Commit graph

819 commits

Author SHA1 Message Date
Jouni Malinen
fcac668faa WPS: Use a dummy WSC_ACK as WLANEvent as the initial event if needed
UPnP device architecture specification requires all evented variables to
be included in the initial event message after subscription. Since this
can happen before we have seen any events, generated a dummy event
(WSC_ACK with all-zeros nonces) if needed.
2009-11-15 01:11:28 +02:00
Jouni Malinen
44577e4c2e WPS: Send SSDP byebye notifications when stopping UPnP advertisements
This will notify control points of the services going away and allows
them to notice this without having to wait timeout on the
initial advertisements.
2009-11-15 00:46:58 +02:00
Jouni Malinen
d806a5588e WPS: Remove derivation of management keys
MgmtAuthKey and MgmtEncKey were not used for anything and are unlikely
to ever be used, so better remove the code to reduce binary size.
2009-11-14 14:18:15 +02:00
Jouni Malinen
00785aba71 WPS: Remove unused WFA WLANConfig Service actions
This removes following WFA WLANConfig Service actions and the related
state variables: GetAPSettings, SetAPSettings, DelAPSettings,
GetSTASettings, SetSTASettings, DelSTASettings, RebootAP,
ResetAP, RebootSTA, ResetSTA.

While WFA WLANConfig Service version 1.0 claims that some of these are
mandatory to implement for an AP, there are no known implementations
supporting these actions neither in an AP/proxy or an External Registrar
that would use them. These are unlikely to be supported in the future
either and as such, it is just simpler to get rid of them to clean up
the implementation and reduce code size.
2009-11-14 14:08:58 +02:00
Jouni Malinen
7ec2e26ddf WPS ER: Fix Op-Code for WSC_{ACK,NACK,Done}
When using UPnP transport, the Op-Code is not included, but the WPS
frame processing will need this. Generate a matching Op-Code based
on the message type.
2009-11-13 22:40:27 +02:00
Jouni Malinen
ed835e539b WPS: Fix AP to proxy WSC_NACK to ER 2009-11-13 22:40:07 +02:00
Jouni Malinen
04f5d74077 WPS: Fix OpCode when proxying WSC_ACK or WSC_NACK from ER
Previously, WSC_MSG was hardcoded for every message from ER, but
this needs to be changed based on message type to send a valid
message to the Enrollee via EAP transport.
2009-11-13 22:29:31 +02:00
Jouni Malinen
72df2f5fc6 WPS ER: Add PIN configuration and SetSelectedRegistrar call
New PINs can now be added to WPS ER. This results in the ER code
using SetSelectedRegistrar to modify AP state so that Enrollees
will be able to notice the actice registrar more easily.
2009-11-13 22:07:11 +02:00
Jouni Malinen
d64d9ddf6c WPS: Fix http_link_update() to nul terminate the result 2009-11-13 22:05:11 +02:00
Jouni Malinen
ecc6d04b89 WPS ER: Add PutWLANResponse generation and transmission
This allows the M2D message to be transmitted as a response to the
Enrollee via the proxying AP.
2009-11-12 01:24:50 +02:00
Jouni Malinen
b345031997 WPS ER: Add STA/Enrollee entries and start processing EAP messages
This keeps STA/Enrollee entries up to date and sets up registration
protocol session. M1 is processed and M2D generated, but the there
is no code yet to transmit the response back to the AP with
PutWLANResponse.
2009-11-11 23:50:17 +02:00
Felix Fietkau
6980c19127 hostapd: fix AP mode initialization for nl80211
Always bring down the wlan interface, even when not changing the
BSSID, the interface also needs to be down for changing its type
from managed to AP mode.
2009-11-11 16:47:01 +02:00
Jouni Malinen
dc6d9ac250 WPS ER: Parse WLANEvent notifications and send HTTP response
The receive Probe Request and EAP-WSC notifications are now parsed
(including the TLVs in them) and contents is shown in the debug log.
Actual processing of the received information is still missing (TODO
comments indicate the needed functionality).
2009-11-11 00:23:22 +02:00
Jouni Malinen
feae037c25 driver_prism54: Use os_zalloc instead of malloc to clear memory
This will make sure the full buffer is initialized even if some
fields were not explicitly set.
2009-11-10 17:08:33 +02:00
Jouni Malinen
6689218ec7 Fix comparison to use correct symbol name (__rand vs. rand)
rand would be the address of rand() function and never NULL. The previous
version could have crashed on invalid AKA-AUTS command. Though, these
commands are only from hostapd which sends valid requests and as such,
the actual issue did not show up.
2009-11-10 16:51:59 +02:00
Jouni Malinen
69856fadf7 Add wpa_msg_ctrl() for ctrl_interface-only messages
This is like wpa_msg(), but the output is directed only to
ctrl_interface listeners. In other words, the output will not be
shown on stdout or in syslog.

Change scan result reporting to use wpa_msg_ctrl() for
CTRL-EVENT-SCAN-RESULTS message at info level and wpa_printf() at
debug level to avoid showing scan result events in syslog in the
common configuration used with NetworkManager.
2009-11-10 15:59:41 +02:00
Jouni Malinen
efa6481438 WPS: Fixed printf size_t warning on 32-bit builds 2009-11-10 11:30:11 +02:00
Jouni Malinen
097c7b3723 WPS ER: Subscribe to UPnP events
This adds code to start a HTTP server and to subscribe to UPnP events
from each discovered WPS AP. The event messages are received, but there
is not yet any code to actually parse the contents of the event.
2009-11-09 20:01:50 +02:00
Jouni Malinen
875a4e5936 WPS: Read HTTP request within HTTP server code
This removes HTTP related code from wps_upnp_web.c and makes it easier
to use HTTP server functionality for new uses (e.g., WPS ER).
2009-11-08 22:33:34 +02:00
Jouni Malinen
b905c4a398 WPS: Add HTTP server module
Clean up code so that UPnP implementation does not need to include all
the HTTP functionality. In addition, make it easier to share HTTP server
functionality with other components in the future.
2009-11-08 17:26:55 +02:00
Jouni Malinen
585774f28a WPS ER: Fetch and parse device description 2009-11-08 16:46:03 +02:00
Jouni Malinen
0b40d03394 WPS: Move generic UPnP XML helper functionality into a separate file 2009-11-08 14:06:01 +02:00
Jouni Malinen
092794f480 WPS: Add HTTP client module to clean up code
Instead of implementing HTTP client functionality inside
wps_upnp_event.c, use a generic HTTP client module to do this. The HTTP
client code can now be shared more easily for other purposes, too.
2009-11-08 12:35:37 +02:00
Jouni Malinen
b02ee4a228 WPS: Mark functions static
These functions are used only within wps_upnp_event.c.
2009-11-07 17:04:19 +02:00
Jouni Malinen
e9bcfebfce WPS: Add initial part of External Registrar functionality
This is the first step in adding support for using wpa_supplicant as a
WPS External Registrar to manage APs over UPnP. Only the device
discovery part is implemented in this commit.
2009-11-07 12:41:01 +02:00
Jouni Malinen
08eb154db5 Fix MCS set field to be based on driver info
Instead of using hardcoded Rx MCS bitmask (indexes 0..15 enabled),
use the real information from the driver capabilities.
2009-11-05 12:38:47 +02:00
Jouni Malinen
5a641ae01e Use type-punning to avoid breaking strict aliasing rules
While the actual use here would be unlikely to be broken by any C
optimization, it is better to use explicit union construction to let
gcc know about the aliasing and avoid warnings from gcc 4.4.
2009-11-05 12:11:49 +02:00
Jouni Malinen
0ae7b08691 Work around some gcc 4.4 strict-aliasing warnings
gcc 4.4 ends up generating strict-aliasing warnings about some very common
networking socket uses that do not really result in a real problem and
cannot be easily avoided with union-based type-punning due to struct
definitions including another struct in system header files. To avoid having
to fully disable strict-aliasing warnings, provide a mechanism to hide the
typecast from aliasing for now. A cleaner solution will hopefully be found
in the future to handle these cases.
2009-11-04 19:49:14 +02:00
Jouni Malinen
eb999fefcb Add Xcode project file for building wpa_supplicant 2009-11-02 19:37:46 +02:00
Andriy Tkachuk
72ffc08242 WPS: SelectedRegistrar expiration for internal PIN registrar
Though we have such a timeout when handling SetSelectedRegistrar UPnP
message from an external registrar, it looks like we don't have one when
the internal registrar is activated for PIN connection. Thus we set the
SelectedRegistrar flag when AP is activated for PIN connection but we
never reset it - not by some timeout, nor when registration succeeds.
This lead to situations where AP everlastingly declare that it is
activated for WPS PIN connection when in reality it is not.

