Commit graph

18505 commits

Author SHA1 Message Date
Vinay Gannevaram
46e6b72b7b Add a callback to notify added PMKSA cache entry details
Add a callback handler to notify details of a PMKSA cache entry when it
is added to the PMKSA cache. This can be used to provide external
components more convenient access to the PMKSA cache contents.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-28 11:39:06 +02:00
Jouni Malinen
e174ec7a07 tests: Check hostapd PID file removal in all cases
Only one of the test cases was doing this, but it's more robust for all
the cases using dynamically started hostapd process to do same.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 15:54:26 +02:00
Raphaël Mélotte
e7829e4466 tests: Add ap_reload_bss_only
The test checks that when the SSID of a BSS is changed using
SET+RELOAD_BSS, the stations already connected to other BSSes on the
same radio are not disconnected.

It also checks that stations can connect using the new SSID after the
reload.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:51:08 +02:00
Raphaël Mélotte
af1528a128 hostapd: Add RELOAD_BSS
When using multiple BSSes on a single radio, it is sometimes desirable
to reconfigure one BSS, without disconnecting the stations already
connected to other BSSes on the same radio.

When a BSS is reconfigured using the SET command, there is no "old"
configuration we can compare to (so we cannot compare a hash of the
configuration for example).

One possible solution would be to make the current RELOAD command
reload only the current BSS. However, that could break the workflow of
existing users. Instead, introduce a new RELOAD_BSS command, which
reloads only the current BSS.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:49:48 +02:00
Raphaël Mélotte
1a27b8838a tests: Add ap_config_reload_on_sighup_config_id
The test checks that when reloading the configuration with SIGHUP,
stations that are connected to BSSes whose config_id did not change are
not disconnected. It also checks that for the BSSes that have a
different config_id and SSID, the new SSID is applied correctly.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:44:58 +02:00
Raphaël Mélotte
34e4a17b48 tests: Add iface_params and bss_params to write_hostapd_config()
To make it easier to write custom hostapd configuration files, add
"iface_params" and "bss_params".

They are both meant to be lists of parameters that the user can supply
to append additional parameters to the configuration file.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:43:53 +02:00
Raphaël Mélotte
bc2b88b253 hostapd: Add config_id to GET_CONFIG output
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:42:23 +02:00
Raphaël Mélotte
b37c3fbad4 hostapd: Add config_id parameter
Add a new configuration parameter: config_id.

If set, only do hostapd_clear_old() for the BSSes for which the
config_id changed.

This makes it possible to reconfigure specific BSSes on a radio,
without disconnecting clients connected to other, unchanged BSSes of
the same radio.

This patch adapted from a patch authored by John Crispin in the
OpenWrt repository:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=package/network/services/hostapd/patches/700-wifi-reload.patch;h=c5ba631a0fc02f70714cb081b42fcf6cb9694450;hb=60fb4c92b6b0d1582d31e02167b90b424185f3a2

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:41:19 +02:00
Raphaël Mélotte
46f6a32775 Split BSS-specific hostapd_clear_old_bss() from hostapd_clear_old()
In hostapd_clear_old() multiple steps are needed to clear a BSS.
There are some places where it would be desirable to clear only some
BSSes and not all.

To make it easier to clear only some BSSes, split hostapd_clear_old()
with hostapd_clear_old_bss(), which does the same actions but on a
single BSS.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2022-11-27 15:35:26 +02:00
xinpeng wang
2afb9b1a58 dbus: Add dbus notify when wpa_s->key_mgmt changes
For WPA2/WPA3 authentication mode, wpa_supplicant needs to notify
CurrentAuthMode property change when wpa_s->key_mgmt changes, so
NetworkManager can judge whether it needs to request a password based on
this.

Call wpas_notify_auth_changed() when starting a new connection item,
i.e., after having updated wpa_s->key_mgmt.

