Commit graph

18650 commits

Author SHA1 Message Date
Jouni Malinen
d12a3dce82 wlantest: Store and check SNonce/ANonce for FT Authentication
Store SNonce and ANonce from FT Authentication frames during FT
over-the-air so that these values are available for processing the FT
reassociation frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-28 13:25:07 +03:00
Jouni Malinen
8cf919ffd5 wlantest: FTE MIC calculation for MLO Reassociation Response frame
Use the MLD MAC addresses and MLO-specific MIC calculation rules per
IEEE P802.11be/D4.0, 13.8.5.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-28 13:25:07 +03:00
Jouni Malinen
78b153f90a Calculate defragmented FTE length during IE parsing
Get rid of the warning about unrecognized Fragment element when FTE is
fragmented and make the total length of the FTE itself and the following
Fragment elements available. For now, use a separate variable for the
total length to avoid confusing existing callers.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-28 13:25:07 +03:00
Jouni Malinen
aa08d9d768 Fix use of defragmented FTE information
The FTE parser itself used valid data, but the reassembled buffer was
available only during the parser run. That buffer will be needed for the
caller as well since most of the parsed data is used as pointers instead
of copied data.

Store the reassembled buffer in struct wpa_ft_ies and require
wpa_ft_parse_ies() callers to use wpa_ft_parse_ies_free() to free any
possibly allocated temporary data after wpa_ft_parse_ies() calls that
return success (0).

Fixes: 43b5f11d96 ("Defragmentation of FTE")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-28 13:25:05 +03:00
Jouni Malinen
ac9bf1cc2a Decrement hmac_sha*_vector() maximum num_elem value to 11
This replaces the earlier commit 4c079dcc64 ("Increment
hmac_sha*_vector() maximum num_elem value to 25") with a smaller
increment of just one extra element since the updated FTE MIC
calculation design does not use separate elements. This reduces stack
memory need. In addition, this starts using a define value for the
maximum number of vector elements to make this easier to change and to
make the code more readable.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-25 11:34:14 +03:00
Jouni Malinen
7381c60db8 FT: Make FTE MIC calculation more flexible
Generate the "extra" data buffer outside wpa_ft_mic() to make this
function easier to share for MLO FT Reassociation Response frame. This
replaces the earlier design in commit e6f64a8e1d ("FT: FTE MIC
calculation for MLO Reassociation Request frame").

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-25 11:28:44 +03:00
Jouni Malinen
ff02f734ba wlantest: Allow specific link BSS to be found with bss_find_mld()
Make this function more capable to address cases where a specific
affiliated link of an AP MLD needs to be found.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-25 11:19:24 +03:00
Jouni Malinen
a83575df59 wlantest: FTE MIC calculation for MLO Reassociation Request frames
SPA (FTO's MAC address) and AA (FTR's MAC address) are the MLD MAC
addresses when using MLO and the Reassociation Request frame will also
include the non-AP STA MAC addresses for the requested links.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Jouni Malinen
e6f64a8e1d FT: FTE MIC calculation for MLO Reassociation Request frame
Extend wpa_ft_mic() to take in an array of link addresses to allow the
FTE MIC to be calculated for Reassociation Request frame as described in
IEEE P802.11be/D4.0, 13.8.4. This commit does not change actual
behavior, i.e., this is just preparing wpa_ft_mic() and the existing
callers with a new argument.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Jouni Malinen
4c079dcc64 Increment hmac_sha*_vector() maximum num_elem value to 25
This is needed for FTE MIC calculation for Reassociation Request frmae
when using MLO which could add 15 link addresses into the input data.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Jouni Malinen
6ae43bb103 wlantest: Learn link address for assoc link from (Re)Association Request
Store the non-AP MLD link address of the link that is used for
association when processing (Re)Association Request frames. This is
needed to get the full set of link addresses when 4-way handshake is not
used (e.g., for FT protocol).