Use the same timeout (and also success with PIN) to clear the selected
registrar flag when using internal registrar, too.
2009-11-01 22:19:02 +02:00
Jouni Malinen
2e71444516 WPS: Abort ongoing PBC protocol run if session overlap is detected
If PBC session overlap is detected during an ongoing PBC protocol run,
reject the run (if M8, i.e., credentials, have not yet been sent). This
provides a bit longer monitoring time at the Registrar for PBC mode to
catch some cases where two Enrollees in PBC mode try to enroll
credentials at about the same time.
2009-11-01 21:59:30 +02:00
Oleg Kravtsov
63330c6832 WPS: Add PBC overlap and timeout events from WPS module
This provides information about PBC mode result from the WPS Registrar
module. This could be used, e.g., to provide a user notification on the
AP UI on PBC failures.
2009-11-01 21:26:13 +02:00
Jouni Malinen
7e3a67514f WPS: Use Config Error 12 to indicate PBC overlap in M2D
If PBC session overlap is detected between button press on the registrar
and M1 is reception, report session overlap with the Config Error
attribute in M2D to the Enrollee.
2009-11-01 20:57:36 +02:00
Jouni Malinen
e5fc45d7ae Fix dbus build without EAP 2009-10-22 11:11:53 -07:00
Jouni Malinen
08d38568df Move shared MD5/SHA-1 internal definitions into header files 2009-10-17 12:55:12 +03:00
Jouni Malinen
1e8c857abe Move shared DES definitions into a header file 2009-10-17 12:53:27 +03:00
Jouni Malinen
f1739bac4f Move PKCS# {1,5,8} functionality into separate files
This functionality fits better with src/tls (i.e., internal TLS
implementation), so move it there to make crypto_internal.c more
of a wrapper like other crypto_*.c files.
2009-10-17 12:48:55 +03:00
Jouni Malinen
3af9f2983c TLS: Replace set_key helpers to return key instead of status code
The status code was not being used anyway, so it is simpler to
just return the key as is done in crypto functions.
2009-10-17 12:15:46 +03:00
Jouni Malinen
3f4ed97a70 Add support for PKCS #5 encrypted PKCS #8 keys with internal crypto
Private keys can now be used in either unencrypted or encrypted
PKCS #8 encoding. Only the pbeWithMD5AndDES-CBC algorithm (PKCS #5)
is currently supported.
2009-10-17 12:06:36 +03:00
Jouni Malinen
506b45ed22 Add DES-CBC support into internal crypto implementation 2009-10-17 12:05:06 +03:00
Jouni Malinen
8ef74414fc Internal TLS: Add support for unencrypred PKCS#8 private keys in PEM
Recognize the PEM header "BEGIN PRIVATE KEY" as base64-decode the data
to be able to use PEM encoded, unencrypted PKCS#8 private keys with the
internal TLS implementation. Previously, only DER encoding of the
PKCS#8 private key was supported.
2009-10-16 22:00:45 +03:00
Jouni Malinen
43fb529750 Add AP mode WPA status into ctrl_iface 2009-10-16 18:35:45 +03:00
Jouni Malinen
20bd9547a1 Add ctrl_iface events for AP mode STA connect/disconnect
These are used to notify ctrl_iface monitors when a STA completes
connection (the port becomes authorized) and when a STA disconnects.
2009-10-16 17:51:49 +03:00
Jouni Malinen
278da1b52a openssl: Allow build with OpenSSL 0.9.7
OpenSSL 0.9.7 does not include get_rfc3526_prime_1536() function, so
provide that functionality internally if needed. In addition, make
sha256_vector() building depend on whether SHA256 support is included
in the OpenSSL library. This with CONFIG_INTERNAL_SHA256=y in .config
allows OpenSSL without SHA256 support to be used.
2009-10-16 15:57:17 +03:00
Jouni Malinen
d8130bdf13 openssl: Mark openssl_digest_vector() static 2009-10-16 15:54:52 +03:00
Masashi Honma
9b336bcef0 DragonFly BSD: Fix driver_bsd.c build
Both hostapd/wpa_supplicant compilation fails on DragonFly BSD.

This patch solves this issue.

I have tested only compilation. Not functionality.
Because I don't have any device which can work on DragonFly BSD.
2009-10-12 09:56:57 +03:00
Jouni Malinen
6d6f4bb87f nl80211: Work around mac80211 limitation on (re)auth when authenticated
mac80211 does not currently allow (re)authentication when we are already
authenticated. In order to work around this, force deauthentication if
nl80211 authentication command fails with EALREADY. Unfortunately, the
workaround code in driver_nl80211.c alone is not enough since the
following disconnection event would clear wpa_supplicant authentication
state. To handle this, add some code to restore authentication state
when using userspace SME.

This workaround will hopefully become unnecessary in some point should
mac80211 start accepting new authentication requests even when in
authenticated state.
2009-10-12 09:39:55 +03:00
Jouni Malinen
34c9910dc7 Fix EAP-AKA server build without EAP-SIM 2009-10-11 22:23:05 +03:00
Jouni Malinen
38b462868c Clean up crypto makefile segments
Reorganize the TLS/crypto library segments into a single set of blocks
for each library instead of multiple locations handling library-specific
operations. Group crypto functionality together and get wpa_supplicant
and hostapd Makefile closer to eachother in order to make it easier to
eventually move this into a shared makefile.
2009-10-11 22:04:29 +03:00
Jouni Malinen
f042122a57 Allow the internal DH implementation to be overridden
Crypto library wrappers can now override the internal DH (group 5)
implementation. As a starting point, this is done with OpenSSL. The
new mechanism is currently available only for WPS (i.e., IKEv2 still
depends on the internal DH implementation).
2009-10-11 19:17:22 +03:00
Jouni Malinen
dd01b1ff9d Include only the used DH groups in the build
This reduces the binary size by 3 kB or so when WPS is included in
the build, but IKEv2 is not.
2009-10-11 15:24:40 +03:00
Jouni Malinen
b3ad11bb80 nl80211: Add parsing of NL80211_BSS_SEEN_MS_AGO into scan results 2009-10-01 17:53:22 +03:00
Jouni Malinen
d942a79e6a nl80211: Recognize NL80211_CMD_TRIGGER_SCAN events
Replace "nl80211: Ignored unknown event (cmd=33)" with
"nl80211: Scan trigger" to make debug output clearer. We do not
currently do anything with this event apart from showing it in
the debug log.
2009-10-01 13:58:17 +03:00
Jouni Malinen
ebf214e670 NSS: Implement TLS PRF using new TLS extractor interface
This allows NSS to be used to derive EAP-TLS/PEAP/TTLS keying material.
NSS requires a patch from
https://bugzilla.mozilla.org/show_bug.cgi?id=507359
to provide the new API. In addition, that patch needs to be modified to
add the 16-bit context length value in SSL_ExportKeyingMaterial() only if
contextlen != 0 in order to match with the EAP-TLS/PEAP/TTLS use cases.
This issue seems to be coming from the unfortunate incompatibility in
draft-ietf-tls-extractor-07.txt (draft-ietf-tls-extractor-00.txt would
have used compatible PRF construction).

At this point, it is unclear how this will be resolved eventually, but
anyway, this shows a mechanism that can be used to implement EAP key
derivation with NSS with a small patch to NSS.
2009-09-30 20:12:32 +03:00
Author: Johannes Berg
1c766b094a nl80211: Fix a typo in set_sta_vlan()
The VLAN interface index needs to use NL80211_ATTR_STA_VLAN. It was
adding a duplicate NL80211_ATTR_IFINDEX.
2009-09-30 19:23:52 +03:00
Jouni Malinen
289ffc2b61 Add preliminary version of NSS TLS/crypto wrapper for wpa_supplicant
This brings in the first step in adding support for using NSS
(Mozilla Network Security Services) as the crypto and TLS library
with wpa_supplicant. This version is able to run through EAP-PEAP
and EAP-TTLS authentication, but does not yet implement any
certificate/private key configuration. In addition, this does not
implement proper key fetching functions either, so the end result
is not really of much use in real world yet.
2009-09-29 01:21:09 +03:00
Masashi Honma
f335c69e14 DragonFly BSD: Fix wired IEEE 802.1X
On DragonFly BSD, wired IEEE 802.1X fails with this message:
ioctl[SIOC{ADD/DEL}MULTI]: Invalid argument

This patch solves this issue.

I have tested with these:
OS : DragonFly BSD 2.4.0
EAP : EAP-TLS
Switch : Cisco Catalyst 2950
2009-09-28 16:10:02 +03:00
Masashi Honma
40e107c129 Mac OS X: Fix wired IEEE 802.1X 2009-09-26 19:29:03 +03:00
Jouni Malinen
2aa5f84709 nl80211: Use defines for NL80211_KEY_CIPHER values 2009-09-15 11:23:48 +03:00
Jouni Malinen
d723bab4b3 Revert "nl80211: Share the same routine for NL80211_ATTR_KEY_CIPHER setup"
This reverts commit 5aa9cb5cca.

