Commit graph

10228 commits

Author SHA1 Message Date
Sunil Dutt
ce7d0eb184 Update AP WPA/RSN IE on all associations if driver can select BSS
It is possible for driver-based BSS selection to end up reassociating
back to the current AP. If wpa_supplicant preferred another BSS, it
would have updated the internal knowledge of the AP's WPA/RSN IE when
requesting a new connection. In the special case of existing association
and new association being with the same BSS that is different from the
wpa_supplicant preference, association event processing skipped the
WPA/RSN IE update. This could result in the following 4-way handshake
getting rejected due to incorrectly detected mismatch with AP's RSN/WPA
IE between Beacon/Probe Response frame and EAPOL-Key msg 3/4.

Fix this by updating the AP WPA/RSN IE on all association events when
driver-based BSS selection is used regardless of whether the BSSID
changes. This could also cover a theoretical case of the AP changing its
RSN/WPA IE at the very moment we try to reassociate back to the same
BSS.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-17 17:40:40 +07:00
Jouni Malinen
43fa110b0b Drop some control interface debug print verbosity for send operations
These prints were at DEBUG level (-d), but they can be very frequent, so
drop them to MSGDUMP (-dd). This allows the prints to be suppressed in
common debugging cases while still leaving them easily enablable to
debug control interface issues without having to enable excessive
debugging.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-10 11:19:44 +03:00
Jouni Malinen
8db9a79d41 Reduce debug verbosity for read-only control interface commands
Commands like BSS and GET_NETWORK are used in some cases very frequently
and those can increase the amount of debug information from
wpa_supplicant without significant benefit. These were logged at the
DEBUG level (-d). Move logging of such read-only commands (i.e., no new
wpa_supplicant operation is started based on it) to EXCESSIVE level
(-ddd) which was already used for the PING command.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-10 11:17:19 +03:00
Jouni Malinen
7cb9bb4d9b WPA: Do not print GTK in debug log unless requested
The GTK value received in RSN (WPA2) group rekeying did not use the
wpa_hexdump_key() version of debug printing that is conditional on -K
being included on the command line.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-09 17:39:57 +03:00
Jouni Malinen
4b9a395e29 WPS: Reduce struct wps_parse_attr size
Use shorter variables for storing the attribute lengths and group these
variables together to allow compiler to pack them more efficiently. This
reduces the struct size from 960 bytes to 760 bytes in 64-bit builds.
This reduces stack use in number of functions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 23:02:19 +03:00
Jouni Malinen
b664ef1c0d WPS: Reduce wps_ap_priority_compar() stack use
There is no need to maintain two concurrent instances of struct
wps_parse_attr in this function. Share a single structure for parsing
both IEs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 22:52:45 +03:00
Jouni Malinen
53bd8653c2 tests: WPS and DISABLE/ENABLE AP
This is a regression test case for the issue fixed by the previous
commit (hapd->num_probereq_cb not getting cleared on deinit).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 20:53:23 +03:00
Chen, Yi
24fd20438f WPS: Fix num_probereq_cb clearing on DISABLE to avoid segfault
Reset hapd->num_probereq_cb to 0 on an interface deinit to avoid
unexpected behavior if the same interface is enabled again without fully
freeing the data structures. hostapd_register_probereq_cb() increments
hapd->num_probereq_cb by one and leaves all old values unchanged. In
this deinit+init case, that would result in the first entry in the list
having an uninitialized pointer and the next Probe Request frame
processing would likely cause the process to terminate on segmentation
fault.