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Jouni Malinen
19f33d7929 wlantest: Learn the Link ID for AP MLD affiliated BSSs
This allows the Link ID to be determined based on the BSS entry when
processing a frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Jouni Malinen
37c87efecf wlantest: Search SPA using MLO aware find for FT Request/Response frame
This is needed to be able to find a previously added STA entry when
roaming using FT over-the-DS back to an AP MLD that was used previously.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-24 18:10:47 +03:00
Veerendranath Jakkam
104aa291e5 wlantest: Fix FT over-the-DS decryption
Use STA address indicated in FT Request/Response frames instead of
transmit or receive addresses for creating/finding STA instance.

For MLO to MLO roaming:
1. STA may use different link compared to FT Action frames negotiated
   links.
2. STA may reassociate with target AP MLD with different set of
   links compared to links connected to current AP MLD.

So create STA with MLD MAC address and attach to one of the BSS
affiliated with target AP MLD. Update link address of the STA and BSS
during processing of the Reassociation Request frame.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-08-24 18:10:43 +03:00
Veerendranath Jakkam
628b9f1022 wlantest: Derive PMK-R1 and PTK using AA/SPA for MLO FT over-the-DS
Use AP and STA addresses indicated in FT Request/Response frames for
PMK-R1 and PTK derivation instead of the addresses in the BSS and STA
entries. This is needed for MLO to use the MLD MAC address instead of
one of the link addresses.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-08-24 16:42:22 +03:00
Veerendranath Jakkam
9318db7c38 wlantest: Use local variables for AA/SPA in FT Request/Response processing
This makes the code more readable by getting rid of the multiple
instances of references to the specifiec fields within the FT Action
frame.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-08-24 16:37:35 +03:00
Yu Wang
338a78846b Add a QCA vendor sub command for transmit latency statistics
Add a new QCA vendor sub command QCA_NL80211_VENDOR_SUBCMD_TX_LATENCY to
configure, retrieve, and report per-link transmit latency statistics.

When used as a command, userspace configures transmit latency monitoring
and get the corresponding statistics of the last period. When used as a
command response, driver replies the get action from userspace with the
statistics of the last period. When used as an event, driver reports the
statistics periodically.

Signed-off-by: Yu Wang <quic_yyuwang@quicinc.com>
2023-08-24 13:05:35 +03:00
Nijun Gong
1085e3bdc6 Update iface->current_mode when fetching new hw_features
When a CHANNEL_LIST_CHANGED event is received, memory of
iface->hw_features is freed and allocated again with
hostapd_get_hw_features(), but iface->current_mode still refer to the
original memory address, which is not correct since that memory has been
freed. This could happen in cases where the driver provides channel list
updates during the lifetime of the started BSS.

Fix this by updated iface->current_mode to point to the new array of hw
features.

Fixes: 0837863fbc ("AP: Handle 6 GHz AP state machine with NO_IR flags")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-22 20:56:49 +03:00
Jouni Malinen
07d3c1177b tests: Make sae_proto_hostapd_status_* more robust
The first MGMT-TX-STATUS event might be for the initial broadcast
Deauthentication frame instead of the SAE Authentication frame. Skip the
first event and try to process TX status for the first Authentication
frame instead.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-22 19:46:44 +03:00
Jouni Malinen
f91d10c0e6 tests: Update RSA 3k certificates
The previous ones expired and caused test failures.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-08-22 17:00:37 +03:00
Jouni Malinen
d606efe054 tests: Beacon rate configuration for 54 Mbps
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-18 21:16:04 +03:00
Prasanna JS
0a6842d503 nl80211: Fix beacon rate configuration for legacy rates 36, 48, 54 Mbps
Typecasting takes precedence over division here, so the legacy rates
larger than 255 * 100 kbps (i.e., 36, 48, 54 Mbps) ended up getting
truncated to invalid values.

Fix this by typecasting the value after the division.

Fixes: d4f3003c56 ("nl80211: Configure Beacon frame TX rate if driver advertises support")
Signed-off-by: Prasanna JS <quic_pjs@quicinc.com>
2023-08-18 21:15:41 +03:00
Jouni Malinen
dd1330b502 Fix hostapd interface cleanup with multiple interfaces
interfaces.iface[i] might be NULL when going through the cleanup of all
remaining interfaces at the end of the process termination. The changes
for clearing drv_priv in AP MLD cause that cleanup process to crash on
dereferencing a NULL pointer.

