Commit graph

1717 commits

Author SHA1 Message Date
Aditya Kumar Singh
3e2758b19a hostapd: Avoid channel selection across underlying hardware index
Currently, channel is selected from the current hw_mode. However, not
all channels under current hw_mode might be available for the current
operating underlying hardware.

Add logic to check if the selected channel falls under the current
operating hardware index and only if so, continue with the selected
channel.

Co-developed-by: Harshitha Prem <quic_hprem@quicinc.com>
Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-08-09 22:25:02 +03:00
Amith A
5cb6747f97 Add support to switch channel when CAC is in progress
Prior to initiating communication on a DFS channel, channel availability
check needs to be performed. During this period, the AP does not beacon.
Hence, no channel switch was allowed during this period. However, if a
user wishes to switch to a non-DFS channel during the potentially long
CAC period and start transmission immediately, there is no provision to
do that currently.

Extend the existing CHAN_SWITCH control interface command to allow
channel switch even when the AP is in CAC state. To do this, first
disable the interface to abort the CAC in progress and then configure
the interface with the new parameters and finally re-enable the
interface.

Signed-off-by: Amith A <quic_amitajit@quicinc.com>
2024-08-07 11:37:00 +03:00
Sidhanta Sahu
69deac87fb AP MLD: Ensure successful addition of link item into list
Currently, hapd->link is added to the MLD links list during driver
initialization and setup BSS operation. However, a call trace has been
observed where a BSS link item is not present in the list and an attempt
is made to delete it from the list. This scenario occurs during the
deinitialization operation, which calls hostapd_bss_link_deinit() and
tries to remove the hapd->link which is not present in the list.

Ensures that the link item is added to the list only after the
successful operation of link addition. Also ensure that mld->num_links
increments only when the addition is successful. Therefore, return from
hostapd_bss_link_deinit(), if mld->num_links is zero. Since the mld
object is shared among all the links, num_links has to be incremented
only when the addition is successful.

Call trace:
        dl_list_del.lto_priv.9.lto_priv ()
        hostapd_bss_link_deinit.lto_priv ()
        hostapd_bss_deinit ()
        hostapd_interface_deinit ()
        hostapd_interface_deinit_free ()
        hostapd_main ()

Signed-off-by: Sidhanta Sahu <quic_sidhanta@quicinc.com>
2024-08-06 00:29:00 +03:00
Jouni Malinen
296104d35c Testing functionality to allow EAPOL-Key Reserved field to be set
The new hostapd configuration parameter eapol_key_reserved_random=1 can
be used for testing STA/Supplicant functionality to accept a random
value in the Reserved field within EAPOL-Key frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-07-24 17:22:42 +00:00
Jouni Malinen
2e4c612dd2 Allow RSNE/RSNXE/RSNOE/RSNO2E/RSNXOE to be replace for testing
This is convenient for testing STA behavior with various RSN element
combinations and special cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-07-24 01:01:29 +00:00
Jouni Malinen
8b2ddfdbb6 RSNO: Allow RSNXE to be omitted
Add an explicit rsn_override_omit_rsnxe=1 configuration parameter to
allow the RSNXE to be omitted when using the RSNXOE and wanting to
minimize interoperability issues with STAs that might recognize the
RSNXE, but not handle it correctly, e.g., when multiple octets of
payload is included.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-07-23 21:20:45 +00:00
Jouni Malinen
157b016383 RSNE/RSNXE overriding for AP
Allow hostapd to be configured to advertised two separate sets of
RSNE/RSNXE parameters so that RSNE/RSNXE can use a reduced set of
capabilities (e.g., WPA2-Personal only) for supporting deployed STAs
that have issues with transition modes while the new override elements
can use a newer security option (e.g., WPA3-Personal only) for STAs that
support the new mechanism.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-07-20 21:28:28 +03:00
Jouni Malinen
d945ddd368 Preparations for v2.11 release
Update the version number for the build and also add the ChangeLog
entries for both hostapd and wpa_supplicant to describe main changes
between v2.10 and v2.11. Update the copyright years for the main
programs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-07-20 21:04:37 +03:00
Jouni Malinen
7d51bf2abd SAE: Drop default dot11RSNASAESync value from 5 to 3
Going through five extra rounds of SAE commit messages in cases where
SAE peers are somehow unsynchronized feels unnecessary much to do by
default, so drop the default value to 3.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-07-13 16:37:15 +03:00
Pradeep Kumar Chitrapu
7d314d6bdf Fix channel switch without 'ht' for HE and EHT modes in 2.4 GHz band
hostapd_cli chan_switch command fails in 2.4 GHz band for HE and EHT
modes if the user does not explicitly specify 'ht' option in the
command.

