While these elements fit without issue in production use cases, it is
possible to override the elements for testing purposes and if such
overridden elements are overly long, they would nto fit into the maximum
length RSN Override Link KDE. This could result in difficult to debug
failure cases, so check for this explicitly and instead of sending out
the invalid M3, report the internal issue in the debug log and do not
send M3.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Elements can actually be 257 octets long (2 octets of header followed by
255 octets of payload). The maximum length for various IE override
testing parameters had somehow ended up being one octet too short to
cover the maximum. Increase this to allow the maximum element length to
be reached for testing purposes.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
These test cases could fail if they happened to be executed after a test
case that set a specific SAE group.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
When the PASN implementation is used as a library for Wi-Fi Aware
applications there is need to allow the Responder to set the noauth
parameter to support opportunistic pairing method using PASN AKMP. Add
pasn_set_noauth() to address this.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
When the PASN implementation is used as a library for Wi-Fi Aware
applications there is need to reject the PASN auth 1 frame based on the
user input. Add support to send PASN auth 2 with failure status for
auth 1 frame received to address this need.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
The restriction of the passphrase length to 8..63 characters is only
applicable for WPA2-Personal (PSK). Remove this constraint when
processing a configuration object that includes SAE without PSK.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
The restriction of the passphrase length to 8..63 characters is only
applicable for WPA2-Personal (PSK). Remove this constraint when
provisioning a configuration object that includes SAE without PSK.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Always set SNonce cookie and enable RSN Override elements validation
irrespective of the RSN Selection element usage in (Re)Association
Request frame when RSN overriding supported.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
STA needs to skip validating RSN Override elements when RSN overriding
is not used since AP will not send RSN Override elements in EAPOL-Key
message 3/4. This is handled correctly in non-MLO case but in MLO case
wpa_supplicant always validates RSN Override link KDEs. Fix validating
RSN Override elements in MLO case as well.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
A STA that supports RSN overriding will always use the SNonce cookie. An
AP that does not advertise RSN overriding elements must not enforce that
SNonce cookie is used with RSN Selection element since a STA includes
the latter only when it sees the AP advertising RSN overriding elements.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Modify wpa_supplicant code based on the updated driver interface for RSN
overriding capability indication.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Be more specific on how the QCA_WLAN_VENDOR_ATTR_FEATURE_FLAGS attribute
is used in the response.
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Add QCA_NL80211_VENDOR_SUBCMD_CONNECT_EXT to send additional information
such as RSN overriding support of the supplicant for the (re)association
attempts with NL80211_CMD_CONNECT.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Use separate interfaces for indicating driver and supplicant RSN
overriding support. Modifying this interface is fine since this feature
is still under development.
Subsequent commit will define the interface for indicating supplicant
RSN overriding support to the driver.
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
wpa_auth_get_seqnum() for ML group rekeying needs to be skipped in the
same way as it is done for non-ML cases to avoid indicating old values
and resulting in group frames being dropped as replays. The simple check
for gsm->wpa_group_state != WPA_GROUP_SETKEYS (as is done for non-ML) is
not sufficient for this since the per-link Authenticator states are not
strictly synchronized and the state change happens in the middle of this
step.
Fixes: 137b855092 ("MLO: Mechanism for fetching group key information for the links")
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
At present, group key update is not confined only on the association
link as originally intended. Hence, ensure now that the group key update
is only performed on the association link for non-AP MLDs.
This was missed during adding support for group rekeying for MLO.
Fixes: 12acda633b ("AP MLD: Support group rekeying for MLO")
Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
The AP MLD change to use a helper function for this broke the design
that depends on the value for sm->group (i.e., the currently assigned
VLAN) being used instead of the sm->wpa_auth->group. Restore previous
behavior to fix GKeyDoneStations tracking when VLANs are used.
Fixes: 78adbf2c08 ("AP MLD: Mark GKeyDone completed for STAs in a helper function")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
The new test case for an AP MLD in a bridge was supposed to use a unique
test name to avoid hiding an existing test case.