Fix this by explicitly checking that the interface context is available
before trying to clear the pointer to driver data.

Fixes: 7fa99b3246 ("AP: Allow starting multiple interfaces within single MLD")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-18 21:03:42 +03:00
Jouni Malinen
7637d0f250 P2P: Do not filter pref_freq_list if the driver does not provide one
wpa_drv_get_pref_freq_list() may fail and the 6 GHz channel removal
should not be done unless the operation actually succeeded. The previous
implementation ended up processing uninitialized data. This did not
really result in any observable misbehavior since the result was not
used, but this showed up as a failed test case when running tests with
valgrind.

Fixes: f0cdacacb3 ("P2P: Allow connection on 6 GHz channels if requested")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-18 20:40:12 +03:00
Jouni Malinen
884125ab7d tests: P2P autonomous GO and clearing of networking information
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-18 20:33:29 +03:00
Xin Deng
47a65ccbfd P2P: Clean wpa_s->last_ssid when removing a temporary group network
wpa_supplicant could crash due to dereferencing freed memory in a corner
case. When a reestablished P2P GO group gets removed because the
hardware mode is not supported when switching from 2.4 to 5 GHz. Group
removal in wpas_p2p_group_delete() forget to clean wpa_s->last_ssid due
to the missing wpas_notify_network_removed() call before removing the
network with wpa_config_remove_network().

That could cause a crash when flushing old BSSs which age out in
wpa_bss_flush_by_age() which uses wpa_s->last_ssid in some cases.

Fix this by invoking wpas_notify_network_removed() to clean
wpa_s->last_ssid when removing a temporary P2P group network.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-18 20:29:18 +03:00
Sunil Dutt
fe72afe713 Define QCA vendor attribute for high RSSI roam trigger threshold
Define an attribute for high RSSI roam trigger threshold. STA is
expected to trigger roam if the current connected AP's RSSI gets above
this high RSSI threshold. STA's roam attempt on high RSSI threshold aims
to find candidates from other better Wi-Fi bands.

Signed-off-by: Sunil Dutt <quic_usdutt@quicinc.com>
2023-08-17 18:41:14 +03:00
Ke Huang
e080930aa0 Define QCA vendor roam control RSSI attributes
Add three vendor roam control attributes to configure the roaming
parameters dynamically.
QCA_ATTR_ROAM_CONTROL_CONNECTED_LOW_RSSI_THRESHOLD controls the
connected AP's low RSSI threshold to trigger the neighbor lookup.
QCA_ATTR_ROAM_CONTROL_CANDIDATE_ROAM_RSSI_DIFF and
QCA_ATTR_ROAM_CONTROL_6GHZ_CANDIDATE_ROAM_RSSI_DIFF control the RSSI
difference threshold between the connected AP and the new candidate AP
for the roam to trigger.

Co-authored-by: Sunil Dutt <quic_usdutt@quicinc.com>
Signed-off-by: Sunil Dutt <quic_usdutt@quicinc.com>
2023-08-17 18:36:49 +03:00
Krunalsinh Padhar
5856373554 Extend QCA vendor command to include more parameters for netdev events
Extend enum qca_wlan_vendor_attr_mlo_peer_prim_netdev_event to add MLD
MAC address, the number of links, and link info. Link info contains
ifindex and MAC address of each link of a non-AP MLD that was negotiated
in ML association.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-17 18:26:21 +03:00
Chunquan Luo
6f293b3211 QCA vendor attributes for updating roaming AP BSSID info
Add vendor attribute IDs QCA_WLAN_VENDOR_ATTR_ROAM_STATS_ORIGINAL_BSSID,
QCA_WLAN_VENDOR_ATTR_ROAM_STATS_CANDIDATE_BSSID, and
QCA_WLAN_VENDOR_ATTR_ROAM_STATS_ROAMED_BSSID for updating roaming AP
BSSID to user space to enable user space collecting the BSSID for
roaming issues.

