Commit graph

9772 commits

Author SHA1 Message Date
Manoj Sekar
c3e5286537 Multi-AP: Parse Profile subelement
Parse the indicate profile support for the Multi-AP Profile subelement.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 18:55:14 +02:00
Manoj Sekar
0034112429 Multi-AP: Generation of Multi-AP Profile subelement
Add support for including the Multi-AP Profile subelement into the
Multi-AP element.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 18:53:45 +02:00
Manoj Sekar
364cb7c943 Multi-AP: Parse the Multi-AP element using a shared helper function
This makes it more convenient to handle extensions to the element and
allows code to be shared between hostapd and wpa_supplicant.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 18:53:42 +02:00
Jouni Malinen
0e2ca2e4e2 Multi-AP: Use proper length for remaining buffer for the element
Replace the hardcoded buffer length with the actually number of
remaining bytes on the buffer. This is needed to be able to do real
buffer size validation within add_multi_ap_ie().

Furthermore, make hostapd_eid_multi_ap() static since it is not used
outside this file.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-19 16:45:41 +02:00
Manoj Sekar
61e46f860c Multi-AP: Move IE parameters into a struct for extensibility
This makes it easier to extend the information that is encoded in the
Multi-AP element.

Signed-off-by: Manoj Sekar <quic_sekar@quicinc.com>
2024-03-19 16:40:13 +02:00
Chien Wong
a438e52933 OpenSSL: Fix a memory leak on hpke_labeled_expand() error path
Fixes: 786ea402bc ("HPKE base mode with single-shot API")
Signed-off-by: Chien Wong <m@xv97.com>
2024-03-08 10:43:52 +02:00
Chien Wong
b35b1036fe OpenSSL: Fix a memory leak on openssl_evp_pkey_ec_prime_len() error path
Fixes: b700a56e14 ("OpenSSL 3.0: Determine the prime length for an EC key group using EVP_PKEY")
Signed-off-by: Chien Wong <m@xv97.com>
2024-03-08 10:43:39 +02:00
Evan Benn
35df7ee09e DPP: Emit a DPP PB_STATUS event when push button starts
To implement an action script that listens for DPP push button events
and for example blinks a LED it is useful to know when push button has
started. Emit an event when push button starts.

Signed-off-by: Evan Benn <evan.benn@morsemicro.com>
2024-03-08 10:37:28 +02:00
Jouni Malinen
69dd408fb8 EHT: More accurate no-second-channel-offset checks when puncturing
This is needed to allow some cases where puncturing prevents HT/VHT/HE
from using the full channel bandwidth.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-08 10:20:28 +02:00
Jouni Malinen
131ee59266 EHT: Support punct_bitmap overriding in HE element generation
This was already added for VHT, but a similar change is needed for HE as
well.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-08 10:13:12 +02:00
Jouni Malinen
c96c3adc36 Move punct_update_legacy_bw() into src/common
This function is needed for more common operations so move it to a more
suitable location.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-08 10:13:12 +02:00
Jouni Malinen
9f43c1e26b Provide punct_bitmap to hostapd_set_freq_params()
This is needed to be able to check validity of the channel parameters
for cases where EHT puncturing impacts what can be enabled for
HT/VHT/HE.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-08 10:01:30 +02:00
Jouni Malinen
47dad1ed16 EHT: Move puncturing bitmap determination into a helper function
Avoid duplicated implementation for this by using a shared helper
function.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-08 10:00:35 +02:00
Jouni Malinen
010d8d10ed EHT: Use eht_oper_puncturing_override when constructing VHT elements
The testing functionality for overriding EHT puncturing bitmap was
applied only for the EHT elements. The mac80211 has been updated to
enforce compartibility between EHT and HT/VHT information and that made
the related test cases fail. Apply the override value for VHT element
generation to avoid some of those issues.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-06 22:34:57 +02:00
Jouni Malinen
9e90486bce 2-octet operating classes in Support Operating Classes element
A previous workaround was used to move the special operating class 130
to the end of the Supported Operating Classes element to avoid getting
any following entry being ignored or misunderstood. That is not really
the correct way of encoding the special cases, i.e., 80+80 MHz channels
that use two nonadjacent frequency segments.

Add support for encoding the 80+80 MHz channel with the 2-octet
operating class design using the Operating Class Duple sequence field of
the Supported Operating Classes element instead of listing the operating
classes that have the 80+ behavior limit set indication in Table E-4
(i.e., opclass 130 and 135) as 1-octet operating classes in the
Operating Classes field.

Fixes: a92660a00e ("Work around Supported Operating Classes element issues for 6 GHz")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-03-05 16:24:35 +02:00
Ainy Kumari
5dabc10185 Extend support for the 6 GHz operating class 137 (320 MHz)
Commit 085a3fc76e ("EHT: Add 320 channel width support") added this in
various places, but it did not cover everything. Extend this support to
be more complete. In particular, this allows wpa_supplicant to report
the operating class 137 in the Supported Operating Classes element and
to use it when processing beacon requests.

Signed-off-by: Ainy Kumari <quic_ainykuma@quicinc.com>
2024-03-04 19:20:03 +02:00
Ainy Kumari
e74d95e0aa nl80211: Process 6 GHz regulatory rules to accurate channel flags
This is needed to be able to indicate all supported operating classes.

Signed-off-by: Ainy Kumari <quic_ainykuma@quicinc.com>
2024-03-04 19:20:03 +02:00
Jouni Malinen
59951ebf09 Use a helper function to free neighbor DB entries
There is no need to duplicate this code in multiple locations.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-03-03 21:33:46 +02:00
Jouni Malinen
96f0af07e6 Clear all neighbor entry items explicitly
Do not leave some of the variables to their previously used values when
a neighbor entry is cleared.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-03-03 21:33:46 +02:00
Nikita Chernikov
6f285fbafc Update own report in nr_db if SSID is changed
short_ssid in the own neighbor report might get out of sync, causing
advertising RNR element based on the old SSID, when SSID is changed
either with control interface command SET or with SIGHUP. Therefore,
sync the own report entry by removing the old entry and setting own
report again if the short SSID value has changed.

Signed-off-by: Nikita Chernikov <nchernikov@maxlinear.com>
2024-03-03 21:33:46 +02:00
Michael-CY Lee
b653420a23 AP MLD: Set link address only when non-AP MLD is not added to driver
Once the non-AP MLD is added to the driver, the driver handles the
address translation so that hostapd receives Management frames with
SA/DA being translated into MLD MAC addresses.

If the Authentication frmae is retransmitted with transaction being 1,
SA of the retransmitted Authentication frame is translated into the MLD
MAC address by the driver, and then in the function handle_auth(),
sta->mld_info.links[].peer_addr would be replaced by the MLD MAC address
even though it is supposed to be the link address.

Therefore, update the MLD information only when the STA has not yet been
added into the driver to avoid replacing the previously determined link
address with the MLD MAC address.

Fixes: bcbe80a66 ("AP: MLO: Handle Multi-Link element during authentication")
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2024-03-03 21:33:46 +02:00
Janusz Dziedzic
b483ceafc4 hostapd: Dump VHT/HE/EHT full capabilities in STA command output
Show full VHT/HE/EHT capabilities for connected stations.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
2024-03-03 20:07:41 +02:00
Jouni Malinen
040ba112aa Use os_snprintf_error() more consistently in STA output generation
In theory, os_snprintf() could return a negative value and as such,
os_snprintf_error() should be used in all cases where the buffer might
not be large enough.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-03-03 20:01:27 +02:00
Jouni Malinen
963dbad7dc nl80211: Indicate EVENT_TX_WAIT_EXPIRE on match-saved
The event indicating expiration of an offchannel TX is useful for cases
where the wait is for a frame that was explicitly requested to have the
pending cookie to be saved.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-03-02 19:39:49 +02:00
Benjamin Berg
e90f6678f1 nl80211: Remnove unused struct i802_link ctx
This was never used.

Fixes: 47269be36e ("nl80211: Refactor i802_bss to support multiple links")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 12:01:33 +02:00
Benjamin Berg
0d4288a005 nl80211: Use valid_links bitmask for bss->links array
Most places in the codebase use a valid_links bitmask with an array.
Switch the bss->links array to use the same design with the Link ID
being used as the array index instead of having a link_id inside.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 11:59:16 +02:00
Jouni Malinen
9ed51186e8 Use a single define MAX_NUM_MLD_LINKS for the maximum number of links
There is no need to maintain a separate MAX_NUM_MLO_LINKS define for
practically the same thing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-03-02 11:25:20 +02:00
Benjamin Berg
dbdf7ef679 Use for_each_link() in most cases
This was done using the below semantic patch. There are a few more
places that were missed due to variable declarations or additional
checks in the for loop.

@@
iterator name for_each_link;
identifier max_links =~ "MAX_NUM_MLD_LINKS|MAX_NUM_MLO_LINKS";
expression links;
expression further_tests;
identifier i;
statement stmt;
@@
-for (i = 0; i < max_links; i++)
+for_each_link(links, i)
 {
(
-  if (!(links & BIT(i)))
-    continue;
   ...
|
-  if (!(links & BIT(i)) || further_tests)
+  if (further_tests)
     continue;
   ...
|
-  if (further_tests || !(links & BIT(i)))
+  if (further_tests)
     continue;
   ...
|
-  if (links & BIT(i))
     stmt
|
-  if (further_tests && (links & BIT(i)))
+  if (further_tests)
     stmt
|
-  if ((links & BIT(i)) && further_tests)
+  if (further_tests)
     stmt
)
 }

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 11:11:12 +02:00
Benjamin Berg
c9f8fe0664 common: Introduce for_each_link() macro
This is a simple macro iterating the given bitmask using the given
variable. Having the macro avoids the for loop-continuation making it
more readable overall.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 11:02:54 +02:00
Benjamin Berg
6cb421c1fa nl80211: Fix link indexing in nl80211_connect_common()
In some places the wrong index variable was used to access the link
configuration. Fix this by simply using link_id instead of i.

With this, the i loop variable is not needed anymore. We can simply
always pass 0 to nla_nest_start(). Also, the kernel does not care about
the order that the links are provides, so just remove the special
handling for the association link.

Fixes: a2c4c0b1b6 ("nl80211: Support MLD association request")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 10:59:02 +02:00
Ilan Peer
408a399aa4 nl80211: Explicitly differentiate between 5 GHz and 6 GHz modes
When a device supports both the 5 GHz band and the 6 GHz band,
these are reported as two separate modes, both with mode set to
HOSTAPD_MODE_IEEE80211A. However, as these are different modes,
each with its own characteristics, e.g., rates, capabilities etc.,
specifically differentiate between them by adding a flag to indicate
whether the mode describes a 6 GHz band capabilities or not.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-03-02 10:53:19 +02:00
Sunil Ravi
dbcf9ff156 P2P: Notify the IP address of the connected P2P Client
When wpa_supplicant assigns the IP address (WFA EAPOL IP address
allocation feature), the assigned IP address of the P2P Client on the GO
side is notified in the AP-STA-CONNECTED event. So to obtain the IP info
to external programs, modify the STA authorized event to include the the
assigned IP address of the P2P Client.

Test: Establish P2P connection and verified from the logs that
      the P2P Client IP address is notified.
Signed-off-by: Sunil Ravi <sunilravi@google.com>
2024-03-01 20:36:41 +02:00
Chenming Huang
8cdb0d3f24 AP MLD: Stop AP per link
For AP MLD cases, the link id is required to determine the correct link
to stop in the stop_ap() driver op.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-28 22:32:09 +02:00
Jouni Malinen
d084ef36b3 AP MLD: Clean up disassoc handling for non-AP MLD link validity check
The check for the non-AP MLD link being valid can be done one level
outside the loop that tries to find a matching AP link.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-28 22:17:57 +02:00
Chenming Huang
7ceafb6e9f AP MLD: Handle disassociation notification with SME offload to driver
For non-AP MLDs, clear STA entry from all affiliated links.

For legacy non-MLO case, find association link to clear the STA entry.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-28 22:17:52 +02:00
Jouni Malinen
95a825bc43 RADIUS: Preliminary support RADIUS/TLS as an alternative to RADIUS/UDP
This adds initial parts for RADIUS/TLS support in the RADIUS client.
This can be used with eapol_test and hostapd. This functionality is not
included by default and CONFIG_RADIUS_TLS=y in .config can be used to
enable it.