The nested key attribute is using different attribute values
(NL80211_KEY_* vs. NL80211_ATTR_KEY_*), so cannot share the same routine
for these purposes..
2009-09-15 11:21:25 +03:00
Jouni Malinen
5aa9cb5cca nl80211: Share the same routine for NL80211_ATTR_KEY_CIPHER setup 2009-09-15 10:54:41 +03:00
Johannes Berg
0194fedb46 driver_nl80211: Fix MLME key settings for static WEP
Current wpa_supplicant has a bug with WEP keys, it adds a zero-length
sequence counter field to netlink which the kernel doesn't accept.

Additionally, the kernel API slightly changed to accept keys only when
connected, so we need to send it the keys after that. For that to work
with shared key authentication, we also include the default WEP TX key
in the authentication command.

To upload the keys properly _after_ associating, add a new flag
WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE indicating that the driver
needs the keys at that point and not earlier.
2009-09-15 10:48:30 +03:00
Jouni Malinen
611ed49118 Add parsed information from WPS IE(s) into scan results
This makes it easier for external programs to show WPS information
since they do not need to parse the WPS IE themselves anymore.
2009-09-11 17:14:49 +03:00
Jouni Malinen
e9a2bca6f5 WPS: Add parsing of AP Setup Locked attribute 2009-09-11 17:13:59 +03:00
Jouni Malinen
6e4f461270 Fix driver_test for hostapd
Commit 0b55b934ee broke this by not
initializing drv->ap = 1 in hostapd case since the mode updating
code ended up unlinking the socket file. Setting drv->ap = 1
removes the mode change and as such, unlinking of the socket file.
2009-09-11 16:45:34 +03:00
Jouni Malinen
abad3ccb1e Convert WPS IE concat routine to a generic helper
This may also be needed in wpa_supplicant and potentially for other
IE types, too.
2009-09-11 16:36:59 +03:00
Jouni Malinen
630a843f59 driver_test: Update BSS data when using wpa_supplicant AP mode 2009-09-11 00:22:35 +03:00
Jouni Malinen
0b55b934ee driver_test: Implement set_mode for wpa_supplicant AP deinit 2009-09-11 00:17:35 +03:00
Jouni Malinen
86e9f093a0 driver_test: Preliminary support for wpa_supplicant AP functionality 2009-09-10 17:41:29 +03:00
Jouni Malinen
5d5b99ecd3 driver_test: Share the same deinit() for hostapd and wpa_supplicant 2009-09-10 17:03:51 +03:00
Jouni Malinen
c6f726748d driver_test: Merge socket_dir into test_dir 2009-09-10 16:52:03 +03:00
Jouni Malinen
5ae8964079 driver_test: Some additional merging of send_mlme 2009-09-10 16:48:10 +03:00
Jouni Malinen
133032e7bd driver_test: Claim AP mode capability for wpa_supplicant 2009-09-10 16:30:35 +03:00
Jouni Malinen
ac48db0f2b driver_test: Build most of code in unconditionally
It is simpler to just build in all the test driver code regardless
of whether this is for hostapd or wpa_supplicant (which will eventually
get AP mode support with driver_test, too).
2009-09-10 16:28:47 +03:00
Jouni Malinen
41aeddf99a driver_test: Merge wpa_supplicant and hostapd data structures
There is no real need to keep these in separate data structures with
different names.
2009-09-10 16:18:04 +03:00
Alex Badea
7598210b79 radius_server: clean up completed sessions sooner
radius_server_encapsulate_eap() resets sess->eap->if->eap{Success,Fail}
to FALSE, such that the completion condition is never true.

The net effect is that completed sessions would linger for
RADIUS_SESSION_TIMEOUT seconds.

Signed-off-by: Alex Badea <vamposdecampos@gmail.com>

Previously, the default settings allowed 100 sessions in 60 seconds.
With this fix, the default limit is now 100 sessions per 10 seconds.
[Bug 329]
2009-09-09 23:54:03 +03:00
Jouni Malinen
2678509dec WPS: Store device info and make it available through AP ctrl_iface
Store a copy of device attributes during WPS protocol run and make it
available for external programs via the control interface STA MIB
command for associated stations. This gives access to device name and
type which can be useful when showing user information about associated
stations.
2009-09-07 22:09:13 +03:00
Jouni Malinen
52eb293dd2 WPS: Add support for AP reconfiguration with wps_reg
wpa_supplicant can now reconfigure the AP by acting as an External
Registrar with the wps_reg command. Previously, this was only used
to fetch the current AP settings, but now the wps_reg command has
optional arguments which can be used to provide the new AP
configuration. When the new parameters are set, the WPS protocol run
is allowed to continue through M8 to reconfigure the AP instead of
stopping at M7.
2009-09-06 13:58:15 +03:00
Jouni Malinen
7da2c5276d nl80211: Ignore connect/roam/disconnect events when using SME
Getting double association/disassociation events can get core code
confused, so better filter out the extra events.
2009-09-04 16:39:41 +03:00
Zhu Yi
cfaab58007 nl80211: Connect API support
If the driver does not support separate authentication and association
steps, use the connect API instead.
2009-09-03 21:31:29 +03:00
Zhu Yi
da72a1c1ae nl80211: Add connect/disconnect event processing 2009-09-03 20:39:59 +03:00
Zhu Yi
93d1140077 nl80211: Check whether the driver support separate auth/assoc commands
This is an initial step in adding support for the new connect command.
For now, we just add the capability query. The actual use of the new
command will be added separately.
2009-09-03 20:36:09 +03:00
Zhu Yi
8d6ca17813 nl80211: Use defines for cipher suite selectors 2009-09-03 20:21:18 +03:00
Masashi Honma
80cc6bf6d0 OpenBSD: wired IEEE 802.1X for OpenBSD
This is a patch for OpenBSD wired IEEE 802.1X. This is only for wired,
not wireless, because OpenBSD uses wpa_supplicant only on wired now.

http://www.openbsd.org/cgi-bin/cvsweb/ports/security/wpa_supplicant/

I have tested with these.
OS : OpenBSD 4.5
EAP : EAP-TLS
Switch : CentreCOM 8724SL
2009-08-26 23:40:51 +03:00
Masashi Honma
fe23eb5696 WPS: Aggregate deinit calls in WPS OOB
In WPS OOB, deinit_func() is called from 3 locations.
This patch aggregates these to one.
2009-08-26 23:34:54 +03:00
Witold Sowa
3a57305f10 Fix a bug with ap_rx_from_unknown_sta() recursion
ap_rx_from_unknown_sta was going into infinite recursion,
or could even crash because of corrupted pointer cast.
2009-08-26 20:18:24 +03:00
Jouni Malinen
335ce76b1c nl80211: Use two sockets to avoid mixing command replies with events
Previously, both the command replies and unsolicited events were
received from the same socket. This could cause problems if an event
message is received between a command and the response to that command.
Using two sockets avoids this issue.
2009-08-26 12:10:50 +03:00
Jouni Malinen
5cd89c26f9 Disable PMTU discovery for RADIUS packets (sent them without DF)
When Linux has Path MTU discovery enabled, it sets by default the DF bit
on all outgoing datagrams, also UDP ones. If a RADIUS message is bigger
than the smallest MTU size to the target, it will be discarded.

This effectively limits RADIUS messages to ~ 1500 Bytes, while they can
be up to 4k according to RFC2865. In practice, this can mean trouble
when doing EAP-TLS with many RADIUS attributes besides the EAP-Message.
[Bug 326]
2009-08-23 21:32:27 +03:00
Stefan Winter
a2fbf12524 Disable PMTU discovery for RADIUS packets (sent them without DF)
When Linux has Path MTU discovery enabled, it sets by default the DF bit
on all outgoing datagrams, also UDP ones. If a RADIUS message is bigger
than the smallest MTU size to the target, it will be discarded.