Signed-off-by: Chunquan Luo <quic_chunquan@quicinc.com>
2023-08-17 18:13:54 +03:00
Chenming Huang
7e1f5c44c9 EHT: 320 MHz DFS support
Add support to obtain the start channel when checking whether DFS
is required when using 320 MHz channels.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-16 21:05:58 +03:00
Chenming Huang
a94ba53228 EHT: Support puncturing for 320 MHz channel bandwidth
Determine the channel width by operating class for the 6 GHz band when
validating puncturing bitmap. This is needed to allow puncturing to be
used with 320 MHz channels.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-16 20:59:14 +03:00
Jouni Malinen
bc0268d053 wlantest: Guess SAE/OWE group from EAPOL-Key length mismatch
The MIC length depends on the negotiated group when SAE-EXT-KEY or OWE
key_mgmt is used. wlantest can determine the group if the capture file
includes the group negotiation, i.e., the initial association when a PMK
was created. However, if the capture file includes only an association
using PMKSA caching, the group information is not available. This can
result in inability to be able to process the EAPOL-Key frames (e.g.,
with the "Truncated EAPOL-Key from" message).

If the negotiated group is not known and an EAPOL-Key frame length does
not seem to match the default expectations for group 19, check whether
the alternative lengths for group 20 or 21 would result in a frame that
seems to have valid length. If so, update the STA entry with the guessed
group and continue processing the EAPOL-Key frames based on this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-11 20:35:34 +03:00
Ilan Peer
bd209633eb AP: Use is_zero_ether_addr() to check if BSSID is NULL
Use helper function is_zero_ether_addr() for checking empty bssid
value in hostapd_driver_init().

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Manaswini Paluri <quic_mpaluri@quicinc.com>
2023-08-11 12:13:20 +03:00
Ilan Peer
763a19286e AP: Add configuration option to specify the desired MLD address
Add mld_addr configuration option to set the MLD MAC address.
The already existing bssid configuration option can be used to
control the AP MLD's link addresses.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Manaswini Paluri <quic_mpaluri@quicinc.com>
2023-08-11 12:12:43 +03:00
Allen.Ye
2763d1d97e hostapd: Fix AID assignment in multiple BSSID
When STAs connect to transmitted BSS and nontransmitted BSS, the
AP should assign the aIDs from the same pool.

Use the transmitted BSS AID pool to assign AIDs when the AP enables
multiple BSSID.

Signed-off-by: Allen.Ye <allen.ye@mediatek.com>
2023-08-11 12:04:59 +03:00
Michael Lee
bc0636841a wpa_supplicant: Fix configuration parsing error for tx_queue_*
In the original flow, after hostapd_config_tx_queue() successfully
parses a tx_queue variable, wpa_config_process_global() would not return
immediately. Then it would print out "unknown global field" later and set
return val to -1.

Return success (0) after hostapd_config_tx_queue() successfully parses a
tx_queue variable to fix this.

Fixes: 790026c3da ("Allow TX queue parameters to be configured for wpa_supplicant AP/P2P GO")
Signed-off-by: Michael Lee <michael-cy.lee@mediatek.com>
2023-08-11 11:53:16 +03:00
Felix Fietkau
a685d84139 BSS coloring: Fix CCA with multiple BSS
Pass bss->ctx instead of drv->ctx in order to avoid multiple reports for
the first bss. The first report would otherwise clear hapd->cca_color and
subsequent reports would cause the iface bss color to be set to 0.
In order to avoid any issues with cancellations, only overwrite the color
based on hapd->cca_color if it was actually set.

Fixes: 33c4dd26cd ("BSS coloring: Handle the collision and CCA events coming from the kernel")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2023-08-11 11:50:34 +03:00
Henry Ptasinski
34841cfd9a Minor formatting changes to CCMP test vectors
Signed-off-by: Henry Ptasinski <henry@e78com.com>
2023-08-11 11:46:37 +03:00
Henry Ptasinski
30771e6e05 Include PTID in PV1 nonce construction for CCMP test vector
Includ the PTID in the PV1 nonce construction.