For example:
"hostapd_cli -i wlan2 chan_switch 10 2412 sec_channel_offset=0 \
 center_freq1=2412 bandwidth=20 blocktx he"

Fix this by enabling HT by default if HE is enabled in the 2.4 GHz and 5
GHz bands. Similarly, enable VHT by default when HE is enabled in the 5
GHz band.

Signed-off-by: Pradeep Kumar Chitrapu <quic_pradeepc@quicinc.com>
2024-07-12 12:25:55 +03:00
Jouni Malinen
58097123ec RADIUS: Require Message-Authenticator attribute in MAC ACL cases
hostapd required Message-Authenticator attribute to be included in EAP
authentication cases, but that requirement was not in place for MAC ACL
cases. Start requiring Message-Authenticator attribute for MAC ACL by
default. Unlike the EAP case, this can still be disabled with
radius_require_message_authenticator=1 to maintain compatibility with
some RADIUS servers when used in a network where the connection to such
a server is secure.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-07-09 14:58:39 +03:00
Jouni Malinen
37a289f8bc SSID protection in 4-way handshake on AP
Add support for SSID protection in 4-way handshake based on the
mechanism added in IEEE 802.11REVme/D6.0. This is a mitigation against
CVE-2023-52424 (a.k.a. the SSID Confusion Attack).

This functionality is disabled by default and can be enabled with
ssid_protection=1. Once there has been more testing of this to confirm
there is no significant interoperability issues, the goal is to be able
to change this to be enabled by default.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-06-19 12:38:14 +03:00
Aditya Kumar Singh
d8e1a353a6 hostapd: Add support to change BSS color from the control interface
Add hostapd_cli command "color_change <color>" to change BSS color at
run time. hostapd_cli status can be used to check the updated color.

Usage: hostapd_cli -i <interface> color_change <color>

If 0 value is given, HE BSS color would be disabled. Same or a non-zero
value between [1-63] can be given to enable color again.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-06-12 12:21:09 +03:00
Jouni Malinen
58ac46baf7 WNM: AP configuration to allow BSS max idle period requests
Add a new hostapd configuration parameter max_acceptable_idle_period to
allow the AP to accept per-STA requested BSS max idle periods.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-05-29 23:40:22 +03:00
Jouni Malinen
6cd0231112 WNM: Group rekeying skipping with BSS max idle period management
Allow hostapd to be configured to not disconnect a STA if the STA fails
to reply to a group key handshake when BSS max idle period management is
used. This might be needed for some STAs that use aggressive power
saving (e.g., battery powered IoT devices).

This is disabled by default since this can delayed group rekeying
slightly and also to maintain the previous behavior. The more relaxed
operation can be enabled with the new configuration parameter
no_disconnect_on_group_keyerror=1.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-05-29 12:57:08 +03:00
Jouni Malinen
846b1d618c WNM: Configurable BSS Max Idle Period management on AP
Allow AP's behavior for BSS Max Idle Period management to be configured.
Previously, this was automatically enabled for all CONFIG_WNM_AP=y
builds. This can now be changed with the new hostapd configuration
parameter bss_max_idle:
0 = BSS Max Idle Period management disabled
1 = BSS Max Idle Period management enabled
    (default and the previous behavior)
2 = BSS Max Idle Period management enabled with requirement for
    protected keep-alive frames

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-05-29 12:45:02 +03:00
Sriram R
3d0cc612fc AP MLD: Support cohosted ML BSS
AP MLD was added with an assumption of only a single BSS per link in the
hostapd configuration. This needs to be extended when a cohosted ML BSS
exist in the same configuration.

Extend the support for cohosted BSSs. This is required for MBSSID MLO
support as well.

Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-04-20 15:58:48 +03:00
Manaswini Paluri
3c79173c32 Add TWT responder support for AP in HT and VHT modes
Add support for TWT responder for AP operating in HT and VHT modes by
introducing a new configuration parameter ht_vht_twt_responder. When
this is enabled, TWT responder mode support in HT and VHT modes is
enabled if the driver supports this and is disabled otherwise.

Signed-off-by: Manaswini Paluri<quic_mpaluri@quicinc.com>
2024-04-19 18:38:37 +03:00
Johannes Berg
d43eb71da7 hostapd: Add support for testing Probe Response frame elements
Add support for additional (vendor) elements to be added
to only Probe Response frames, for testing.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-04-16 10:38:00 +03:00
Felix Fietkau
dec6fccf17 Support qos_map_set without CONFIG_INTERWORKING
This feature is useful on its own even without full interworking
support.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2024-04-15 23:18:24 +03:00
Raj Kumar Bhagat
1be706e862 hostapd: Add RRM link measurement request support
RRM link measurement request/report management frames are used to get
the radio link information between the connected stations.