Signed-off-by: xinpeng wang <wangxinpeng@uniontech.com>
2022-11-27 14:18:53 +02:00
Jouni Malinen
af97aaa503 tests: Random MAC address with two APs
This verifies locally generated deauthentication determination when the
MAC address changes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 14:18:53 +02:00
Andrzej Ostruszka
98e9d553f2 nl80211: Check previous MAC address for locally-generated-deauth
When using MAC randomization wpa_supplicant can change the local MAC
address during roaming scenario:

1. We attach to AP1 (with MAC1/SSID1).
2. Roaming to AP2 (with MAC2/SSID2) is started:
  a) we send DEAUTH(for AP1, with MAC1)
  b) we change MAC to MAC2 due to randomization
  c) we start authentication for AP2
  d) we get notification about DEAUTH for AP1 (which we ignore)
  e) we complete association with AP2

In point 2d we completely ignore the notification which later causes
problems. This happens if the deauthentication event is generated by the
local driver (e.g., due to beacon loss) instead of AP2 sending an
explicit Deauthentication frame.

The intended behavior is as follows: during roaming we generate DEAUTH
(2a) and signal this event right away. To protect from handling of our
own DEAUTH for the 2nd time supplicant marks 'ignore_next_local_deauth'
variable.  In point 2d we should receive this notification and clear the
flag but this does not happen because MAC1 in the notification is not
the current MAC address (it has been changed in 2b) so this notification
is ignored as a one with a "foreign" address.

So we end up successfully at AP2 but with 'ignore_next_local_deauth'
still set which causes problems.  For example if AP2 shuts down it has
been observed on some drivers that the DEAUTH notification is generated
as a local one and since we have flag to ignore it nothing is reported
over D-Bus.

To address the problem let's store the previously used MAC address and
use it for checking for foreign address (in combination with the current
one).

Signed-off-by: Andrzej Ostruszka <amo@semihalf.com>
2022-11-27 14:18:53 +02:00
Kaidong Wang
87ffa1bec6 wpa_supplicant: Convert SSID into printable form before printing
SSID may include unprintable characters. This change converts
unprintable characters into printable form before printing SSID in the
function wpas_send_ctrl_req(). The conversion is based on the function
wpa_ssid_txt().

Signed-off-by: Kaidong Wang <kaidong@chromium.org>
2022-11-27 14:18:53 +02:00
Vinayak Yadawad
4163860605 Mark authorization completed on driver indication during 4-way HS offload
In case of drivers supporting 4-way handshake offload, mark port
authorized and state completion only if the driver advertizes authorized
state in the connect event. Otherwise there are fair chances of the
driver port authorization API getting called while 4-way handshake is in
progress at the lower layer.

In order to avoid this possible race condition always update port
authorization and supplicant state WPA_COMPLETED setting from
EVENT_PORT_AUTHORIZED context when the driver is done with the 4-way
handshake.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2022-11-27 14:18:53 +02:00
Jouni Malinen
da2ec9459c D-Bus: Split set_cred_properties() into two functions
Reduce the number of intentation levels here and make this a bit more
readable.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 14:18:53 +02:00
Damien Dejean
f5ce680ee6 D-Bus: Hotspot 2.0 credentials with multiple domains
Add the support of multiple domains for interworking credentials in
D-Bus API AddCred() using an array of strings.

Signed-off-by: Damien Dejean <damiendejean@chromium.org>
2022-11-27 14:18:53 +02:00
Janusz Dziedzic
2f739c71ce ctrl: Fix compilation with UDP control interface
Fix compilation issue when using the following build parameter:
CONFIG_CTRL_IFACE=udp-remote

Fixes: 0aae045af0 ("ctrl: Print the source address of the received commands")
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
2022-11-27 14:18:53 +02:00
Jouni Malinen
6d45481870 RSN: Split EAPOL-Key msg 3/4 processing for WPA(v1)
Separate more of WPA(v1) functionality away from the RSN processing
code path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 14:18:53 +02:00
Jouni Malinen
5b7957b7ee RSN: Split EAPOL-Key msg 1/4 processing for WPA(v1)
Separate more of WPA(v1) functionality away from the RSN processing
code path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 14:18:53 +02:00
Jouni Malinen
e5dfce38f7 RSN: Split EAPOL-Key group msg 1/2 processing more completely for WPA(v1)
Separate more of WPA(v1) functionality away from the RSN processing
code path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 14:18:53 +02:00
Jouni Malinen
5ab43c738e RSN: Split WPA(v1) processing of EAPOL-Key frames into a separate function
This is a step in separating RSN and WPA(v1) processing of EAPOL-Key
frames into separate functions. This allows the implementation to be
simplified and potentially allows the validation rules to be made
stricter more easily. This is also a step towards allowing WPA(v1)
functionality to be removed from the build in the future.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-27 08:30:58 +02:00
Jouni Malinen
f7fd891c70 Fix a typo in driver ops poll() documentation
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-26 20:48:21 +02:00
Damien Dejean
5f89fffb76 tests: New Passpoint Home OI parameters
Move testing to use the new Home OI parameters while maintaining a
couple of tests for the deprecated parameters.