This issue could be hit when hostapd was used with WPS enabled (non-zero
wps_state configuration parameter) and control interface command DISABLE
and ENABLE were used.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 20:51:58 +03:00
Jouni Malinen
ae3eacf771 tests: WPS ER learn OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 17:51:55 +03:00
Jouni Malinen
f0f82bd82f WPS ER: Clean up WPS session on PutMessage error cases
This is needed to allow new operation to be started after an error
without having to wait for the AP entry to time out.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 17:45:53 +03:00
Jouni Malinen
db9c88ebb5 tests: WPS ER SetSelectedRegistrar OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 17:27:14 +03:00
Jouni Malinen
fe67b94506 tests: WPS ER OOM in PutWLANResponse generation
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 17:11:41 +03:00
Jouni Malinen
3d105cdff6 tests: WPS ER OOM in STA add
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 17:04:57 +03:00
Jouni Malinen
18478107c2 tests: WPS ER and OOM in HTTP response generation
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 16:59:19 +03:00
Jouni Malinen
a302ee342c tests: Use sqlite3.Binary() with the log files
This is needed to avoid issues in some cases where 8-bit bytestrings may
be present in the otherwise text debug log.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 16:53:23 +03:00
Jouni Malinen
eb95ced2d2 tests: WPS ER subscribe OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 16:38:38 +03:00
Jouni Malinen
d840350aca tests: WPS ER caching AP settings (OOM)
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 16:31:38 +03:00
Jouni Malinen
7511ead0a7 tests: WPS against external implementation
This adds a Python-based minimal WSC protocol implementation to allow
more testing coverage to be reached for various error cases in protected
attributes. The wps_ext test case completes successful exchange in both
the Enrollee and Registrar roles acting in the middle of AP and STA. The
other test cases cover error cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 15:20:04 +03:00
Jouni Malinen
07536b18ce tests: WPS ER init failure
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 13:47:08 +03:00
Jouni Malinen
4c355e3ed1 tests: WPS AP configured for special ap_setup_locked=2 mode
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-07 13:42:30 +03:00
Jouni Malinen
d91a64c426 tests: WPS AP and UPnP event subscription and many events
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-06 11:56:10 +03:00
Jouni Malinen
61c3d464e6 tests: Multiple WPS ERs adding a new enrollee using PIN
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-06 11:32:02 +03:00
Jouni Malinen
084780f1ca tests: D-Bus GroupFormationFailure signal
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 23:01:20 +03:00
Nishant Chaprana
2a95fac944 P2P: Add D-Bus signal GroupFormationFailure
This is similar to the control interface event
P2P-GROUP-FORMATION-FAILURE.

Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2015-09-05 23:01:20 +03:00
Jouni Malinen
926404a6b2 tests: WPS config method update for WPS and P2P
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 21:58:18 +03:00
Jouni Malinen
1067f49520 WPS: Allow config_methods to be cleared with an empty string
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 21:49:38 +03:00
Jouni Malinen
8aab52461d tests: IBSS RSN OOM during wpa_init
This is a regression test for a segfault that was fixed in the previous
commit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 21:35:58 +03:00
Jouni Malinen
6f416c7867 RSN IBSS: Fix segfault on error path
If wpa_init() fails, wpa_deinit(NULL) must not be called to avoid
hitting a NULL pointer dereference.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 21:35:16 +03:00
Jouni Malinen
2fca1f67cf tests: Secure mesh network setup failing due to wpa_init() OOM
This is a regression test for incorrect error path behavior that was
fixed in the previous commits.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 21:31:25 +03:00
Masashi Honma
449d63d6b7 mesh: Fix memory leak on error path
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-09-05 21:31:25 +03:00
Masashi Honma
a5d2bf2473 mesh: Fix segfault on error path
When wpa_init() in __mesh_rsn_auth_init() failed, empty rsn->auth caused
segmentation fault due to NULL pointer dereference when wpa_deinit() was
called. Fix this by checking the pointer before executing deinit steps.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-09-05 21:31:25 +03:00
Masashi Honma
f029c44cf2 mesh: Add RSN IE to Mesh Peering Open/Confirm frames
The RSN IE is required by IEEE Std 802.11-2012 on SAE use case:
Table 8-262 Mesh Peering Open frame Action field format
Table 8-263 Mesh Peering Confirm frame Action field format

