Commit graph

17319 commits

Author SHA1 Message Date
Jouni Malinen
e8e2d9ff6b tests: Additional coverage for WPS_AP_PIN error case
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
38e700198e tests: Display unexpected stdout and stderr prints in parallel-vm.py
Make it more difficult to miss issues that were previously only printed
out in /tmp/hwsim-test-logs/*-parallel.log. This covers things like
memory leaks and test script failures or forgotten development time
prints to stdout.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
40551a15c1 Fix a memory leak in WPS with ap_scan=2
The wpa_ie buffer is now allocated here and needs to be freed before
returning from the function.

Fixes: d2ba0d719e ("Move assoc param setting into a helper function")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:46:32 +02:00
Jouni Malinen
900adb3c9f FILS: Simplify code paths
Use a shared code path for freeing the wpa_ie buffer to avoid
unnecessary complexity with a separate return for the non-FILS case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:42:06 +02:00
Jouni Malinen
4a5f6e88b2 SAE: Use more explicit IE payload validation steps
This is an attempt of making the code easier to understand for static
analyzers. The helper functions were already verifying that these IEs
are fully within the memory buffer, but that may not have been clear
enough for automated analysis.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:39:49 +02:00
Jouni Malinen
57fec19dab Use more consistent iface->conf checks
Commit f1df4fbfc7 ("mesh: Use setup completion callback to complete
mesh join") added a check for iface->conf being NULL into a debug print.
However, it is not clear how that could be NULL here. In any case,
setup_interface() could end up dereferencing iface->conf in the call to
hostapd_validate_bssid_configuration(), so better be consistent with the
checks and not get warnings from static analyzers regardless of whether
this can happen in practice.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:51:16 +02:00
Jouni Malinen
b8211e1e75 PASN: Avoid unreachable code with CONFIG_NO_RADIUS
There is no point in trying to build in rest of this function if in the
middle of it the CONFIG_NO_RADIUS case would unconditionally fail.
Simply make all of this be conditional on that build parameter not being
set to make things easier for static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:37:47 +02:00
Jouni Malinen
9a1136b7f1 FILS: Fix RSN info in FD frame for no-group-addressed
The value from the initial RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED check
ended up getting overridden with the following if. This was supposed to
be a single if statement to avoid that.

Fixes: 9c02a0f5a6 ("FILS: Add generation of FILS Discovery frame template")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:27:42 +02:00
Jouni Malinen
6035969e0e Fix dynamic EAP library building
Build eap_*.so into the wpa_supplicant similarly with the wpa_supplicant
binary and include the shared helper functions from additional files
into the builds. This got broken at some point with the build system
changes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 23:42:21 +02:00
Jouni Malinen
8ea3561c6c tests: Fix sigma_dut_ap_dpp_tcp_enrollee_init to stop hostapd
This test case was missing an explicit CAPI ap_reset_default and that
could result in hostapd being left running at the end of the test case.
This could result in issues with following test cases if they used a new
radio interface from HWSimRadio().

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 21:07:54 +02:00
Jouni Malinen
32360ad498 wlantest: Fix broadcast EAPOL-Key frame handling
This resulted in an attempt to dereference a NULL pointer since sta_addr
is not known in this type of a case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-27 20:27:06 +02:00
Jouni Malinen
a826ff2d95 Ignore group-addressed SA Query frames
These frames are used for verifying that a specific SA and protected
link is in functional state between two devices. The IEEE 802.11
standard defines only a case that uses individual MAC address as the
destination. While there is no explicit rule on the receiver to ignore
other cases, it seems safer to make sure group-addressed frames do not
end up resulting in undesired behavior. As such, drop such frames
instead of interpreting them as valid SA Query Request/Response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-27 20:27:00 +02:00
Jimmy Chen
d314213f6c P2P: Pick a 5 GHz channel from more possible channels
For an autonomous P2P group on the 5 GHz band, a channel was picked only
from the operating class 115 which is not available in the EU region
anymore. As a result, an autonomous group creation would always fail in
this generic 5 GHz channel case.

There are more possible available channels for the 5 GHz currently.
Especially in the EU region, the operating class 115 channels are no
longer available, but SRD channels (the operating class 124) are
available. Allow them to be used here if they are marked as allowed for
P2P GO use.

In addition, iterate through all the potential options instead of just
checking the first randomly picked channel. Start this iteration from
random position to maintain some randomness in this process.

Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
2021-02-27 19:19:35 +02:00
Jouni Malinen
468efe79a7 tests: Work around exception handling issue in wpas_config_file
Raising an exception while the wlan5 interface was remove (i.e., between
wpas.interface_remove() and .interface_add() calls) would result in the
cleanup code failing and generating yet another exception while the
first one was being processed. Work around this by re-adding the wlan5
interface back temporarily if the interface is not available for the
cleanup operations.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 18:10:41 +02:00
Jouni Malinen
205c35ceff nl80211: Allow compilation with both vendor do_acs() handlers
Use a helper function as the do_acs() callback to allow builds to pull
in all the vendor specific operations into a single binary.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 17:57:08 +02:00
Xinrui Sun
61a258e784 nl80211: Add ACS support for Broadcom device
BRCM vendor command used to trigger ACS scan. After ACS finished,
DHD driver will send results by event BRCM_VENDOR_EVENT_ACS.

Signed-off-by: Xinrui Sun <xinrui.sun@broadcom.com>
2021-02-27 12:14:09 +02:00
Jouni Malinen
90d3ee383f tests: RADIUS client device specified
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 10:51:15 +02:00
Ben Greear
827b43b3ca RADIUS client: Support SO_BINDTODEVICE
Allow the RADIUS client socket to be bound to a specific netdev. This
helps hostapd work better in VRF and other fancy network environments.

Signed-off-by: Ben Greear <greearb@candelatech.com>
Signed-off-by: Andreas Tobler <andreas.tobler at onway.ch>
2021-02-27 10:51:15 +02:00
Sunil Dutt
3a05f89edc Android: Add DRIVER command support on hostapd and hostapd_cli
Add DRIVER command support on hostapd and hostapd_cli on Android
similarly to the way this previously enabled in wpa_supplicant and
wpa_cli.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-26 20:22:41 +02:00
Sreeramya Soratkal
50baf345b4 TDLS: Support TDLS operations in HE mode
Determine if the TDLS peer is HE capable based on HE Capability element
received in the TDLS Setup Response frame. Indicate the peer's HE
capabilities to the driver through sta_add().

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-02-26 20:16:48 +02:00
Jouni Malinen
184c824689 P2P: Add device address to the debug entry on oldest peer removal
This makes it easier to understand debug logs with large number of peer
entries.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-25 20:09:58 +02:00
Jouni Malinen
8460e32309 P2P: Fix a corner case in peer addition based on PD Request
p2p_add_device() may remove the oldest entry if there is no room in the
peer table for a new peer. This would result in any pointer to that
removed entry becoming stale. A corner case with an invalid PD Request
frame could result in such a case ending up using (read+write) freed
memory. This could only by triggered when the peer table has reached its
maximum size and the PD Request frame is received from the P2P Device
Address of the oldest remaining entry and the frame has incorrect P2P
Device Address in the payload.

Fix this by fetching the dev pointer again after having called
p2p_add_device() so that the stale pointer cannot be used.

Fixes: 17bef1e97a ("P2P: Add peer entry based on Provision Discovery Request")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-25 20:09:46 +02:00
Kiran Kumar Lokere
59e9794c7d QCA vendor attribute to configure Punctured Preamble Rx in HE cap
Add a QCA vendor attribute to enable/disable the Punctured Preamble Rx
support in HE PHY capabilities.

This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-23 00:46:37 +02:00
Kiran Kumar Lokere
875d7be38c QCA vendor attribute to disable data and management frame Tx
Add a QCA vendor attribute to configure the driver to disable data and
management response frame transmission to test the BSS max idle period
feature.

This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-23 00:46:31 +02:00
Kiran Kumar Lokere
ecb7590f34 QCA vendor attribute to configure RU 242 tone for data Tx
Add a QCA vendor attribute to configure the driver/firmware to use only
RU 242 tone for data frame transmission.

This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-23 00:46:27 +02:00
Kiran Kumar Lokere
8d23297128 QCA vendor attribute to configure BSS max idle period
Add a QCA vendor attribute to configure the driver with a specific BSS
max idle period value to advertise in (Re)Association Request frames.

This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-23 00:46:21 +02:00
Jouni Malinen
dc72854fe2 Fix handle_auth_cb() message length check regression
Reordering of code in handle_auth_cb() when adding support for full
station state messaged up frame length checks. The length was originally
tested before looking at the payload of the frame and that is obviously
the correct location for that check. The location after those full state
state changes was after having read six octets of the payload which did
not help at all since there was no addition accesses to the payload
after that check.