Add new hostapd_cli command req_link_measurement to send an RRM link
measurement request to an associated station. Add support to handle the
link measurement report in hostapd.

RRM link measurement support can be enabled with the following new
configuration parameter:
rrm_link_measurement_report=1

Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
Signed-off-by: Yuvarani V <quic_yuvarani@quicinc.com>
2024-04-15 22:28:55 +03:00
Rajat Soni
36bd75dfd2 hostapd: Fix channel switch to a DFS channel
When we are configuring automatic channel selection, we are not able to
switch to a given DFS channel because when we are trying to move to a
DFS channel, the interface is disabled and enabled again. When the
interface is disabled and enabled we are setting iface's freq and
channel to 0 in setup_interface2() in case ACS is enabled, and now we
don't know to which channel we were trying to move. Now ACS will run and
the interface will be up in the channel that is suitable.

To fix this issue add a flag named is_ch_switch_dfs to check if the
channel switch request is for a DFS channel and we can use this in
setup_interface2() to decide whther we have to set iface's freq and
channel to 0 or not. This way iface's freq and channel will retain the
values while channel switching to a DFS channel when ACS is enabled.

Signed-off-by: Rajat Soni <quic_rajson@quicinc.com>
2024-04-15 11:56:41 +03:00
Vinay Gannevaram
147f836924 PASN: Add set and get API for PASN data context
Modules that use libpasn for PASN authentication need the context of
PASN data. PASN data is a common context for the library and the modules
using it. Hence, initialize the context through init and deinit
functions. Also use set and get functions to update the parameters.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-04-06 00:12:54 +03:00
Vinay Gannevaram
ba55088a73 Replace PTKSA cache inline stubs with wrapper function stubs
PTKSA cache API is included in libpasn.so used by external modules,
e.g., Wi-Fi Aware. To avoid dependency on CONFIG_PTKSA_CACHE define for
the external modules at compile time, remove PTKSA cache static inline
functions from the header file and add wrapper function stubs.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-04-05 20:07:32 +03:00
Aditya Kumar Singh
4bc61b6577 AP MLD: Remove restriction of having to disable the first link BSS last
The first link BSS was always disabled last. However, now the first BSS
can be dynamically adjusted. Hence, remove such restriction.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-27 18:12:39 +02:00
Aditya Kumar Singh
df34c2ced3 AP MLD: De-initialize/disable link BSS properly
When the first link BSS of an interface was de-initialized/disabled, the
whole MLD was brought down. All other links were stopped beaconing and
links were removed. And if the non-first link BSS was
de-initialized/disabled, nothing happened. Even beaconing was not
stopped which is wrong.

Fix this by properly bringing down the intended link alone from the
interface.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-27 18:12:39 +02:00
Aditya Kumar Singh
fac34688ad AP MLD: Assign link ID during BSS creation
Link ID was assigned when BSS is going through setup and the driver
interface init. Later if interface is disabled and enabled again, setup
BSS is called which will give a new link ID to it. However, Link ID
should be same for a BSS affliated to an AP MLD for the full lifetime of
the BSS.

Hence, assign the link ID during BSS creation itself. And it will remain
until BSS entry is completely freed. Hence, link ID will not change as
part of disable/enable.

Also, since link ID would be decided now, it will help in creating link
level control sockets in a subsequent patch.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-27 11:15:33 +02:00
Aditya Kumar Singh
b19aa9c422 AP MLD: Use MLD struct for MLD level information
MLD level structure is present to store the MLD level information.

Add changes to use the MLD structure instead of link specific struct
hostapd_data to get/set the MLD level information.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-27 11:15:19 +02:00
Aditya Kumar Singh
2f0e5303e8 AP MLD: Add a separate MLD level structure
MLD level information like MLD MAC address, next link ID, etc. was
stored in each BSS. However, only the first link BSS assigns values to
these members and the other link BSSs store references to the first BSS.
However, if the first BSS is disabled, the first BSS reference in all
BSS should be updated which is an overhead. Also, this does not seem to
scale.

Instead, a separate MLD level structure can be maintained which can
store all this ML related information. All affiliated link BSSs can keep
reference to this MLD structure.

This commit adds that MLD level structure. However, assigning values to
it and using that instead of BSS level members will be done in
subsequent commits.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-27 11:15:10 +02:00
Sriram R
259b43a31a hostapd: MLO: Avoid use of mld_id as user configuration
mld_id was provided as a user configuration to identify partner BSS
belonging to the same AP MLD. The same id is used at the protocol level
also to indicate the AP MLD ID of the MLD.

