jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/wpa_supplicant/sme.c

2815 lines
80 KiB
C
Raw Normal View History

Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* wpa_supplicant - SME
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
* Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi>
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*
Remove the GPL notification from files contributed by Jouni Malinen Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-11 15:46:35 +01:00
* This software may be distributed under the terms of the BSD license.
* See README for more details.
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*/
#include "includes.h"
#include "common.h"
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
#include "utils/eloop.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/ieee802_11_defs.h"
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
#include "common/ieee802_11_common.h"
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
#include "common/ocv.h"
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
#include "common/hw_features_common.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "eapol_supp/eapol_supp_sm.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/wpa_common.h"
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#include "common/sae.h"
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#include "common/dpp.h"
Remove src/rsn_supp from default header path
2009-11-29 17:28:08 +01:00
#include "rsn_supp/wpa.h"
#include "rsn_supp/pmksa_cache.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "config.h"
#include "wpa_supplicant_i.h"
Add preliminary hostapd data structure initialization for AP mode wpa_supplicant can now initialize hostapd data structures when mode=2 is used to set up an AP. The hostapd configuration is not yet set based on wpa_supplicant network configuration block. In addition, the glue code for hostapd driver_ops needs number of functions that will be needed for AP functionality.
2009-03-26 19:37:05 +01:00
#include "driver_i.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "wpas_glue.h"
#include "wps_supplicant.h"
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#include "p2p_supplicant.h"
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
#include "notify.h"
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
#include "bss.h"
Move wpa_supplicant specific scan code away from src/drivers This fits better in wpa_supplicant/scan.c. Couple of remaining scan_helpers.c functions are currently used in driver wrappers, but they can likely be removed in the future.
2010-01-03 17:48:11 +01:00
#include "scan.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "sme.h"
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
#include "hs20_supplicant.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
#define SME_AUTH_TIMEOUT 5
#define SME_ASSOC_TIMEOUT 5
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
static int index_within_array(const int *array, int idx)
{
int i;
for (i = 0; i < idx; i++) {
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (array[i] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return 0;
}
return 1;
}
static int sme_set_sae_group(struct wpa_supplicant *wpa_s)
{
int *groups = wpa_s->conf->sae_groups;
SAE: Enable only groups 19, 20, and 21 in station mode Remove groups 25 (192-bit Random ECP Group) and 26 (224-bit Random ECP Group) from the default SAE groups in station mode since those groups are not as strong as the mandatory group 19 (NIST P-256). In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:23:58 +01:00
int default_groups[] = { 19, 20, 21, 0 };
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (!groups || groups[0] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
groups = default_groups;
/* Configuration may have changed, so validate current index */
if (!index_within_array(groups, wpa_s->sme.sae_group_index))
return -1;
for (;;) {
int group = groups[wpa_s->sme.sae_group_index];
Fix SAE group selection in an error case The sae_groups parameter is zero terminated array, not -1 terminated, so must check the value against <= 0 to break out from the loop. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 22:29:57 +02:00
if (group <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
break;
if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
wpa_s->sme.sae.group);
Fix indentation level This gets rid of smatch warnings about inconsistent indenting. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-30 16:56:56 +01:00
return 0;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
}
wpa_s->sme.sae_group_index++;
}
return -1;
}
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
struct wpa_ssid *ssid,
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
const u8 *bssid, int external,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
int reuse, int *ret_use_pt)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
struct wpabuf *buf;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
size_t len;
SAE: Allow SAE password to be configured separately (STA) The new sae_password network profile parameter can now be used to set the SAE password instead of the previously used psk parameter. This allows shorter than 8 characters and longer than 63 characters long passwords to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 22:09:16 +02:00
const char *password;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
struct wpa_bss *bss;
int use_pt = 0;
if (ret_use_pt)
*ret_use_pt = 0;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
SAE: Allow commit fields to be overridden for testing purposes (STA) The new "SET sae_commit_override <hexdump>" control interface command can be used to force wpa_supplicant to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 01:12:44 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->sae_commit_override) {
wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
if (!buf)
return NULL;
SAE: Fix commit message override with external authentication Do not add duplicate Transaction Sequence and Status Code fields when using test functionality to override SAE commit message. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-29 22:04:35 +01:00
if (!external) {
wpabuf_put_le16(buf, 1); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
}
SAE: Allow commit fields to be overridden for testing purposes (STA) The new "SET sae_commit_override <hexdump>" control interface command can be used to force wpa_supplicant to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 01:12:44 +02:00
wpabuf_put_buf(buf, wpa_s->sae_commit_override);
return buf;
}
#endif /* CONFIG_TESTING_OPTIONS */
SAE: Allow SAE password to be configured separately (STA) The new sae_password network profile parameter can now be used to set the SAE password instead of the previously used psk parameter. This allows shorter than 8 characters and longer than 63 characters long passwords to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 22:09:16 +02:00
password = ssid->sae_password;
if (!password)
password = ssid->passphrase;
if (!password) {
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
wpa_printf(MSG_DEBUG, "SAE: No password available");
return NULL;
}
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
if (reuse && wpa_s->sme.sae.tmp &&
os_memcmp(bssid, wpa_s->sme.sae.tmp->bssid, ETH_ALEN) == 0) {
wpa_printf(MSG_DEBUG,
"SAE: Reuse previously generated PWE on a retry with the same AP");
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
use_pt = wpa_s->sme.sae.tmp->h2e;
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
goto reuse_data;
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (sme_set_sae_group(wpa_s) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
SAE: Maintain EC group context in struct sae_data This can be used to share same EC group context through the SAE exchange. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 10:29:53 +01:00
return NULL;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
}