This version does not yet include all the needed functionality for TLS
validation and the rules for dropping a TCP connection based on invalid
RADIUS attributes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-25 20:54:14 +02:00
Jouni Malinen
87f33c26b9 RADIUS: Simplify IPv4/IPv6 socket handling in client
There is only one connection in use in parallel to a RADIUS
authentication server (and similarly to a RADIUS accounting server). As
such, there is not really any need to maintain separate open IPv4 and
IPv6 sockets. Instead, open the socket for the appropriate IP version
only when actually connecting to a specific server.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-25 18:10:05 +02:00
Jouni Malinen
971b781479 RADIUS: Simplify radius_change_server() parameters
There is no need for passing the sock and sock6 parameters separately
since they were always the same values for auth == 0 or auth == 1 cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-25 17:25:15 +02:00
Jouni Malinen
3386e1327e l2_packet_freebsd: Fix macOS build
ETHER_VLAN_ENCAP_LEN does not seem to be defined in macOS
net/ethernet.h, so define that, if needed, to avoid build issues.

Fixes: 5b21f4861c ("l2_packet_freebsd: Enable receiving priority tagged (VID=0) frames")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-24 18:29:57 +02:00
Kiran Kumar Lokere
86c2421711 TDLS: Defer the start request until the discovery response RX for MLO
When the station (non-AP MLD) is associated with an AP MLD the link ID
for TDLS setup is derived from the discovery response frame and the link
ID is used in TDLS setup operation when acting as initiator. The driver
sends the received discovery response frame followed by the TDLS setup
request event. But the discovery response frame is received after the
setup request event leading to use incorrect link ID value for TDLS
setup operation causing the setup failure. Process the TDLS setup
request if the discovery response frame is received, else defer the
process until the discovery response frame is received and process the
setup request after discovery response frame is processed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-18 11:24:29 +02:00
Haribabu Krishnasamy
352ad5f1a2 Apply CHAN_SWITCH in all BSS for MBSSID case
When the CHAN_SWITCH command is executed during multi BSSID case (say
BSS1, BSS2, and BSS3), if one of the BSS is disabled (say BSS2), the
CHAN_SWITCH command returns an error in BSS2 and does not proceed to the
next BSS (BSS3).

The CHAN_SWITCH command handler iterates over all configured BSSs and
attempts to send the switch_channel to each one. However, if any one of
the BSSs fails, the entire command is aborted and returns a failure.

Continue the iteration even if one BSS is failing to make sure the
configuration is applied to other BSSs.

Signed-off-by: Haribabu Krishnasamy <quic_hkr@quicinc.com>
2024-02-18 11:09:40 +02:00
mukul sharma
87120a5b6e Add QCA_NL80211_VENDOR_SUBCMD_ADJUST_TX_POWER command
During high battery voltage scenario, higher MCS data rate leads to poor
EVM accuracy which causes poor user experience. Hence to provide better
user experience, EVM accuracy needs to be improved by adjusting TX power
for MCS rate of specific band/radio chain. To achieve this, add a new
vendor command to configure required parameters in the WLAN driver.

Signed-off-by: Mukul Sharma <quic_mukul@quicinc.com>
2024-02-16 19:37:47 +02:00
Veerendranath Jakkam
fe82a61efa Add QCA vendor attribute for BTM support configuration
Add a vendor attribute to configure BTM support in STA mode.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2024-02-16 19:27:07 +02:00
Jouni Malinen
3a5d1a7e6d NAN: USD in hostapd
Add hostapd support for interacting with the NAN discovery engine to
allow single-channel (i.e., the AP's operating channel) USD as Publisher
or Subscriber.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 19:54:17 +02:00
Jouni Malinen
e3f9ab3c3a NAN: USD in wpa_supplicant
Add wpa_supplicant support for interacting with the NAN discovery engine
to allow USD as Publisher or Subscriber.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 19:54:17 +02:00
Jouni Malinen
9eb0bc1f0a NAN: Unsynchronized service discovery (USD)
Add NAN discovery engine and wpa_supplicant interface to use it for the
subset of NAN functionality that is needed for USD.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 19:54:14 +02:00
Jouni Malinen
f2ea8791c0 NAN: Protocol definitions
Add NAN protocol definitions that are needed for USD based on Wi-Fi
Aware specification v4.0.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 11:36:09 +02:00
Jouni Malinen
4f557c5947 Add os_reltime helpers to work with milliseconds
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-15 11:36:09 +02:00
Jouni Malinen
0b5d370c00 DPP: Fix DPP Action frame check for EVENT_RX_MGMT events
This was missing a check for the Category field and could have matched
other Action frames than Public Action frames.

Fixes: 9c2b8204e6 ("DPP: Integration for hostapd")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-14 01:01:07 +02:00
Jouni Malinen
8fa52a7974 FT: Allow wpa_supplicant to be configured to prepend PMKR1Name
The standard is somewhat unclear on whether the PMKIDs used in
(Re)Association Request frame (i.e., potential PMKIDs that could be used
for PMKSA caching during the initial mobility domain association) are to
be retained or removed when generating EAPOL-Key msg 2/4.

wpa_supplicant has replaced the PMKID List contents from (Re)Association
Request frame with PMKR1Name when generating EAPOL-Key msg 2/4 for FT.
Allow it to be configured (ft_prepend_pmkid=1) to prepend the PMKR1Name
without removing the PMKIDs from (Re)Association Request frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-03 20:58:01 +02:00
Jouni Malinen
9929426b92 FT: Allow PMKIDs from AssocReq to be in EAPOL-Key msg 2/4
The standard is somewhat unclear on whether the PMKIDs used in
(Re)Association Request frame (i.e., potential PMKIDs that could be used
for PMKSA caching during the initial mobility domain association) are to
be retained or removed when generating EAPOL-Key msg 2/4.

hostapd used to require that only the PMKR1Name is included in the PMKID
List of RSNE in EAPOL-Key msg 2/4. Extend this to allow the PMKIDs that
were included in the (Re)Association Request frame to be present as long
as the correct PMKR1Name is also present. This would allow PMKSA caching
to be used in initial mobility domain association with supplicant
implementations that insert the PMKR1Name without removing the PMKIDs
used in the (Re)Association Request frame. wpa_supplicant did not use to
that, but other implementations might.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-03 20:43:24 +02:00
Chenming Huang
5603899976 AP MLD: Handle EAPOL only on the association link
For some implementation, there is no link id in EAPOL event, e.g., use
drv_event_eapol_rx for receiving. Current design for such case is switch
to a link that stores the peer. However, this is error-prone because for
non-AP MLD case, sta_info is stored in all valid links but EAPOL sm is
only initialized in the association link. If EAPOL RX event is handled
in a non-association link, it will be discarded and this leads to EAPOL
timeout.

So find the association link to handle received EAPOL frame in such
case. This replaces the previously used workaround for RSN/wpa_sm for
the no link id specified case.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 23:01:57 +02:00
Chenming Huang
7ba039ba11 AP MLD: Do not allow disabling first interface affiliated with an AP MLD
Disabling the first interface calls hapd_deinit(), which causes some
issues, e.g., failure when trying to disable other interfaces due to
NULL drv_priv.

So check that all other interfaces are already disabled before disable
the first interface.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 22:54:44 +02:00
Chenming Huang
03e89de47b AP MLD: Process link info when handling new STA event with driver SME
When association is handled in hostapd, a non-AP MLD's info is stored in
all valid links. This should be the same when SME is offloaded to the
driver.

Also skip some operations that are already done by the driver
when SME is offloaded.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 20:06:49 +02:00
Jouni Malinen
d3d59967af Handle both HT40+ and HT40- allowed consistently in channel check
Return the result from the first hostapd_is_usable_chan() call instead
of the following attempts in case of ht40_plus_minus_allowed to have
consistent behavior with the case where only one option is specified.
This allows the fallback to 20 MHz to work in additional cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-02-02 17:50:40 +02:00
Chenming Huang
e650fa4d79 ACS: Handle ACS channel selected event in specified link
When ACS offloaded to the driver, the channel selected event carries
link id to specify the link if operating as AP MLD.

Find the specified link to handle this event.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 10:48:10 +02:00
Chenming Huang
0e91a86ec5 ACS: Add link id if operating as an AP MLD
ACS is triggered per link, so link id is needed for the driver to handle
when the ACS operation is offloaded.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-02-02 10:44:46 +02:00
Harish Rachakonda
f972420e82 AP MLD: Fix AID allocation for legacy STA
Currently, AID is not allocated properly in hostapd for legacy non-MLD
STA in case of an AP MLD. All such stations have same AID.

Fix this issue by allocating AID properly in hostapd when operating as
an AP MLD and the STA is not an MLD.

Fixes: d924be3bd0 ("AP: AID allocation for MLD")
Signed-off-by: Harish Rachakonda <quic_rachakon@quicinc.com>
2024-01-30 11:50:21 +02:00
Muna Sinada
fe36750b39 Add QCA vendor command to disassociate with peer
This is an event indicating to the user space to disassociate with
peer based on the peer MAC address provided.

Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
2024-01-29 18:51:44 +02:00
Jouni Malinen
9fe2970ff6 OpenSSL: Use library functions for HPKE when possible
OpenSSL 3.2 added support for HPKE. Use that implementation when
possible. At least for now, the internal version needs to be included as
well to be able to cover the special DPP use case with brainpool curves.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 20:18:07 +02:00
Jouni Malinen
14c5f401f0 Remove forgotted STAKey related functionality in EAPOL-Key Request
The use of a MAC KDE in the Key Data field of an EAPOL-Key Request frame
was only for the STAKey handshake. That handshake was implemented in
2005 as an experimental functionality and it was then removed in 2006.
However, this part of the functionality was forgotten. This does not do
anything in practice, so simplify the implementation and remove it.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 19:15:08 +02:00
Jouni Malinen
3f60fcdd88 FILS: Fix EAPOL-Key request generation
The Encrypted Key Data field need to be set to 1 whenever using an AEAD
cipher. Without this, the Authenticator would discard the EAPOL-Key
request frame when using FILS.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 18:56:47 +02:00
Jouni Malinen
b27086e6eb Discard EAPOL-Key request without Secure=1
EAPOL-Key request is accepted only if the MIC has been verified, so PTK
must have already been derived and Secure=1 needs to be used. Check the
Secure bit explicitly for completeness even though the MIC verification
is already taking care of validating that the sender is in the
possession of valid keys.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 18:41:06 +02:00
Jouni Malinen
0967940885 Discard EAPOL-Key Request frames during 4-way handshake
While the Authenticator state machine conditions are already checking
for sm->EAPOLKeyRequest, it seems clearer to explicitly discard any
EAPOL-Key Request frame that is received unexpectedly during a 4-way
handshake.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 18:32:03 +02:00
Jouni Malinen
8037c1ad61 Move Key Replay Counter checks for EAPOL-Key frames to helper functions
This simplifies wpa_receive().

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 11:38:45 +02:00
Jouni Malinen
2c6147404e Check Key Descriptor Version value earlier in the process
There is no need to try to process the EAPOL-Key frame if it has an
unexpected Key Descriptor Version value. Move these checks to happen
earlier in the sequence. In adition, use a separate helper function for
this to simplify wpa_receive() a bit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 11:26:16 +02:00
Jouni Malinen
bd1e078996 Reject undefined Key Descriptor Version values explicitly
Check that the EAPOL-Key frame Key Descriptor Version value is one of
the defined values explicitly instead of failing to process the Key Data
field later (or end up ignoring the unexpected value if no processing of
Key Data is needed).

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 11:22:47 +02:00
Jouni Malinen
fff69bba10 Use more generic checks for Key Descriptor Version 2 and 3
IEEE Std 802.11-2020 describes the rule based on not-TKIP for value 2
and no pairwise cipher condition on value 3, so use that set of more
generic rules here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 11:18:40 +02:00
Jouni Malinen
74a25a6602 Remove always true check on EAPOL-Key message in authenticator
This was practically dead code since no other msg value exist anymore.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-28 11:07:55 +02:00
Thirusenthil Kumaran J
9e9afd9569 Extend frequency configuration to handle 6 GHz channel 2
In hostapd_set_freq_params(), if center_segment0 is 2, call
ieee80211_chan_to_freq() with operating class 136 instead of 131.

This is needed because, channel 2 is an exception in the 6 GHz band. It
comes before channel 1 and is part of operating class 136.

Channels order in 6 GHz:
    2 (Operating Class 136)
    1   5   9 ....  (Operating Class 131)

Signed-off-by: Thirusenthil Kumaran J <quic_thirusen@quicinc.com>
2024-01-26 20:08:41 +02:00
Muna Sinada
8677844db8 Add a QCA vendor attribute to determine QCA device
Add a new attribute for
%QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION subcommand. This
attribute is an 8 bit unsigned value used to specify whether an
associated peer is a QCA device.