Add the RSN IE to these frames.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-09-05 21:19:25 +03:00
Masashi Honma
8a51dcbc2f mesh: Rename IE field to clarify its use
This is used only for RSNE.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-09-05 21:15:53 +03:00
Jouni Malinen
faf427645a TDLS: Use proper IE parsing routine for non-EAPOL-Key cases
wpa_supplicant_parse_ies() was never supposed to be used as a generic IE
parser, i.e., it is for the specific purpose of parsing EAPOL-Key Key
Data IEs and KDEs. TDLS used this function for parsing generic AP IEs
and while that works, it resulted in confusing "WPA: Unrecognized
EAPOL-Key Key Data IE" debug messages. Clean this up by using
ieee802_11_parse_elems() for the cases where generic IEs are being
parsed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 20:51:11 +03:00
Jouni Malinen
dcc8bc82e0 Add BSS operating frequency to more debug messages
This makes it easier to analyze debug logs when figuring out channel
related issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 20:40:44 +03:00
Jouni Malinen
5c92d474e6 tests: AP and STA tracking with passive scan
Verify that Public Action frame from a STA is used to add a tracking
entry.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 20:29:01 +03:00
Jouni Malinen
b308a304d4 Add station tracking based on other management frame subtypes
This extends the previous tracking design to add a station entry based
on other management frames than Probe Request frames. For example, this
covers a case where the station is using passive scanning.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:38:06 +03:00
Jouni Malinen
c4f0c4d67d wpa_gui: Increase control interface message buffer for LIST_NETWORKS
Double the buffer length from 2048 to 4096 to match the length used
currently in wpa_supplicant. This allows wpa_gui to retrieve information
for more networks than previously.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:28:56 +03:00
Jouni Malinen
c1d43d0bac WPS: Merge identical error paths in ssdp_listener_open()
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:28:45 +03:00
Jouni Malinen
9425bb7828 tests: Dualband AP rejecting authentication from dualband STA on 2.4 GHz
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
0e2412d086 Add option to reject authentication on 2.4 GHz from dualband STA
The new no_auth_if_seen_on=<ifname> parameter can now be used to
configure hostapd to reject authentication from a station that was seen
on another radio.

This can be used with enabled track_sta_max_num configuration on another
interface controlled by the same hostapd process to reject
authentication attempts from a station that has been detected to be
capable of operating on another band, e.g., to try to reduce likelihood
of the station selecting a 2.4 GHz BSS when the AP operates both a 2.4
GHz and 5 GHz BSS concurrently.

Note: Enabling this can cause connectivity issues and increase latency for
connecting with the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
ec4387f9c9 Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection
This allows control interface monitors to get more detailed information
in cases where wpa_supplicant-based SME receives an Authentication frame
with non-zero status code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
142f7ba643 tests: Dualband AP not replying to probes from dualband STA on 2.4 GHz
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:00 +03:00
Jouni Malinen
964f64e2ee Add option to ignore Probe Request frames on 2.4 GHz from dualband STA
The new no_probe_resp_if_seen_on=<ifname> parameter can now be used to
configure hostapd to not reply to group-addressed Probe Request from a
station that was seen on another radio.

This can be used with enabled track_sta_max_num configuration on another
interface controlled by the same hostapd process to restrict Probe
Request frame handling from replying to group-addressed Probe Request
frames from a station that has been detected to be capable of operating
on another band, e.g., to try to reduce likelihood of the station
selecting a 2.4 GHz BSS when the AP operates both a 2.4 GHz and 5 GHz
BSS concurrently.

Note: Enabling this can cause connectivity issues and increase latency
for discovering the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:53:15 +03:00
Jouni Malinen
c58b5f65b1 tests: Unconnected station tracking
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:30:28 +03:00
Jouni Malinen
a65a9b8d67 hostapd: Add mechanism to track unconnected stations
hostapd can now be configured to track unconnected stations based on
Probe Request frames seen from them. This can be used, e.g., to detect
dualband capable station before they have associated. Such information
could then be used to provide guidance on which colocated BSS to use in
case of a dualband AP that operates concurrently on multiple bands under
the control of a single hostapd process.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:11:11 +03:00
Jouni Malinen
6ebe816be0 wpa_priv: Add authentication command and event
These are needed to work with nl80211 driver interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 13:21:17 +03:00
Jouni Malinen
06f52b12f9 wpa_priv: Add support for EVENT_SCAN_STARTED
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:39:11 +03:00
Jouni Malinen
d01136a06e wpa_priv: Print unsupported driver event name in debug log
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:35:59 +03:00
Jouni Malinen
c968f2d56c wpa_priv: Clear extended_capa pointers
For now, there is no support for passing extended_capa pointers through
the driver_privsep.c interface from wpa_priv. Avoid leaving bogus
pointers by explicitly clearing these on both wpa_priv and
wpa_supplicant sides.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:32:58 +03:00