SAE: Maintain EC group context in struct sae_data This can be used to share same EC group context through the SAE exchange. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 10:29:53 +01:00
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
if (ssid->sae_password_id && wpa_s->conf->sae_pwe != 3)
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
use_pt = 1;
if (use_pt || wpa_s->conf->sae_pwe == 1 || wpa_s->conf->sae_pwe == 2) {
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
if (bss) {
const u8 *rsnxe;
rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
if (rsnxe && rsnxe[1] >= 1)
use_pt = !!(rsnxe[2] &
BIT(WLAN_RSNX_CAPAB_SAE_H2E));
}
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
if ((wpa_s->conf->sae_pwe == 1 || ssid->sae_password_id) &&
SAE: Special test mode sae_pwe=3 for looping with password identifier The new sae_pwe=3 mode can be used to test non-compliant behavior with SAE Password Identifiers. This can be used to force use of hunting-and-pecking loop for PWE derivation when Password Identifier is used. This is not allowed by the standard and as such, this functionality is aimed at compliance testing. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-10 03:59:10 +01:00
wpa_s->conf->sae_pwe != 3 &&
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
!use_pt) {
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
wpa_printf(MSG_DEBUG,
"SAE: Cannot use H2E with the selected AP");
return NULL;
}
}
if (use_pt &&
sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
wpa_s->own_addr, bssid,
wpa_s->sme.sae_rejected_groups) < 0)
return NULL;
if (!use_pt &&
sae_prepare_commit(wpa_s->own_addr, bssid,
SAE: Allow SAE password to be configured separately (STA) The new sae_password network profile parameter can now be used to set the SAE password instead of the previously used psk parameter. This allows shorter than 8 characters and longer than 63 characters long passwords to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 22:09:16 +02:00
(u8 *) password, os_strlen(password),
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
ssid->sae_password_id,
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
return NULL;
}
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
if (wpa_s->sme.sae.tmp)
os_memcpy(wpa_s->sme.sae.tmp->bssid, bssid, ETH_ALEN);
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
reuse_data:
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (ssid->sae_password_id)
len += 4 + os_strlen(ssid->sae_password_id);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
return NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external) {
wpabuf_put_le16(buf, 1); /* Transaction seq# */
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
wpabuf_put_le16(buf, use_pt ? WLAN_STATUS_SAE_HASH_TO_ELEMENT :
WLAN_STATUS_SUCCESS);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
SAE: Expose sae_write_commit() error cases to callers Check whether an error is reported from any of the functions that could in theory fail and if so, do not proceed with the partially filled SAE commit buffer. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:59:42 +01:00
if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
ssid->sae_password_id) < 0) {
wpabuf_free(buf);
return NULL;
}
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (ret_use_pt)
*ret_use_pt = use_pt;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
int external)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
struct wpabuf *buf;
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
return NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external) {
wpabuf_put_le16(buf, 2); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
}
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
sae_write_confirm(&wpa_s->sme.sae, buf);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
}
#endif /* CONFIG_SAE */
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
/**
* sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
* @wpa_s: Pointer to wpa_supplicant data
* @bss: Pointer to the bss which is the target of authentication attempt
*/
static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
const u8 rrm_ie_len = 5;
u8 *pos;
const u8 *rrm_ie;
wpa_s->rrm.rrm_used = 0;
wpa_printf(MSG_DEBUG,
"RRM: Determining whether RRM can be used - device support: 0x%x",
wpa_s->drv_rrm_flags);
rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
return;
}
SME: Add support for global RRM flag Add RRM to SME authentication/association if the global RRM flag is set. Signed-off-by: Beni Lev <beni.lev@intel.com>
2016-04-06 18:42:17 +02:00
if (!((wpa_s->drv_rrm_flags &
WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_printf(MSG_DEBUG,
"RRM: Insufficient RRM support in driver - do not use RRM");
return;
}
SME: Fix a sign-compare warning Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-25 00:07:16 +01:00
if (sizeof(wpa_s->sme.assoc_req_ie) <
wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_printf(MSG_INFO,
"RRM: Unable to use RRM, no room for RRM IE");
return;
}
wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
os_memset(pos, 0, 2 + rrm_ie_len);
*pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
*pos++ = rrm_ie_len;
wpa_supplicant: Handle link measurement requests Send link measurement response when a request is received. Advertise only RCPI, computing it from the RSSI of the request. The TX power field is left to be filled by the driver. All other fields are not published. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-11-05 09:42:56 +01:00
/* Set supported capabilites flags */
if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
*pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
RRM: Enable beacon report with active/passive scan for all drivers The requested behavior can be approximated for most use cases even if the driver does not support reporting exact TSF values for frames. Enable this capability for all drivers to make beacon report processing more useful for a common use case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-02 22:04:02 +01:00
*pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
wpa_supplicant: Add support for Beacon Report Radio Measurement Beacon Report Radio Measurement is defined in IEEE Std 802.11-2016, 11.11.9.1. Beacon Report is implemented by triggering a scan on the requested channels with the requested parameters. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-12-28 14:06:47 +01:00
wpa_supplicant: Handle LCI request Handle radio measurement request that contains LCI request. Send measurement report based on a configurable LCI report element. The LCI report element is configured over the control interface with SET lci <hexdump of the element> and cleared with SET lci "" Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:13 +02:00
if (wpa_s->lci)
pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
wpa_s->rrm.rrm_used = 1;
}
Mark sme_send_authentication() static This function is not used outside sme.c. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-25 14:47:43 +01:00
static void sme_send_authentication(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid,
int start)
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
{
struct wpa_driver_auth_params params;
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
struct wpa_ssid *old_ssid;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#ifdef CONFIG_IEEE80211R
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
const u8 *ie;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#endif /* CONFIG_IEEE80211R */
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
#if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
const u8 *md = NULL;
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
#endif /* CONFIG_IEEE80211R || CONFIG_FILS */
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
int bssid_changed;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
struct wpabuf *resp = NULL;
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
u8 ext_capab[18];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
int ext_capab_len;
