Commit graph

18014 commits

Author SHA1 Message Date
Vinay Gannevaram
09a281e52a Add QCA vendor interface for PASN offload to userspace
Define QCA vendor interface for PASN offload to userspace from the driver.

The driver can send this command as an event to a userspace component to
perform PASN authentication with a list of peers with which the driver
needs to do ranging. The userspace component, if capable of performing
PASN handshake, can perform PASN handshake with all the peer devices and
set the relevant keys by sending the
QCA_NL80211_VENDOR_SUBCMD_SECURE_RANGING_CONTEXT command for each peer
to the driver.

Once PASN handshake is completed with all requested peers, the userspace
component sends consolidated status for all the peers to the driver. The
consolidated report is required for the driver to understand that the
PASN handshake process is complete and whether it succeeded/failed for
each of the peers it was requested for. The secure ranging context is
configured only for the peers with which the PASN handshake succeeded.

When the driver requests PASN keys, the userspace component can set the
keys from its cache if those keys have not already expired and were
derived with the same source MAC address that is requested by the driver
instead of doing the full PASN handshake again.

If the driver detects that current keys of a peer are not valid anymore,
it sends a notification to userspace using the
QCA_NL80211_VENDOR_SUBCMD_PASN command and setting the action to
QCA_WLAN_VENDOR_PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT. The userspace
component should delete the corresponding keys from its cache.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-23 21:50:04 +03:00
Purushottam Kushwaha
809fb96fa0 Add a vendor attribute to configure concurrency policy for AP interface
Add a new QCA vendor attribute
QCA_WLAN_VENDOR_ATTR_CONCURRENT_POLICY_AP_CONFIG to
QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_POLICY sub command to set the
concurrency policy for AP interface.
QCA_WLAN_VENDOR_ATTR_CONCURRENT_POLICY_AP_CONFIG uses the values
defined in enum qca_wlan_concurrent_ap_policy_config to specify
concurrency policy.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2022-06-23 21:33:38 +03:00
Purushottam Kushwaha
a5754f531e Rename QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_MULTI_STA_POLICY
Rename QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_MULTI_STA_POLICY to
QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_POLICY to allow extension for other
interface type(s). A subsequent commit will extend the renamed
definitions in a manner that is inconsistent with the current naming.

This is a precursor for AP/P2P concurrency policy configuration support
via updated vendor command QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_POLICY.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2022-06-23 21:32:06 +03:00
Veerendranath Jakkam
085a3fc76e EHT: Add 320 channel width support
Add initial changes to support 320 MHz channel width.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
2022-06-20 14:39:26 +03:00
Aleti Nageshwar Reddy
bafe35df03 Move CHANWIDTH_* definitions from ieee80211_defs.h to defs.h
Move most of CHANWIDTH_* definitions from ieee80211_defs.h to defs.h as
the definitions are getting used mostly for internal purpose only. Also
change prefix of the definitions to CONF_OPER_CHWIDTH_* and update in
all the files accordingly.

Leave the couple of VHT-specific exceptions to use the old defines (the
reason why they were originally added as VHT values), to avoid use of
clearly marked configuration values in information elements. In
addition, use the defines instead of magic values where appropriate.

Signed-off-by: Aleti Nageshwar Reddy <quic_anageshw@quicinc.com>
2022-06-20 14:39:18 +03:00
Jouni Malinen
92f5499010 tests: Remove the 80+80 vs. 160 part from wpa2_ocv_ap_vht160_mismatch
This started failing with the OCV implementation change to ignore the
second segment when using a 160 MHz channel.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-16 20:31:45 +03:00
Jouni Malinen
c580c2aecd tests: Make OCV negative test error cases more robust
Try to avoid an exception while processing an exception that indicates
the test case failed. Explicit DISCONNECT command here can avoid the
undesired FAIL-BUSY from cleanup SCAN.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-16 20:26:11 +03:00
Veerendranath Jakkam
3c2ba98add Add QCA vendor event to indicate driver recovery after internal failures
Add QCA vendor event to indicate user space that the driver recovery is
completed after the internal failure reported with
QCA_NL80211_VENDOR_SUBCMD_HANG.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-06-16 20:15:39 +03:00
Xinyue Ling
6b461f68c7 Set current_ssid before changing state to ASSOCIATING
For hidden GBK encoding of a Chinese SSID, both the UTF-8 and GBK
encoding profiles are added into wpa_supplicant to make sure the
connection succeeds. In this situation, wpa_supplicant_select_network()
will not be called so current_ssid is NULL when association begins.