Signed-off-by: Damien Dejean <damiendejean@chromium.org>
2022-11-26 18:59:10 +02:00
Damien Dejean
3268ec0acf HS20: Use required_home_ois in hs20-osu-client
Move from the now deprecated roaming_consortium and
required_roaming_consortium credential parameters to home_ois and
required_home_ois.

Signed-off-by: Damien Dejean <damiendejean@chromium.org>
2022-11-26 17:58:57 +02:00
Damien Dejean
58eb905ad3 HS20: Support credentials with multiple home OIs
Until now Hotspot 2.0 credentials were only supporting one home OI (with
roaming_consortium option) and one required home OI (with
required_roaming_consortium option). To improve the compliance with
Passpoint specification, add the support for multiple home and required
OIs.

The lists of OIs are provided using two new configuration options
home_ois and required_home_ois that expect a list of OIs formatted as
the roaming_consortiums list. It allows to keep the old options to avoid
breaking currently running configurations and better fits the vocabulary
used in the spec.

The OI match algorithm is updated to implement the behavior described in
Passpoint specification v3.2 section 9.1.2 (Home OIs nodes description
PerProviderSubscription/<X+>/HomeSP/HomeOIList/<X+>).

Signed-off-by: Damien Dejean <damiendejean@chromium.org>
2022-11-26 17:58:54 +02:00
Norman Hamer
0143dc1cb6 OpenSSL: Load OpenSSL 3.0 legacy provider but let default be loaded
The default provider is being loaded here explicitly only because
OSSL_PROVIDER_load() disables the fallback provider loading (on either
success or failure). If the legacy provider fails to load, which it may
in some configurations, it will never load the default provider.

Just use the formulation which attempts to load without changing the
fallback behavior.

"default" will still be/only be loaded if no other provider (notably
FIPS) is loaded to provide algorithms.

Signed-off-by: Norman Hamer <nhamer@absolute.com>
2022-11-26 12:29:14 +02:00
Norman Hamer
fef4c6cb0d OpenSSL: Don't provide implementation of DES/RC4 for FIPS builds
DES and RC4 are not allowed in such builds, so comment out des_encrypt()
and rc4_skip() from the build to force compile time failures for cases
that cannot be supported instead of failing the operations at runtime.
This makes it easier to detect and fix accidental cases where DES/RC4
could still be used in some older protocols.

Signed-off-by: Norman Hamer <nhamer@absolute.com>
2022-11-26 11:34:30 +02:00
Jouni Malinen
1d42dafce6 RSN: Do not include RC4 use in FIPS builds
CONFIG_NO_RC4=y could have been used to remove this functionality, but
it might as well be done automatically based on CONFIG_FIPS=y as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-26 11:34:30 +02:00
Morten Brørup
df5ae2aadb Add more detailed description of RADIUS attributes in EAP user file
The description of how to use radius_accept_attr did not provide the
details on how the value is set. Extend it to cover the more complete
syntax.

Signed-off-by: Morten Brørup <mb@smartsharesystems.com>
2022-11-25 19:02:45 +02:00
Jintao Lin
0ba266d86c dbus: Add virtual interface create/remove logic to be inline with ctrl_iface
There is no way to create or remove a virtual interface with
wpa_supplicant dbus methods. The platform has to use out-of-band methods
to manage the virtual interfaces.

This change adds virtual interface create/remove logic to the dbus
methods CreateInterface and RemoveInterface to achieve similar
functionalities as wpa_cli commands interface_add and interface_remove.

Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2022-11-25 18:57:51 +02:00
Abhiram V
5102d7411f wpa_passphrase: Disable terminal echo when reading from stdin
Disable terminal echo using tcgetattr() and tcsetattr() when reading a
passphrase from stdin.