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
int skip_auth;
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
u8 *wpa_ie;
size_t wpa_ie_len;
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
#ifdef CONFIG_MBO
const u8 *mbo_ie;
#endif /* CONFIG_MBO */
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
int omit_rsnxe = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (bss == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
"the network");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
wpa_s->reassoc_same_bss;
Maintain a pointer to the current BSS table entry
2010-01-02 15:59:19 +01:00
wpa_s->current_bss = bss;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(&params, 0, sizeof(params));
wpa_s->reassociate = 0;
params.freq = bss->freq;
params.bssid = bss->bssid;
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
params.ssid = bss->ssid;
params.ssid_len = bss->ssid_len;
nl80211: Change vif type to P2P_CLI upon P2P authentication Currently, wpa_driver_nl80211_authenticate() changes the interface type to station. However, in case of P2P, we need to change the interface type to P2P_CLI. Add p2p field to the authentication params, and consider it for choosing the correct interface type. Signed-off-by: Eliad Peller <eliad@wizery.com>
2011-07-17 19:25:58 +02:00
params.p2p = ssid->p2p_group;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.ssid_len != params.ssid_len ||
os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
wpa_s->sme.prev_bssid_set = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.freq = params.freq;
os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
wpa_s->sme.ssid_len = params.ssid_len;
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_OPEN;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef IEEE8021X_EAPOL
if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
if (ssid->leap) {
if (ssid->non_leap == 0)
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
else
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg |= WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
}
#endif /* IEEE8021X_EAPOL */
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ssid->auth_alg) {
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = ssid->auth_alg;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
"0x%x", params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_s->sme.sae_pmksa_caching = 0;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
const u8 *rsn;
struct wpa_ie_data ied;
rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
if (!rsn) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise RSN");
DPP: Support DPP and SAE in the same network profile Make both DPP and SAE code aware of the cases where the same network profile is configured to enable both DPP and SAE. Prefer DPP over SAE in such cases and start DPP/SAE exchanges based on what both the station and the AP support. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 16:15:09 +01:00
#ifdef CONFIG_DPP
} else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
(ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
(ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
#endif /* CONFIG_DPP */
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
} else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
wpa_key_mgmt_sae(ied.key_mgmt)) {
wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
params.auth_alg = WPA_AUTH_ALG_SAE;
} else {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise SAE AKM for RSN");
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
{
int i;
for (i = 0; i < NUM_WEP_KEYS; i++) {
if (ssid->wep_key_len[i])
params.wep_key[i] = ssid->wep_key[i];
params.wep_key_len[i] = ssid->wep_key_len[i];
}
params.wep_tx_keyidx = ssid->wep_tx_keyidx;
nl80211: Fix static WEP key configuration when using SME Need to set WEP keys before requesting authentication in order to get Shared Key authentication working. Previously, the WEP keys were not set at all when using SME in wpa_supplicant.
2009-04-04 15:58:16 +02:00
}
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
nl80211: Fix static WEP key configuration when using SME Need to set WEP keys before requesting authentication in order to get Shared Key authentication working. Previously, the WEP keys were not set at all when using SME in wpa_supplicant.
2009-04-04 15:58:16 +02:00
Remove unnecessary bss != NULL checks from sme_authenticate() This is already verified in the beginning of the function, so no need to repeat that multiple times.
2010-01-10 20:31:54 +01:00
if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
wpa_key_mgmt_wpa(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
int try_opportunistic;
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
const u8 *cache_id = NULL;
Allow OKC to be enabled by default Previously, OKC (opportunistic key caching, a.k.a. proactive key caching) could be enabled only with a per-network parameter (proactive_key_caching). The new global parameter (okc) can now be used to change the default behavior to be OKC enabled (okc=1) for network blocks that do not override this with the proactive_key_caching parameter. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-12 19:07:53 +01:00
try_opportunistic = (ssid->proactive_key_caching < 0 ?
wpa_s->conf->okc :
ssid->proactive_key_caching) &&
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
(ssid->proto & WPA_PROTO_RSN);
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
#ifdef CONFIG_FILS
if (wpa_key_mgmt_fils(ssid->key_mgmt))
cache_id = wpa_bss_get_fils_cache_id(bss);
#endif /* CONFIG_FILS */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
wpa_s->current_ssid,
SAE: Only allow SAE AKMP for PMKSA caching attempts Explicitly check the PMKSA cache entry to have matching SAE AKMP for the case where determining whether to use PMKSA caching instead of new SAE authentication. Previously, only the network context was checked, but a single network configuration profile could be used with both WPA2-PSK and SAE, so should check the AKMP as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 19:06:40 +02:00
try_opportunistic, cache_id,
0) == 0)
Simplify eapol_sm_notify_pmkid_attempt() Drop the unneeded 'attempt' argument. This was originally used for indicating an aborted PMKID caching attempt, but a fix in 2006 removed the only such user and since that time, only attempt == 1 has been used. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 00:26:14 +01:00
eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
HS 2.0: Generate AssocReq OSEN IE based on AP advertisement Parse the OSEN IE from the AP to determine values used in the AssocReq instead of using hardcoded cipher suites. This is needed to be able to set the group cipher based on AP advertisement now that two possible options exists for this (GTK_NOT_USED in separate OSEN BSS; CCMP or GTK_NOT_USED in shared BSS case). Furthermore, this is a step towards allowing other ciphers than CCMP to be used with OSEN. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-09 17:07:16 +01:00
#ifdef CONFIG_HS20
} else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
(ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
/* No PMKSA caching, but otherwise similar to RSN/WPA */
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len)) {
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites");
wpas_connect_work_done(wpa_s);
return;
}
#endif /* CONFIG_HS20 */
Allow non-WPA IEEE 802.1X to be select even if WPA is also enabled If key_mgmt was set to allow both WPA and non-WPA IEEE 802.1X (i.e., to IEEE8021X WPA-EAP), non-WPA IEEE 802.1X was rejected while preparing association parameters. Allow this special case to be handled by selecting non-WPA case if the scan results for the AP do not include either WPA or RSN elements. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-15 18:34:04 +02:00
} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
/*
* Both WPA and non-WPA IEEE 802.1X enabled in configuration -
* use non-WPA since the scan results did not indicate that the
* AP is using WPA or WPA2.