Signed-off-by: Muna Sinada <quic_msinada@quicinc.com>
2024-01-26 18:46:10 +02:00
Jouni Malinen
576f462504 P2P: Accept P2P SD response without TX status
If a GAS response is received for a pending SD query, process it even if
the TX status event for the query has not yet been received. It is
possible for the TX status and RX events to be reordered especially when
using UML time-travel, so this is needed to avoid race conditions to
make SD more robust.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-26 17:12:16 +02:00
Jouni Malinen
16a22ef340 nl80211: Increase the hard scan timeout for initial attempt
If both 6 GHz and S1G channels are included, the previously used timeout
was not long enough at least with mac80211_hwsim. Increase the initial
timeout to allow such a scan to be completed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-26 12:26:36 +02:00
Jouni Malinen
f20ca22dce DFS: Print the random channel list entry selection in debug print
This makes it a bit easier to understand what happens with random
channel selection after radar detection.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-26 11:59:48 +02:00
Jouni Malinen
d88fe8fe5d DFS: Fix a typo in a debug message
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-26 11:42:54 +02:00
Chenming Huang
6c334d9f04 nl80211: Set allowed frequency list per link for AP MLD
QCA_WLAN_VENDOR_ATTR_CONFIG_AP_ALLOWED_FREQ_LIST needs be to set per
link if operating as an AP MLD.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2024-01-24 18:32:50 +02:00
mukul sharma
42cd2376fd Enhance QCA vendor interface with new SAR version numbers
Add more SAR version numbers in the qca_wlan_vendor_sar_version.

Signed-off-by: Mukul Sharma <quic_mukul@quicinc.com>
2024-01-24 12:47:54 +02:00
Jouni Malinen
348c047afd ACS: More consistent checking of the best channel pointer
It looks like best might be NULL in some cases, so check for this
explicitly before trying to dereference it for a debug print.

Fixes: 733de85680 ("ACS: Fix not selecting the best channel in the segment")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:58:06 +02:00
Jouni Malinen
5d54bf6fb6 Fix error path on Key Data field decryption
key_data_buf is already freed on the common exit path, so do not try to
free it here on error.

Fixes: 4abc37e67b ("Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:54:34 +02:00
Jouni Malinen
a4d599a53d FT: Fix architecture for RxKH loading from a file
src/ap/ap_config.c is not really supposed to call directly into a
function in hostapd/config_file.c. Furthermore, the wrapper through
ap_config.c did not really have any real value since it just called a
function that is within hostapd/*.c and that wrapper was called from
hostapd/*.c.

Instead of the wrapper, just call the function directly within the
hostapd directory.

Fixes: 392114a179 ("FT: Add dynamic reload of RxKH definitions from file")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:30:10 +02:00
Jouni Malinen
0b95d1346f OpenSSL: Fix a memory leak on an error path
peerkey from EVP_PKEY_new() needs to be freed on all error paths.

Fixes: b062507670 ("OpenSSL: Implement crypto_ecdh routines without EC_KEY for OpenSSL 3.0")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:16:47 +02:00
Jouni Malinen
456bfec470 Avoid uninitialized seq number in debug print for testing functionality
If the driver fetch for the current sequency number fails, do not try to
print the value in a debug print without having cleared it.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:16:47 +02:00
Jouni Malinen
c179002789 tests: Fix a memory leak in a module test
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:16:47 +02:00
Jouni Malinen
4037c0ac1e nl80211: Fix wiphy event handling when the driver is deinitialized
Radar detection event could have resulted in the driver interface
instance getting deinitialized and the related memory freed in the
middle of the loop. This was not an issue when the event was passed only
into a single interface, but it became an issue when the loop tried to
send it to all interfaces. If the driver were removed, that loop check
would have used freed memory. Avoid this by explicitly checking that the
driver interface instance is still valid.

Fixes: f136837202 ("nl80211: Pass wiphy events to all affected interfaces")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 21:16:43 +02:00
Jouni Malinen
1c90c8d24e DPP: Avoid a potential use-after-free on an error path in AP
The TX status handler for DPP Authentication Confirm message might have
resulted in use-after-free if the start of a GAS query were to fail,
e.g., due to being somehow unable to transmit the initial request. Avoid
this by explicitly confirming that the authentication session was not
removed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 13:59:03 +02:00
Jouni Malinen
32940c7a44 DPP: Fix use-after-free in connection status reporting when using TCP
The current connection (struct dpp_connection) might get removed during
the dpp_tcp_send_msg() call, so the code setting the
on_tcp_tx_complete_remove flag needs to check whether that happened to
avoid a potential use-after-free.

Fixes: 33cb47cf01 ("DPP: Fix connection result reporting when using TCP")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 13:11:17 +02:00
Jouni Malinen
9456adeeba DPP3: Fix potential use-after-free on push button bootstrap info
When removing the bootstrap info for the PB context, all the possible
pointers to that information needs to be cleared to avoid accesses to
freed memory.

Fixes: 37bccfcab8 ("DPP3: Push button bootstrap mechanism")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 12:51:53 +02:00
Jouni Malinen
e3d6fce848 EAP-SIM/AKA peer: Fix use-after-free for privacy identity
When the privacy protected itentity is used for EAP-SIM/AKA, the buffer
containing the identity was freed just before its use. Fix that by
reordering the operations.

Fixes: 881cb4198b ("EAP-SIM/AKA peer: Simplify identity selection for MK derivation")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 11:47:00 +02:00
Jouni Malinen
fd71cae6c9 nl80211: Fix memory leak on libnl nl_cb
nl_socket_get_cb() increases cb_refcnf for the cb that is bound to a
socket and as such, nl_cb_put() needs to be used with the returned cb
after having cloned it to avoid leaking memory due to cb_refcnt never
getting back to 0.

Fixes: da0d51fee7 ("nl80211: Use socket cb instead of global->nl_cb in send_and_recv()")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-22 11:35:51 +02:00
Jouni Malinen
2814dbd6db OpenSSL: Fix a memory leak in crypto_ec_key_parse_priv()
The OpenSSL 3.x version of crypto_ec_key_parse_priv using
OSSL_DECODER_CTX missed the call to free the context. Fix it to avoid a
memory leak.

Fixes: 4f4479ef9e ("OpenSSL: crypto_ec_key_parse_{priv,pub}() without EC_KEY API")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-22 00:37:31 +02:00
Jouni Malinen
aa1aa289cd AP MLD: Optimize struct mld_link_info size
Use smaller variables when possible and reorder the variables to avoid
unnecessary padding. This drops struct mld_link_info size from 64 to 48
bytes and removes 240 bytes from struct sta_info.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 22:24:08 +02:00
Jouni Malinen
93eab9f0fa Mark hostapd_gen_probe_resp() static
This function has been used only within beacon.c and it got accidentally
converted to a global function.

Fixes: 6b5e00a80e ("AP: Use a struct for Probe Response generation in/out params")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 22:23:47 +02:00
Jouni Malinen
512b925240 AP MLD: Reduce struct mld_link_info size
Replace the fixed length maximum buffer size for STA profile with
dynamically allocated buffers for active links. This reduces struct
mld_link_info size by almost 16 kB and drops the per-STA information in
struct sta_info to a more reasonable size to avoid the almost 10x
increase from MLO support.

In addition, free the resp_sta_profile buffers as soon as the ML element
has bee generated for (Re)Association Response frame since those buffers
are not needed after that.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 21:59:11 +02:00
Jouni Malinen
b91572b308 AP MLD: Fix RADIUS deinit
The singleton RADIUS client design did not address the deinit path
properly. Since hapd->radius could be shared with another links, the
pointer on all those other links needs to be cleared before freeing the
RADIUS client context. Without this, deinit path could have ended trying
to use freed memory when clearing STA entries from other links and
trying to flush any pending RADIUS client messages.

Fixes: a213fee11d ("AP: MLO: Make IEEE 802.1X SM, authserv, and RADIUS client singletons")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 21:21:11 +02:00
Jouni Malinen
fa79e46c78 AP MLD: Use a helper function to set whether a STA is a non-AP MLD
This makes it easier to change the struct sta_info design for MLD by
reducing the number of direct references.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 19:08:08 +02:00
Jouni Malinen
6bda0aca8b AP MLD: Use a helper function to check if a STA is a non-AP MLD
This makes it easier to change the struct sta_info design for MLD by
reducing the number of direct references.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 19:08:08 +02:00
Jouni Malinen
ee9375fb3b tests: Association comeback mechanism in wpa_supplicant
Allow the Timeout Interval Type field in the Timeout Interval element to
be overridden with a different value for testing purposes to be able to
bypass the association comeback processing in mac80211. This allows the
wpa_supplicant internal functionality to be tested.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 12:17:23 +02:00
Henry Ptasinski
4e3f6b847a wlantest: Add test vectors for S1G BIP
- CMAC and GMAC modes
- 128-bit and 256-bit modes
- normal BIP and BIP using BCE
- test vectors with minimum and optional additional header elements in
  S1G beacon frames
- S1G Beacon Compatibility element in some cases, no other beacon body
   components

Signed-off-by: Henry Ptasinski <henry@e78com.com>
Signed-off-by: Andrew Pope <andrew.pope@morsemicro.com>
Signed-off-by: David Goodall <dave@morsemicro.com>
2024-01-20 19:39:27 +02:00
Dariusz Kopka
392114a179 FT: Add dynamic reload of RxKH definitions from file
hostapd reads the list of Rx Key Holders from hostapd.conf file.
However, for systems where topology changes dynamically, the update
of RxKHs list is required without reloading the whole configuration.

Introduce a new source of RxKH definition with original syntax:
- rxkh_file - Path to a file containing a list of RxKHs.

In addition, add a control interface command RELOAD_RXKHS to
reload RxKHs definition from the file specified in `rxkh_file`.

This allows hostapd to properly distribute Rx keys even after topology
change (assuming rxkh_file is updated and reload_rxkhs command issued).

Syntax of rxkh_file is the same as extraction of r0kh and r1kh options
from original hostapd.conf file.

```
r0kh=ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff
r0kh=ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
r1kh=00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeef
```

Signed-off-by: Dariusz Kopka <dariusz@plume.com>
2024-01-20 10:23:04 +02:00
Dariusz Kopka
e94a7d7940 FT: Move RxKH configuration clearing into a helper function
This can be used as a shared function for reloading RxKHs at runtime.

Signed-off-by: Dariusz Kopka <dariusz@plume.com>
2024-01-20 10:19:25 +02:00
Jouke Witteveen
c69ce778f6 Fix building against OpenSSL 3
Smartcard support uses the ENGINE API of OpenSSL, which has been
deprecated as of OpenSSL 3. Rather than migrating the code to the new API
or pretending that we do not support OpenSSL 3, accept that we use
deprecated functionality.

Signed-off-by: Jouke Witteveen <j.witteveen@gmail.com>
2024-01-20 09:39:49 +02:00
Benjamin Berg
5589d62c57 nl80211: Avoid NL80211_WPA_VERSION_3 on older kernel versions
NL80211_WPA_VERSION_3 was only added in kernel 5.2 so it should not be
set for older kernel versions.  There is no direct way to check if the
value is supported. However, we can use the new infrastructure to check
whether the kernel has the NL80211_ATTR_SAE_PASSWORD attribute. It is
related and was added at the same time.

Fixes: 6cc78b3945 ("nl80211: Set NL80211_WPA_VERSION_2 vs. _3 based on AKM")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-01-20 09:39:04 +02:00
Jouni Malinen
5ff6a2749b Remove the MLD specific exception for distinguishing EAPOL-Key msg 2 and 4
Now that we have a more advanced check for the differences within the
Key Data field, nonzero Key Data Length case can be determined to be
EAPOL-Key msg 4/4 if there is no RSNE in the Key Data field.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 22:05:02 +02:00
Jouni Malinen
2314a3569f Testing functionality for EAPOL-Key Key Data field encryption
Allow the Key Data field to be encrypted in EAPOL-Key msg 2/4 and 4/4.
This is for testing purposes to enable a convenient mechanism for
testing Authenticator behavior with either potential future extensions
or unexpected Supplicant behavior.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 22:04:55 +02:00
Jouni Malinen
4abc37e67b Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4
Extend RSN authenticator to be able to process EAPOL-Key msg 2/4 and 4/4
messages in cases where the Key Data field is encrypted using AES key
wrapping (i.e., non-AEAD cipher). While there is not yet any defined
case where such encryption would be used in IEEE Std 802.11-2020,
extensions are considered to be added to use such constructions (e.g.,
in IEEE P802.11bh). As such, it is good to extend the parsing and
processing rules in the authenticator to be ready for such
functionality.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 21:05:13 +02:00
Jouni Malinen
f591732af7 Supplicant side testing functionality for EAPOL-Key Key Data field
Allow additional elements and KDEs to be added to EAPOL-Key msg 2/4 and
4/4. This is for testing purposes to enable a convenient mechanism for
testing Authenticator behavior with either potential future extensions or
incorrect Supplicant behavior.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 16:38:30 +02:00
Jouni Malinen
f7a903654f Extend mechanism to distinguish EAPOL-Key msg 2/4 from 4/4
The initial Authenticator implementation depended on the Key Data field
being empty for EAPOL-Key msg 4/4. This worked fine for years in
practice, but in theory, vendor specific elements or KDEs could have
been added inti EAPOL-Key msg 4/4 and that would have broken this
design. In addition, the MLD case did introduce a KDE into EAPOL-Key msg
4/4 and required changes here.