Move the payload length check to appropriate place to get this extra
level of protection behaving in the expected manner. Since this is a TX
status callback handler, the frame payload is from a locally generated
Authentication frame and as such, it will be long enough to include
these fields in production use cases. Anyway, better keep this check in
working condition.

Fixes: bb598c3bdd ("AP: Add support for full station state")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-23 00:30:09 +02:00
Jouni Malinen
f03580e319 Restore permanent MAC address on the FLUSH command
Clear previously used random MAC address on the FLUSH command if
mac_addr setting has been disabled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 17:22:37 +02:00
Jouni Malinen
39fac5abd1 tests: Fix clean at the end of sigma_dut_client_privacy
These commands were being issues to incorrect wpa_supplicant instance
and were missing clearing of the MAC_RAND_SCAN parameter.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 17:21:48 +02:00
Jouni Malinen
c210aed4b6 tests: Fix the cleanup at the end of scan_setband
The iteration of WpaSupplicant instances used incorrect variable and
ended up cleaning up only the wlan5 interface. This left unexpected
setband parameter for wlan0/wlan1/wlan2 which could result in
consecutive test cases failing due to scan not finding the expected
BSSs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 16:58:33 +02:00
Jouni Malinen
976c3c161f DPP2: Accept Config Result before GAS response TX status
The TX event for the next frame in the sequence might be received before
the TX status for the final GAS response frame is processed. This used
to result in the Config Result getting discarded and the negotiation not
completing successfully on the Configurator side.

Accept the Config Result message as an indication of the final GAS
response frame having went through fine even if the TX status has not
yet been processed to avoid this issue from a potential race condition
on kernel events.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 16:44:33 +02:00
Jouni Malinen
6518c72b02 Multi-AP: Fix backhaul SSID printing condition
ssid->ssid is an array so comparison against NULL is pointless; check
ssid->ssid_len instead.

Fixes: 871d6648f5 ("hostapd: Add multi_ap settings to get_config() output")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 12:50:34 +02:00
Jouni Malinen
1ba8a315cd Avoid use of C++ keyword in a header file
Don't use 'protected' as the name of the variable in bss.h since this
might be used in control interfaces that use C++.

Fixes: 1c77f3d3f9 ("Indicate whether additional ANQP elements were protected")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 12:48:13 +02:00
Jouni Malinen
10502ad59f radiotap: Fix compiler issues with packed structures
Replace the Radiotap parser platform.h file with use of helper functions
from utils/common.h to avoid compiler issues with the updated design and
getting pointers to members of packet structs.

Silence the warning about _next_bitmap assignment. This pointer is
dereferenced only with operations that are safe for unaligned access, so
the compiler warning is not helpful here.

__packed might not be defined in this context, so use STRUCT_PACKED from
utils/common.h.

Fixes: e6ac269433 ("radiotap: Update radiotap parser")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 12:40:58 +02:00
Jouni Malinen
fcdf5d93ea tests: EAP-TTLS and PEAP with TLS 1.3
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-20 18:00:54 +02:00
Alexander Clouter
0dee287c84 EAP server: Extend EAP-TLS Commitment Message use to PEAP and EAP-TTLS
Use the explicit Commitment Message per draft-ietf-emu-eap-tls13-13
Section 2.5 and extend this functionality to PEAP and EAP-TTLS when
using TLS 1.3.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:53:52 +02:00
Alexander Clouter
fae4eafe4a EAP-TTLS peer: Handle Commitment Message for TLS 1.3
Recognize the explicitly defined Commitment Message per
draft-ietf-emu-eap-tls13-13 at the conclusion of the EAP-TTLS with TLS
1.3.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:47:41 +02:00
Alexander Clouter
155125b02a EAP-TLS peer: Handle Commitment Message for TLS 1.3
Recognize the explicitly defined Commitment Message per
draft-ietf-emu-eap-tls13-13 at the conclusion of the EAP-TLS with TLS
1.3.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:47:39 +02:00
Alexander Clouter
3a457509db EAP: Extend Session-Id derivation with TLS 1.3 to PEAP and EAP-TTLS
This newer Session-Id/Method-Id derivation is used with PEAP and
EAP-TTLS when using TLS 1.3 per draft-ietf-emu-tls-eap-types-00, so do
not limit this to only EAP-TLS.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:36:57 +02:00
Alexander Clouter
647db6a6b5 EAP-TTLS: Key derivation per draft-ietf-emu-tls-eap-types-00
Use the TLS-Exporter with the label and context as defined in
draft-ietf-emu-tls-eap-types-00 when deriving keys for EAP-TTLS with TLS
1.3.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:35:51 +02:00
Alexander Clouter
c74f230200 EAP-PEAP: Key derivation per draft-ietf-emu-tls-eap-types-00
Use the TLS-Exporter with the label and context as defined in
draft-ietf-emu-tls-eap-types-00 when deriving keys for PEAP with TLS
1.3.