*/
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
} else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites (no "
"scan results)");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
#ifdef CONFIG_WPS
} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
struct wpabuf *wps_ie;
wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
if (wps_ie && wpabuf_len(wps_ie) <=
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
wpa_s->sme.assoc_req_ie_len);
} else
wpa_s->sme.assoc_req_ie_len = 0;
wpabuf_free(wps_ie);
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
#endif /* CONFIG_WPS */
} else {
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
}
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
/* In case the WPA vendor IE is used, it should be placed after all the
* non-vendor IEs, as the lower layer expects the IEs to be ordered as
* defined in the standard. Store the WPA IE so it can later be
* inserted at the correct location.
*/
wpa_ie = NULL;
wpa_ie_len = 0;
if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
if (wpa_ie) {
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
wpa_s->sme.assoc_req_ie_len = 0;
} else {
wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
wpas_connect_work_done(wpa_s);
return;
}
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
md = ie + 2;
FT: Clean up wpa_sm_set_ft_params() by using common parse Instead of parsing the IEs in the callers, use the already existing parser in wpa_ft.c to handle MDIE and FTIE from initial MD association response. In addition, this provides more complete access to association response IEs to FT code which will be needed to fix FT 4-way handshake message 2/4.
2010-04-10 10:36:35 +02:00
wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
FT: Fix SAE + FT-SAE behavior in association parameter selection Do not try to initialize FT reassociation if the selected AKM is for SAE instead of FT-SAE when both of these are enabled in a network profile. This fixes an issue with MDE being included in an (Re)Association Request frame even when using a non-FT AKM (which is something that results in hostapd rejecting the association). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-26 05:29:34 +01:00
if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
!wpa_key_mgmt_ft(wpa_s->key_mgmt)))
md = NULL;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (md) {
/* Prepare for the next transition */
FT: Copy FT Capability and Policy to MDIE from target AP This sets the FT Capability and Policy field in the MDIE to the values received from the target AP (if available). This fixes the MDIE contents during FT Protocol, but the correct value may not yet be used in initial mobility domain association.
2010-04-09 15:26:20 +02:00
wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
if (md) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
md[0], md[1]);
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_s->sme.assoc_req_ie_len + 5 <
sizeof(wpa_s->sme.assoc_req_ie)) {
struct rsn_mdie *mdie;
u8 *pos = wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len;
*pos++ = WLAN_EID_MOBILITY_DOMAIN;
*pos++ = sizeof(*mdie);
mdie = (struct rsn_mdie *) pos;
os_memcpy(mdie->mobility_domain, md,
MOBILITY_DOMAIN_ID_LEN);
FT: Set FT Capability and Policy properly in MDIE during initial MD assoc This field needs to be copied from the scan results for the AP per IEEE Std 802.11r-2008, 11A.4.2.
2010-04-09 15:41:57 +02:00
mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len += 5;
}
FT: Do not try to use FT-over-air if reassociation cannot be used There is no point in going through FT authentication if the next step would have to use association exchange which will be rejected by the AP for FT, so only allow FT-over-air if previous BSSID is set, i.e., if reassociation can be used. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 19:28:56 +01:00
if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
SME: Do not try to use FT over-the-air if PTK is not available
2010-04-10 21:39:49 +02:00
os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
wpa_sm_has_ptk(wpa_s->wpa)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
"over-the-air");
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_FT;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ie = wpa_s->sme.ft_ies;
params.ie_len = wpa_s->sme.ft_ies_len;
}
}
#endif /* CONFIG_IEEE80211R */
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
Allow PMF to be enabled by default Previously, PMF (protected management frames, IEEE 802.11w) could be enabled only with a per-network parameter (ieee80211w). The new global parameter (pmf) can now be used to change the default behavior to be PMF enabled (pmf=1) or required (pmf=2) for network blocks that do not override this with the ieee80211w parameter. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-24 21:21:29 +01:00
if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
struct wpa_ie_data _ie;
if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
_ie.capabilities &
(WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
"MFP: require MFP");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
}
}
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#ifdef CONFIG_P2P
if (wpa_s->global->p2p) {
u8 *pos;
size_t len;
int res;
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
P2P: Set p2p auth/assoc parameter based on connection type Fix the previous code that was hardcoding the p2p parameter based on the driver P2P capability regardless of whether the connection was really used for P2P or not.
