Using D-Bus, it is possible to add a valid UPnP service where 'query'
and 'response' are specified. In this case, memory for 'query' and
'response' is allocated but not used nor freed. Valgrind complains as
follows:
42 bytes in 1 blocks are definitely lost in loss record 32 of 75
at 0x484C214: calloc (vg_replace_malloc.c:1675)
by 0x41C673: wpabuf_alloc (wpabuf.c:124)
by 0x41C673: wpabuf_alloc_copy (wpabuf.c:162)
by 0x54F41A: wpas_dbus_handler_p2p_add_service (dbus_new_handlers_p2p.c:2762)
by 0x53B9A2: msg_method_handler (dbus_new_helpers.c:356)
by 0x53B9A2: message_handler (dbus_new_helpers.c:412)
by 0x4EAB4B8: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.19.13)
by 0x5495DF: dispatch_data (dbus_common.c:37)
by 0x5495DF: process_watch (dbus_common.c:73)
by 0x5495DF: process_watch_read (dbus_common.c:89)
by 0x41EE8E: eloop_sock_table_dispatch.part.0 (eloop.c:603)
by 0x41FA46: eloop_sock_table_dispatch (eloop.c:597)
by 0x41FA46: eloop_run (eloop.c:1233)
by 0x56A3CE: wpa_supplicant_run (wpa_supplicant.c:8074)
by 0x40DB06: main (main.c:393)
49 bytes in 1 blocks are definitely lost in loss record 37 of 75
at 0x484C214: calloc (vg_replace_malloc.c:1675)
by 0x41C673: wpabuf_alloc (wpabuf.c:124)
by 0x41C673: wpabuf_alloc_copy (wpabuf.c:162)
by 0x54F348: wpas_dbus_handler_p2p_add_service (dbus_new_handlers_p2p.c:2755)
by 0x53B9A2: msg_method_handler (dbus_new_helpers.c:356)
by 0x53B9A2: message_handler (dbus_new_helpers.c:412)
by 0x4EAB4B8: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.19.13)
by 0x5495DF: dispatch_data (dbus_common.c:37)
by 0x5495DF: process_watch (dbus_common.c:73)
by 0x5495DF: process_watch_read (dbus_common.c:89)
by 0x41EE8E: eloop_sock_table_dispatch.part.0 (eloop.c:603)
by 0x41FA46: eloop_sock_table_dispatch (eloop.c:597)
by 0x41FA46: eloop_run (eloop.c:1233)
by 0x56A3CE: wpa_supplicant_run (wpa_supplicant.c:8074)
by 0x40DB06: main (main.c:393)
Fix this ensuring that query and resp are freed both in the error and
non-error path of wpas_dbus_handler_p2p_add_service(). Also, add a test
in test_dbus.py to verify the correct behavior.
Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
SignalChange should be defined as a property of an interface.
Previously, it was incorrectly defined as a property of P2P peers.
Fixes: 7a7ce95746 ("dbus: Emit more information over D-Bus")
Signed-off-by: David Ruth <druth@chromium.org>
In the hostapd_cleanup_driver() function, the NULL check for the driver
private data (drv_priv) is located within the CONFIG_IEEE80211BE feature
flag. As a result, on platforms where CONFIG_IEEE80211BE is not defined,
driver->hapd_deinit(drv_priv) is called with drv_priv set to NULL. This
leads to a null pointer exception in wpa_driver_nl80211_deinit().
To address this issue, move the NULL check for drv_priv outside the
CONFIG_IEEE80211BE build flag. This ensures that the check is performed
regardless of the value of CONFIG_IEEE80211BE, preventing the NULL
pointer exception.
Fixes: df34c2ced3 ("AP MLD: De-initialize/disable link BSS properly")
Signed-off-by: Sunil Ravi <sunilravi@google.com>
Currently wpa_ft_parse_ies() is setting FTE information to wpa_buf
pointer data which is generated after defragmentation. This data will
not contain FTE and Fragment element(s) headers.
