Currently while deciding to create a new Multiple BSSID element based on
the condition when the length reaches 255, the length value being used
is the total element length (including the length of the Element ID and
Length fields as well). However, the value in the length field denotes
the number of octets following it and excluding itself. Hence including
the total length is wrong. This leads to incorrect count of Multiple
BSSID elements.
And while filling the data, the length is considered porperly as it
should be hence we are filling more data in a single go and all data is
filled in MBSSID count which is less than originally calculated. This
ultimately leads to incorrect length calculation during nla_put() and
setting the beacon to the driver fails while putting the Multiple BSSID
element data into the netlink socket buffer.
Fix this issue by considering the length excluding the Element ID and
Length field sizes.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Share VLAN info in RRB when the driver advertises support for VLAN
offload (WPA_DRIVER_FLAGS_VLAN_OFFLOAD). sta->vlan_desc is unused in
this case, only sta->vlan_id is used. Skip the checks that are based on
sta->vlan_desc.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
The previous timeout allowed only a single chirping round, and sometimes
not even that full round. That resulted in test failures for cases where
there was not really any incorrect behavior.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Stop dev[0] from trying to associate at the end of the test case to
reduce risk for leaving out some pending operations that could mess up
the following test case.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Handle the cases where the first attempt to start scan fails due to an
ongoing scan. Stop such scan and try again instead of failing the test
case immediately.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This avoids race conditions with UML time-travel where some cases ended
up not reporting the DPP-TX-STATUS event and that resulted in discarding
events that are more important to verify for correct behavior.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
One of the sigma_dut testing cases missed the t.join() call to make
surte the separate thread terminated. This could result in confusing
"unexpected stdout output" in a middle of an unrelated test case.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Stop and restart P2P_FIND on dev[1] to avoid timing issues where the
wait on dev[1] makes the test case fail even though this was trying to
verify that dev[0] is reacting quickly enough.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This helper is of no real use anymore, so get rid of it. This completes
send_and_recv*() cleanup. What remains is the most generic
send_and_recv() and two wrappers for it to cover the most common simpler
cases.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a variant for the second most common case of send_and_recv() needs:
send a command with a special response handling.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a variant for the most common case of send_and_recv() needs:
send a command without needing a special response handling. In addition,
move the helper functions into driver_nl80211.h since these are now
simple wrappers for the more flexible send_and_recv().
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is not really that helpful as a separate helper function, so get
rid of one of the many send_and_recv() variants.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is not helpful as a separate helper function anymore, so get rid of
one of the many send_and_recv() variants.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is independent of the NL80211_ATTR_SOCKET_OWNER use, so add these
attributes from a separate helper function that is called only from
locations that actually start an operation that uses EAPOL frames.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Doing this based on driver support for control port RX or SAE seems like
undesired extra complexity. Just use this in all cases where the special
handle for a longer term operation, like connection or AP mode
operation, is needed.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a step towards cleaning up all the workarounds that have showed
up over the years and made the design difficult to understand. This
removes use of the separate registration of process_bss_event() as
NL_CB_VALID for the individual commands since the use of the appropriate
cb (i.e., the one from nl80211_init_bss() in these cases) will already
point to the correct handler.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This is a workaround for some race conditions where the hardcoded use of
global->nl_cb in send_and_recv() ends up getting events delivered
through unexpected context when they happen to arrive at the time when a
command is being processed.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Wait a bit between the DPP-SCAN-PEER-QR-CODE event and reporting of the
QR Code to avoid a race condition.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Avoid a race condition that could result in the relay (hostapd)
maintaining STA association with PMF and discarding of the GAS frames.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Terminate the group explicitly before cleanup to avoid a race condition
between an automatically started scan to find the GO again and the scan
started to clear the scan cache.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Wait a bit to allow stopping of the DPP_LISTEN operation to be completed
before issuing the DPP_QR_CODE command that would send the frame that
these test cases expect to not get ACKed.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Avoid potential read of one or two octets beyond the end of the
subelement when verifying that there is sufficient amount of data
included in each subelement/element within the MLE in Association
Request frames.
Signed-off-by: Jouni Malinen <j@w1.fi>
Instead of rejecting the Multi-Link element, skip unknown subelements to
be less likely to cause interop issues for future. IEEE P802.11be/D5.0
allows other optional subelements to be included here.
Signed-off-by: Jouni Malinen <j@w1.fi>
Wait some time between the first DPP Authentication Response that
indicates the response is not yet available and the second DPP
Authentication Response to make this sequence a bit more realistic and
less likely to hit race conditions with UML time-travel.
Signed-off-by: Jouni Malinen <j@w1.fi>
This function is both updating the hostapd-internal sta->flags value and
sending out the AP-STA-CONNECTED control interface message. When
authorizing a STA, the call to this function is followed by a driver
command to update the flags of the STA entry in the driver. That has a
race condition at least for UML time-travel since the AP-STA-CONNECTED
event is used as a message to wait for before running a connectivity
test or some other operation that depends on the data connection being
in working condition.
Split the function into two steps so that the driver STA entry update
can be done between those two steps for the cases where it matters for
the race condition. In other words, send the AP-STA-CONNECTED message
only after having authorized the STA in the driver.
Signed-off-by: Jouni Malinen <j@w1.fi>
Wait for hostapd to complete STA authorization before running the
connectivity test between two associated STAs.
Signed-off-by: Jouni Malinen <j@w1.fi>
The check for extra data was not dereferencing the pointer, but avoid
complaints about such uses by freeing the decrypted data only after the
check. The hexdump could have read freed memory, so that needs to be
before the freeing.
Fixes: 54ac6ff8c4 ("PKCS 1: Add function for checking v1.5 RSA signature")
Signed-off-by: Jouni Malinen <j@w1.fi>
Even though this function is documented to always return 1, be more
consistent in checking that to avoid warnings from static analyzers.
Signed-off-by: Jouni Malinen <j@w1.fi>
This memcpy was causing warnings from static analyzers since it is being
misinterpreted as copying all the data into the lnkid.bssid[] array
instead of that and the following arrays. Since the copy is not needed
at all, just use the original pointer to get rid of these warnings.
Signed-off-by: Jouni Malinen <j@w1.fi>
Verify that sta is not NULL before calling
hostapd_process_assoc_ml_info() that references this parameter. In
theory, sta might be NULL here if addition of the STA entry failed in
the 60 GHz case.
Signed-off-by: Jouni Malinen <j@w1.fi>
This line seemed to trigger SIGSEGV in some code coverage testing cases.
It is not exactly clear how that was possible, but just in case, check
that iface->current_mode is set before using it here.
Signed-off-by: Jouni Malinen <j@w1.fi>
During scan results matching for connection skip BSS entries for the
current connection if disassociation imminent is set.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
If the BSS TM Request for imminent BSS temoval is for a non-AP MLD that
has multiple affiliated links, do not schedule full disconnection since
other links remain associated.
Signed-off-by: Jouni Malinen <j@w1.fi>
Allow link removal imminent indication to be added with the new
link_removal_imminent=1 parameter to BSS_TM_REQ.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