As an initial step to make this more robust for future extensions,
recognize a received EAPOL-Key message as msg 4/4 if it is for RSN
(i.e., not WPAv1), has Secure=1, contains an unencrypted Key Data field,
and does not include RSNE.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 15:52:34 +02:00
Jouni Malinen
3547ed403d Authenticator side testing functionality for EAPOL-Key Key Data field
Allow additional elements and KDEs to be added to EAPOL-Key msg 1/4 and
3/4 and allow EAPOL-Key msg 3/4 Key Data field to be not encrypted.
These are for testing purposes to enable a convenient mechanism for
testing supplicant behavior with either potential future extensions or
incorrect Authenticator behavior.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-16 13:04:59 +02:00
Jouni Malinen
38719f113e Verify center frequency seg0/seg1 mapping result before use
Handle the center frequency to channel mapping more cleanly by skipping
the cases where the center frequencies are not set and verifying that
the mapping succeeds when they are set.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-14 21:14:42 +02:00
Baligh Gasmi
acea0654f0 Initialize the variables before using it in channel update
seg0 and seg1 variables can have any initial value, but they may cause
the BSS to have a wrong configuration later on in cases where the
separate center frequencies are not set.

Signed-off-by: Baligh Gasmi <gasmibal@gmail.com>
2024-01-14 21:13:24 +02:00
朱海
af6e21faa0 P2P: Fix a logical error of workaround of extended listen failure
When p2p->state == P2P_LISTEN_ONLY, the statement before it
'p2p->cfg->is_p2p_in_progress(p2p->cfg->cb_ctx)' will be true, too, so
this function will print a message "Operation in progress" and return;
the workaround to handle listen failure will be never reached.

I met such an error when the 'remain-on-channel' command failed, then
the function p2p_ext_listen_timeout() just printed 'Operation in
progress' again and again, and the listen operation was not started
anymore.

Fixes: 0f1034e388 ("P2P: Refrain from performing extended listen during P2P connection")
Signed-off-by: zhuhai <zhuhai.mail@163.com>
2024-01-14 21:13:24 +02:00
Andrei Otcheretianski
abc239a0b0 Get rid of multiple MIN macros
There are multiple redundant MIN macro declarations, some of which are
not protecting against side effects. Move it to common.h instead.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2024-01-14 20:13:20 +02:00
Jouni Malinen
12cdeb5016 nl80211: Print driver name in debug output
This can be helpful in debugging some driver specific issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-14 17:32:22 +02:00
Jouni Malinen
197b440c49 nl80211: Print kernel version in debug output
This can be helpful in debugging some kernel specific issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-14 17:18:57 +02:00
Benjamin Berg
5ae010aae5 nl80211: Avoid sending unsupported attributes
The kernel will reject commands if newer attributes are included even
though they should not be. Add appropriate checks in set_ap().

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-01-14 17:13:37 +02:00
Benjamin Berg
7fec9e7bc1 nl80211: Retrieve maxattr via genl for nl80211
Older kernel versions may not support all attributes and may refuse
commands that include them. To avoid sending too new attributes query
the highest supported attribute. This allows adding appropriate checks
where needed.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-01-14 17:11:24 +02:00
Benjamin Berg
f136837202 nl80211: Pass wiphy events to all affected interfaces
Previously, we would only pass the event to the first interface that
matches. However, one wiphy can have multiple interfaces and each one
needs to get the event delivered. Without this, it could e.g. happen
that a radar detection event is forwarded to p2p-dev-wlan0 and not to
the wlan0 interface which actually needs it.

As such, keep iterating if we are processing a wiphy match and send the
event to all affected BSSs.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2024-01-14 17:03:06 +02:00
Jouni Malinen
f9b3ecb0ad DPP: Work arouind missing Auth Confirm ACK for testing
The dpp_test DPP_TEST_STOP_AT_AUTH_CONF case is supposed to prevent the
GAS exchange from happening. It was possible to bypass that testing
functionality if the TX status event for the Authentication Confirm
message was lost or delayed long enough for the GAS Request to be
proessed first. This could happen at least with UML time travel.

Work around this by checking for the special dpp_test case within GAS
request handling.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-14 12:10:04 +02:00
Jouni Malinen
2d83d224ff Use ether_addr_equal() to compare whether two MAC addresses are equal
This was done with spatch using the following semantic patch and minor
manual edits to clean up coding style and avoid compiler warnings in
driver_wext.c:

@@
expression a,b;
@@
-	os_memcmp(a, b, ETH_ALEN) == 0
+	ether_addr_equal(a, b)

@@
expression a,b;
@@
-	os_memcmp(a, b, ETH_ALEN) != 0
+	!ether_addr_equal(a, b)

@@
expression a,b;
@@
-	!os_memcmp(a, b, ETH_ALEN)
+	ether_addr_equal(a, b)

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 23:47:21 +02:00
Jouni Malinen
58027cfecc WPS: Fix authorized MAC removal
Missing array referencing ended up only the first entry in the list to
be compared.

Fixes: 31fcea931d ("WPS 2.0: Add support for AuthorizedMACs attribute")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 23:47:20 +02:00
Jouni Malinen
95123ab3b3 Introduce ether_addr_equal()
This makes a code more readable for the large number of cases that use
os_memcmp() to check whether two ethernet addresses are equal.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 23:47:20 +02:00
Andrei Otcheretianski
76616a46b9 RSN: Fix (B)IGTK MLO KDE length print
Array pointer was mistakenly printed instead of actual length.
Fix it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2024-01-13 23:47:20 +02:00
Andrei Otcheretianski
8e8964cdbd AP: Fix compilation warning in hapd_pasn_update_params()
If CONFIG_FILS isn't set, the compiler complains about unused variables.
Fix it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2024-01-13 23:47:20 +02:00
Jintao Lin
628f286102 trace: Fix compilation issue due to using an undefined symbol
Fix commit 5545d995b3 which could use undefined symbol
testing_fail_alloc() in os_malloc() if CONFIG_WPA_TRACE=y is used
without CONFIG_WPA_TRACE_BFD=y.

Fixes: 5545d995b3 ("trace: Share common implementation for TEST_FAIL and TEST_ALLOC_FAIL")
Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2024-01-13 23:47:20 +02:00
Ilan Peer
cbcd056ece AP: Fix a typo in function name
Rename hostpad_dfs_update_background_chain() to
hostapd_dfs_update_background_chain().

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2024-01-13 23:47:20 +02:00
Johannes Berg
f40a588335 nl80211: Fix AP MLD MAC address on auth retry
The AP MLD MAC address is meant to be preserved here, but since it's
reset to zeroes before attempting to authenticate in
nl80211_mark_disconnected(), we can't just point to the AP MLD MAC
address in drv->auth_ap_mld_addr. Fix it by using a copy.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2024-01-13 22:33:22 +02:00
Ilan Peer
38711a011f AP MLD: Remove link stations on a new station authentication
When a station tries to authenticate to an AP that is affiliated with an
AP MLD, we need to remove all station instances from all the APs.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2024-01-13 22:29:21 +02:00
Ilan Peer
c6f519ff15 AP: Support deauthenticate/disassociate with MLD
When requested to deauthenticate/disassociate a station also handle the
corresponding MLD stations.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2024-01-13 22:29:19 +02:00
Ilan Peer
9c937c8891 AP: Move hostapd_ml_get_assoc_sta() to shared
So it could be used from different contexts.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2024-01-13 22:20:30 +02:00
Ilan Peer
ea401c168e AP MLD: Fix station lookup in hostapd_ml_get_assoc_sta()
If the station is not an MLO station do not attempt to find the
association station and return false in the ML specific disconnection
processing.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2024-01-13 22:17:21 +02:00
Ilan Peer
e9f75a3520 AP: Unify code handling deauthentication/disassociation
This avoids unnecessary code duplication and adds the sta->wpa_sm deinit
calls for deauthentication while it was previously done only in the
disassociation case.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2024-01-13 22:14:17 +02:00
Ilan Peer
2112f0572f AP MLD: Correctly set the BSS parameters change count in RNR
Set the current value instead of hardcoded 1.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2024-01-13 19:44:05 +02:00
Hu Wang
0120d052d7 nl80211: Add NL80211_ATTR_MLO_LINK_ID for NL80211_CMD_REMAIN_ON_CHANNEL
cfg80211 requires the link ID to be specified for requests to start a
remain-on-channel operation during an ML association. This feels wrong
since the ROC operation is in most cases unrelated to the
association. However, that requirement has been in place since kernel
commit 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link
APIs") from April 2022, and as such, it looks necessary to have
wpa_supplicant work around this by specifying the currently used link ID
that would seem to match the ROC channel most closely.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2024-01-13 19:39:03 +02:00
Jouni Malinen
6ea81f3238 nl80211: More detailed debug print for Management frame TX
Print all three addresses to make it easier to debug issues with
Management frame sending.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 19:09:31 +02:00
Jouni Malinen
9ccfc0d516 AP MLD: MLD address conversion for hostapd_drv_send_action_addr3_ap()
Commit 31e025c033 ("AP: When sending Action frames, use the AP MLD MAC
address if needed") added this for hostapd_drv_send_action(), but the
A3=BSSID variant of that function needs similar changes for GAS to work
correctly with STAs that are currently associated with MLO.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 19:09:31 +02:00
Jouni Malinen
febb51bf87 AP MLD: Fix Association Response frame ACK handling
Invert the check on hapd->conf->mld_ap on the affiliated links to
actually call the link specific callback handler. This is needed to set
the STA associated.

Fixes: 55038680a6 ("AP: MLO: Handle association callback")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 19:09:31 +02:00
Jouni Malinen
07f44a7c42 AP MLD: Prefer STA entry that has sta->wpa_sm initialized
This is needed to allow RSN operations, like PTK rekeying, to be
completed on the correct STA entry. The previous design worked by
accident since it was using the WLAN_STA_ASSOC flag and the code that
was supposed to set that flag did not work correctly and left it unset
for the interfaces that were not used for the initial 4-way handshake.
That needs to be fixed, so this search need to be extended to be able to
prefer the STA entry that has sta->wpa_sm set instead of just the
WLAN_STA_ASSOC flag.

Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 19:09:31 +02:00
Nirav Shah
0aeeaaaf13 Add QCA vendor command for flow policy configuration
Define subcmd ID 239 for flow policy configuration.

Signed-off-by: Nirav Shah <quic_nnshah@quicinc.com>
2024-01-12 19:25:05 +02:00
Jouni Malinen
064c233d1e AP: Fix a regression in indoor 6 GHz AP determination
The change to use a helper function for checking he_6ghz_reg_pwr_type
missed the difference between two types of checks for different values:
indoor AP vs. SP AP. Fix this by introducing another helper function to
cover the indoor (i.e., SP and non-SP indoor cases).

Fixes: 121ccadeb4 ("AP: A helper function for determining whether the AP is an SP AP")
Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-04 11:04:20 +02:00
Michael-CY Lee
98f3bd26de ACS: Extend the 320 MHz support
There are bandwidth 320 MHz-1 and 320 MHz-2 channelization in EHT mode.
When using ACS, user might prefer one of the channelization or both, but
original ACS was unable to take such preference.

Another problem is that the original ACS returns only the ideal channel
but no 320 MHz channelization. The function acs_get_bw_center_chan()
also could not correctly return the center frequency of bandwidth 320
MHz that is decided by ACS.

For example, if ACS decide the ideal channel is channel 37 with
channelization 320 MHz-2 (center frequency 6265 MHz),
acs_get_bw_center_chan() returns 6105 MHz, which is 320 MHz-1.

Extend the support for 320 MHz so that ACS can choose the best channel
according to the user's preference. Also, after calling
acs_find_ideal_chan_mode(), the best channel and bandwidth can be
derived.