2011-07-17 19:52:49 +02:00
res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
ssid->p2p_group);
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
if (res >= 0)
wpa_s->sme.assoc_req_ie_len += res;
}
#endif /* CONFIG_P2P */
FST: Integration into wpa_supplicant This commit integrates the FST into the wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-11-16 16:28:53 +01:00
#ifdef CONFIG_FST
if (wpa_s->fst_ies) {
int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
sizeof(wpa_s->sme.assoc_req_ie)) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->fst_ies),
fst_ies_len);
wpa_s->sme.assoc_req_ie_len += fst_ies_len;
}
}
#endif /* CONFIG_FST */
Re-order elements in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, RM Enabled Capabilities element must come before the Extended Capabilities element. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
sme_auth_handle_rrm(wpa_s, bss);
Remove MBO dependency from Supported Operating Classes element Supported Operating Classes element and its use is define in the IEEE 802.11 standard and can be sent even when MBO is disabled in the build. As such, move this functionality out from the CONFIG_MBO=y only mbo.c. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-02 09:54:39 +01:00
wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
Fill the current opclass in (Re)AssocRequest depending on HT/VHT IEs The previous implementation was assuming a fixed 20 MHz channel bandwidth when determining which operating class value to indicate as the Current Operating Class in the Supported Operating Classes element. This is not accurate for many HT/VHT cases. Fix this by determining the current operating class (i.e., the operating class used for the requested association) based on the HT/VHT operation elements from scan results. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-10 07:37:33 +01:00
wpa_s, ssid, bss,
Remove MBO dependency from Supported Operating Classes element Supported Operating Classes element and its use is define in the IEEE 802.11 standard and can be sent even when MBO is disabled in the build. As such, move this functionality out from the CONFIG_MBO=y only mbo.c. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-02 09:54:39 +01:00
wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
nl80211: Use extended capabilities per interface type This adds the necessary changes to support extraction and use of the extended capabilities specified per interface type (a recent cfg80211/nl80211 extension). If that information is available, per-interface values will be used to override the global per-radio value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-04-12 10:01:42 +02:00
if (params.p2p)
wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
else
wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
sizeof(ext_capab));
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
if (ext_capab_len > 0) {
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
u8 *pos = wpa_s->sme.assoc_req_ie;
if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
pos += 2 + pos[1];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
os_memmove(pos + ext_capab_len, pos,
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
wpa_s->sme.assoc_req_ie_len -
(pos - wpa_s->sme.assoc_req_ie));
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
wpa_s->sme.assoc_req_ie_len += ext_capab_len;
os_memcpy(pos, ext_capab, ext_capab_len);
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
}
SAE H2E: RSNXE override for testing purposes "SET rsnxe_override_{assoc,eapol} <hexdump>" can now be used to override RSNXE in (Re)Association Request frames and EAPOL-Key msg 2/4 for testing purposes. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 11:54:54 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->rsnxe_override_assoc &&
wpabuf_len(wpa_s->rsnxe_override_assoc) <=
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->rsnxe_override_assoc),
wpabuf_len(wpa_s->rsnxe_override_assoc));
wpa_s->sme.assoc_req_ie_len +=
wpabuf_len(wpa_s->rsnxe_override_assoc);
} else
#endif /* CONFIG_TESTING_OPTIONS */
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
if (wpa_s->rsnxe_len > 0 &&
wpa_s->rsnxe_len <=
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
!omit_rsnxe) {
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpa_s->rsnxe, wpa_s->rsnxe_len);
wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
}
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
#ifdef CONFIG_HS20
if (is_hs20_network(wpa_s, ssid, bss)) {
struct wpabuf *hs20;
HS 2.0: Add Roaming Consortium Selection element into AssocReq This makes wpa_supplicant add Hotspot 2.0 Roaming Consortium Selection element into (Re)Association Request frames if the network profile includes roaming_consortium_selection parameter. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-17 16:22:56 +02:00
hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
if (hs20) {
int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
size_t len;
HS 2.0: As a STA, do not indicate release number greater than the AP Hotspot 2.0 tech spec mandates mobile device to not indicate a release number that is greater than the release number advertised by the AP. Add this constraint to the HS 2.0 Indication element when adding this into (Re)Association Request frame. The element in the Probe Request frame continues to show the station's latest supported release number. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-07 23:51:04 +01:00
wpas_hs20_add_indication(hs20, pps_mo_id,
get_hs20_version(bss));
HS 2.0: Add Roaming Consortium Selection element into AssocReq This makes wpa_supplicant add Hotspot 2.0 Roaming Consortium Selection element into (Re)Association Request frames if the network profile includes roaming_consortium_selection parameter. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-17 16:22:56 +02:00
wpas_hs20_add_roam_cons_sel(hs20, ssid);
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(hs20) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(hs20), wpabuf_len(hs20));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
}
wpabuf_free(hs20);
}
}
#endif /* CONFIG_HS20 */
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
if (wpa_ie) {
size_t len;
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (len > wpa_ie_len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpa_ie, wpa_ie_len);
wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
} else {
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
}
os_free(wpa_ie);
}
Extend VENDOR_ELEM parameters to cover non-P2P Association Request The new VENDOR_ELEM value 13 can now be used to add a vendor element into all (Re)Association Request frames, not just for P2P use cases like the previous item was for. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-13 23:50:58 +01:00
if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
size_t len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(buf) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(buf), wpabuf_len(buf));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
}
}
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
#ifdef CONFIG_MBO
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
MBO/OCE: Work around misbehaving MBO/OCE APs that use RSN without PMF The MBO and OCE specification require the station to mandate use of PMF when connecting to an MBO/OCE AP that uses WPA2. The earlier implementation prevented such misbehaving APs from being selected for connection completely. This looks like the safest approach to take, but unfortunately, there are deployed APs that are not compliant with the MBO/OCE requirements and this strict interpretation of the station requirements results in interoperability issues by preventing the association completely. Relax the approach by allowing noncompliant MBO/OCE APs to be selected for RSN connection without PMF to avoid the main impact of this interoperability issue. However, disable MBO/OCE functionality when PMF cannot be negotiated to try to be as compliant as practical with the MBO/OCE tech spec requirements (i.e., stop being an MBO/OCE STA for the duration of such workaround association). Also disable support for BTM in this workaround state since MBO would expect all BTM frames to be protected. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-11 12:35:22 +02:00
if (!wpa_s->disable_mbo_oce && mbo_ie) {
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
int len;
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) -
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
wpa_s->sme.assoc_req_ie_len,
!!mbo_attr_from_mbo_ie(mbo_ie,
OCE_ATTR_ID_CAPA_IND));
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
if (len >= 0)
wpa_s->sme.assoc_req_ie_len += len;
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
}
#endif /* CONFIG_MBO */
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, ssid, 0,
SAE: Fix PMKSA cache entry search for FT-SAE case Previously, PMKSA cache entries were search for AKM=SAE and that did not find an entry that was created with FT-SAE when trying to use FT-SAE again. That resulted in having to use full SAE authentication instead of the faster PMKSA caching alternative. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-27 03:03:12 +01:00
NULL,
wpa_s->key_mgmt == WPA_KEY_MGMT_FT_SAE ?