But, in general mld_id is a relative reference of the MLD where 0 is
used as the mld_id to represent the self MLD and in case of MLO MBSSID
mld_id of a non transmitted BSS affiliated to an AP MLD is based on the
relative BSS index of the non transmitted BSS from the transmitted BSS.
Hence mld_id need not be fetched from users, rather it can be identified
wherever required.

To verify if the partners belong to the same AP MLD the interface name
can be checked, since all link BSS partners of the same AP MLD belong to
the same interface.

Hence, remove use of mld_id user config and instead introduce two
functions hostapd_is_ml_partner() and hostapd_get_mld_id(). The former
is used to verify whether partners belong to the same AP MLD and the
latter is used to get the MLD ID of the BSS.

Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2024-03-26 20:16:59 +02:00
Manoj Sekar
69d0862989 Multi-AP: Add support for VLAN related information
Add support to fill "multi_ap_vlanid" info to the hostapd config file.
Add the Multi-AP Default 802.1Q Setting subelement into Multi-AP element
generating and parsing.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 19:20:51 +02:00
Manoj Sekar
210c2b4bd7 Multi-AP: Add hostapd config option to disallow certain profiles
Add a new config option "multi_ap_client_disallow" to control allowing
backhaul STA with certain profiles alone to associate. This is done to
adhere to Wi-Fi EasyMesh specification which defined rules to
allow/disallow association of backhaul STA of certain profiles.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 19:11:27 +02:00
Manoj Sekar
420afbdbdf Multi-AP: Allow supported profile to be configured
Allow both hostapd and wpa_supplicant to be configured with the
supported Multi-AP profile. The configured value will be advertised in
the Multi-AP element.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 18:57:35 +02:00
Nikita Chernikov
6f285fbafc Update own report in nr_db if SSID is changed
short_ssid in the own neighbor report might get out of sync, causing
advertising RNR element based on the old SSID, when SSID is changed
either with control interface command SET or with SIGHUP. Therefore,
sync the own report entry by removing the old entry and setting own
report again if the short SSID value has changed.

Signed-off-by: Nikita Chernikov <nchernikov@maxlinear.com>
2024-03-03 21:33:46 +02:00
Mujibur Rahiman K
16abdac809 Fix INTERFACES command buffer size to allow more data
reply_size instead sizeof(buffer) should be provided to
hostapd_global_ctrl_iface_interfaces() when processing INTERFACES
commands. The previous use of sizeof(buffer) used a significantly
shorter limit (256 vs. 4096 bytes) for the output and this could have
resulted in unnecessary truncation of the output.

Fixes: 618f5d01b0 ("hostapd: Add INTERFACES ctrl_iface command")
Signed-Off-By : Mujibur Rahiman K mujiburrahimank@maxlinear.com
2024-03-03 20:10:13 +02:00
Jouni Malinen
0e4aa28daf hostapd_cli: Indentation cleanup
Fix indentation level for some function parameters.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-28 22:35:04 +02:00
Chenming Huang
a01972a065 Add "stop_ap" command for hostapd_cli
Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-28 22:34:08 +02:00
Jouni Malinen
95a825bc43 RADIUS: Preliminary support RADIUS/TLS as an alternative to RADIUS/UDP
This adds initial parts for RADIUS/TLS support in the RADIUS client.
This can be used with eapol_test and hostapd. This functionality is not
included by default and CONFIG_RADIUS_TLS=y in .config can be used to
enable it.

This version does not yet include all the needed functionality for TLS
validation and the rules for dropping a TCP connection based on invalid
RADIUS attributes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-25 20:54:14 +02:00
Haribabu Krishnasamy
352ad5f1a2 Apply CHAN_SWITCH in all BSS for MBSSID case
When the CHAN_SWITCH command is executed during multi BSSID case (say
BSS1, BSS2, and BSS3), if one of the BSS is disabled (say BSS2), the
CHAN_SWITCH command returns an error in BSS2 and does not proceed to the
next BSS (BSS3).

The CHAN_SWITCH command handler iterates over all configured BSSs and
attempts to send the switch_channel to each one. However, if any one of
the BSSs fails, the entire command is aborted and returns a failure.

Continue the iteration even if one BSS is failing to make sure the
configuration is applied to other BSSs.