IEEE P802.11be/D5.0 describes the MIC to be calculated on the
concatenation of FTE and corresponding Fragment element(s) which
implies the element headers are included for each element in the
fragmented case.
Fix this by correctly populating FTE information when FTE is
fragmented.
Fixes: 43b5f11d9 ("Defragmentation of FTE")
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Non-AP MLD finds AP MLD's partner links by BSSID from the scan results.
However, if the scan results contain BSSs with the same BSSID but
different BSS information, the non-AP MLD might assign a wrong BSS to
one of the AP MLD's partner links.
Avoids the problem by using both BSSID and SSID to find the AP MLD's
partner links.
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
During CSA with DFS channels, disable, enable interface is a part of the
algorithm. When interface was enabled old operating class before switch
and new channel were used causing mismatch in
configured_fixed_chan_to_freq() function.
Example of log when switch from channel 157 to 108 was triggered:
"Could not convert op_class 124 channel 108 to operating frequency"
Fixes: bb781c763 ("AP: Populate iface->freq before starting AP")
Signed-off-by: Marek Kwaczynski <marek@mazekey.pl>
When multi_ap is active, hostapd creates an AP-VLAN interface for 4addr
stations, even though wds_sta is not configured.
A check should be added to determine if wds_sta is active before
re-enabling the WDS mode by creating an AP-VLAN for 4addr stations.
Signed-off-by: Baligh Gasmi <gasmibal@gmail.com>
Going through five extra rounds of SAE commit messages in cases where
SAE peers are somehow unsynchronized feels unnecessary much to do by
default, so drop the default value to 3.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Reduce the number of unwanted SAE commit retries in synchronization
error cases when Sync > dot11RSNASAESync in mesh cases by discarding
received SAE commit messages for 10 seconds after a sync error has been
detected.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
I've run into a case where I can bring a 2.4 GHz AP up without it being
in a bridge while I used the 'bridge=' config option. This happens when
the HT scan needed for 40 MHz operation failed to start from the get go
because another dev on the same phy was already in a scan. At the end
the AP is up and running but not added into any bridge.
Upon looking at the code, it seems that some hardware fails to issue a
scan while in AP and thus we have a fallback that switches the interface
from AP to STA before retrying another scan (it will change it back to
AP later on when finished). As we cannot have a (non-WDS) STA in a
bridge, during that procedure, we also remove/add the AP/STA from/to the
bridge as needed.
However, in wpa_driver_nl80211_scan() we do not set
drv->ap_scan_as_station until the end of the switch-to-sta &
retry-scan-start block. This means that when the recursive call to
wpa_driver_nl80211_scan() fails (the hardware is busy in my case) we
restore the interface to AP with wpa_driver_nl80211_set_mode() but that
will not add it back to the bridge. Problem.
To fix this lets always set drv->ap_scan_as_station before calling
wpa_driver_nl80211_set_mode(). In case wpa_driver_nl80211_set_mode() or
wpa_driver_nl80211_scan() fails lets call nl80211_restore_ap_mode() that
will set the mode back to AP but also handle the bridge thing as needed.
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
The USD passive subscriber and solicited transmission only publisher
require receiving multicast NAN action frames in order to work.
Currently, we are not requesting to receive multicast when
registering NAN action frames. As a result, USD passive subscribe or
solicited only publish may not work.
The NL80211_ATTR_RECEIVE_MULTICAST attribute corresponds to wiphy
ext feature NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS, which
requires driver support and only a few drivers in the kernel tree
support it. Namely ath9k, ath9k_htc, ath10k and hwsim. We should
fall back to register non multicast action frames if the driver
has no support.
It was confirmed that ath9k_htc starts to work after the changes.
Note that even without requesting to receive multicast Action
frames, some drivers would still upload them. For example, rtl8192cu
and hwsim. This is why test cases like test_nan_usd_match would not
fail.