WPA_KEY_MGMT_FT_SAE :
WPA_KEY_MGMT_SAE) == 0) {
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
SAE: Fix default PMK configuration for PMKSA caching case The RSN supplicant state machine PMK was set based on WPA PSK even for the cases where SAE would be used. If the AP allows PMKSA caching to be used with SAE, but does not indicate the selected PMKID explicitly in EAPOL-Key msg 1/4, this could result in trying to use the PSK instead of SAE PMK. Fix this by not setting the WPA-PSK as default PMK for SAE network profiles and instead, configuring the PMK explicitly from the found PMKSA cache entry. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 18:55:52 +02:00
wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
params.auth_alg = WPA_AUTH_ALG_OPEN;
wpa_s->sme.sae_pmksa_caching = 1;
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (start)
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
resp = sme_auth_build_sae_commit(wpa_s, ssid,
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
bss->bssid, 0,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
start == 2, NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
else
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
resp = sme_auth_build_sae_confirm(wpa_s, 0);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (resp == NULL) {
SAE: Report connection failure if SME cannot build auth frame Instead of just stopping connection process and network discovery, report SAE failures to build Authentication frames (e.g., due to missing password) as a connection failure to get the normal retry mechanism into use. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 15:48:38 +01:00
wpas_connection_failed(wpa_s, bss->bssid);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
}
Rename sae_data to more generic auth_data This makes it cleaner for the FILS implementation to use the same design for setting Authentication frame elements as was already done with SAE. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 16:11:11 +02:00
params.auth_data = wpabuf_head(resp);
params.auth_data_len = wpabuf_len(resp);
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
SME: Postpone current BSSID clearing until IEs are prepared sme_send_authentication() could fail before actually requesting the driver to authenticate with a new AP. This could happen after wpa_s->bssid got cleared even though in such a case, the old association is maintained and still valid. This can result in unexpected behavior since wpa_s->bssid would not match the current BSSID anymore. Fix this by postponing clearing of wpa_s->bssid until the IE preparation has been completed successfully. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 17:06:01 +01:00
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
old_ssid = wpa_s->current_ssid;
wpa_s->current_ssid = ssid;
wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
wpa_supplicant_initiate_eapol(wpa_s);
#ifdef CONFIG_FILS
/* TODO: FILS operations can in some cases be done between different
* network_ctx (i.e., same credentials can be used with multiple
* networks). */
if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
wpa_key_mgmt_fils(ssid->key_mgmt)) {
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
const u8 *indic;
u16 fils_info;
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
const u8 *realm, *username, *rrk;
size_t realm_len, username_len, rrk_len;
u16 next_seq_num;
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
/*
* Check FILS Indication element (FILS Information field) bits
* indicating supported authentication algorithms against local
* configuration (ssid->fils_dh_group). Try to use FILS
* authentication only if the AP supports the combination in the
* network profile. */
indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
if (!indic || indic[1] < 2) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not include FILS Indication element - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
fils_info = WPA_GET_LE16(indic + 2);
if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not support FILS SK without PFS - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not support FILS SK with PFS - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
if (wpa_s->last_con_fail_realm &&
eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
&username, &username_len,
&realm, &realm_len, &next_seq_num,
&rrk, &rrk_len) == 0 &&
realm && realm_len == wpa_s->last_con_fail_realm_len &&
os_memcmp(realm, wpa_s->last_con_fail_realm,
realm_len) == 0) {
wpa_printf(MSG_DEBUG,
"SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
goto no_fils;
}
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
ssid, 0,
SAE: Only allow SAE AKMP for PMKSA caching attempts Explicitly check the PMKSA cache entry to have matching SAE AKMP for the case where determining whether to use PMKSA caching instead of new SAE authentication. Previously, only the network context was checked, but a single network configuration profile could be used with both WPA2-PSK and SAE, so should check the AKMP as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 19:06:40 +02:00
wpa_bss_get_fils_cache_id(bss),
0) == 0)
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS with PMKSA caching");
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
if (resp) {
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
int auth_alg;
if (ssid->fils_dh_group)
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS SK authentication with PFS (DH Group %u)",
ssid->fils_dh_group);
else
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS SK authentication without PFS");
auth_alg = ssid->fils_dh_group ?
WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
params.auth_alg = auth_alg;
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
params.auth_data = wpabuf_head(resp);
params.auth_data_len = wpabuf_len(resp);
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
wpa_s->sme.auth_alg = auth_alg;
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
}
}
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
no_fils:
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
#endif /* CONFIG_FILS */
Use sched_scan in driver init This patch uses sched_scan, if available, when the driver is initialized. It also adds a couple of cancel operations where appropriate. Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-09-27 21:21:31 +02:00
wpa_supplicant_cancel_sched_scan(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_cancel_scan(wpa_s);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
SME: Clear portValid on starting authentication to fix FILS The ft_completed for FILS authentication case in wpa_supplicant_event_assoc() depends on something having cleared portValid so that setting it TRUE ends up authorizing the port. This clearing part did not happen when using FILS authentication during a reassociation within an ESS. Fix this by clearing portValid in sme_send_authentication() just before the keys are cleared (i.e., the old connection would not be usable anyway). Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:49:16 +01:00
eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_clear_keys(wpa_s, bss->bssid);
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (old_ssid != wpa_s->current_ssid)
wpas_notify_network_changed(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
HS 2.0: Add support for configuring frame filters When a station starts an association to a Hotspot 2.0 network, request the driver to do the following, based on the BSS capabilities: 1. Enable gratuitous ARP filtering 2. Enable unsolicited Neighbor Advertisement filtering 3. Enable unicast IP packet encrypted with GTK filtering if DGAF disabled bit is zero Clear the filter configuration when the station interface is disassociated. Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2016-04-06 16:14:41 +02:00
#ifdef CONFIG_HS20
hs20_configure_frame_filters(wpa_s);
#endif /* CONFIG_HS20 */
wpa_supplicant: Call frequency conflict handling during auth Previously, the frequency conflict was handled only during the association flow. However, some drivers, e.g., mac80211 based drivers, will fail an authentication request in case that there are no available channels for use (as they might be used by other interfaces), and thus the frequency conflict resolution is never called. Fix this by calling frequency conflict resolution during authentication (SME-in-wpa_supplicant) as well. In addition, get the shared radio frequency from the wpa_s context in both the SME-in-driver and SME-in-wpa_supplicant cases and not from the driver. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-04-24 07:45:40 +02:00
#ifdef CONFIG_P2P
/*
* If multi-channel concurrency is not supported, check for any
* frequency conflict. In case of any frequency conflict, remove the
* least prioritized connection.