Signed-off-by: Haribabu Krishnasamy <quic_hkr@quicinc.com>
2024-02-18 11:09:40 +02:00
Jouni Malinen
3a5d1a7e6d NAN: USD in hostapd
Add hostapd support for interacting with the NAN discovery engine to
allow single-channel (i.e., the AP's operating channel) USD as Publisher
or Subscriber.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 19:54:17 +02:00
Chenming Huang
9a47ede871 AP MLD: Add support for hostapd_cli to disable/enable AP MLD
Existing commands ENABLE/DISABLE only enable/disable the corresponding
link. To disable all links, multiple calls from different control
interfaces would be needed.

Add new commands "disable_mld" and "enable_mld" for hostapd_cli to
support disabling/enabling AP MLD for convenience.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 22:47:03 +02:00
Jouni Malinen
0102c5c606 hostapd: Do not use prefix matching for ENABLE/RELOAD/DISABLE
These control interface commands do not take any parameters and as such,
do not need to use a prefix match. Replace that with an exact string
match to avoid matching other potential command strings.

Fixes: 7554565299 ("hostapd: Add ctrl_iface for enabling/reloading/disabling interface")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-02 22:28:29 +02:00
Jouni Malinen
c03377cf27 SAE: Fix resource leak on reading a separate password file
The file needs to be closed on all paths before exiting from the
function.

Fixes: e748e50c62 ("SAE passwords from a separate file")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 22:16:46 +02:00
Jouni Malinen
a4d599a53d FT: Fix architecture for RxKH loading from a file
src/ap/ap_config.c is not really supposed to call directly into a
function in hostapd/config_file.c. Furthermore, the wrapper through
ap_config.c did not really have any real value since it just called a
function that is within hostapd/*.c and that wrapper was called from
hostapd/*.c.

Instead of the wrapper, just call the function directly within the
hostapd directory.

Fixes: 392114a179 ("FT: Add dynamic reload of RxKH definitions from file")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:30:10 +02:00
Jouni Malinen
9456adeeba DPP3: Fix potential use-after-free on push button bootstrap info
When removing the bootstrap info for the PB context, all the possible
pointers to that information needs to be cleared to avoid accesses to
freed memory.

Fixes: 37bccfcab8 ("DPP3: Push button bootstrap mechanism")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 12:51:53 +02:00
Jouni Malinen
ee9375fb3b tests: Association comeback mechanism in wpa_supplicant
Allow the Timeout Interval Type field in the Timeout Interval element to
be overridden with a different value for testing purposes to be able to
bypass the association comeback processing in mac80211. This allows the
wpa_supplicant internal functionality to be tested.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 12:17:23 +02:00
Dariusz Kopka
542ccf00b5 FT: Add control interface command to show configured RxKHs
The new GET_RXKHS control interface command can be used to list the
currently configured RxKHs.

Signed-off-by: Dariusz Kopka <dariusz@plume.com>
2024-01-20 10:23:43 +02:00
Dariusz Kopka
392114a179 FT: Add dynamic reload of RxKH definitions from file
hostapd reads the list of Rx Key Holders from hostapd.conf file.
However, for systems where topology changes dynamically, the update
of RxKHs list is required without reloading the whole configuration.

Introduce a new source of RxKH definition with original syntax:
- rxkh_file - Path to a file containing a list of RxKHs.

In addition, add a control interface command RELOAD_RXKHS to
reload RxKHs definition from the file specified in `rxkh_file`.

This allows hostapd to properly distribute Rx keys even after topology
change (assuming rxkh_file is updated and reload_rxkhs command issued).

Syntax of rxkh_file is the same as extraction of r0kh and r1kh options
from original hostapd.conf file.

```
r0kh=ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff
r0kh=ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
```

Signed-off-by: Dariusz Kopka <dariusz@plume.com>
2024-01-20 10:23:04 +02:00
Jouni Malinen
4abc37e67b Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4
Extend RSN authenticator to be able to process EAPOL-Key msg 2/4 and 4/4
messages in cases where the Key Data field is encrypted using AES key
wrapping (i.e., non-AEAD cipher). While there is not yet any defined
case where such encryption would be used in IEEE Std 802.11-2020,
extensions are considered to be added to use such constructions (e.g.,
in IEEE P802.11bh). As such, it is good to extend the parsing and
processing rules in the authenticator to be ready for such
functionality.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 21:05:13 +02:00
Jouni Malinen
3547ed403d Authenticator side testing functionality for EAPOL-Key Key Data field
Allow additional elements and KDEs to be added to EAPOL-Key msg 1/4 and
3/4 and allow EAPOL-Key msg 3/4 Key Data field to be not encrypted.
These are for testing purposes to enable a convenient mechanism for
testing supplicant behavior with either potential future extensions or
incorrect Authenticator behavior.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 13:04:59 +02:00