The changes are:
- bw_type ACS_BW320 is divided into ACS_BW320_1 and ACS_BW320_2
- in bandwidth 320 MHz, find the best channel and bandwidth according to
  user's perference (320 MHz-1, 320 Mhz-2 or both are OK)
- before acs_find_ideal_chan_mode() returns, update bw320_offset in
  iface->conf so that the best channel's channelization is recorded.
- get the best center frequency from bw320_offset

Co-developed-by: Money Wang <money.wang@mediatek.com>
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-23 16:38:06 +02:00
Michael-CY Lee
e6f2494c3a hostapd: Add eht_bw320_offset configuration option
Introduce a new configuration option, "eht_bw320_offset", which enables
devices to specify a preferred channelization for 320 MHz BSSs when
using automatic channel selection (ACS). This option is applicable only
when the channel is not already decided and the bandwidth is set to 320
MHz.

The value and meaning of the option:
0: auto-detected by ACS
1: 320 MHz-1
2: 320 MHz-2

Co-developed-by: Money Wang <money.wang@mediatek.com>
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-23 16:38:06 +02:00
Michael-CY Lee
733de85680 ACS: Fix not selecting the best channel in the segment
Fix the following bugs about selecting the best channels in the segment:
1. If the 'update_best' once became false, it never becomes true again.
   In other word, if one of the channels in the segment is not usable,
   the remaining channels in the segment were never able to be the best
   channel.
2. The primary channel in the segment might not be usable due to the
   insufficient survey data. Therefore, it cannot be the best channel and
   we cannot take its factor/weight into account.

Co-developed-by: Money Wang <money.wang@mediatek.com>
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-23 15:28:50 +02:00
Michael-CY Lee
4881accbb4 ACS: Add HT40- support in the 2.4 GHz band
Allow ACS to pick a HT40- channel in the 2.4 GHz band in addition to the
previously hardcoded HT40+ case.

Co-developed-by: Money Wang <money.wang@mediatek.com>
Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-23 15:16:57 +02:00
Jintao Lin
0143cf42cd Move parse_freq() to be a common helper function
This allows the function to be used outside the context of the
wpa_supplicant control interface implementation.

Signed-off-by: Jintao Lin <jintaolin@chromium.org>
2023-12-23 11:59:19 +02:00
Vinayak Yadawad
b91113e05f Support all PSK AKMs in case of AP mode PSK offload
Previously only the SHA-1 -based AKM was supported. Extend that to cover
all PSK AKMs so that the PSK configuration to the driver happens for all
the possible cases during AP start.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-12-23 11:24:26 +02:00
Jouni Malinen
4efb0247a0 Update definitions to point to the current IEEE 802.11 standard
The previous references were to various snapshots of the standard and
draft versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 21:30:28 +02:00
Jouni Malinen
121ccadeb4 AP: A helper function for determining whether the AP is an SP AP
Get rid of unnecessary code duplication.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 20:57:53 +02:00
Jouni Malinen
24baffc8b6 AP: Share a common helper function for determining length of TPE elements
There is no need to maintain three copies of almost identical code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 20:54:40 +02:00
Ilan Peer
150ee0c068 AP: Add an additional TPE element when needed
If the regulatory client EIRP PSD values advertised by an AP that is a
standard power AP or indoor standard power AP are insufficient to ensure
that regulatory client limits on total EIRP are always met for all
transmission bandwidths within the bandwidth of the AP’s BSS, the AP
shall also send a TPE element in Beacon and Probe Response frames as
that depicts the regulatory client EIRP limit.

Add support for this.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 20:43:27 +02:00
Ilan Peer
3cbb3ac3fa AP: Add TPE element for Indoor standard power AP
According to IEEE P802.11-REVme/D4.0, E.2.7 (6 GHz band), two Transmit
Power Envelope (TPE) elements need to be included by Indoor Standard
Power (Indoor SP) APs. Extend the code to support this.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 18:22:04 +02:00
Andrei Otcheretianski
bcad7fec65 AP: Publish the correct PSD value in RNR TBTT information field
According to IEEE P802.11-REVme/D4.0, 9.4.2.169.2 (Neighbor AP
Information field), the 20 MHz PSD subfield in the TBTT Information
field is a signed value with valid range of -127 to +126, while +127
indicates "no maximum transmit power is specified". Fix the default
value advertised.

Fixes: 3db24e4eef ("RNR: Define element format")
Fixes: a7c152d6b8 ("RNR: Add data from neighbor database")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-22 18:20:28 +02:00
Ilan Peer
7065e5242a AP: Add configuration options for 6 GHz TPE Tx power
Add configuration options for setting the Tx Power value
in the Transmit Power Envelope for 6 GHz:

- The Tx power value for default client where the transmit
  power interpretation is "Regulatory Client EIRP PSD"
- The Tx power value for subordinate client where the transmit
  power interpretation is "Regulatory Client EIRP PSD"

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 18:06:49 +02:00
Ilan Peer
ada9083ac4 AP: Update the HE regulatory information AP types for the 6 GHz band
Update the HE regulatory information AP types based on IEEE
P802.11-REVme/D4.0. Set the default AP type to VLP. Check for valid
values when setting 'he_6ghz_reg_pwr_type' in the interface
configuration.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 17:57:26 +02:00
Ilan Peer
2d4f905214 RRM: Add support for including extended ID elements in beacon report
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 17:14:33 +02:00
Ilan Peer
615835626f AP: Use the MLD MAC address for SAE authentication failures and testing
In cases of SAE failure and testing, mgmt->sa was used for sending the
Authentication frame. Fix these to use the station address (which is
the MLD MAC address in cases of non-AP MLDs).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 16:47:48 +02:00
Jouni Malinen
4a973718d4 Split hostapd_eid_rnr_iface() into two functions
Make this a bit more readable by moving the per-BSS processing into a
helper function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 16:17:20 +02:00
Ilan Peer
0b55b8da3c AP: Add testing option to indicate an AP is disabled
Add a testing configuration such that the AP would be reported as
disabled in the RNR TBTT information MLD parameters included by other
affiliated APs of the AP MLD.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 16:01:40 +02:00
Ilan Peer
2249b9f776 nl80211: Include disabled links indication in association command
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 15:58:12 +02:00
Ilan Peer
5927455b8b MLD: Add support for disabled APs
An affiliated AP of an AP MLD can temporarily be disabled. Other
affiliated APs of the AP MLD indicate this in the Reduced Neighbor
Report (RNR) elements added to their Beacon and Probe Response frames.

When an affiliated AP is disabled, it should be included in the
association exchange, but can be activated only after it is enabled.

Add support identifying disabled APs and propagate the information
to the driver within the associate() callback.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-22 15:56:41 +02:00
Ilan Peer
981e8c1e49 nl80211: Add link ID to the queue parameters configuration print
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-22 15:40:46 +02:00
Ilan Peer
409ebaaa1c AP: Support overriding EHT operation puncturing mask
Add support for overriding EHT Operation element puncturing mask
for testing purposes.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-22 14:19:28 +02:00
Andrei Otcheretianski
799115a8eb AP: Fix EHT MCS size validation for received element
STA EHT MCS and NSS set field size shouldn't depend on AP HE operation
channel width. Fix it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-22 13:24:22 +02:00
Jouni Malinen
12a9574342 nl80211: Fix AP deinit path (link removal) in error cases
If the interface initialization fails, no links might be set when
calling the deinit functions. Those functions need to be prepared for
bss->n_links being 0.

Fixes: 859cbc396f ("nl80211: Remove links when stopping AP MLD in hostapd")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 11:13:28 +02:00
Jouni Malinen
6c3438eef6 nl80211: Fix AP deinit path in error cases
If the interface initialization fails, no links might be set when
calling the deinit functions. Those functions need to be prepared for
bss->flink being NULL.

Fixes: 47269be36e ("nl80211: Refactor i802_bss to support multiple links")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 11:13:25 +02:00
Gururaj Pandurangi
6b7bb10016 Add QCA vendor attribute for EHT SCS traffic description support
Add a vendor attribute for EHT testbed STA to configure the
SCS traffic description support in the EHT capabilities of an
Association Request frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-21 20:22:49 +02:00
mukul sharma
f8657ea031 Add QCA vendor command for reporting firmware page fault informatin
This is an event indicating to the user space firmware page fault
summary report that the driver has generated from firmware indications.
This summary report is used to analyze major cause of page faults and
associated debug information.

Signed-off-by: Mukul Sharma <quic_mukul@quicinc.com>
2023-12-21 20:18:44 +02:00
Shiva Sankar Gajula
ee00bbd297 Support VLAN offload with SAE password based selection
Allow VLAN selection based on SAE password entries when VLAN offloading
is used.

Signed-off-by: Shiva Sankar Gajula <quic_sgajula@quicinc.com>
2023-12-21 20:12:18 +02:00
Jouni Malinen
09d57e5f89 MBSSID: Element ID values in increasing order in Non-Inheritance element
Reorder the Element ID List to fill in the values in increasing order to
match the way the Element ID List is defined.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-21 13:22:03 +02:00
Aditya Kumar Singh
c8dd70cfb1 Fix Multiple BSSID element length calculation
Currently while deciding to create a new Multiple BSSID element based on
the condition when the length reaches 255, the length value being used
is the total element length (including the length of the Element ID and
Length fields as well). However, the value in the length field denotes
the number of octets following it and excluding itself. Hence including
the total length is wrong. This leads to incorrect count of Multiple
BSSID elements.

And while filling the data, the length is considered porperly as it
should be hence we are filling more data in a single go and all data is
filled in MBSSID count which is less than originally calculated. This
ultimately leads to incorrect length calculation during nla_put() and
setting the beacon to the driver fails while putting the Multiple BSSID
element data into the netlink socket buffer.

Fix this issue by considering the length excluding the Element ID and
Length field sizes.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2023-12-21 12:50:27 +02:00
Sai Pratyusha Magam
618df655ae Use sta->vlan_id when needed for VLAN offload
Share VLAN info in RRB when the driver advertises support for VLAN
offload (WPA_DRIVER_FLAGS_VLAN_OFFLOAD). sta->vlan_desc is unused in
this case, only sta->vlan_id is used. Skip the checks that are based on
sta->vlan_desc.

Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
2023-12-21 12:24:35 +02:00
Jouni Malinen
afd306cf79 nl80211: Remove send_and_recv_msgs()
This helper is of no real use anymore, so get rid of it. This completes
send_and_recv*() cleanup. What remains is the most generic
send_and_recv() and two wrappers for it to cover the most common simpler
cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:09:22 +02:00
Jouni Malinen
7c2f67cea2 nl80211: Add send_and_recv_resp() helper
This is a variant for the second most common case of send_and_recv() needs:
send a command with a special response handling.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:07:36 +02:00
Jouni Malinen
ab506d7772 nl80211: Add send_and_recv_cmd() helper
This is a variant for the most common case of send_and_recv() needs:
send a command without needing a special response handling. In addition,
move the helper functions into driver_nl80211.h since these are now
simple wrappers for the more flexible send_and_recv().

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:00:23 +02:00
Jouni Malinen
c73f9cde8b nl80211: Remove send_and_recv_msgs_connect_handle()
This is not really that helpful as a separate helper function, so get
rid of one of the many send_and_recv() variants.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:38:11 +02:00
Jouni Malinen
d2e6a395cc nl80211: Do not set socket owner for NL80211_CMD_LEAVE_IBSS
This operation terminates the IBSS and as such, does not really use
NL80211_ATTR_SOCKET_OWNER.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:28:30 +02:00
Jouni Malinen
35e58b7415 nl80211: Remove send_and_recv_msgs_owner()
This is not helpful as a separate helper function anymore, so get rid of
one of the many send_and_recv() variants.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:26:32 +02:00
Jouni Malinen
9823f43053 nl80211: Move control port attribute adding into more accurate location
This is independent of the NL80211_ATTR_SOCKET_OWNER use, so add these
attributes from a separate helper function that is called only from
locations that actually start an operation that uses EAPOL frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:20:16 +02:00
Jouni Malinen
0d619df8b3 nl80211: Use bss->nl_connect unconditionally
Doing this based on driver support for control port RX or SAE seems like
undesired extra complexity. Just use this in all cases where the special
handle for a longer term operation, like connection or AP mode
operation, is needed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 23:45:09 +02:00
Jouni Malinen
da0d51fee7 nl80211: Use socket cb instead of global->nl_cb in send_and_recv()
This is a step towards cleaning up all the workarounds that have showed
up over the years and made the design difficult to understand. This
removes use of the separate registration of process_bss_event() as
NL_CB_VALID for the individual commands since the use of the appropriate
cb (i.e., the one from nl80211_init_bss() in these cases) will already
point to the correct handler.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 21:41:32 +02:00
Jouni Malinen
84fdc8cd8b nl80211: Accept NL80211_CMD_FRAME events in global context
This is a workaround for some race conditions where the hardcoded use of
global->nl_cb in send_and_recv() ends up getting events delivered
through unexpected context when they happen to arrive at the time when a
command is being processed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 21:08:26 +02:00
Jouni Malinen
828311ef31 AP MLD: More careful checking of Multi-Link element length fields
Avoid potential read of one or two octets beyond the end of the
subelement when verifying that there is sufficient amount of data
included in each subelement/element within the MLE in Association
Request frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 21:55:10 +02:00
Jouni Malinen
38a5ed5fda AP MLD: Skip unknown Multi-Link element subelements
Instead of rejecting the Multi-Link element, skip unknown subelements to
be less likely to cause interop issues for future. IEEE P802.11be/D5.0
allows other optional subelements to be included here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 21:53:52 +02:00
Jouni Malinen
2ab56694f6 Split ap_sta_set_authorized() into two steps
This function is both updating the hostapd-internal sta->flags value and
sending out the AP-STA-CONNECTED control interface message. When
authorizing a STA, the call to this function is followed by a driver
command to update the flags of the STA entry in the driver. That has a
race condition at least for UML time-travel since the AP-STA-CONNECTED
event is used as a message to wait for before running a connectivity
test or some other operation that depends on the data connection being
in working condition.