Android monitors the WPA_EVENT_STATE_CHANGE event to get the SSID and
BSSID. When connecting to a Chinese SSID, in case of association
rejection happens, Android will report null SSID to OEM APP because
current_ssid is updated after wpa_supplicant_set_state(wpa_s,
WPA_ASSOCIATING), which may cause confusion.

Fix this by setting the current_ssid before changing state to
ASSOCIATING.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-16 18:02:07 +03:00
Purushottam Kushwaha
8dd8267413 QCA vendor attribute to configure direct data path for audio traffic
Add a new QCA vendor attribute
QCA_WLAN_VENDOR_ATTR_CONFIG_AUDIO_DATA_PATH to
QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION to configure audio data
path.

Possible audio data paths are defined in enum qca_wlan_audio_data_path.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2022-06-16 17:49:45 +03:00
Kiran Kumar Lokere
504be2f9de QCA vendor command support to get WLAN radio combinations
Vendor command to get the WLAN radio combinations matrix supported by
the device which provides the device simultaneous radio configurations
such as standalone, dual band simultaneous, and single band
simultaneous.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-16 17:47:06 +03:00
Jouni Malinen
d5905dbc84 OCV: Check the Frequency Segment 1 Channel Number only on 80+80 MHz
The initial OCV implementation validating this field in the OCI element
for both the 80+80 MHz and 160 MHz cases. However, IEEE Std 802.11-2020,
12.2.9 ("Requirements for Operating Channel Validation") limitis that
verification step for the 80+80 MHz case: "Verifying that, if operating
an 80+80 MHz operating class, the frequency segment 1 channel number ...
is equal to the Frequency Segment 1 Channel Number field of the OCI."

Remove this check for the 160 MHz case since there has been incorrect
interpretation on how the Frequency Segment 1 Channel Number field of
the OCI element is set in this case (using VHT rules for CCFS2). The
modified validation step is meets the real need here, is compliant with
the standard, and avoids potential interoperability issues when using
contiguous 160 MHz channels.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-06-14 17:19:27 +03:00
Sreeramya Soratkal
4383528e01 P2P: Use weighted preferred channel list for channel selection
Previously, the driver could optionally (using QCA vendor command)
provide a preferred channel list to wpa_supplicant for channel selection
during the GO negotiation. Channel selection process can be more
efficient with the information of weights and flags of the preferred
channel list that can be provided by the driver. Use a weighted
preferred channel list provided by the driver for channel selection
during GO negotiation if such a list is available.

Signed-off-by: Sreeramya Soratkal <quic_ssramya@quicinc.com>
2022-06-02 17:09:10 +03:00
Jianmin Zhu
f2c5c8d38f QCA vendor attribute to configure RX link speed threshold for roaming
Add QCA_ATTR_ROAM_CONTROL_RX_LINKSPEED_THRESHOLD value as the RX link
speed threshold to disable roaming. If the current link speed is above
the threshold, there is no need to roam.

Signed-off-by: Jianmin Zhu <quic_jianminz@quicinc.com>
2022-06-02 16:10:28 +03:00
Purushottam Kushwaha
94bc94b206 Add QCA vendor attribute for DO_ACS to allow using existing scan entries
Add a new QCA vendor attribute
QCA_WLAN_VENDOR_ATTR_ACS_LAST_SCAN_AGEOUT_TIME to
QCA_NL80211_VENDOR_SUBCMD_DO_ACS and opportunistically optimize time
taken for ACS scan. Avoid scanning the channels which were scanned
within last QCA_WLAN_VENDOR_ATTR_ACS_LAST_SCAN_AGEOUT_TIME milliseconds
and use scan results from the scan results cache for ACS scoring. For
other channels, perform ACS scan and use the received scan results.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-31 12:44:38 +03:00
Qiwei Cai
b9e2826b9d P2P: Filter 6 GHz channels if peer doesn't support them
When 6 GHz channels are included in channel list of P2P Action frames
but some peer devices don't support the 6 GHz feature and cannot parse
P2P IE data correctly, P2P handshake will fail.

Remove 6 GHz channels from the P2P Action frames if the peer doesn't
support 6 GHz feature to avoid such failures.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-31 12:41:48 +03:00
Vikram Kandukuri
d5a9944b84 Reserve QCA vendor sub command id 206..212
This is reserved for QCA use.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-31 12:09:52 +03:00
Jeff Johnson (QUIC)
ed63c286fc Remove space before tab in QCA vendor commands
A few of the comments in the QCA vendor commands have a space
character before a tab. That is pointless, and some code style
checkers may complain about it, so remove the spaces.

Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
2022-05-31 12:00:43 +03:00
Jouni Malinen
e4015440af ProxyARP: Clear bridge parameters on deinit only if hostapd set them
Skip the x_snoop_deinit() operations if hostapd did not actually
configure the parameters in the first place. While clearing these
specific parameters is unlikely to change how they were set outside the
scope of hostapd, it is better to leave them as-is to avoid surprises if
hostapd was not configured to use ProxyARP.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-31 11:53:05 +03:00
Jouni Malinen
02047e9c88 hs20-osu-client: Explicit checks for snprintf() result
Get rid of the gcc warnings on potentially truncating the output buffer
by explicitly checking that there was enough room to write the full
string.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-27 00:32:13 +03:00
Jouni Malinen
cd92f7f98a FIPS PRF: Avoid duplicate SHA1Init() functionality
The initialization values used for the FIPS 186-2 PRF are identical to
the ones used in SHA1Init(), so use that internal function instead of
maintaining a duplicate set of values here. fips186_2_prf() was already
using an internal SHA1Transform() function so using another internal
function does not make this any worse.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-27 00:32:12 +03:00
Jouni Malinen
5c87fcc154 OpenSSL: Use internal FIPS 186-2 PRF with OpenSSL 3.0
OpenSSL 3.0 has deprecated the low-level SHA1 functions and does not
include an upper layer interface that could be used to use the
SHA1_Transform() function. Use the internal SHA-1 implementation instead
as a workaround.

While this type of duplicate implementation of SHA-1 is not really
ideal, this PRF is needed only for EAP-SIM/AKA and there does not seem
to be sufficient justification to try to get this working more cleanly
with OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-27 00:32:10 +03:00
Jouni Malinen
9e305878c0 SAE-PK: Fix build without AES-SIV
CONFIG_SAE_PK=y was not pulling in AES-SIV implementation even though it
needs this.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:23 +03:00
Jouni Malinen
c41004d861 OpenSSL: Convert more crypto_ec_key routines to new EVP API
This avoids some more uses of the deprecated EC_KEY API when using
OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:23 +03:00
Jouni Malinen
667a2959c2 OpenSSL: crypto_ec_key_get_public_key() using new EVP_PKEY API
Implement crypto_ec_key_get_public_key() without the deprecated EC_KEY
API when using OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:22 +03:00
Jouni Malinen
5b97395b3e OpenSSL: crypto_ec_key_get_private_key() using new EVP_PKEY API
Implement crypto_ec_key_get_private_key() without the deprecated EC_KEY
API when using OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:20 +03:00
Jouni Malinen
177ebfe109 crypto: Convert crypto_ec_key_get_public_key() to return new ec_point
This makes it easier for the crypto library/wrapper to avoid direct
references to internal EC key parameters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:19 +03:00
Jouni Malinen
26780d92f3 crypto: Convert crypto_ec_key_get_private_key() to return new bignum
This makes it easier for the crypto library/wrapper to avoid direct
references to internal EC key parameters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:18 +03:00
Jouni Malinen
c9c2c2d9c7 OpenSSL: Fix a memory leak on crypto_hash_init() error path
The EVP_MAC context data needs to be freed on error paths.

Fixes: e31500adea ("OpenSSL: Implement HMAC using the EVP_MAC API")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:17 +03:00
Jouni Malinen
6d19dccf94 OpenSSL: Free OSSL_DECODER_CTX in tls_global_dh()
The conversion to the new OpenSSL 3.0 API had forgotten to free the
context structure.

Fixes: bcd299b326 ("OpenSSL: Convert DH/DSA parameter loading to new API")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:16 +03:00
Jouni Malinen
4f4479ef9e OpenSSL: crypto_ec_key_parse_{priv,pub}() without EC_KEY API
Avoid using the deprecated EC_KEY API when building these functions with
OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:15 +03:00
Jouni Malinen
b092d8ee63 tests: imsi_privacy_attr
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-25 20:19:52 +03:00
Jouni Malinen
5636991749 EAP-SIM/AKA peer: IMSI privacy attribute
Extend IMSI privacy functionality to allow an attribute (in name=value
format) to be added using the new imsi_privacy_attr parameter.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-25 20:18:40 +03:00
Jouni Malinen
1004fb7ee4 tests: Testing functionality to discard DPP Public Action frames
This can be used to make sure wpa_supplicant does not process DPP
messages sent in Public Action frames when a test setup is targeting
DPP-over-TCP.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 23:30:39 +03:00
Jouni Malinen
3550696160 tests: Add forgotten files for expired IMSI privacy cert tests
Fixes: 426932f061 ("tests: EAP-AKA and expired imsi_privacy_key")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 21:16:36 +03:00
Jouni Malinen
b9a222cdd7 tests: sigma_dut and DPP curve-from-URI special functionality
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 12:49:27 +03:00
Jouni Malinen
fa36e7ee48 tests: sigma_dut controlled STA and EAP-AKA parameters
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:44:03 +03:00
Jouni Malinen
99165cc4b0 Rename wpa_supplicant imsi_privacy_key configuration parameter
Use imsi_privacy_cert as the name of the configuration parameter for the
X.509v3 certificate that contains the RSA public key needed for IMSI
privacy. The only allowed format for this information is a PEM-encoded
X.509 certificate, so the previous name was somewhat confusing.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:44:03 +03:00
Jouni Malinen
dde7f90a41 tests: Update VM setup example to use Ubuntu 22.04 and UML
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:34:08 +03:00
Jouni Malinen
426932f061 tests: EAP-AKA and expired imsi_privacy_key
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:34:08 +03:00
Jouni Malinen
35eda6e700 EAP-SIM peer: Free imsi_privacy_key on an error path
This is an allocated resource so it needs to be free on the error path.