This effectively limits RADIUS messages to ~ 1500 Bytes, while they can
be up to 4k according to RFC2865. In practice, this can mean trouble
when doing EAP-TLS with many RADIUS attributes besides the EAP-Message.
[Bug 326]
2009-08-23 21:21:25 +03:00
Jouni Malinen
ad469aecc1 Reject X.509 certificate strings with embedded NUL characters
These could, at least in theory, be used to generate unexpected common
name or subject alternative name matches should a CA sign strings with
NUL (C string termination) in them. For now, just reject the certificate
if an embedded NUL is detected. In theory, all the comparison routines
could be made to compare these strings as binary blobs (with additional
X.509 rules to handle some exceptions) and display NUL characters
somehow. Anyway, just rejecting the certificate will get rid of
potential problems with the C string getting terminated and it should
not really be used in certificates, so this should not break valid use
cases.
2009-08-23 21:00:38 +03:00
Jouni Malinen
9932c17fc8 Sync with linux/nl80211.h from wireless-testing.git 2009-08-18 11:33:40 +03:00
Jouni Malinen
1ba787b954 Remove unneeded aes_i.h inclusion from number of places
The BLOCK_SIZE define can be made more specific by using AES_ prefix and
by moving it to aes.h. After this, most aes-*.c do not really need to
include anything from the internal aes_i.h header file. In other words,
aes_i.h can now be used only for the code that uses the internal AES
block operation implementation and none of the code that can use AES
implementation from an external library do not need to include this
header file.
2009-08-17 20:27:25 +03:00
Jouni Malinen
04b6b3ed51 Verify that EAPOL-Key MIC generation succeeds
This can now fail, e.g., if trying to use TKIP in FIPS mode.
2009-08-16 22:35:15 +03:00
Jouni Malinen
7a215dfc2b Verify that RC4 operation succeeds 2009-08-16 22:28:40 +03:00
Jouni Malinen
108f9dd49b Fix crypto_cipher_init() EVP initialization
Better not specify EVP_CIPHER again for the second init call since that
will override key length with the default value. The previous version
was likely to work since most use cases would be likely to use the
default key length. Anyway, better make this handle variable length
ciphers (mainly, RC4), too, just in case it is needed in the future.
2009-08-16 22:26:59 +03:00
Jouni Malinen
7cba52d852 Use OpenSSL for RC4 instead of internal implementation 2009-08-16 22:26:13 +03:00
Jouni Malinen
ac73690c06 Move RC4 into crypto.h as a replaceable crypto function
This allows crypto library wrappers to override the internal RC4
implementation in the same way as can already be done for other crypto
algorithms.
2009-08-16 20:13:14 +03:00
Jouni Malinen
8ef1683115 Remove rc4() wrapper
This is not really of that much use since rc4_skip() can be used as
easily. In addition, rc4 has caused some symbol conflicts in the past,
so it is easier to live without that as an exported symbol.
2009-08-16 19:57:50 +03:00
Jouni Malinen
1d5ed36e7c Fix build with non-FIPS capable OpenSSL 2009-08-16 19:56:33 +03:00
Jouni Malinen
c5f6ad5766 Verify CHAP/MSCHAPv2 return code
Check the return code in some (but not yet all) places where the
functions from ms_funcs.c are used.
2009-08-16 19:07:57 +03:00
Jouni Malinen
ff916b9df7 Allow non-FIPS MD5 to be used with TLS PRF even in FIPS mode
This is allowed per FIPS1402IG.pdf since the TLS PRF depends fully on
both MD5 and SHA-1.
2009-08-16 18:56:48 +03:00
Jouni Malinen
be299ca4ce Pass digest return value to CHAP/MSCHAPv2 caller 2009-08-16 18:38:35 +03:00
Jouni Malinen
76f04b38b0 Preliminary support for FIPS mode operation with OpenSSL
wpa_supplicant can now be built with FIPS capable OpenSSL for FIPS mode
operation. Currently, this is only enabling the FIPS mode in OpenSSL
without providing any higher level enforcement in wpa_supplicant.
Consequently, invalid configuration will fail during the authentication
run. Proper configuration (e.g., WPA2-Enterprise with EAP-TLS) allows
the connection to be completed.
2009-08-16 14:24:22 +03:00
Jouni Malinen
6d503f67e3 Pass error values from digest calls to ms_funcs callers
These function calls can now fail, so better let the caller know if that
happened.
2009-08-16 14:18:59 +03:00
Jouni Malinen
1430ba9b7e OpenSSL: Use library version of SHA256
There is no need to use the internal SHA256 implementation when using
OpenSSL.
2009-08-16 14:15:36 +03:00
Jouni Malinen
4b77bf2a40 OpenSSL: Use EVP_Digest*() functions
Instead of using low level, digest-specific functions, use the generic
EVP interface for digest functions. In addition, report OpenSSL errors
in more detail.
2009-08-16 14:12:06 +03:00
Jouni Malinen
0a5d68aba5 Make hash functions return error value
Some crypto libraries can return in these functions (e.g., if a specific
hash function is disabled), so we better provide the caller a chance to
check whether the call failed. The return values are not yet used
anywhere, but they will be needed for future changes.
2009-08-16 14:06:00 +03:00
Jouni Malinen
e1ffdfc18b Enable SHA256 digest support in OpenSSL
This is needed to allow X.509 certificates with SHA256 digest to be
used. [Bug 323]
2009-08-16 10:25:13 +03:00
Jouni Malinen
1b8409a0a5 Support PEM format RSA private key with internal TLS implementation 2009-08-16 09:34:21 +03:00
Masashi Honma
d43430d43d NetBSD: Fix wired IEEE 802.1X problem
On NetBSD 5.0, when I use wired 802.1X, "Invalid argument" occurs
on SIOCADDMULTI ioctl and 802.1X fails.

I tried FreeBSD code, but "Address family not supported by protocol family"
occurs on SIOCADDMULTI ioctl and 802.1X fails, too.

This patch solves this issue.

I have tested with these:
OS : NetBSD 5.0
EAP : EAP-MD5
Switch : CentreCOM 8724SL
2009-08-15 20:59:16 +03:00
Jouni Malinen
ba30964b60 Force rebuilding of src/drivers between hostapd and wpa_supplicant
This is a (hopefully) temporary workaround to allow the same source code
tree to be used for building hostapd and wpa_supplicant without having
to manually force recompilation of some files. Currently, some of the
driver wrapper files need to be built separately for hostapd and
wpa_supplicant (#ifdef's in the files based on AP functionality).

This is somewhat racy as far as parallel make execution is concerned,
i.e., it may be necessary to run "make -j#" twice (plain "make" works
fine. Since this is supposed to be a temporary workaround, there is not
much point in trying to fix this with any more complex make processing.
2009-08-14 20:40:37 +03:00
Johannes Berg
e7cd16cac5 Create a common drivers makefile snippet
Instead of having all driver stuff collected across wpa_supplicant
and hostapd, create a common snippet that they both include and
that handles the build configuration.
2009-08-14 19:53:27 +03:00
Jouni Malinen
6b23b70445 Avoid a theoretical integer overflow in base64_encode()
If base64_encode() were to be used with a huge data array, the
previous version could have resulted in overwriting the allocated
buffer due to an integer overflow as pointed out in
http://www.freebsd.org/cgi/query-pr.cgi?pr=137484. However, there
are no know use cases in hostapd or wpa_supplicant that would do that.
Anyway, the recommended change looks reasonable and provides additional
protection should the base64_encode() function be used for something
else in the future.
2009-08-13 16:36:41 +03:00
Johannes Berg
4c9e03e0b2 Crypto build cleanup: remove CONFIG_NO_AES_*
Instead of using a defines and conditional building of AES parts,
move the conditional functionality into separate files.
2009-08-13 11:40:28 +03:00
Johannes Berg
6b5c4c3359 Remove some more crypto ifdef, fix a few small bugs 2009-08-13 11:28:03 +03:00
Johannes Berg
27da6d4a0e Crypto build cleanup: remove CONFIG_NO_AES_ENCRYPT
Instead of using a define and conditional building of AES parts,
move the AES encryption routines into a separate file.
2009-08-13 11:21:32 +03:00
Johannes Berg
381fcbc9f4 Crypto build cleanup: remove CONFIG_NO_AES_DECRYPT
Instead of using a define and conditional building of AES parts,
move the AES decryption routines into a separate file.
2009-08-13 11:16:21 +03:00
Johannes Berg
18abe7acb0 Crypto build cleanup: remove CONFIG_NO_PBKDF2
Instead of using a define and conditional building of sha1.c parts,
move the PBKDF2 implementation into a separate file.
2009-08-11 20:31:39 +03:00
Johannes Berg
d9feab18fc Crypto build cleanup: remove CONFIG_NO_TLS_PRF
Instead of using a define and conditional building of sha1.c parts,
move the TLS PRF implementation into a separate file.
2009-08-11 20:24:06 +03:00
Johannes Berg
6f693b5d0b Crypto build cleanup: remove CONFIG_NO_T_PRF
Instead of using a define and conditional building of sha1.c parts,
move the T-PRF implementation into a separate file.
2009-08-11 20:19:37 +03:00
Johannes Berg
05edfe2994 Crypto build cleanup: remove NEED_FIPS186_2_PRF
Instead of using a define and conditional building of crypto wrapper
parts, move the FIPS 186-2 PRF implementation into separate files.
2009-08-11 20:06:23 +03:00
Johannes Berg
ad01a5315e Crypto build cleanup: remove INTERNAL_MD5
Instead of using a define and conditional building of md5.c parts,
move the internal-MD5 into a separate file.
2009-07-28 21:36:13 +03:00
Johannes Berg
bd4e28950d Crypto build cleanup: remove INTERNAL_MD4
In addition, rename md4.c to md4-internal.c to match in style with
SHA-1 conditionally built internal implementation.
2009-07-28 21:27:02 +03:00
Johannes Berg
598a792d8c Crypto build cleanup: remove INTERNAL_SHA256
Instead of using a define and conditional building of sha256.c parts,
move the internal-SHA256 into a separate file.
2009-07-28 21:20:04 +03:00
Johannes Berg
246157cba6 Crypto build cleanup: remove INTERNAL_AES
In addition, rename aes.c to aes-internal.c to match in style with
SHA-1 conditionally built internal implementation.
2009-07-28 21:09:57 +03:00
Johannes Berg
657f038102 Crypto build cleanup: remove INTERNAL_DES
In addition, rename des.c to des-internal.c to match in style with
SHA-1 conditionally built internal implementation.
2009-07-28 21:00:44 +03:00
Johannes Berg
928a50a355 Crypto build cleanup: remove INTERNAL_SHA1
Instead of using a define and conditional building of sha1.c parts,
move the internal-SHA-1 into a separate file.
2009-07-28 20:47:04 +03:00
Johannes Berg
849ef835a7 nl80211: Fix WEP key configuration
Current wpa_supplicant has a bug with WEP keys, it adds a zero-length
sequence counter field to netlink which the kernel doesn't accept.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
2009-07-26 21:22:55 +03:00
Johannes Berg
7a47d567cf hostapd: fix auth encryption
hostapd currently tries to encrypt all auth frames,
except for "OPEN" and "SHARED with transaction 3".
This means that it will send an encrypted "unknown
auth algorithm" reply for all other algorithsm. Fix
this by changing the logic to only encrypt shared
key auth frames with transaction 3.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
2009-07-26 21:15:47 +03:00
Jon Loeliger
2e8eac2d67 Allow wpa_supplicant to use libnl-2.0
Change existing CONFIG_LIBNL20 compatibility code in
driver_nl80211.c to be used by both wpa_supplicant
and hostapd, but take care of nl_handle too now.