*/
if (wpa_s->num_multichan_concurrent < 2) {
int freq, num;
num = get_shared_radio_freqs(wpa_s, &freq, 1);
if (num > 0 && freq > 0 && freq != params.freq) {
wpa_printf(MSG_DEBUG,
"Conflicting frequency found (%d != %d)",
freq, params.freq);
if (wpas_p2p_handle_frequency_conflicts(wpa_s,
params.freq,
ssid) < 0) {
wpas_connection_failed(wpa_s, bss->bssid);
wpa_supplicant_mark_disassoc(wpa_s);
wpabuf_free(resp);
wpas_connect_work_done(wpa_s);
return;
}
}
}
#endif /* CONFIG_P2P */
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (skip_auth) {
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Skip authentication step on reassoc-to-same-BSS");
wpabuf_free(resp);
sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
return;
}
FT: Process reassoc resp FT IEs when using wpa_supplicant SME
2010-03-13 20:13:18 +01:00
wpa_s->sme.auth_alg = params.auth_alg;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_authenticate(wpa_s, &params) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
"driver failed");
SME: Fix processing of Authentication request failure The wpa_state needs to be dropped back to DISCONNECTED to allow scan results to trigger a new authentication attempt. In addition, we can use wpas_connection_failed() instead of requesting a scan after a fixed time to make this error case more consistent with other similar error paths in sme.c. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-04 20:04:24 +01:00
wpas_connection_failed(wpa_s, bss->bssid);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
NULL);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* Association will be started based on the authentication event from
* the driver.
*/
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
}
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
{
struct wpa_connect_work *cwork = work->ctx;
struct wpa_supplicant *wpa_s = work->wpa_s;
if (deinit) {
wpa_supplicant: Complete radio works on disable event While testing rfkill blocking of a scanning interface, it was seen that the ongoing scan never completes. This happens since EVENT_SCAN_RESULTS is discarded on a disabled interface. Fix this and also other possible radio work completion issues by removing all the radio works (including started) of the disabled interface. To be able to remove already started radio works, make their callbacks be reentrant with deinit flag (when the work is started), so each radio work should be able to handle its own termination. Signed-hostap: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-02-13 10:24:00 +01:00
if (work->started)
wpa_s->connect_work = NULL;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_free(cwork);
return;
}
wpa_s->connect_work = work;
Update pending connect radio work BSS pointer on scan update It is possible for scan result processing or BSS entry removal to occur while there is a pending connect or sme-connect radio work with a previously selected BSS entry. The BSS pointer was previously verified to be valid, i.e., still point to a BSS entry, at the time the actual connection operation is started. However, that BSS entry could have changed to point to another BSS if the old BSS entry was either removed or reallocated and a new BSS entry was added at the same location in memory. This could result in the connection attempt failing to configure parameters properly due to different BSS information (e.g., different BSSID). Fix this by updated the pending connect radio work data on BSS entry updates similarly to how the last_scan_res array was updated. If the selected BSS entry is removed, this will still result in a failed connection, but reallocated BSS entry is now followed properly and used when the connection work starts. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-10-27 23:19:24 +01:00
if (cwork->bss_removed ||
Drop connection attempt if network is disabled before radio work starts With the radio work design, it is possible for a network entry to get disabled (e.g., DISABLE_NETWORK <id>) during the time the connect or sme-connect radio work waits to start. Previously, only the validity of the BSS entry and BSSID/SSID was verified when starting the actual connection step. Add call to wpas_network_disabled() to those checks to catch the case where the network profile is disabled. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-10 21:12:59 +02:00
!wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
wpas_network_disabled(wpa_s, cwork->ssid)) {
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
wpas_connect_work_done(wpa_s);
return;
}
SME: Clear possibly used WPA/RSN IE for new connection This was already done in the case SME in the driver is used, but the SME code path was resetting the local WPA/RSN IE only for association. While that was fine for existing use cases, FILS needs a new RSN IE to be set for PMKSA caching case in Authentication frames, so clear the local IE before starting new authentication. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 21:48:25 +02:00
/* Starting new connection, so clear the possibly used WPA IE from the
* previous association. */
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
wpa_s->rsnxe_len = 0;
SME: Clear possibly used WPA/RSN IE for new connection This was already done in the case SME in the driver is used, but the SME code path was resetting the local WPA/RSN IE only for association. While that was fine for existing use cases, FILS needs a new RSN IE to be set for PMKSA caching case in Authentication frames, so clear the local IE before starting new authentication. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 21:48:25 +02:00
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
void sme_authenticate(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid)
{
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
struct wpa_connect_work *cwork;
if (bss == NULL || ssid == NULL)
return;
if (wpa_s->connect_work) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
return;
}
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
if (radio_work_pending(wpa_s, "sme-connect")) {
wpa_supplicant: Remove pending sme-connect radio work If a new connection is attempted while there is a pending sme-connection radio work, cancel the pending radio work and continue with the new connection attempt. This is preferable over rejecting the new work and continuing with the pending one, as it is possible that the previous work is no longer valid. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-03-27 07:58:33 +01:00
/*
* The previous sme-connect work might no longer be valid due to
* the fact that the BSS list was updated. In addition, it makes
* sense to adhere to the 'newer' decision.