Split the function into two steps so that the driver STA entry update
can be done between those two steps for the cases where it matters for
the race condition. In other words, send the AP-STA-CONNECTED message
only after having authorized the STA in the driver.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 14:09:57 +02:00
Jouni Malinen
da8a38fecb Remove unused assignment from Country element generation
This looks confusing and can cause warnings from static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:17:43 +02:00
Jouni Malinen
33b5fc0763 PKCS#1: Do not use pointer value after freeing
The check for extra data was not dereferencing the pointer, but avoid
complaints about such uses by freeing the decrypted data only after the
check. The hexdump could have read freed memory, so that needs to be
before the freeing.

Fixes: 54ac6ff8c4 ("PKCS 1: Add function for checking v1.5 RSA signature")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:17:10 +02:00
Jouni Malinen
231d86ef91 OpenSSL: Check EVP_MAC_update() return value more consistently
Check this in crypto_hash_update() to be more consistent and report any
error in crypto_hash_finish().

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:06:04 +02:00
Jouni Malinen
a92694b001 OpenSSL: Check EVP_CIPHER_CTX_set_padding() return value more consistently
Even though this function is documented to always return 1, be more
consistent in checking that to avoid warnings from static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 11:58:48 +02:00
Jouni Malinen
88bc6711a7 TDLS: Avoid unnecessary copying of the Link Identifier element
This memcpy was causing warnings from static analyzers since it is being
misinterpreted as copying all the data into the lnkid.bssid[] array
instead of that and the following arrays. Since the copy is not needed
at all, just use the original pointer to get rid of these warnings.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 11:51:35 +02:00
Jouni Malinen
656cf50d8b More consistent sta pointer checks in handle_assoc()
Verify that sta is not NULL before calling
hostapd_process_assoc_ml_info() that references this parameter. In
theory, sta might be NULL here if addition of the STA entry failed in
the 60 GHz case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 00:12:59 +02:00
Jouni Malinen
29f38ebcf6 ACS: Check whether iface->current_mode is NULL before use
This line seemed to trigger SIGSEGV in some code coverage testing cases.
It is not exactly clear how that was possible, but just in case, check
that iface->current_mode is set before using it here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 00:02:43 +02:00
Jouni Malinen
7a873c81ee AP MLD: Do not schedule disconnection on BSS TM Request link removal
If the BSS TM Request for imminent BSS temoval is for a non-AP MLD that
has multiple affiliated links, do not schedule full disconnection since
other links remain associated.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-16 19:46:41 +02:00
Ilan Peer
ec70d14f7c AP: MLD: Extend BSS transition management request for link removal
Allow link removal imminent indication to be added with the new
link_removal_imminent=1 parameter to BSS_TM_REQ.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 19:46:41 +02:00
Ilan Peer
80810929a4 WNM: Handle BTM request with Link Removal Imminent field set to 1
Based on IEEE P802.11be/D5.0, when a station is non-AP MLD with more
than one link the combination of the Link Removal Imminent field set to
1 and the BSS Termination Included field set to 1 means than only one of
the links is removed while the other links will remains associated.
Handle this case without starting a scan to find another BSS.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 19:12:23 +02:00
Ilan Peer
31e025c033 AP: When sending Action frames, use the AP MLD MAC address if needed
When the AP MLD sends an Action frame to a non-AP MLD, use the AP MLD
MAC address instead of the local AP address (BSSID).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:54:39 +02:00
Ilan Peer
54e6c56d25 AP: Use AP MLD MAC address for terminating MLO association
Use the AP MLD MAC address when sending Deauthentication and
Disassociation frames to a non-AP MLD.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:49:56 +02:00
Ilan Peer
0546f0e1b0 WNM: Use correct address when configured as AP MLD
When the AP is configured to operate as an AP MLD, use the AP MLD MAC
address when needed for transmission of WNM Action frames.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:43:18 +02:00
Michael-CY Lee
0af4c1478e hostapd: Check the bridge if ioctl SIOCBRADDIF fails
If ioctl() returns EBUSY on the command SIOCBRADDIF, the interface might
have already been added to the bridge by an external operation (e.g.,
netifd in OpenWrt), and linux_br_add_if() should not indicate an error.

Check whether the interface is correctly brigded when ioctl()
returns EBUSY and if so, report success.

Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-16 18:16:05 +02:00
Ilan Peer
d43a49a66d Remove a spurious tab in hostapd_eid_rnr()
Remove a spurious \tab char in hostapd_eid_rnr() between arguments to a
function.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 17:58:33 +02:00
Ilan Peer
a28ea8e517 AP: Fix setting MLD Parameters subfield in RNR element
In case the TBTT information is reporting about an AP in the same AP MLD
as the current AP, the AP MLD ID in the MLD Parameters subfield should
be set to 0.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 17:56:42 +02:00
Chenming Huang
40410c04f4 AP MLD: Channel switch for specific link
Link ID needs to be specified for MLD case when doing channel switch.
Add it to the driver command.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2023-12-14 13:14:37 +02:00
Dmitrijs Martinovs
7dd7ae965a DFS: Change vht_capab according to user requested bandwidth
There are different CHAN_SWITCH flows for DFS and non-DFS channels.
Non-DFS one saves previous BW value in iface->conf, but DFS flow
replaces it with a new user requested value. Setting a non-DFS channel
after a DFS one with BW = 160 would have resulted in a mismatch between
the saved BW and vht_capab (if VHT160 was not included by default). This
would have led to a check fail in the hostapd_set_freq_params()
function.

Signed-off-by: Dmitrijs Martinovs <dmartinovs@maxlinear.com>
2023-12-10 20:58:57 +02:00
Jouni Malinen
8e294c3a2c P2P: Recover from successfully requested, but not started, listen
It is possible for the start_listen() callback to be called to request
the driver to start a driver operation and stop_listen() called
immediately after that (e.g., due to a request to transmit a P2P Public
Action frame) before the driver has had time to start ROC and send an
event to notify of that. Such a sequence could result in
p2p->pending_listen_freq being left to a nonzero value without getting a
call to p2p_listen_cb() to clear it. This would stop an ongoing P2P
listen operation since no following p2p_listen() call would start the
listen due to the pending command being assumed to be in effect.

Fix this by detecting this particular sequence and clearing
p2p->pending_listen_freq.

This was found with the p2p_listen_and_offchannel_tx test case with the
new kernel scheduled and UML time-travel.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-10 19:30:44 +02:00
Jouni Malinen
a83d3132e8 WNM: Define BSS transition management reason values
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-09 11:22:14 +02:00
Vinayak Yadawad
7ee7b046a9 nl80211: Use attribute NL80211_ATTR_BSSID to scan for specific BSSID
With changes to optimize scan for specific BSSID, there arises a
scenario where in nl80211_trigger_scan() is called with a scan
randomization enabled. A combination of NL80211_ATTR_MAC for BSSID and
scan randomization, which uses NL80211_ATTR_MAC for a different purpose,
results in invalid error for the scan request. To fix the issue use
attribute NL80211_ATTR_BSSID instead of NL80211_ATTR_MAC.

NL80211_ATTR_BSSID was introduced in kernel commit 2fa436b3a2a7
("nl80211: Use different attrs for BSSID and random MAC addr in scan
req") in 2016. Prior to that, only NL80211_ATTR_MAC could be used for
specifying the target BSSID. For backwards compatibility, add the
NL80211_ATTR_MAC attribute as well when not using a random MAC address.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-12-09 10:56:20 +02:00
Benjamin Berg
5bbc9462a0 tests: Test driver association ML link rejection flow
The underlying driver can reject only specific links in an association
request. In that case we will only ignore the corresponding BSS. Add a
test for this flow by simulating an association failure on the second
link specifically.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-06 22:41:40 +02:00
Ilan Peer
32434aa68a AP: Always include WPA_STA_AUTHORIZED in station flags mask
As otherwise, the underlying driver would not handle a change
in the 'authorized' state.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-06 21:54:08 +02:00
Ilan Peer
174a8fc416 AP MLD: Do not modify flags for link stations
All the station flags other than WPA_STA_SHORT_PREAMBLE are relevant
only for the MLD station and not to the link stations (as these flags
are related to the MLD state and not the link state).

As for the WPA_STA_SHORT_PREAMBLE, since the station is an EHT
station, it must have short preamble.

Thus, do not propagate the flags change for link stations to the driver.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-06 21:49:09 +02:00
Mikelis Vuls
58116877b6 EHT: Fix updating center freq segment 0 index for HE and VHT
Add additional check for 6 GHz operating class. Otherwise this results
in setting incorrect segment 0 index for 5 GHz 40 MHz channel 157-161,
which has the same center segment 0 index 159 as 6 GHz 320 MHz expected
channel.

Fixes: 085a3fc76e ("EHT: Add 320 channel width support")
Signed-off-by: Mikelis Vuls <mvuls@maxlinear.com>
2023-12-06 12:11:13 +02:00
Jaap Keuter
37d122c2f1 KaY: Make debug output consistent
Be consistent in capitalization and peer presentation.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2023-12-06 12:11:08 +02:00
Jurijs Soloveckis
f0cb823512 EHT: Add configuration for the EHT default PE duration
Add a new configuration parameter for the duration of PE field in EHT TB
PPDU.

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-12-06 12:02:44 +02:00
Liangwei Dong
5a47bbc36b Add QCA vendor command to query transmit power information
Add a new QCA subcommand QCA_NL80211_VENDOR_SUBCMD_REGULATORY_TPC_INFO
and related attributes qca_wlan_vendor_attr_tpc_links,
qca_wlan_vendor_attr_tpc definition to query transmit power information
on STA interface from the driver for a connected AP.

The information includes regulatory max transmit power limit, AP local
power constraint advertised from AP's Beacon and Probe Response frames.
For PSD power mode, the information includes PSD power levels for each
subchannel of operating bandwidth. The information is driver calculated
power limits based on current regulatory domain, AP local power
constraint and other IEs. The information will be set to target. Target
will decide final TX power based on this and chip specific power
conformance test limits (CTL), and SAR limits.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-05 13:01:27 +02:00
Chenming Huang
9c2d6c4232 Add QCA vendor attributes for link id for HT-scan/ACS command
For AP MLD case, HT-scan and ACS happens per link. To determine the
correct link, link id is required.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2023-12-05 12:52:01 +02:00
Nagarajan Maran
7b67055794 Add QCA vendor commands for SDWF
Define subcmd IDs 235 and 236 for Service Defined Wi-Fi (SDWF).

Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
2023-12-04 17:33:27 +02:00
Chaitanya Tata
6ed8eba00d Add an option to remove RRM and supported operating class indication
Removing radio measurements and supported operating class indication
might be needed to reduce binary size for a memory constrained system
that does not need more advanced features. However, removing these is
not recommended since they can help the AP manage the network and STA
steering.

By default this functionality is enabled.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-12-03 11:43:43 +02:00
Jun Yu
4b80ad1194 Populate the new beacon hint event to wpa_msg()
Beacon hinting is a feature that can temporarily change the regulatory
rule flags on the channel where the radio hears the beacon. Add a new
event CTRL-EVENT-REGDOM-BEACON-HINT to notify the wpa_supplicant user
about an important update to the regulatory rules including which
frequencies are impacted, new power limit, and new rule flags.