Propagate CONFIG_LIBNL20 out of .config file and onto
CFLAGS in the Makefile.

Use libnl-gen now too.

Signed-off-by: Jon Loeliger <jdl@bigfootnetworks.com>
---
2009-07-25 17:21:52 +03:00
Ryuji
1c5a1aa51c Fix EAP-TNC peer memory leak on an error path 2009-06-30 19:39:13 +03:00
Jouni Malinen
064bb8232c Add root .gitignore file to cleanup ignore lists
This removes need for local configuration to ignore *.o and *~
and allows the src/*/.gitignore files to be removed (subdirectories
will inherit the rules from the root .gitignore).
2009-06-29 21:47:19 +03:00
Jouni Malinen
f141be0caf EAP-SIM peer: Remove AT_NOTIFICATION from Notification response
This attribute is not supposed to be used in the response frame (i.e.,
it is only in the EAP-Request/SIM-Notification frame) per RFC 4186
chapters 10.1 and 9.9. This is a minor bug since the server is required
to ignore the contents of the EAP-Response/SIM-Notification during
protected result indication per chapter 6.2.

EAP-AKA peer was already following the similar specification in RFC 4187,
but this was somehow missed in the EAP-SIM peer implementation.
2009-06-29 21:42:29 +03:00
Jouni Malinen
2b16c01c4e Rename variable to avoid gcc warning about shadowed names 2009-06-29 21:26:48 +03:00
Jouni Malinen
3fed6f2504 Replace hostapd_wps_probe_req_rx() with more generic ProbeReq notifier
The driver wrappers should not need to include wps_hostapd.h, so let's
make this easier by introducing a driver callback for reporting Probe
Request frames.
2009-06-12 17:31:43 +03:00
Jouni Malinen
efe22727da X.509: Add parsing of alternative name to internal TLS implementation
The alternative name extensions are now parsed, but the actual values
are not yet used for alt. subject name matching.
2009-06-11 23:47:35 +03:00
Jouni Malinen
4625a47f4b WPS: Change wpa_supplicant wps_reg to not send out M8
Since we do not currently support changing the AP settings received
from M7, there is no point in actually sending out the M8 that would
likely trigger the AP to reconfigure itself and potentially reboot.
For now, we just receive the AP settings in M7 and add a local network
configuration block based on those, but NACK the message. This makes
wps_reg work like wps_pin, but by using the AP PIN instead of a client
PIN.
2009-06-10 15:53:35 +03:00
Roy Marples
a5b73cc49d driver_bsd.c: Use new MLME method of association.
Old way does not work with all drivers on NetBSD and FreeBSD are
also using this so should be a safe change. [Bug 312]

Signed-off-by: Roy Marples <roy@marples.name>
2009-05-29 22:41:43 +03:00
Roy Marples
66d4085f0a driver_bsd.c: Reduce code duplication between hostapd and wpa_supplicant
Add generic functions to get/set 80211 vars, set 80211 params and
get/sid ssid.
Change NetBSD defines to match the ioctl used for portability.
Check size we're copying into instead of assuming IFNAMSIZ.

Signed-off-by: Roy Marples <roy@marples.name>
2009-05-29 22:38:55 +03:00
Jouni Malinen
92e63aafdc bsd: Get rid of printf size_t warnings with 64-bit builds 2009-05-29 22:34:07 +03:00
Karl Hiramoto
a35187e71a hostapd: nl80211 retry creating a interface if it fails the first time
If hostapd segfaults, or is killed with -9, or the interface already exists,
when the interface is created, it will fail.

Configuration file: /tmp/hostapd/hostapd.conf
Failed to create interface mon.wlan0_0.
Using interface wlan0_0 with hwaddr 00:13:01:01:08:0a and ssid 'IG_0405_LAN'
Failed to set beacon head/tail or DTIM period
Failed to create interface wlan0_1.

Try to remove the interface and re-create it before aborting.
2009-05-29 21:48:19 +03:00
Dan Williams
2976121955 wext: disconnect at init and deinit
To ensure the supplicant starts and ends with a clean slate (keys are
already cleaned up at init and deinit time), force a null BSSID and
bogus SSID to ensure the driver isn't connected to anything.

Signed-off-by: Dan Williams <dcbw@redhat.com>
2009-05-27 21:01:26 +03:00
Dan Williams
87d01acfeb wext: Fix deauthentication to do IW_MLME_DEAUTH prior to disconnect
4853d5ac84 had a small bug in the order
of these function calls in _wext_deauthenticate() (_disassociate()
did have the correct order). The deauthentication frame is supposed
to go out (if driver supports that) before we disconnect more
forcefully.
2009-05-27 20:57:29 +03:00
Dan Williams
64a04447c3 wext: don't force-disconnect in ad-hoc mode
Otherwise the driver might interpret the request as a request to
create/join a new adhoc network with the bogus SSID.

Signed-off-by: Dan Williams <dcbw@redhat.com>
2009-05-27 20:55:15 +03:00
Jouni Malinen
077a781f7a WPS: Add support for setting timeout for PIN
hostapd_cli wps_pin command can now have an optional timeout
parameter that sets the PIN lifetime in seconds. This can be used
to reduce the likelihood of someone else using the PIN should an
active PIN be left in the Registrar.
2009-05-26 17:44:44 +03:00
Jouni Malinen
b63303b864 hostapd: Fix internal crypto build without TLS 2009-05-26 17:09:04 +03:00
Jouni Malinen
c7be4c2e3e Resolve couple of compiler warnings 2009-05-26 17:08:16 +03:00
Masashi Honma
a65f4a57fd driver_bsd.c: use get_scan_results2
The attached patch will replace get_scan_results with get_scan_results2.
This is a preparation for WPS on BSD.
And I erased "wpa_scan_result_compar". Because scan result
sorting will be done with "wpa_scan_result_compar" on
"scan_helpers.c".

I have done below tests on NetBSD with an atheros card.
- WPA2-PSK(CCMP)
- WPA-PSK(TKIP)
- PEAP(MSCHAPv2)
- EAP-TLS
- EAP-TTLS(MSCHAPv2)
2009-05-21 11:34:54 +03:00
Masashi Honma
131289d88d Fix hostapd and wpa_supplicant comipilation on NetBSD 4.0.1 2009-05-21 11:21:09 +03:00
Jouni Malinen
0165255010 nl80211: Add support for IEEE 802.1X port control in station mode
This adds a cleaner mechanism for protecting against unauthorized
data frames than the previously used drop_unencrypted mechanism
(which is not even available with nl80211 and had to use a WEXT
ioctl.

