c445d99d in wpa_receive ../src/ap/wpa_auth.c:1411
    #7 0x55a2c43e7747 in ieee802_1x_receive ../src/ap/ieee802_1x.c:1118
    #8 0x55a2c43bbf73 in hostapd_event_eapol_rx ../src/ap/drv_callbacks.c:1542
    #9 0x55a2c43bbf73 in wpa_supplicant_event ../src/ap/drv_callbacks.c:1932
    #10 0x55a2c466cb2d in drv_event_eapol_rx ../src/drivers/driver.h:6074
    #11 0x55a2c466cb2d in nl80211_control_port_frame ../src/drivers/driver_nl80211_event.c:2822
    #12 0x55a2c466cb2d in process_bss_event ../src/drivers/driver_nl80211_event.c:3194
    #13 0x7feed9e90b9b in nl_cb_call ./include/netlink-private/netlink.h:145
    #14 0x7feed9e90b9b in recvmsgs ./lib/nl.c:1006
    #15 0x7feed9e90b9b in nl_recvmsgs_report ./lib/nl.c:1057
    #16 0x7feed9e91058 in nl_recvmsgs ./lib/nl.c:1081
    #17 0x55a2c45f2e8c in wpa_driver_nl80211_event_receive ../src/drivers/driver_nl80211.c:1782
    #18 0x55a2c44b9afa in eloop_sock_table_dispatch ../src/utils/eloop.c:603
    #19 0x55a2c44be122 in eloop_run ../src/utils/eloop.c:1228
    #20 0x55a2c43360bf in hostapd_global_run /home/mbr/hostapd/hostapd/main.c:451
    #21 0x55a2c43360bf in main /home/mbr/hostapd/hostapd/main.c:898
    #22 0x7feed8ce20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #23 0x55a2c432f3fd in _start (/home/mbr/hostapd/hostapd/hostapd+0x9f23fd)

0x6110000663f8 is located 184 bytes inside of 216-byte region [0x611000066340,0x611000066418)
freed by thread T0 here:
    #0 0x7feeda1477cf in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x55a2c44ce56b in os_free ../src/utils/os_unix.c:773
    #2 0x55a2c451a986 in radius_msg_free ../src/radius/radius.c:137
    #3 0x55a2c4527104 in radius_client_msg_free ../src/radius/radius_client.c:261
    #4 0x55a2c452f53c in radius_client_list_add ../src/radius/radius_client.c:715
    #5 0x55a2c452f53c in radius_client_send ../src/radius/radius_client.c:807
    #6 0x55a2c453b24c in accounting_sta_report ../src/ap/accounting.c:352
    #7 0x55a2c453d6e9 in accounting_sta_stop ../src/ap/accounting.c:384
    #8 0x55a2c44190fd in ap_free_sta ../src/ap/sta_info.c:194
    #9 0x55a2c4934530 in handle_deauth ../src/ap/ieee802_11.c:6035
    #10 0x55a2c4934530 in ieee802_11_mgmt ../src/ap/ieee802_11.c:6399
    #11 0x55a2c43bf114 in hostapd_mgmt_rx ../src/ap/drv_callbacks.c:1468
    #12 0x55a2c43bf114 in wpa_supplicant_event ../src/ap/drv_callbacks.c:1912
    #13 0x55a2c465faf7 in mlme_event_mgmt ../src/drivers/driver_nl80211_event.c:823
    #14 0x55a2c4661774 in mlme_event ../src/drivers/driver_nl80211_event.c:1135
    #15 0x55a2c466c43b in process_bss_event ../src/drivers/driver_nl80211_event.c:3177
    #16 0x7feed9e90b9b in nl_cb_call ./include/netlink-private/netlink.h:145
    #17 0x7feed9e90b9b in recvmsgs ./lib/nl.c:1006
    #18 0x7feed9e90b9b in nl_recvmsgs_report ./lib/nl.c:1057