Signed-off-by: Jun Yu <junyuu@chromium.org>
2023-12-02 20:48:15 +02:00
Ilan Peer
d8cae2d024 nl80211: Do not allow off channel when frequency is not specified
Do not allow offchannel operation for action frame transmission if
no frequency is specified, as this doesn't make sense.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-02 20:35:21 +02:00
Jouni Malinen
4f69b4a31e mesh: Fix PMKSA cache entry addition with external PMKSA management
The length of the PMK ended up getting lost when a PMKSA cache entry was
added based on externally managed information. Set the PMK length in SAE
context to get the correct length stored into the actual PMKSA cache
entry that gets created in this path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-02 20:31:16 +02:00
Jaap Keuter
0302c3ad22 trace: binutils replaces bfd_hostptr_t with uintptr_t
According to this message https://marc.info/?l=binutils&m=165363679302282
the type bfd_hostptr_t is dropped in favor of uintptr_t.
Replace the use of this type in the code.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2023-12-02 19:08:25 +02:00
Chenming Huang
d54d0d8983 AP MLD: Handle DFS in correct link
Link ID is needed for AP MLD to handle DFS events in the correct link.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:31:46 +02:00
Chenming Huang
f1fee0d1ff AP MLD: Handle channel switch event in correct link
USe the link ID information to determine the specific affiliated link
when processing channel switch events on an AP MLD.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:25:41 +02:00
Chenming Huang
fb6598864b nl80211: Add link ID when setting BSS attributes for AP MLD
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:12:46 +02:00
Chenming Huang
5487d8d9e9 nl80211: Specify link ID when sending Management frames
Extend nl80211_send_frame_cmd() to include the link ID to use for TX
with NL80211_CMD_FRAME.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:12:05 +02:00
Chenming Huang
859cbc396f nl80211: Remove links when stopping AP MLD in hostapd
There is an issue when starting a non-MLD AP on the same interface that
previous operated as an AP MLD. When the previous AP MLD got stopped,
links were not removed when using hostapd. Next non-MLD AP will fail to
start because some nl80211 operations still require link id (e.g., set
freq).

Remove links when AP MLD is stop to avoid such issue. This was already
done in the deinit_ap() handler when using wpa_supplicant, but hostapd
needs to do same.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:05:59 +02:00
Ilan Peer
780e72cc14 AP MLD: Do not include empty MLO KDEs
Do include group MLO KDEs for links for which the information is
missing.

In addition, set the KDE buffer length based on the added data.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 17:01:02 +02:00
Ilan Peer
ecd9ea0c8a AP MLD: Do not access WPA authenticator object if not valid
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 16:56:18 +02:00
Ilan Peer
21e8fcc807 nl80211: Add support for handling MLO removed links
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 13:42:43 +02:00
Benjamin Berg
cd79d834bf trace: Add TEST_FAIL_TAG macro to allow more narrow matching
The tag is inserted as the first item in the stack trace, making it
trivial to match against it from the test.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 13:00:45 +02:00
Benjamin Berg
781e87c418 trace: Allow multiple failures in one test
Refactor the backtrace matching a bit in order to allow triggering
multiple failures in one test.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:47:40 +02:00
Benjamin Berg
e62d351ce7 trace: Document function pattern prefixes
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:45:12 +02:00
Benjamin Berg
5545d995b3 trace: Share common implementation for TEST_FAIL and TEST_ALLOC_FAIL
Get rid of more or less duplicated implementation of backtrace matching
for the two testing failure cases.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:40:11 +02:00
Benjamin Berg
7d901dc7e7 trace: Use an array of skipped function names
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:14:04 +02:00
Benjamin Berg
e9bdecce4d Share TEST_FAIL/TEST_ALLOC_FAIL/GET_FAIL/GET_ALLOC_FAIL handler
Move the hostapd and wpa_supplicant control interface handlers into a
shared functions instead of duplicated implementation.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:03:47 +02:00
Andrei Otcheretianski
6fc2d1357d AP: Get rid of wpa_auth_pmksa_add3()
Simply pass another parameter to wpa_auth_pmksa_add2() instead.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-26 00:06:50 +02:00
Ilan Peer
e996704201 AP: Handle re-association from a non-AP MLD
When processing a (Re)Association Request frame and no corresponding
station is found, try to find the station using the station MLD MAC
address from the Basic ML element, as it is possible that the station
is trying to re-associate but with a different link address (in such
a case the underlying driver would not perform address translations).

When sending the (Re)Association Response frame, use the addresses from
the (Re)Association Request frame and not the AP MLD MAC address, again,
to avoid the address translation done in the driver.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-26 00:05:51 +02:00
Ilan Peer
a18f8ee0f5 AP MLD: Use MLD MAC address for SA query and response when needed
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-25 21:52:23 +02:00
Andrei Otcheretianski
d64ec94140 AP MLD: Don't include AP MLD ID in Beacon frames
IEEE P802.11be/D4.0, 9.4.2.312.2.3 states that the AP MLD ID should only
be included in some ML probe responses. Beacon frames shouldn't include
AP MLD ID.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:50:03 +02:00
Benjamin Berg
3bde811756 ML: Add basic handling of ML probe requests
This responds by simply embedding most of the IEs from the other links
into the ML element. This is not correct really, as inheritance rules
should be applied and an inheritance element may need to be added.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:47:44 +02:00
Benjamin Berg
ecb22ba12e AP: MLO: Add helper to iterate all links of an AP MLD
Add a simple for_each_mld_link helper that sets first variable to the
hapd data for every link. It takes the interfaces and MLD ID as
arguments and two extra integers as scratch variables (for the interface
and bss offsets).

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-25 18:30:57 +02:00
Benjamin Berg
db2bc0364f AP: Add parsing of ML probe requests
This adds the parsing of ML probe requests. Handling will be added by a
later commit.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:29:50 +02:00
Benjamin Berg
82453a3482 AP: Split Probe Response frame IE generation into a separate function
To support ML probe request we will need to include IEs from the other
hapd instances in the response. Split the function to allow just
generating the per-instance IEs separately.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:22:41 +02:00
Benjamin Berg
6b5e00a80e AP: Use a struct for Probe Response generation in/out params
This effectively moves setting the csa/ecsa/cca position to happen
only when a Probe Response template for offloading is generated.

One could probably avoid the global variable altogether, as the
value is immediately consumed into struct {csa,cca}_settings.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:10:18 +02:00
Benjamin Berg
4a1cd7f545 nl80211: Report link specific association failures from the kernel
If a link specific error occured, mark the offending link within the
association parameters.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 17:06:52 +02:00
Benjamin Berg
6ba9b9440b nl80211: Add support to parse out link from error reply
The kernel may report the link that caused an error by setting
NLMSGERR_ATTR_OFFS pointing to the NL80211_ATTR_MLO_LINKS element
that was the reason for the error.

Parse this information if the optional struct nl80211_err_info is
passed to send_and_recv_msgs().

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 17:03:52 +02:00
Benjamin Berg
92d8d1d760 MLD: Add a TEST_FAIL to fail one link in an MLD association.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 16:49:43 +02:00
Benjamin Berg
846e65c7ce MLD: Return status code for links when rejecting association
When the TX link rejects the association, return a status code for all
requested links. For simplicity, just return "TX link not accepted" so
that clients may try to connect to other links. This could be improved
to explicitly reject each link if directly associating to the link will
not work either.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 16:49:27 +02:00
Benjamin Berg
c55a272f66 EHT: Define status codes from IEEE P802.11be/D4.0
Add the new status code that had not yet been defined.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 14:03:41 +02:00
Ilan Peer
d95838b793 AP: Add support for testing ML link removal
Add support for testing ML link removal to hostapd. While such support
should inherently be integrated with the underlining driver, simulate
the inclusion of the ML reconfiguration element in hostapd.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 13:58:37 +02:00
Ilan Peer
73a6f5c37e AP MLD: Make BSS parameter change variable
As a preparation to support link removal, make the BSS parameter
change count variable.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-25 13:41:21 +02:00
Andrei Otcheretianski
cb90aa3acf wpa_supplicant: Remove duplicate logic in wpas_ml_element()
Parsing multiple RNR elements already exists in
wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates
the same code. Combine the functionality of both these functions and
remove the duplicate.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 12:03:52 +02:00
Benjamin Berg
b3aafd5a87 common: Simplify and avoid confusing defragmentation API
Three functions were provided for defragmentation. First
ieee802_11_defrag(), ieee802_11_defrag_mle() and then
ieee802_11_defrag_data() which would do the actual job. With
ieee802_11_defrag() picking the member in the elements struct for an
EID. The problem with this is, that for the Multi-Link element, there
are multiple entries in the elems struct depending on its type. As such,
remove the intermediate function and simply pass the correct members
directly.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 10:56:56 +02:00
Johannes Berg
0f7d15dd38 ieee802_11_defs: Fix EHT_ML_PRES_BM_PROBE_REQ_AP_MLD_ID
This Presence Bitmap field is B4..B15 of the Multi-Link Control field
and the value used here is for that full 16-bit field, not just within
the Presence Bitmap field.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-24 23:09:23 +02:00
Benjamin Berg
645ec9b58a nl80211: Do a roundtrip to reset event supressions
With nl80211 we need to supress the kernel generated event for any
disconnect and deauthenticate. This code is a bit fragile, as it
assumes that an event will happen. Commit b898b65582 ("nl80211: Do
not ignore disconnect event in case of !drv->associated") changed this
to only disconnect when the driver knows it is associated (apparently
required for P2P), however, deauthentication may also occur without
being associated yet.

Looking at the issue, what we are really interested in is whether the
event belongs to a disconnect/deauth command that we have send
ourselves. Any event happening after the disconnect/deauth completes
should not be suppressed (or after the next connect/auth as that would
be sufficient). We therefore need to know from the event stream
whether events were generated before or after disconnect/deauth
command completion.

To do so, send a simple command on the nl_event socket. As this will
be returned back to us in the correct order with regard to the events.
We can therefore use it to safely reset our internal
ignore_next_local_{deauth,disconnect} variables.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-24 22:49:15 +02:00
Vinayak Yadawad
69ea73bfed nl80211: Update port authorized indication for MLO address
Handling of port authorized event for STA currently handles the
connected BSSID. This needs additional handling to support the AP MLD
address in case of MLO connection. The connected_addr expected by
cfg80211_port_authorized() is mld_addr for ML connection case.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-24 18:49:01 +02:00
Nicolas Escande
6f014c0d01 ACS: Add 320 MHz support for EHT
Enable support for ACS in the IEEE 802.11be/320 MHz case. To do so we
just:
  - add channel definitions for the 320 MHz blocks of the 6 GHz band
  - handle CONF_OPER_CHWIDTH_320MHZ in the different cases
  - restrict 320 MHz to ieee80211be=1 only

Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
2023-11-24 18:40:24 +02:00
Jurijs Soloveckis
f0aea885f8 EHT: Fix HE Channel Center Freq Seg0/Seg1 for 6 GHz 320 MHz cases
Fix for the HE Channel Center Freq Seg0/Seg1 within the HE 6GHz
Operation Information field. As downgrade of bandwidths for VHT and HE
when using puncturing is TODO for 320 MHz and/or if puncturing is
disabled and bandwidth is 320 MHz, the same rules as for 160 MHz should
be applied for Channel Center Freq Seg0/Seg1 within 6 GHz Operation
Information field.

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-11-24 18:38:32 +02:00
Jurijs Soloveckis
07c03a6557 EHT: Fix conditions for including EHT Operation Information field
Include EHT Operation Information field only if the operating bandwidth
is 320 MHz or there is at least one punctured 20 MHz subchannel. This
behavior is defined in IEEE P802.11be/D4.0, 35.15.1 (Basic EHT BSS
operation).

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-11-24 18:36:27 +02:00
Juliusz Sosinowicz
01d95b75b8 SAE: prime_len means length in bytes not bits
The prime_len variable is used as the length in bytes but it is set as
the length in bits. This fixes the sae DH group tests with wolfSSL.

Fixes: f8f20717f8 ("SAE: Use const_time selection for PWE in FFC")
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-24 18:07:34 +02:00
Jouni Malinen
a02585cef7 MBSSID: Use BIGTK from the transmitted BSS for beacon protection
MBSSID shares a single Beacon frame with multiple BSSs. This implies
that the key used for beacon protection (BIGTK) needs to be shared. The
nontransmitted BSSs managed their own BIGTK previously and that resulted
in providing incorrect value to the stations associated with those BSSs.
Use the BIGTK from the transmitted BSS to fix this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-24 12:53:09 +02:00
Vinayak Yadawad
73b49016f2 Fix references to correct driver capability flag for PSK/OWE offloads
Fix references to the appropriate driver capability drv_flags2. The
initial version used the incorrect drv_flags value and by doing so,
ended up using incorrect driver capabilities (DEAUTH_TX_STATUS,
BSS_SELECT, TDLS_SUPPORT) which could result in incorrect OWE
functionality for both AP and STA cases.