The old drop_unencrypted code is left in for now as the final
surviving WEXT use in driver_nl80211.c. However, it can be removed
from the build by defining NO_WEXT. It may also be removed
eventually when most users are expected to be using recent enough
kernel version.
2009-05-14 21:54:47 +03:00
Jouni Malinen
7e76ee9c45 nl80211: Add support for NL80211_ATTR_STA_FLAGS2
For now, the old code using NL80211_ATTR_STA_FLAGS is left in for
backwards compatibility with older kernel versions. It may be removed
eventually when most users are expected to be running with new
enough kernel version.
2009-05-14 21:53:21 +03:00
Jouni Malinen
a652fc1a24 Sync with linux/nl80211.h from wireless-testing.git 2009-05-14 21:51:59 +03:00
Jouni Malinen
e572fa331c nl80211: Add MFP flag configuration for station mode
This fixes IEEE 802.11w use with driver_nl80211.c in station mode.
2009-05-12 11:55:18 +03:00
Jouni Malinen
c4e281fd91 Drop unprotected Robust Action frames from MFP STAs
These frames are delivered through mac80211 monitor interface, so we
need to filter them out in hostapd.
2009-05-08 12:51:28 +03:00
Jouni Malinen
4209a95df5 Update SA Query transaction id length based on IEEE 802.11w/D8.0
IEEE 802.11w/D8.0 changed the length of the SA Query transaction
identifier from 16 to 2 octets.
2009-05-06 18:57:17 +03:00
Jouni Malinen
826fff182f WPS: Add a workaround for auth/encr type flags mismatches
Some deployed implementations seem to advertise incorrect information
in this attribute. For example, Linksys WRT350N seems to have a
byteorder bug that breaks this negotiation. In order to interoperate
with existing implementations, assume that the Enrollee supports
everything we do.
2009-05-06 10:56:18 +03:00
Jouke Witteveen
077ed46d2b General revision of RoboSwitch driver
Attached is a patch for the RoboSwitch driver in trunk. It is a
general revision of the source code.

Changes:
- Improved IEEE 802.1X conformance ([1])
- Better conformity to Broadcom specifications
- Fixed compatibility with different chipset revisions

It is worth noting that performance may drop a little using the new
driver. This can be overcome by using "multicast_only=1" as a
parameter. In that case only packets to the PAE group address are
regarded, as the previous revision of the driver did. A more detailed
description of the parameter and it's consequences is available at [2]
(summary: use "multicast_only=1" whenever possible).

[1] http://lists.shmoo.com/pipermail/hostap/2009-February/019398.html
[2] http://forum.openwrt.org/viewtopic.php?id=19873
2009-04-26 21:25:48 +03:00
Jouni Malinen
da1fb17ca7 Add handling of SME auth/assoc timeout events
This allows wpa_supplicant to start searching for other APs (or re-try)
if the MLME times out.
2009-04-24 00:08:24 +03:00
Jouni Malinen
1fb1a6f0bf Remove unused set_broadcast_ssid() driver op
None of the driver wrappers user this. hostapd-controlled broadcast SSID
hiding can only be used with drivers that use hostapd for handling
Beacon and Probe Request/Response frames.
2009-04-22 16:15:24 +03:00
Jouni Malinen
9351257cfb Remove the unused set_ieee80211d driver op
None of the driver wrappers use this. Only the drivers that use hostapd
for Beacon and Probe Request/Response handling can now use IEEE 802.11d
properly.
2009-04-22 16:11:22 +03:00
Jouni Malinen
4bc181ecc7 Add new wpa_supplicant driver op for setting 802.1X port status
This can be used with drivers that implement PAE to control whether
normal data frames (non-EAPOL) are allowed.
2009-04-22 16:01:37 +03:00
Jouni Malinen
ad6494515e nl80211: Replace WEXT code for RTS/fragmentation threshold
nl80211 has new attributes for setting RTS and fragmentation threshold
values. Use these instead of the old WEXT ioctls.
2009-04-21 18:11:07 +03:00
Jouni Malinen
30985b8600 Remove unused set_retry() driver op 2009-04-21 18:01:43 +03:00
Jouni Malinen
5645fbdc85 nl80211: Sync with linux/nl80211.h from wireless-testing.git
Note: This changes values for existing NL80211_ATTR_MAX_SCAN_IE_LEN
and NL80211_ATTR_KEY_TYPE (for some reason, they ended up getting
swapped in wireless-testing.git) and as such, could break Michael
MIC  error reporting (well, at least partially).
2009-04-21 17:54:50 +03:00
Jouni Malinen
3ec97afe57 wpa_supplicant AP: Add preliminary support for WPS Internal Registrar
When in AP mode, wpa_supplicant is now enabling WPS (only Internal
Registrar). wpa_cli wps_pbc and wps_pin commands can be used to initiate
WPS negotiation similarly to how this is done in station mode (though,
the BSSID parameter is ignored).
2009-04-21 16:45:16 +03:00
Jouni Malinen
a8d6ffa48f wpa_supplicant AP: Add sta_set_flags 2009-04-20 16:33:13 +03:00
Jouni Malinen
db149ac949 wpa_supplicant AP: Add EAPOL frame TX and RX
This allows WPA-Personal 4-way handshake to be completed successfully.
2009-04-20 16:27:45 +03:00
Jouni Malinen
13405f3542 nl80211: Mark state disassociated on local deauth/disassoc 2009-04-20 11:37:35 +03:00
Jouni Malinen
83935317a7 Disconnect if 4-way handshake processing fails
There is no point in trying to continue if a 4-way handshake frame is
discarded or if PTK/GTK/IGTK configuration fails. Force the client to
disconnect in such a case to avoid confusing user by claiming the
connection was successfully completed.
2009-04-20 11:35:21 +03:00
Jouni Malinen
0f4e8b4f65 wpa_supplicant AP: add sta_add() and sta_remove() 2009-04-17 20:09:20 +03:00
Jouni Malinen
460456f832 nl80211: Add/remove monitor interface dynamically based on mode 2009-04-17 16:27:38 +03:00
Jouni Malinen
8a27af5c70 nl80211: Delete Beacon information on deinit in wpa_supplicant AP mode 2009-04-17 16:06:12 +03:00
Jouni Malinen
b08d177aad Use C99 designated initializers to cleanup driver_ops setup
These driver wrappers use UNIX domain sockets and as such, won't be
built with Microsoft compiler. Consequently, use of C99-style designated
initializers can be used to make these files easier to maintain. Only
driver_ndis.c needs to support the old C89-style due to Microsoft
compiler not supporting newer C standard.
2009-04-17 15:58:34 +03:00
Jouni Malinen
61693eaa80 hostapd: Remove unused passive scan functionality
This was not really supported by any of the included driver wrappers. If
this functionality is desired in the future, this (or something similar)
can be added with the changes needed into a driver wrapper to use the
mechanism.
2009-04-17 15:47:37 +03:00
Jouni Malinen
c811d5bc78 nl80211: Use ifndef hostapd to reduce binary size
Number of areas are not used by hostapd, so remove them from the build.
2009-04-17 15:36:06 +03:00
Jouni Malinen
6d550fbeea nl80211: Fix secondary BSS ifindex
This was broken by a cleanup patch that moved from ifname to ifindex.
2009-04-17 13:33:30 +03:00
Jouni Malinen
4b9841d34c Move more multi-BSSID processing into drv_callbacks.c
This simplifies driver wrapper operations and removes last direct
struct hostapd_data dereferences from driver_nl80211.c. In addition,
some of the TX callbacks are now fixed for secondary BSSes.
2009-04-17 13:29:29 +03:00
Jouni Malinen
412036f5f0 Provide own_addr buffer in hapd_init() parameters
This reduces number of places in driver wrapper that would need to
dereference struct hostapd_data pointer directly.
2009-04-17 11:55:51 +03:00
Jouni Malinen
731723a5bd Add own_addr as a parameter to sta_deauth() and sta_disassoc()
This fixes deauth/disassoc frames in secondary BSSes when using
multi-BSSID. In addition, it reduces need to dereference
struct hostapd_data inside driver wrappers.
2009-04-17 11:37:22 +03:00
Jouni Malinen
7af376e456 nl80211: Fix wpa_supplicant build 2009-04-17 11:23:24 +03:00
Jouni Malinen
41d931ee37 nl80211: Add helper functions for SIOC{G,S}IFHWADDR 2009-04-17 11:22:16 +03:00
Jouni Malinen
b8c4d6df5f Remove dead code related to WDS setup
hostapd does not have any code that would actually call this, so there
is no current need to try to figure out how to set up WDS links with
nl80211.
2009-04-16 19:08:58 +03:00
Jouni Malinen
bbaf083777 nl80211: Share more of init/deinit code 2009-04-16 17:16:41 +03:00
Jouni Malinen
37b7d08204 nl80211: Make it possible to build without WEXT support
NO_WEXT can be defined to disable all remaining WEXT uses from
driver_nl80211.c. This breaks some functionality, so the code is still
in use by default. Anyway, the new #ifdef blocks make it easy to search
for areas that need to be converted to nl80211.
2009-04-16 16:36:03 +03:00
Jouni Malinen
ad1e68e6b5 Clean up HT40 scan and share nl80211 scanning code
Instead of adding a new driver_ops for fetching neighbor BSS data (that
nl80211 driver interface had to scan during initialization), share the
same scan operations that wpa_supplicant is using. This gets rid of
duplicated scan code in driver_nl80211.c (and better yet, removes large
part of old WEXT code).