Signed-off-by: Abhiram V <abhi.raa.man.v@gmail.com>
2022-11-25 18:35:53 +02:00
Vinay Gannevaram
86ab282170 PASN: Fix passing own address and peer address to pasn_deauthenticate()
Need to copy own address and peer address locally and pass them to
pasn_deauthenticate(), because this pointer data will be flushed from
the PTKSA cache before sending the Deauthentication frame and these
pointers to then-freed memory would be dereferenced.

Fixes: 24929543 ("PASN: Deauthenticate on PTKSA cache entry expiration")
Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-25 16:47:42 +02:00
Veerendranath Jakkam
a9062432e2 wpa_cli: Fix PASN control interface commands
Map to correct control interface commands for PASN start and stop.

Fixes: ad338cfe58 ("ctrl_iface: Add support for PASN authentication")
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-25 16:45:51 +02:00
Jouni Malinen
b6d3fd05e3 FT: Use SHA256 to derive PMKID for AKM 00-0F-AC:3 (FT-EAP)
PMKSA caching for the FT initial mobility domain association was fully
defined in IEEE Std 802.11-2020. The state before that was unclear and
there has been interoperability issues in this area, so use of PMKSA
caching with FT-EAP has been disabled in wpa_supplicant by default.

The wpa_supplicant and hostapd implementation of PMKSA caching for FT
ended up using an earlier default mechanism (SHA-1) for deriving the
PMKID when using the FT-EAP. This does not match what got defined in
IEEE Std 802.11-2020, 12.11.2.5.2 (SHA256). It is not really desirable
to use SHA-1 for anything with FT since the initial design of FT was
based on SHA256. Furthermore, it is obviously not good to differ in
behavior against the updated standard. As such, there is sufficient
justification to change the implementation to use SHA256 here even
though this ends up breaking backwards compatibility for PMKSA caching
with FT-EAP.

As noted above, this is still disabled in wpa_supplicant by default and
this change results in PMKSA caching not working only in cases where it
has been enabled explicitly with ft_eap_pmksa_caching=1. Those cases
recover by falling back to full EAP authentication.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-25 09:37:17 +02:00
Mukul Sharma
ef70f814a7 Add a new QCA vendor attribute to configure wifi calling (wfc) state
Add QCA_WLAN_VENDOR_ATTR_CONFIG_WFC_STATE vendor attribute. Userspace
uses this attribute to configure wfc state to the driver/firmware. The
driver/firmware uses this information to optimize power savings, rate
adaption, roaming, etc.

Signed-off-by: Mukul Sharma <quic_mukul@quicinc.com>
2022-11-24 20:23:23 +02:00
Jouni Malinen
bb9099785e tests: WPS PBC provisioning with configured AP and passive scanning
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-24 18:54:33 +02:00
Sai Pratyusha Magam
05ec485688 WPS: Pick WPS AP based on latest received WPS IE
wpa_supplicant used the WPS IE from a Probe Response frame, if one was
received, even if there might have been a more recent Beacon frame with
an updated WPS IE. This could result in using stale information about
active WPS registrar, e.g., when operating on the 6 GHz band.

Prefer WPS IE from a Beacon frame over the default selection of Probe
Response frame (if one has been received) in cases where the Beacon
frame is received more recently than the Probe Response frame and active
WPS Registrar information is being checked. Skip this for the case where
UUID-E is needed since that is not available in the Beacon frame.

Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
2022-11-24 18:50:44 +02:00
Jouni Malinen
00bd744ed5 tests: OCV on 2.4 GHz with PMF getting enabled automatically on STA
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-24 17:21:08 +02:00
Jouni Malinen
ca4fa867d3 Enable PMF automatically if OCV is enabled
OCV cannot be used without PMF and such a configuration were to be used
with wpa_supplicant, the AP would reject the association. hostapd is
already enabling PMF automatically whenever OCV is being enabled, so do
the same with wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-24 17:16:26 +02:00
Mert Ekren
c823197bde SAE: Use Challenge Failure status code in confirm message failure cases
IEEE Std 802.11-2020, 12.4.7.6 says that status code CHALLENGE_FAILURE,
needs to be sent in case the verification action fails for SAE Confirm
message frame from a STA: "An SAE Confirm message, with a status code
not equal to SUCCESS, shall indicate that a peer rejects a previously
sent SAE Confirm message. An SAE Confirm message that was not
successfully verified is indicated with a status code of
CHALLENGE_FAILURE."

hostapd, however, did not use this status code for this case. In
ieee802_11.c the function sae_check_confirm() is called and in case of
verification failure (-1 is returned), the response is set to
WLAN_STATUS_UNSPECIFIED_FAILURE (status code = 1). Fix this to use
CHALLENGE_FAILURE.