Fixes: c4f9279267 ("tests: AP MLD with two links in a bridge")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
In the current hostapd flow, AP_VLAN net device is added to a bridge
before the interface is brought up.
Interface up event is used in mac80211 layer for setting device context
in the driver. Vendor specific datapath offload configurations for net
device might also be set up in interface up event context. Adding
AP_VLAN interface to a bridge before the UP event could cause
inconsistent state for datapath offload context setup in a vendor
driver.
Change the sequence to add AP_VLAN interface to a bridge after the
interface is set up. This makes the interface up and bridge add sequence
for AP_VLAN to be consistent with that of a regular AP interface.
Signed-off-by: Radha Krishna Simha Jiguru <quic_rjiguru@quicinc.com>
During FT, RRB messages are getting dropped at bridge on an AP MLD since
bridge doesn't know all the link address, so roaming gets failed.
Add AP MLD's each link address to the bridge FDB, so that RRB frames
get forwarded through bridge to hostapd.
Co-developed-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
Signed-off-by: Karthikeyan Kathirvel <quic_kathirve@quicinc.com>
bss->flink could be NULL when wpa_driver_nl80211_del_beacon() is called
if wpa_driver_nl80211_drv_init() fails early through the 'failed' label
and jumps to wpa_driver_nl80211_deinit() with bss->flink unset.
Fixes: 47269be36e ("nl80211: Refactor i802_bss to support multiple links")
Signed-off-by: Jintao Lin <jintaolin@chromium.org>
Currently, channel is selected from the current hw_mode. However, not
all channels under current hw_mode might be available for the current
operating underlying hardware.
Add logic to check if the selected channel falls under the current
operating hardware index and only if so, continue with the selected
channel.
Co-developed-by: Harshitha Prem <quic_hprem@quicinc.com>
Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
When a driver consolidates several hardware components under a single
radio, it provides details about these components via the
NL80211_CMD_GET_WIPHY command.
Parse this information and store it. A subsequent change will use this
information for validation in certain scenarios.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Whenever there is only one BSS left and if the number of links is one,
is_shared_drv() returns false assuming no one else is sharing the driver
interface. However, when the number of links is one, this does not
guarantee that the caller's link ID is the only active link ID. If this
is not the case and false is returned, the caller calls hapd_deinit()
which will free the driver interface. However, when the actual active
link_id reaches deinit path, this leads to dereferencing a NULL pointer
ultimately leading to segmentation fault.
To prevent this, pass the link ID into the is_drv_shared() ops and match
it with only with active link IDs. Only return false if they are same.
Signed-off-by: Ganesh Kariganuru Mahabalesh <quic_gkarigan@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
In function driver_nl80211_link_remove(), when there is no active links,
interface is removed. This will free the BSS pointer. A copy of the BSS
pointer is also stored in each of the affiliated links' hapd->drv_priv
member.
driver_nl80211_link_remove() is called via multiple paths, e.g., via
NL80211_CMD_STOP_AP and via driver_nl80211_ops. When called when
handling an nl80211 event, links will be removed and when count reaches
zero, the interface will be removed. However, core hostapd will be
unaware of this removal. Hence, if it tries to access its drv_priv
pointer, this can lead to segmentation fault at times since the pointer
is now pointing to freed memory.
Prevent this by adding a new notification event
(EVENT_MLD_INTERFACE_FREED). Whenever the interface is freed, this
notification will be sent. hostapd will process this notification and
will set all affliated links' hapd->drv_priv to NULL.
Signed-off-by: Naveen S <quic_naves@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Currently, a stop AP event is processed always on the first BSS in the
drv. However, with multi-link operation, it can come on any interface
and there is need to process it for the intended BSS. Also, the event
has a link ID attribute during MLO which is not used and still the event
is passed to the first link BSS.
Process the event for the intended BSS and for the intended link BSS
during MLO.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
No functionality changes.