hostapd interface initialization is now completed in a callback, if
needed, i.e., he_features channel/hw_mode selection can use as much time
as needed. This can also help with radar detection in the future.
2009-04-16 16:22:40 +03:00
Jouni Malinen
814aaa844a Fix small HTTP processing issues
Parse "Transfer-Encoding: chunked" properly.
Get more data if read buffer is empty when starting to process the body.
2009-04-15 11:18:09 +03:00
Jouni Malinen
9fff9fdcf9 nl80211: Use shared code for netlink initialization 2009-04-14 15:52:05 +03:00
Jouni Malinen
7da3abe711 nl80211: Merge handle_frame() implementations 2009-04-14 15:35:03 +03:00
Jouni Malinen
f019981aee nl82011: Use common code for setting channel 2009-04-14 15:15:33 +03:00
Jouni Malinen
c720f2cd56 nl80211: Remove inclusion of unneeded header files 2009-04-14 15:03:07 +03:00
Jouni Malinen
071f8ac4df nl80211: Fix management frame sending after driver_ops cleanup
hostapd ended up with unregistered send_mlme() in commit
9f324b61ba. Fix this by registering the
handler both for wpa_supplicant-AP and hostapd use. [Bug 310]
2009-04-14 13:12:58 +03:00
Jouni Malinen
b4fd6fab5b Share driver beacon configuration handlers 2009-04-09 23:44:39 +03:00
Jouni Malinen
92f475b4d8 Merge hostapd driver init functions into one
Use a parameter structure to pass in information that can be more easily
extended in the future. Include some of the parameters that were
previously read directly from hapd->conf in order to reduce need for
including hostapd/config.h into driver wrappers.
2009-04-09 23:28:21 +03:00
Jouni Malinen
989f52c639 Remove unneeded inclusion of hostapd header files 2009-04-09 20:53:29 +03:00
Jouni Malinen
2135f224db nl80211: Share common interface processing code 2009-04-09 20:41:21 +03:00
Jouni Malinen
072ad14cc4 nl80211: Share monitor mode filtering and reading functions 2009-04-09 20:20:21 +03:00
Jouni Malinen
e785c2ba3b Share same set_country driver op for hostapd and wpa_supplicant 2009-04-09 20:01:25 +03:00
Jouni Malinen
9f324b61ba Share management frame send driver op for hostapd and wpa_supplicant
The same implementation can be shared in most cases, so better share the
same driver_ops handler function.
2009-04-09 19:57:20 +03:00
Jouni Malinen
8342130269 Remove flags parameter from send_mgmt_frame() driver op
This was not documented properly and was not really used nor would it be
suitable to be used in generic way as it was implemented. It is better
to just remove the parameter since there does not seem to be any
reasonable use for it.
2009-04-09 19:42:19 +03:00
Jouni Malinen
5b7b85f669 nl80211: Replace hostapd WEXT events with nl80211 events
This shares the nl80211 event processing with wpa_supplicant and removes
the old WEXT code from driver_nl80211.c.
2009-04-09 17:10:22 +03:00
Jouni Malinen
35583f3fa6 nl80211: Add Michael MIC failure event processing for wpa_supplicant 2009-04-09 16:50:48 +03:00
Jouni Malinen
ac184de0ec Sync linux/nl80211.h with wireless-testing.git
This adds support for Michael MIC failure events and info on maximum
supported scan IE length.
2009-04-09 16:39:24 +03:00
Jouni Malinen
1ad1cdc241 nl80211: Merge hostapd and wpa_supplicant key configuration
No need to duplicate more or less identical code.
2009-04-09 16:31:11 +03:00
Francesco Gringoli
5a0ffb5f1f nl80211: Fix channel 14 use
nl80211 interface has a trivial bug that prevents it to work correctly
with channel 14. Channel frequency is erroneously 2848 instead of 2484.
To correct it just apply this patch. [Bug 308]
2009-04-09 14:51:31 +03:00
Jouni Malinen
c3965310e6 Use common get_hw_feature_data for hostapd and wpa_supplicant
This merges the driver wrapper implementations to use the same
implementation both for hostapd and wpa_supplicant operations to avoid
code duplication.
2009-04-09 14:11:39 +03:00
Jouni Malinen
c51218372f Merge wpa_supplicant and hostapd driver wrapper implementations
This commit merges the driver_ops structures and implementations from
hostapd/driver*.[ch] into src/drivers. This is only an initial step and
there is room for number of cleanups to share code between the hostapd
and wpa_supplicant parts of the wrappers to avoid unnecessary source
code duplication.
2009-04-09 13:40:12 +03:00
Jouni Malinen
a0b2f99bd7 nl80211: Fix static WEP key configuration when using SME
Need to set WEP keys before requesting authentication in order to get
Shared Key authentication working. Previously, the WEP keys were not set
at all when using SME in wpa_supplicant.
2009-04-04 16:58:16 +03:00
Jouni Malinen
282d55908b wpa_supplicant AP: Add get_hw_feature_data
This is enough to allow open mode association to be completed with
driver_nl80211.c.
2009-04-03 19:11:22 +03:00
Jouni Malinen
6caf9ca68c Share same hw_feature definitions between hostapd and wpa_supplicant 2009-04-03 19:04:20 +03:00
Jouni Malinen
2c2010acda Implement management frame TX for wpa_supplicant AP mode 2009-04-03 16:45:09 +03:00
Jouni Malinen
6179d2fd7d Fix driver_ops function documentation 2009-04-03 16:35:46 +03:00
Jouni Malinen
0915d02c3c wpa_supplicant AP: Add management frame RX for nl80211 2009-04-02 21:59:14 +03:00
Jouni Malinen
d2440ba01b Add Beacon configuration for wpa_supplicant AP mode 2009-04-02 16:09:48 +03:00
Jouni Malinen
2e24a366ea nl80211: Add IGTK (AES-128-CMAC) configuration
This was somehow forgotten from IEEE 802.11w/MFP patches from
wpa_supplicant -Dnl80211.
2009-04-01 17:14:07 +03:00
Jouni Malinen
efa4607800 SME: Add processing for rejected associations 2009-04-01 17:10:36 +03:00
Jouni Malinen
c0a6190815 Fix SHA-256-based KDF when using CCMP as the pairwise cipher
IEEE 802.11r KDF uses key length in the derivation and as such, the PTK
length must be specified correctly. The previous version was deriving
using 512-bit PTK regardless of the negotiated cipher suite; this works
for TKIP, but not for CCMP. Update the code to use proper PTK length
based on the pairwise cipher.

This fixed PTK derivation for both IEEE 802.11r and IEEE 802.11w (when
using AKMP that specifies SHA-256-based key derivation). The fixed
version does not interoperate with the previous versions. [Bug 307]
2009-04-01 12:04:36 +03:00
Jouni Malinen
d61f48ba1d nl80211: Remove forgotten comment about SIOCSIWMODE 2009-03-31 15:25:10 +03:00
Jouni Malinen
1b2a72e884 nl80211: Remove SIOCGIWRANGE and assume TKIP+CCMP+WPA+WPA2
All currently known drivers that use nl80211/cfg80211 support these, so
no need to use old WEXT ioctl for figuring out capabilities.
2009-03-31 14:25:15 +03:00
Jouni Malinen
d8816397c3 nl80211: Remove WEXT Michael MIC event processing
mac80211 does not use this type of Michael MIC event, so this is not
really used and proper Michael MIC failure processing will be added
using an nl80211 event once that gets added into wireless-testing.git.
2009-03-31 14:14:16 +03:00
Jouni Malinen
e8a029fb6d nl80211: Remove WEXT_COMPAT
It looks like both new nl80211 operations (scan and auth/assoc) end up
being added in Linux 2.6.30, so we do not need to maintain the backwards
compatibility code in wpa_supplicant.
2009-03-31 14:09:30 +03:00
Jouni Malinen
73267b9ca4 WPS: Fix local configuration update after AP configuration
Update credential to only include a single authentication and
encryption type in case the AP configuration includes more than one
option. Without this, the credential would be rejected if the AP was
configured to allow more than one authentication type.
2009-03-30 19:00:55 +03:00
Jouni Malinen
d3a9822542 Add support for specifying subset of enabled frequencies to scan
A new network block parameter, scan_freq, can be used to specify subset
of frequencies to scan. This can speed up scanning process considerably
if it is known that only a small subset of channels is actually used in
the network. A union of configured frequencies for all enabled network
blocks is used in scan requests.