Signed-off-by: Koen Van Oost <koen.vanoost@airties.com>
Signed-off-by: Mert Ekren <mert.ekren@airties.com>
2022-11-24 12:09:38 +02:00
Jouni Malinen
7c62bccc6e tests: SAE and preferred AP using wrong password
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-24 12:06:59 +02:00
Jouni Malinen
65c8633d90 Allow a lower priority BSS to be tried after network disabling
If a higher priority BSS has invalid security parameters, e.g., an
invalid SAE password, and a lower priority BSS is discovered only after
the local network profile has been temporarily disabled, the BSSID
ignoring mechanism is not sufficient to allow the lower priority BSS to
be tried and all consecutive attempts will continue to use the higher
priority BSS. This might prevent connection in some unexpected cases
with invalid network configuration.

Extend BSSID ignoring mechanism to work in this type of a case by
ignoring the BSSID that resulted in disabling the SSID temporarily
during the first connection attempt after having re-enabled the SSID.
This allows a lower priority BSS, if any is available in scan results,
to be tried next to see if it might have working security parameters.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-24 12:03:01 +02:00
Jouni Malinen
e91ac53d53 DFS: Do not allow channel checks to go beyond the channel list
Explicitly check for invalid cases where the configured channel and
bandwidth might result in the full channel number range going beyond the
list of supported channels to avoid reading beyond the end of the
channel buffer.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-23 22:51:50 +02:00
Vinay Gannevaram
f96dfdeef6 PASN: Fix missing libraries for libpasn.so on Android
Fixes: 08abcdf4 ("PASN: Makefile and Android.mk changes for libpasn.so")
Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-23 18:46:23 +02:00
Vinay Gannevaram
91d148f508 PASN: Fix is_pasn_auth_frame() for mgmt tx status frames
The SA/DA checks needs to be reversed for the TX case.

Fixes: 8481c750 ("PASN: Fix Authentication frame checks")
Signed-off-by: Vinay Gannevaram <quic_vganneva@quicinc.com>
2022-11-23 18:45:51 +02:00
Qiwei Cai
b6c38cee93 Skip CAC if the driver switches channel to non-DFS
If an AP is started on a DFS channel (or any channels within its
bandwidth require DFS) and DFS is offloaded to the driver, hostapd needs
to wait for CAC to complete. But the driver may not do CAC and just
switches to a non-DFS channel instead. This would result in a failure to
start the AP because hostapd fails to receive a CAC complete event and
cannot finish interface setup.

Skip CAC and complete AP setup in the channel switch event handler for
this case.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-23 18:32:46 +02:00
Sai Pratyusha Magam
080afc03d5 Add hostapd control interface command to stop logging to file
Add CLOSE_LOG command to stop hostapd logging to file. This can be
followed with RELOG to restart logging to the same file path.

Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
2022-11-23 18:24:56 +02:00
Purushottam Kushwaha
0fd13c90eb Add QCA vendor interface for AP doze mode configuration
Add a new subcommand QCA_NL80211_VENDOR_SUBCMD_DOZED_AP to configure
doze mode state on an AP interface. This is also used as an event to
indicate the updated configuration. In doze mode, AP transmits
beacons at higher beacon intervals and RX is disabled.

Uses attributes defined in enum qca_wlan_vendor_attr_dozed_ap.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2022-11-23 18:16:24 +02:00
Sunil Dutt
4e1f55a113 Roam control configuration for 6 GHz in full scan only on prior discovery
During the roam scan, if there are no desired APs found in the partial
frequency list, an immediate full scan on all the supported frequencies
is initiated as a fallback. This would include the 6 GHz PSC
frequencies. Define an attribute to allow that behavior to be modified
to include PSCs only if 6 GHz use has been detected.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-23 13:03:42 +02:00
Jouni Malinen
22a5d615ba tests: HS 2.0 deauthentication imminent with and without URL timing
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-21 22:57:51 +02:00