Signed-off-by: Henry Ptasinski <henry@e78com.com>
2023-08-11 11:46:29 +03:00
Henry Ptasinski
232667eafe Fix CCMP test vector issues
Commit b20991da69 introduced errors in
the order of arguments to the calls of ccmp_decrypt() and
ccmp_256_decrypt(). Correct the order of arguments.

Fixes: b20991da69 ("wlantest: MLD MAC Address in CCMP/GCMP AAD/nonce")
Signed-off-by: Henry Ptasinski <henry@e78com.com>
2023-08-11 11:46:22 +03:00
Ilan Peer
b7db495ad9 AP: Fix ieee802_1x_ml_set_sta_authorized()
One of the conditions in the function should be inverted. Fix it.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-08-11 11:27:02 +03:00
Chien Wong
8f148d5132 Fix a compiler warning on prototype mismatch
Fix the warning:
wpa_supplicant.c:2257:5: warning: conflicting types for
‘wpas_update_random_addr’ due to enum/integer mismatch; have ‘int(struct
wpa_supplicant *, enum wpas_mac_addr_style,  struct wpa_ssid *)’
[-Wenum-int-mismatch]
 2257 | int wpas_update_random_addr(struct wpa_supplicant *wpa_s,
      |     ^~~~~~~~~~~~~~~~~~~~~~~
In file included from wpa_supplicant.c:32:
wpa_supplicant_i.h:1653:5: note: previous declaration of
‘wpas_update_random_addr’ with type ‘int(struct wpa_supplicant *, int, 
struct wpa_ssid *)’
 1653 | int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int
style,
      |     ^~~~~~~~~~~~~~~~~~~~~~~

Fixes: 1d4027fdbe ("Make random MAC address style parameters use common enum values")
Signed-off-by: Chien Wong <m@xv97.com>
2023-08-11 11:25:36 +03:00
Jouni Malinen
011775af94 tests: Check for beacon loss when using beacon protection
This extends testing coverage to detect an issue that was fixed in
commit bf9cbb462f ("Fix writing of BIGTK in FT protocol").

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 21:28:14 +03:00
Jouni Malinen
bf9cbb462f Fix writing of BIGTK in FT protocol
A copy-paste issue in wpa_ft_bigtk_subelem() ended up encoding the IGTK
value instead of the BIGTK when providing the current BIGTK to the STA
during FT protocol. Fix this to use the correct key to avoid issues when
beacon protection is used with FT.

Fixes: 16889aff40 ("Add BIGTK KDE and subelement similarly to IGTK")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 21:17:40 +03:00
Vinay Gannevaram
084745ffc5 Add QCA vendor attributes for NDP setup
QCA vendor extension is used for NDP setup. This defines the new
attributes QCA_WLAN_VENDOR_ATTR_NDP_CSIA_CAPABILITIES and
QCA_WLAN_VENDOR_ATTR_NDP_GTK_REQUIRED to support GTKSA, IGTKSA, and
BIGTKSA for NDP setup.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 18:22:36 +03:00
Jouni Malinen
770760454f wlantest: Do not update BSS entries for other AP MLDs in PTK cloning
The new PTK migth need to be copied to another MLO STA entry, but that
operation should not modify the MLD MAC address of unrelated AP MLDs.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 12:37:47 +03:00
Jouni Malinen
709d46da73 wlantest: Do not claim update to AP MD MAC address if no change
The "Updated AP MLD MAC Address from EAPOL-Key 1/4" can be confusing
when there is actually no change.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 12:37:47 +03:00
Jouni Malinen
a19fcf685c wlantest: Include the MLD MAC address of the AP MLD in new-STA prints
This makes the "Discovered new STA" entries in the debug log easier to
use when analyzing roaming cases with MLO.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 12:37:47 +03:00
Jouni Malinen
5434a42ec6 wlantest: Search for FT Target AP using MLD MAC address as well
When FT over-the-DS is used with MLO, the Target AP Address field is
expected to identify the AP MLD using its MLD MAC address.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-08-10 12:37:43 +03:00