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:35:51 +02:00
Alexander Clouter
872609c151 EAP-TTLS/PEAP peer: Fix failure when using session tickets under TLS 1.3
EAP peer does not expect data present when beginning the Phase 2 in
EAP-{TTLS,PEAP} but in TLS 1.3 session tickets are sent after the
handshake completes.

There are several strategies that can be used to handle this, but this
patch picks up from the discussion[1] and implements the proposed use of
SSL_MODE_AUTO_RETRY. SSL_MODE_AUTO_RETRY has already been enabled by
default in OpenSSL 1.1.1, but it needs to be enabled for older versions.

The main OpenSSL wrapper change in tls_connection_decrypt() takes care
of the new possible case with SSL_MODE_AUTO_RETRY for
SSL_ERROR_WANT_READ to indicate that a non-application_data was
processed. That is not really an error case with TLS 1.3, so allow it to
complete and return an empty decrypted application data buffer.
EAP-PEAP/TTLS processing can then use this to move ahead with starting
Phase 2.

[1] https://www.spinics.net/lists/hostap/msg05376.html

Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
2021-02-20 17:02:35 +02:00
Jouni Malinen
9acf8da223 tests: Use a longer timeout for connection in sigma_dut DPP test cases
It was possible for these test cases to fail if the first scan iteration
did not find the AP since the 10 second timeout was small enough to
terminate the second attempt before fetching the scan results. Increase
this timeout to allow at least two full scan iterations to be completed
before declaring failure.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-20 16:10:47 +02:00
Jouni Malinen
6ef749ce15 tests: Clear scan results at the end of scan-ssid-list tests
These test cases use hidden SSIDs and left behind a BSS entry with no
SSID. That can cause issues for consecutive test cases where the BSSID
can be used as the key for finding a BSS entry. That could end up
picking the old hidden SSID BSS instead of the one that was meant to be
used in the test case.

Flush the scan cache at the end of the scan-ssid-list test cases to
reduce invalid test failures for the consecutive test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-20 16:01:32 +02:00
Jouni Malinen
751ce086aa tests: Make PASN tests more robust
The PASN_START command can fail if there is an old BSS entry for the
same BSSID from an earlier test case. Try to avoid this by flushing the
scan results before running these test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-20 15:45:54 +02:00
Andrei Otcheretianski
8265f84531 nl80211: Unconditionally clear nl_msg
Previously nl80211_nlmsg_clear() would be called under a special
condition when valid_handler is NULL and valid_data is -1. Such API is
not very convenient as it forces the handler to be NULL. Change the
send_and_recv() function to always clear the nl_msg, which will simplify
all this logic.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:34:42 +02:00
Ilan Peer
6c7b0a9657 PASN: Correctly set RSNXE bits from AP
The capability bit index should not be shifted here as the shifting is
handled later below when building the RSNXE octets.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:26:21 +02:00
Ilan Peer
85eb47e3a9 PASN: Correctly set RSNXE bits from STA
These defines are for the capability bit number, not the binary value
from the bit index. As such, need to use BIT() here to set the bitmap
appropriately.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:25:10 +02:00
Andrei Otcheretianski
be5f7f3746 wpa_supplicant: Fix potential memleak on an error path
extra_buf allocation was missed in one of the error cases.

Fixes: 170775232d ("ANQP: Add support to specify frequency in ANQP_GET command")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:18:45 +02:00
Andrei Otcheretianski
fb83e4fbc3 tests: Replace deprecated thread isAlive function
The isAlive() function is deprecated in newer versions of Python
so replace it with the is_alive() instead.

Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:16:33 +02:00