Fixes: d984c7b298 ("hostapd: Add support for OWE offload for STA/AP interface")
Fixes: da364180fb ("hostapd: Support 4-way handshake offload for AP/P2P GO")
Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-23 11:41:18 +02:00
Jouni Malinen
415839406a OpenSSL: Allow openssl_ciphers override with Suite B config on server
The openssl_ciphers parameter is a global data entry on the server
instead of the per-connection design on client. As such, hostapd needs
to make a local copy of the global value and use that whenever setting
per-connection parameters. This is needed particularly when testing
Suite B functionality where the Suite B specific parameters might end up
overriding the cipher list.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-22 19:39:45 +02:00
Prasanna JS
e9b13938a9 Add EHT mode support for ratemask configuration vendor command
Extend enum qca_wlan_ratemask_params_type to configure ratemask for EHT
mode.

Signed-off-by: Prasanna JS <quic_pjs@quicinc.com>
2023-11-21 21:14:30 +02:00
Purushottam Kushwaha
239469eb1d Define new command in qca_tsf_cmd to get AP channel switch TSF time
Define a new command QCA_TSF_SYNC_GET_CSA_TIMESTAMP in qca_tsf_cmd to
retrieve the TSF time value at which the AP will move and starts
beaconing on a new channel. Userspace queries this TSF after receiving
NL80211_CMD_CH_SWITCH_STARTED_NOTIFY event on the AP interface. This TSF
can be communicated via an OOB mechanism to connected STAs which may
fail to receive the CSA frames due to channel congestion.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2023-11-21 21:13:44 +02:00
Jouni Malinen
30748d2b3f SAE: Require PMKID match to PMKSA with SAE-EXT-KEY
This check was supposed to be done for all SAE cases other than FT
roaming.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-11-11 23:44:52 +02:00
Vinayak Yadawad
b089803091 hostapd: Add support for SAE offload for AP interface
The driver advertising SAE AP offload support would take care of SAE
authentication and PMK generation at the driver/firmware. This feature
requires the driver to be supporting 4-way handshake offload to process
the generated PMK at the driver level for 4-way handshake.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-11 23:44:01 +02:00
Vinayak Yadawad
d984c7b298 hostapd: Add support for OWE offload for STA/AP interface
The driver advertising OWE offload support would take care of
Diffie-Hellman Parameter element generation and processing part. The
driver would be responsible for OWE PMK generation in this case.

Avoid the Diffie-Hellman Parameter element handling in
wpa_supplicant/hostapd for drivers advertising OWE offload support. This
change is applicable only for drivers supporting 4-way handshake
offload.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-11 22:36:24 +02:00
Vinayak Yadawad
da364180fb hostapd: Support 4-way handshake offload for AP/P2P GO
Add support for offloaded 4-way handshake in AP/P2P GO mode. For drivers
supporting the AP PSK offload, wpa_supplicant/hostapd passes down the
PSK for the driver to handle the 4-way handshake. The driver is expected
to indicate port authorized event to indicate that the 4-way handshake
is completed successfully.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-11 22:34:06 +02:00
Kaidong Wang
790beb84ac Adjust the SNR when comparing BSSes based on Tx power config
The max transmit power of Standard Power (SP) Access Points (AP) on
6 GHz band and APs on 2.4 GHz and 5 GHz bands is limited by effective
isotropic radiated power (EIRP), while the max transmit power of Low
Power Indoor (LPI) APs on 6 GHz Band is limited by power spectral
density (PSD). Therefore the max transmit power of LPI APs grows as the
channel width increases, similar to the noise power which has constant
PSD.

Adjust the SNR of BSSes based on the transmit power config and max
channel width. EIRP limited APs usually have constant max transmit power
on different channel widths, their SNR decreases on larger channel width
because the noise power is higher, while PSD limited APs have constant
SNR over all channel widths.

Signed-off-by: Kaidong Wang <kaidong@chromium.org>
2023-11-10 16:34:01 +02:00
Ben Greear
99a8dd0495 MLD: Support multiple RNR elements
Beacon frames are allowed to optionally include one more more Reduced
Neighbor Report elements. Only the first one was parsed previously.
Extend this to use a loop to go through all included RNR elements.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2023-11-07 18:55:50 +02:00
Jouni Malinen
84c33cc81f MBSSID: Use DTIM Count 0 in the Beacon template for nontransmitted BSSID
The driver is expected to update the DTIM Count field for each BSS that
corresponds to a nontransmitted BSSID. Initialized this value to 0 in
the Beacon frame template so that the DTIM count would be somewhat
functional even if the driver were not to update this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-07 10:44:28 +02:00
Chaitanya Tata
3e1fb2dec7 dragonfly: Fix legendre symbol calculation failure handling
In case of low-memory conditions, the computation for legendre symbol
can fail and return -2 as per documentation, but the check for that
was missed here. And this can can cause an infinite loop searching for
qr and qnr if the error repeats for each attempt.

Break the loop if calculation fails, we can leave retry to the callers
or user. This is similar to the way allocation and generation of a new
random number was handled in this loop.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-11-06 20:07:05 +02:00
Mohan Prabu
76ae985b0a Remove QCA_WLAN_VENDOR_ATTR_CONFIG_MLO_LINK_ID constraint
Currently the documentation for QCA_WLAN_VENDOR_ATTR_CONFIG_MLO_LINK_ID
indicates it is only for use inside nest attribute
QCA_WLAN_VENDOR_ATTR_CONFIG_MLO_LINKS.  Update the documentation to
allow it to be used outside that nest as well.

Signed-off-by: Mohan Prabu <quic_mprabub@quicinc.com>
2023-11-06 20:02:46 +02:00
Jouni Malinen
cc1867f5ca MLD STA: Use MLD MAC address as destination for EAPOL-Key request
Also this EAPOL frame uses the MLD MAC address of the AP MLD when sent
during an MLO association.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-06 20:02:09 +02:00
Rohan Dutta
c92311fed7 MLD STA: Fix destination address for Group Key handshake msg 2/2
For MLO association, specify destination address as the MLD MAC address
for sending Group Key msg 2/2.

Signed-off-by: Rohan Dutta <quic_drohan@quicinc.com>
2023-11-06 19:58:22 +02:00
Gokul Sivakumar
c0da381a31 nl80211: Add capa.flags2 to STATUS-DRIVER
This adds the newer driver capability "flags2" bitmask to the
hostapd_cli/wpa_cli "status driver" result.

Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
2023-11-06 15:15:59 +02:00
Gokul Sivakumar
d193726aa1 nl80211: Dump driver_flags2 in debug prints
This was already done for driver_flags, but the newer driver_flags2 was
not covered here.

Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
2023-11-06 15:15:41 +02:00
Gokul Sivakumar
ed1ae82a39 Update the driver_flags2 to string conversion
Populate the switch case in the driver_flag2_to_string() function with
the full list of feature MACROs represented with the "flags2" bitmask.

Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
2023-11-06 15:14:32 +02:00
Gokul Sivakumar
bbc7ffe852 Rename driver capability for radar background detection
Use the WPA_DRIVER_FLAGS2_ prefer for this to be more consistent.

Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
2023-11-06 15:07:01 +02:00
Chung-Hsien Hsu
6cc78b3945 nl80211: Set NL80211_WPA_VERSION_2 vs. _3 based on AKM
Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu@infineon.com>
Signed-off-by: Daisuke Mizobuchi <mizo@atmark-techno.com>
2023-11-05 20:35:10 +02:00
Chung-Hsien Hsu
c3b8452e0e nl80211: SAE authentication offload support
Set WPA_DRIVER_FLAGS2_SAE_OFFLOAD flag if the driver indicates SAE
authentication offload support for STA mode. Allow SAE password to be
provided to the driver in such cases when using the CONNECT command.

Signed-off-by: Chung-Hsien Hsu <chung-hsien.hsu@infineon.com>
Signed-off-by: Daisuke Mizobuchi <mizo@atmark-techno.com>
2023-11-05 20:35:07 +02:00
Ze Gan
750403f3ad mka: Fix re-establishment by resetting MI
The key server may be removed due to the ingress packets delay. In this
situation, the endpoint of the key server may not be aware of this
participant who has removed the key server from the peer list. Because
the egress traffic is normal, the key server will not remove this
participant from the peer list of the key server. So in the next MKA
message, the key server will not dispatch a new SAK to this participant.
And this participant cannot be aware of that that is a new round of
communication so that it will not update its MI at re-adding the key
server to its peer list. So we need to update MI to avoid the failure of
re-establishment MKA session.

Signed-off-by: Ze Gan <ganze718@gmail.com>
2023-11-05 19:25:27 +02:00
Ze Gan
61f0e19b86 mka: Fix unexpected cleanup on missing MKA_LIFE_TIME while installing SC/SA
The key server may not include dist sak and use sak in one packet.
Meanwhile, after dist sak, the current participant (non-key server) will
install SC or SA(s) after decoding the dist sak which may take few
seconds in real physical platforms. Meanwhile, the peer expire time is
always initialized at adding the key server to peer list. The gap
between adding the key server to peer list and processing next use sak
packet may exceed the threshold of MKA_LIFE_TIME (6 s). It will cause an
unexpected cleanup (delete SC and SA(s)), so update the expire timeout
at dist sak also.

Signed-off-by: Ze Gan <ganze718@gmail.com>
2023-11-05 19:13:07 +02:00
David Ruth
c84388ee4c Compile-time config for dynamically loading libraries in wpa_supplicant
Prevent loading arbitrary executable code based on config at runtime,
while allowing libraries to be specified at compile time when they are
known in advance.

Add the ability to configure libraries to load at compile time.
	* CONFIG_PKCS11_ENGINE_PATH - pkcs11_engine library location.
	* CONFIG_PKCS11_MODULE_PATH - pkcs11_module library location.
	* CONFIG_OPENSC_ENGINE_PATH - opensc_engine library location.

Add flags with the ability to set each of the libraries to NULL and
prevent loading them at runtime.
	* CONFIG_NO_PKCS11_ENGINE_PATH - prevents loading pkcs11_engine
	  library.
	* CONFIG_NO_PKCS11_MODULE_PATH - prevents loading pkcs11_module
	  library.
	* CONFIG_NO_OPENSC_ENGINE_PATH - prevents loading opensc_engine
	  library.
	* CONFIG_NO_LOAD_DYNAMIC_EAP - prevents loading EAP libraries at
	  runtime.

Signed-off-by: David Ruth <druth@chromium.org>
2023-11-05 10:23:29 +02:00
Juliusz Sosinowicz
890953a32c wolfSSL: Old FIPS APIs have void return
Fix the calls to wc_AesEncryptDirect(). Old versions of wolfCrypt FIPS
had wc_AesEncryptDirect() return void instead of int. Fix this build
issue.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
ec7f064fa7 wolfSSL: Implement DPP backend functions
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
b37238d3ac wolfSSL: Set up generator manually in FIPS build
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
8dabc1fede wolfSSL: Get EC generator for DPP
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
732ed5abe1 wolfSSL: Add crypto_ecdh_init2()
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
15a7c9b9e3 wolfSSL: Refactor crypto ECC section
Use heap allocated objects and improve error checking.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:41:26 +02:00
Juliusz Sosinowicz
41b5c9d8dc wolfSSL: Use wc_ecc_get_curve_size_from_id()
Avoid use of direct member access.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
378bef3697 wolfSSL: Use wc_ecc_forcezero_point() in non-FIPS builds
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
de38571b86 wolfSSL: More complete crypto_ec_key_group()
Add more curves and check if brainpool support is built.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
d48f6b9138 wolfSSL: EC group-to-id conversion into a helper function
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
a16916b749 wolfSSL: Improve logging
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
7ebb5469b3 wolfSSL: Improve error checking and logging in AES functions
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
10fd91d8fb wolfSSL: Better error message in pbkdf2_sha1() for FIPS password failure
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
aa4c4d079b wolfSSL: Always clean up resources and log errors in wolfssl_hmac_vector()
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
644d87c34a wolfSSL: Improve error checking in vector hashing functions
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
5e20b924da wolfSSL: Add crypto logging macros
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
a0e8d9ae71 wolfSSL: Add FIPS warning
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00
Juliusz Sosinowicz
48a65d47cd wolfSSL: Put wolfSSL headers in alphabetical order
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-04 18:18:25 +02:00