Fixes: 42871a5d25 ("EAP-SIM/AKA peer: IMSI privacy")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:34:08 +03:00
Jouni Malinen
1328cdeb19 Do not try to use network profile with invalid imsi_privacy_key
Disable a network profile that has set the imsi_privacy_key if a valid
key cannot be read from the specified file. Previously, this check was
done only after having associated, but there is no point in associating
just to see EAP authentication fail in such a case. This is needed for
avoiding connection attempts if the X.509 certificate for IMSI privacy
has expired.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:34:08 +03:00
Jouni Malinen
d1652dc7cc OpenSSL: Refuse to accept expired RSA certificate
This is needed for IMSI privacy to avoid trying to use an expired public
key.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:32:56 +03:00
Jouni Malinen
866e7b7458 OpenSSL: Include rsa.h for OpenSSL 3.0
This is needed to get RSA_PKCS1_OAEP_PADDING.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 23:13:28 +03:00
Jouni Malinen
bc99366f9b OpenSSL: Drop security level to 0 with OpenSSL 3.0 when using TLS 1.0/1.1
Commit 9afb68b039 ("OpenSSL: Allow systemwide secpolicy overrides for
TLS version") with commit 58bbcfa31b ("OpenSSL: Update security level
drop for TLS 1.0/1.1 with OpenSSL 3.0") allow this workaround to be
enabled with an explicit network configuration parameter. However, the
default settings are still allowing TLS 1.0 and 1.1 to be negotiated
just to see them fail immediately when using OpenSSL 3.0. This is not
exactly helpful especially when the OpenSSL error message for this
particular case is "internal error" which does not really say anything
about the reason for the error.

It is is a bit inconvenient to update the security policy for this
particular issue based on the negotiated TLS version since that happens
in the middle of processing for the first message from the server.
However, this can be done by using the debug callback for printing out
the received TLS messages during processing.

Drop the OpenSSL security level to 0 if that is the only option to
continue the TLS negotiation, i.e., when TLS 1.0/1.1 are still allowed
in wpa_supplicant default configuration and OpenSSL 3.0 with the
constraint on MD5-SHA1 use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 17:01:35 +03:00
Johannes Berg
39e6623082 tests: Work around reentrant logging issues due to __del__ misuse
Unfortunately, some objects (WlantestCapture, WpaSupplicant
and wpaspy.Ctrl) use __del__ and actually have some logic
there. This is more or less wrong, and we should be using
context managers for it. However, cleaning that up is a
pretty large task.

Unfortunately, __del__ can cause reentrant logging which is
wrong too, because it might be invoked while in the middle
of a logging call, and the __del__ of these objects closes
connections and logs while doing that.

Since we're (likely) using cpython, we can work around this
by explicitly calling gc.collect() in a context where the
logging and close is fine, not only ensuring that all the
connections are closed properly before the next test, but
also fixing the issue with reentrant logging.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2022-05-22 11:46:57 +03:00
Jouni Malinen
72641f924e tests: Clean up failed test list in parallel-vm.py
Instead of printing a very long line of the failed tests, print the test
case names on separate lines up to the number of available lines at the
bottom of the screen. This avoids some issues with curses and overlong
lines. Furthermore, display the last failed test cases instead of
somewhat confusing sequence of test case names from the VMs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 11:43:38 +03:00
Jouni Malinen
e36a7c7940 tests: Support pycryptodome
This is a drop-in replacement for pycrypto and the only version that is
now available in Ubuntu 22.04.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 11:08:59 +03:00
Jouni Malinen
a44744d3bb tests: Set ECB mode for AES explicitly to work with cryptodome
AES.new() needs the mode to be set explicitly.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 11:08:23 +03:00
Jouni Malinen
e90ea900a9 tests: sigma_dut DPP TCP Configurator as initiator with addr from URI
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-19 22:54:44 +03:00