previously allocated by thread T0 here:
    #0 0x7feeda147bc8 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x55a2c44cd387 in os_malloc ../src/utils/os_unix.c:715
    #2 0x55a2c44ceb7f in os_zalloc ../src/utils/os_unix.c:779
    #3 0x55a2c451a9f2 in radius_msg_new ../src/radius/radius.c:109
    #4 0x55a2c4539a6e in accounting_msg ../src/ap/accounting.c:46
    #5 0x55a2c453be15 in accounting_report_state ../src/ap/accounting.c:439
    #6 0x55a2c453d91d in accounting_init ../src/ap/accounting.c:534
    #7 0x55a2c4378952 in hostapd_setup_bss ../src/ap/hostapd.c:1333
    #8 0x55a2c4382530 in hostapd_setup_interface_complete_sync ../src/ap/hostapd.c:2094
    #9 0x55a2c4382815 in hostapd_setup_interface_complete ../src/ap/hostapd.c:2229
    #10 0x55a2c4384100 in setup_interface2 ../src/ap/hostapd.c:1726
    #11 0x55a2c4386b58 in setup_interface ../src/ap/hostapd.c:1628
    #12 0x55a2c4386b58 in hostapd_setup_interface ../src/ap/hostapd.c:2318
    #13 0x55a2c4387a57 in hostapd_enable_iface ../src/ap/hostapd.c:2730
    #14 0x55a2c455d723 in hostapd_ctrl_iface_enable /home/mbr/hostapd/hostapd/ctrl_iface.c:1606
    #15 0x55a2c455d723 in hostapd_ctrl_iface_receive_process /home/mbr/hostapd/hostapd/ctrl_iface.c:3607
    #16 0x55a2c456821e in hostapd_ctrl_iface_receive /home/mbr/hostapd/hostapd/ctrl_iface.c:4018
    #17 0x55a2c44b9afa in eloop_sock_table_dispatch ../src/utils/eloop.c:603
    #18 0x55a2c44be122 in eloop_run ../src/utils/eloop.c:1228
    #19 0x55a2c43360bf in hostapd_global_run /home/mbr/hostapd/hostapd/main.c:451
    #20 0x55a2c43360bf in main /home/mbr/hostapd/hostapd/main.c:898
    #21 0x7feed8ce20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free ../src/common/ptksa_cache.c:310 in ptksa_cache_add
Shadow bytes around the buggy address:
  0x0c2280004c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2280004c30: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2280004c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2280004c50: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa
  0x0c2280004c60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c2280004c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c2280004c80: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2280004c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2280004ca0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c2280004cb0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2280004cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==19798==ABORTING

Fixes: a4e3691616 ("WPA: Add PTKSA cache implementation")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2021-08-19 16:51:20 +03:00
Jouni Malinen
af89683a43 tests: Update RSA 3k certificates
The previous ones expired and caused test failures.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-08-19 13:57:53 +03:00
Davide Caratti
e2e9adc3d9 openssl: Disable padding after initializing the cipher suite
according to OpenSSL documentation [1], EVP_CIPHER_CTX_set_padding()
should be called after EVP_EncryptInit_ex(), EVP_DecryptInit_ex(), or
EVP_CipherInit_ex(). Not doing this causes EVP_CIPHER_CTX_set_padding()
to return false on OpenSSL-3.0.0, resulting in the impossibility to
connect in many scenarios. Fix this changing the order of function calls
where needed.

[1] https://www.openssl.org/docs/man1.1.1/man3/EVP_CIPHER_CTX_set_padding.html

Reported-by: Vladimir Benes <vbenes@redhat.com>
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
2021-08-19 12:13:17 +03:00
Davide Caratti
d265dd2d96 openssl: Remove deprecated functions from des_encrypt()
NetworkManager-CI detected systematic failures on test scenarios using
MSCHAPv2 when wpa_supplicant uses OpenSSL-3.0.0.
The 'test_module_tests.py' script also fails, and the following log is
shown:

 1627404013.761569: generate_nt_response failed
 1627404013.761582: ms_funcs: 1 error

It seems that either DES_set_key() or DES_ecb_encrypt() changed their
semantic, but it doesn't make sense to fix them since their use has been
deprecated. Converting des_encrypt() to avoid use of deprecated
functions proved to fix the problem, and removed a couple of build
warnings at the same time.

Reported-by: Vladimir Benes <vbenes@redhat.com>
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
2021-08-19 12:10:33 +03:00
Arowa Suliman
46b60299a4 wpa_supplicant: src: Replace Sane with Valid.
Replace the word Sane with Valid which is inclusive.

Signed-off-by: Arowa Suliman <arowa@chromium.org>
2021-08-19 11:34:45 +03:00
Joshua Emele
12388313a0 RADIUS client: Fix void-pointer-to-enum-cast warning
Found using x86_64-cros-linux-gnu-clang (Chromium OS
12.0_pre416183_p20210305-r3 clang version 12.0.0):

radius_client.c:818:24: warning: cast to smaller integer ...
        RadiusType msg_type = (RadiusType) sock_ctx;

Signed-off-by: Joshua Emele <jemele@chromium.org>
2021-08-19 11:19:37 +03:00