Currently, only driver_nl80211.c has support for this functionality.

For example, following parameter marks 2.4 GHz channels 1, 6, 11 to be
scanned: scan_freq=2412 2437 2462
2009-03-26 21:55:01 +02:00
Jouni Malinen
c746331b52 Allow hostapd/config.h and wpa_supplicant/config_ssid.h coexist
Move the shared IEEE 802.11w enum definition into src/common/defs.h to
avoid redefinition when both configuration structures are included into
the same file.
2009-03-26 16:06:15 +02:00
Jouni Malinen
bfd67fc44c Fix WPS UPnP SSDP on 32-bit targets
The memcpy was using incorrect size (of pointer; should have been of
data structure) for the client address. This ended up working on 64-bit
targets, but left part of the address uninitialized on 32-bit targets.
2009-03-26 15:32:02 +02:00
Jouni Malinen
1e5839e06f Rename EAP server defines from EAP_* to EAP_SERVER_*
This allows separate set of EAP server and peer methods to be built into
a single binary.
2009-03-25 12:06:19 +02:00
Jouni Malinen
1581b38b67 Initial step in adding simple AP mode support into wpa_supplicant
This version is adding the configuration option (mode=2) for this and
driver capability reporting to figure out whether AP mode can be used.
However, this does not actually implement any real functionality yet.
2009-03-25 11:38:47 +02:00
Jouni Malinen
a87c9d9609 driver_nl80211: Fix initial iftype change
Need to set drv->ifindex before calling set_mode(). In addition, set the
mode before setting the interface up to avoid having to set it down
again.

Add more useful error message on mode changes.
2009-03-24 20:50:40 +02:00
Jouni Malinen
36b15723ca Deprecate set_drop_unencrypted(), set_auth_alg(), and set_mode()
All these driver handlers can be implemented in associate() handler
which gets all the needed information in the parameters structure. The
old functions that provided only a single parameter will be removed
eventually to clean up the driver_ops structure, so driver wrappers
should start using the newer mechanism.
2009-03-24 20:06:02 +02:00
Jouni Malinen
22498d6dc3 Fix WPS UPnP build for FreeBSD 2009-03-21 21:00:37 +02:00
Jouni Malinen
4df91b3f3f Fix driver_bsd.c build for FreeBSD 2009-03-21 20:58:27 +02:00
Jouni Malinen
fd05d64ecf nl80211: Make get_ssid behave like get_bssid with SME
Use a local copy of SSID instead of WEXT when using wpa_supplicant-based
SME.
2009-03-20 23:03:18 +02:00
Jouni Malinen
ed384c2c67 nl80211: Make set_bssid() WEXT_COMPAT 2009-03-20 22:59:17 +02:00
Jouni Malinen
95f02a5ddd nl80211: Make PMKSA caching candidate event WEXT_COMPAT 2009-03-20 22:57:46 +02:00
Jouni Malinen
f555b6dec1 nl80211: Mark PMKSA cache operations with WEXT_COMPAT
These are not needed with wpa_supplicant SME.
2009-03-20 22:55:24 +02:00
Jouni Malinen
af723760ba nl80211: Fix no-WEXT_COMPAT build
wpa_driver_nl80211_set_ssid() and wpa_driver_nl80211_set_freq() are only
for WEXT_COMPAT now that the user space MLME code is removed.
2009-03-20 22:44:53 +02:00
Jouni Malinen
625f587b03 nl80211: Remove user space MLME code
This design did not make it into the kernel and the new user space SME
design has removed the need for keeping the experimental code.
2009-03-20 22:31:24 +02:00
Jouni Malinen
c2a0407851 Add SME support (separate authentication and association)
This can be used, e.g., with mac80211-based Linux drivers with
nl80211. This allows over-the-air FT protocol to be used (IEEE
802.11r).

Since the nl80211 interface needed for this is very recent (added
today  into wireless-testing.git), driver_nl80211.c has backwards
compatibility code that uses WEXT for association if the kernel does
not support the new commands. This compatibility code can be
disabled by defining NO_WEXT_COMPAT. That code will also be removed
at  some point to clean up driver_nl80211.c.
2009-03-20 22:26:41 +02:00
Jouni Malinen
b21fab69fd Update linux/nl80211.h copy based on wireless-testing.git 2009-03-20 21:28:34 +02:00
Jouni Malinen
9f98c48315 Fix doxygen function comment 2009-03-19 21:42:15 +02:00
Jouni Malinen
4cb0dcd92d Fix IEEE 802.11r key derivation function to match with the standard
IEEE Std 802.11r-2008, 8.5.1.5.2 starts the 'i' counter from 1, not 0.
Note: this breaks interoperability with previous versions. [Bug 303]
2009-03-19 15:46:00 +02:00
Masashi Honma
2943799678 TNC: Fix a stray pointer that could cause segfault on error path
On "eap_tnc_process" function error case, data->in_buf keeps reference
to a local scope variable. For example this will cause segmentation
fault in "eap_tnc_deinit" function "wpabuf_free(data->in_buf)"
statement.
2009-03-16 21:01:07 +02:00
Jouni Malinen
c590cb67d4 Update draft-cam-winget-eap-fast-provisioning references to RFC 5422 2009-03-14 10:30:14 +02:00
Jouni Malinen
51853c899b Fix TNC with EAP-TTLS
This was broken by 510c02d4a3 which added
validation of eap_ttls_phase2_eap_init() return value. The main problem
in the code trying to initialize a new phase 2 EAP method
unconditionally; this should only happen if there is a new method in the
inner method sequence.
2009-03-13 18:20:59 +02:00
Jouni Malinen
99bff8430f Fix segmentation fault on EAP-TTLS phase 2 EAP method init failure
This is based on a patch and report by Masashi Honma
<honma@ictec.co.jp>. The issue is more generic than just TNC, though,
since failure to initialize any phase 2 EAP method can result in NULL
dereference.
2009-03-13 17:53:13 +02:00
Masashi Honma
0d308bc074 TNC: Send EAP-Failure on TNC failure
On PEAP(TNC), hostapd integrated RADIUS server doesn't return
EAP-Failure when "Recommendation = none". So, EAP data retransmittion
occurs.

My co-worker "Ryuji Ohba" made below patch.
2009-03-13 17:41:58 +02:00
Larry Stefani
b7d3a95afc Zero struct ifreq data before use in l2_packet_init()
[Bug 300]
2009-03-13 17:04:33 +02:00
Jouni Malinen
86f4deb635 FT: Fix status code values to match with IEEE 802.11r-2007
It looks like couple of status code values were changed during the
802.11r draft process and these were not updated in source code yet.
2009-03-09 22:28:30 +02:00
Jouni Malinen
f238cf9f42 FT: Add RIC Request processing and RIC Response generation
hostapd will now go through the RIC Request and process each RDIE. Only
WMM TSPEC requests are currently supported; all other request
descriptors will be declined.

RIC Response is written by hostapd and verified by wpa_supplicant (MIC
validation). wpa_supplicant does not yet have code to notify the driver
about the resource request results.
2009-03-09 22:25:58 +02:00
Jouni Malinen
babfbf15cc FT: Add RIC Request generation and validation (but not processing)
This adds first part of FT resource request as part of Reassocition
Request frame (i.e., FT Protocol, not FT Resource Request Protocol).
wpa_supplicant can generate a test resource request when driver_test.c
is used with internal MLME code and hostapd can verify the FTIE MIC
properly with the included RIC Request.

The actual RIC Request IEs are not processed yet and hostapd does not
yet reply with RIC Response (nor would wpa_supplicant be able to
validate the FTIE MIC for a frame with RIC Response).
2009-03-09 20:45:17 +02:00
Jouni Malinen
143a4bf632 WPS: Add a workaround for static WEP with Windows network probe
Windows XP and Vista clients can get confused about EAP-Identity/Request
when they probe the network with EAPOL-Start. In such a case, they may
assume the network is using IEEE 802.1X and prompt user for a
certificate while the correct (non-WPS) behavior would be to ask for the
static WEP key. As a workaround, use Microsoft Provisioning IE to
advertise that legacy 802.1X is not supported.

This seems to make Windows ask for a static WEP key when adding a new
network, but at least Windows XP SP3 was still marking IEEE 802.1X
enabled for the network. Anyway, this is better than just leaving the
network configured with IEEE 802.1X and automatic WEP key distribution.
2009-03-08 19:36:02 +02:00