This is needed to support STOP_AP events for MLD interface in a
subsequent change.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
When an interface is enabled, keys are reconfigured, if required, and
beaconing is started again. With MLO, this needs to be done for each of
the affiliated links. Before starting the beaconing, the link needs to
be added back first.
Similarly, when the interface is disabled, hostapd removes the keys and
set the BSS state to disabled. However, for an AP MLD interface, this
needs to be done for each of the affiliated link BSS.
Handle the interface enable/disable driver event for AP MLD.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Driver events for interface enable/disable are currently handled on
interface level with one hostapd_data instance under consideration. In
order to extend it for MLO, this needs to be done for each of the
affiliated links. Hence, refactor the code into a helper function which
can be used later.
No functionality change. Support for MLO will be added in a subsequent
change.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Store the full set of AP's RSNE/RSNXE variants to wpa_sm while
processing association event. Commit 521374b978 did this for the cases
that were needed for SME-in-wpa_supplicant cases, but forgot to update
the cases needed for SME-in-driver. Convert those to the updated
protocol design as well.
Fixes: 521374b978 ("RSNO: Include all RSNE/RSNXE variants in EAPOL-Key message 3/4")
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
Some APs do not advertise operating classes correctly for BSS Transition
Management. Try to determine the most likely operating frequency based
on the channel number (1..14 --> 2.4 GHz; 36..177 --> 5 GHz) if invalid
op_class == 255 is received in a BSS Transition Management Request. This
speeds up the following operating by avoiding a full scan due to an
unknown channel.
This extends the workaround that was added in commit 80ce804e88 ("WNM:
Workaround for broken AP operating class behavior") for invalid
operating class 0 to cover another observed case with invalid operating
class 255.
Signed-off-by: Yu Zhang(Yuriy) <quic_yuzha@quicinc.com>
Currently MLO CSA test case supports CSA only on the first link.
However, now it can be extended to other links as well.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
During channel switch handling for AP MLD, if link ID is incorrect,
there is no point in proceeding till end and failing or returning from
there. Hence sanitize it in the initial time itself and return if it is
incorrect. Throw a warning print if it is not correct as well.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
Channel switch operation fails if 'eht' option is given without 'he'
as hostapd_config_check() returns following error:
"Cannot set ieee80211be without ieee80211ax"
The issue is seen only when switching within/to DFS channels because
hostapd_switch_channel_fallback() does not set 'ieee80211ax' in
hostapd configuration unless 'he_enabled' is set for the new channel.
Set 'he_enabled' in struct hostapd_freq_params for channel switch
when EHT is enabled.
Signed-off-by: Aloka Dixit <quic_alokad@quicinc.com>
Now that per STA profile is cached already, there is no need to form it
dynamically on every Probe Request frame.
Use the cached one instead.
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
As per IEEE P802.11be/D7.0, 35.3.3.5.1 (Inheritance in the Per-STA
Profile subelement of Basic Multi-Link element), Note 1, if there exists
one or more Vendor Specific elements carried in a Management frame that
includes the Basic Multi-Link element containing a per-STA profile for a
reported STA, and the contents of the Information field for at least one
of the Vendor Specific elements is not the same as that of at least one
Vendor Specific element that applies to the reported STA, then each
Vendor Specific element that applies to the reported STA is included in
its Per-STA Profile subelement.
Handle this.
Signed-off-by: Arunpandi Kannan <quic_arunpand@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
There can be an element in the reporting BSS which is not there in the
reported BSS. This element should not be inherited in the per STA
profile. Hence to indicate this, the corresponding per STA profile
should include a Non-Inheritance element in the per STA profile.
Include Non-Inheritance element in the per STA profiles when needed.
Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
If an element is present in the reporting BSS and it is also present in
the reported BSS and the contents are same, ideally, the reported BSS
need not carry such element in its per STA profile. Such elements are
assumed to be inherited from the reporting BSS.
Intersect the reported BSS profile with the reporting BSS and avoid such
element inclusion.
Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