Tested-on: TP-LINK TL-WN821N v3(AR7010+AR9287, ath9k_htc)
Signed-off-by: Chien Wong <m@xv97.com>
The Wi-Fi Aware Specification v4.0 only defines unsolicited
transmissions only, solicited transmissions only and both unsolicited
and solicited transmissions publish. The other possibility is undefined
so we should reject it.
Signed-off-by: Chien Wong <m@xv97.com>
The 'req_instance' parameter in transmit command should be
'req_instance_id'.
Fixes: e3f9ab3c3a ("NAN: USD in wpa_supplicant")
Signed-off-by: Chien Wong <m@xv97.com>
When the first link is deleted and there are still remaining links,
drv->ctx should be updated to the new default link on the bss.
Otherwise, drv->ctx points to the address that has already been freed
and makes hostapd crash.
Fixes: d2b62b3fe5 ("AP MLD: Support link removal before removing interface")
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
Clear scan results at the beginning of the test case to avoid incorrect
behavior if there are multiple entries for the same BSS. In addition,
use a bit longer wait for receiving an updated Beacon frame in scan
results.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Instead of checking the latest scan results every second indefinitely,
add more latency between the checks in case the driver does not update
the time stamp value (i.e., does not report new Beacon frames during an
association).
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
In the case that the AP MLD is disabled and enabled again, flush
the wpa_supplicant BSS table before reconnecting as otherwise
the previous AP MLD BSSs would be in the BSS table and the wpa_supplicant
would try to connect to them.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Using just sta_find() won't work for any link addresses
but the assoc link, use sta_find_mlo() instead.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
The test assumes that STA will try to reconnect with the same SAE group
after the first authentication attempt is rejected due to unsupported
group. Since this behaviour is fixed in the previous patch, configure
two different groups to trigger the second authentication attempt.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Make sure that sme_set_sae_group() doesn't select a group that was
previously rejected during this instance of SAE authentication.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
SAE rejected groups were not cleared in case of re-association to the
same ESS. Since new BSS can support different groups, keeping rejected
groups doesn't make sense and may result in AP rejecting the
authentication. Fix it.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Currently, when the ACS is updating the puncturing bitmap, the function
acs_update_puncturing_bitmap() sets the primary channel bitmap to 0.
This leads to a potential issue where the primary channel could be
punctured if ACS selects a different best channel within the same
segment.
To fix this issue, ensure that the primary channel bitmap is correctly
set by calculating the index of the primary channel based on the
frequency difference between the current channel and the best channel in
the segment, and is then passed to acs_update_puncturing_bitmap().
Fixes: af0f60e7dd ("EHT: Calculate puncturing bitmap for ACS")
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
The current ACS algorithm incorrectly returns success even when there is
no survey list, leading to improper interference factor calculation.
This leads to treating 0 as a valid interference factor, which affects
channel selection judgment.
Fix the issue by ensuring success is only returned when the survey list
is not empty, thereby ignoring non-zero values in the interference
factor calculation.
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
Update the documentation to reflect the ACS algorithm used in the code.
No functionality change.
Signed-off-by: Hari Naraayana Desikan Kannan <quic_hnaraaya@quicinc.com>
While TKIP should not really be used at all anymore and is not allowed
for WPA3 (which is required for Wi-Fi 7), there are some deployed APs
that allow WPA2 PSK to be used with MLO and even allowing WPA+WPA2 mode
with TKIP as the group cipher). IEEE P802.11be/D5.0 does not seem to
explicitly disallow this combination, so handle the MLO GTK KDE key
processing similarly to the way GTK KDE is processed, i.e., including
swapping of Michael MIC Tx and Rx keys for TKIP.
This fixes issues with Michael MIC failures if TKIP is used as a group
cipher for a multi-link association.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
hostapd_cli chan_switch command fails in 2.4 GHz band for HE and EHT
modes if the user does not explicitly specify 'ht' option in the
command.
For example:
"hostapd_cli -i wlan2 chan_switch 10 2412 sec_channel_offset=0 \
center_freq1=2412 bandwidth=20 blocktx he"
Fix this by enabling HT by default if HE is enabled in the 2.4 GHz and 5
GHz bands. Similarly, enable VHT by default when HE is enabled in the 5
GHz band.
Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
When the wiphy supports multiple bands and reports different capability
values between 5 GHz and 6 GHz channels, the 6 GHz mesh interface is
unable to correctly map the channel width in function
ibss_mesh_setup_freq(). This issue arises because the modes of 5 GHz and
6 GHz interfaces are the same (HOSTAPD_MODE_IEEE80211A) in supported
modes.
To address this, use function get_mode() to determine the appropriate
mode during mesh setup. This will iterates through all the hw_features
sets and ensures compatibility with the band of the channel supported in
hw_features set.
Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
If SSID was not verified during the initial setup of an association, but
beacon protection was negotiated, try verify the SSID based on Beacon
frames that have been received after the first BIGTK has been
configured.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a variant of wpa_bss_get_ie() to allow IEs to be checked from
only Beacon frames similarly to how wpa_bss_get_vendor_ie_beacon()
behaves for vendor specific elements.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
The new "bigtk_set=1" entry in the control interface STATUS command
output indicates that a BIGTK has been successfully configured. This
shows that beacon protection has been enabled for the current
association.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Add a new "ssid_verified=1" entry into the control interface STATUS
command output if the SSID has been verified for the current
association. This verification may have been done implicitly (e.g., with
SAE H2E and FT protocol binding in the SSID into key derivation or with
FILS protecting the SSID element in the (Re)Association Request frame)
or explicitly with the recently added SSID protection mechanism during
the 4-way handshake.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
On the AP responder side, KDK was derived if the driver advertises
WPA_DRIVER_FLAGS2_SEC_LTF_AP. That is not correct, i.e., this needs to
also depend on the initiator indicating support for this in the RSNXE of
PASN authentication frame 1.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
In case the scan request handling fails, exit cleanly, i.e., without
setting internal state such as the 'scan_res_handler' pointer.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
wpa_supplicant will generally never allocate a memory block of that
size. We can therefore assume that it belongs to ASAN and we need to
ignore it.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The matching code currently only tests whether the prefix of a function
matches. Make this more strict by ensuring that the function name is not
longer.
However, as this breaks some tests (due to inlining), add the ability to
do an explicit prefix match by appending a '*' to the function name. Use
this to change the eap_eke_prf match to eap_eke_prf_* in order to match
one of the actual implementations.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The functions specified by the user might be longer than the function in
the backtrace, potentially overflowing the memcmp(). In practice, it
should not be a relevant out-of-memory read. However, we can use
strncmp() instead.
Note that, as before, this is only a prefix match. If a function name is
longer in the backtrace it will still match.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
It seems that sha256_prf may not always be in the stack trace for
failure checking, possibly due to tail call optimization as it simply
calls sha256_prf_bits with updated parameters. Simply match against
sha256_prf_bits directly to avoid issues due to optimizations.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The wpas_p2p_nfc_handover failure test and the more specific
wps_build_nfc_handover_req_p2p were effectively the same as the matching
currently does a prefix match. The code-path tested in these two cases
only hit a single TEST_FAIL macro in openssl_digest_vector.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The test here is triggering the allocation failure in the static
wpa_config_parse_password() helper. Use this and decrease the count
instead of matching both wpa_config_set_quoted() and wpa_config_set()
and counting down based on that.
This is in preparation to fix the failure function matching to not do a
prefix match.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The test expects rsn_pmkid_suite_b_192() to fail but specified only
rsn_pmkid_suite_b without the _192 postfix. Add the postfix so that the
function matching can be fixed later.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
If the kck_len is 0 then the pointer may be NULL. If that happens UBSAN
complains about the NULL pointer as memcpy() has the arguments declared
to never be NULL even if the copied number of bytes were zero.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
The consumer of the link_bssid array assumes it is a NULL terminated
array of BSSIDs. As such, add one to the maximum number of links to
ensure that there is always a sentinel value.
Fixes: 5af986c75a ("MLD: Also mark links as failed after association failure")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