*/
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Remove previous pending sme-connect");
radio_remove_works(wpa_s, "sme-connect", 0);
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
}
Abort an ongoing scan before connect Connect radio work is sometimes delayed for a considerable duration if there is an ongoing scan radio work. To avoid these delays abort the ongoing scan on that interface before queuing a connect request. Upon a scan done indication from the driver, connect radio work will be scheduled. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-10-19 16:00:34 +02:00
wpas_abort_ongoing_scan(wpa_s);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
cwork = os_zalloc(sizeof(*cwork));
if (cwork == NULL)
return;
cwork->bss = bss;
cwork->ssid = ssid;
cwork->sme = 1;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#ifdef CONFIG_SAE
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_NOTHING;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
wpa_s->sme.sae.send_confirm = 0;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
wpa_s->sme.sae_group_index = 0;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#endif /* CONFIG_SAE */
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
sme_auth_start_cb, cwork) < 0)
wpas_connect_work_free(cwork);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
static int sme_external_auth_build_buf(struct wpabuf *buf,
struct wpabuf *params,
const u8 *sa, const u8 *da,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
u16 auth_transaction, u16 seq_num,
u16 status_code)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct ieee80211_mgmt *resp;
resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
u.auth.variable));
resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
(WLAN_FC_STYPE_AUTH << 4));
os_memcpy(resp->da, da, ETH_ALEN);
os_memcpy(resp->sa, sa, ETH_ALEN);
os_memcpy(resp->bssid, da, ETH_ALEN);
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
resp->seq_ctrl = host_to_le16(seq_num << 4);
resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
resp->u.auth.status_code = host_to_le16(status_code);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (params)
wpabuf_put_buf(buf, params);
return 0;
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
const u8 *bssid,
struct wpa_ssid *ssid)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct wpabuf *resp, *buf;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
int use_pt;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid, 1, 0, &use_pt);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (!resp) {
wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
return -1;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->sme.sae.state = SAE_COMMITTED;
buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp));
if (!buf) {
wpabuf_free(resp);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
return -1;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
wpa_s->sme.seq_num++;
sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
bssid, 1, wpa_s->sme.seq_num,
use_pt ? WLAN_STATUS_SAE_HASH_TO_ELEMENT :
WLAN_STATUS_SUCCESS);
driver: Extend send_mlme() with wait option PASN authentication can be performed while a station interface is connected to an AP. To allow sending PASN frames while connected, extend the send_mlme() driver callback to also allow a wait option. Update the relevant drivers and wpa_supplicant accordingly. hostapd calls for send_mlme() are left unchanged, since the wait option is not required there. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:27 +01:00
wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpabuf_free(resp);
wpabuf_free(buf);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
return 0;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
u16 status)
{
struct external_auth params;
os_memset(&params, 0, sizeof(params));
params.status = status;
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
params.ssid = wpa_s->sme.ext_auth_ssid;
params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
params.bssid = wpa_s->sme.ext_auth_bssid;
SAE: Conditionally set PMKID while notifying the external auth status This is needed for the drivers implementing SME to include the PMKID in the Association Request frame directly following SAE authentication. This commit extends the commit d2b208384391 ("SAE: Allow PMKID to be added into Association Request frame following SAE") for drivers with internal SME that use the external authentication mechanism. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:18:45 +02:00
if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
params.pmkid = wpa_s->sme.sae.pmkid;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_drv_send_external_auth_status(wpa_s, &params);
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct wpa_ssid *ssid;
size_t ssid_str_len = data->external_auth.ssid_len;
Remove unnecessary copying of SSID and BSSID for external_auth The external authentication command and event does not need to copy the BSSID/SSID values into struct external_auth since those values are used before returning from the call. Simplify this by using const u8 * to external data instead of the array with a copy of the external data. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-12 19:38:08 +02:00
const u8 *ssid_str = data->external_auth.ssid;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
/* Get the SSID conf from the ssid string obtained */
for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
if (!wpas_network_disabled(wpa_s, ssid) &&
ssid_str_len == ssid->ssid_len &&
external-auth: Check key_mgmt when selecting SSID When selecting SSID to start external authentication procedure also check the key_mgmt field as several network configuration may be defined for the same SSID/BSSID pair. The external authentication mechanism is only available for SAE. Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2018-11-26 12:47:37 +01:00
os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
FT-SAE: Enable external auth support for FT-SAE also Extend the external authentication support to FT-SAE mode connections also in addition to SAE mode connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-26 15:29:59 +01:00
(ssid->key_mgmt & (WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE)))
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
break;
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (!ssid ||
sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
ssid) < 0)
return -1;
return 0;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
const u8 *da)
{
struct wpabuf *resp, *buf;
resp = sme_auth_build_sae_confirm(wpa_s, 1);
if (!resp) {
wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
return;
}
wpa_s->sme.sae.state = SAE_CONFIRMED;
buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp));
if (!buf) {
wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
wpabuf_free(resp);
return;
}
wpa_s->sme.seq_num++;
sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
da, 2, wpa_s->sme.seq_num,
WLAN_STATUS_SUCCESS);
driver: Extend send_mlme() with wait option PASN authentication can be performed while a station interface is connected to an AP. To allow sending PASN frames while connected, extend the send_mlme() driver callback to also allow a wait option. Update the relevant drivers and wpa_supplicant accordingly. hostapd calls for send_mlme() are left unchanged, since the wait option is not required there. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:27 +01:00
wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpabuf_free(resp);
wpabuf_free(buf);
}
void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
if (RSN_SELECTOR_GET(&data->external_auth.key_mgmt_suite) !=
RSN_AUTH_KEY_MGMT_SAE)
return;
if (data->external_auth.action == EXT_AUTH_START) {
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
if (!data->external_auth.bssid || !data->external_auth.ssid)
return;
os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
ETH_ALEN);
os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
data->external_auth.ssid_len);
wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->sme.seq_num = 0;
wpa_s->sme.sae.state = SAE_NOTHING;
wpa_s->sme.sae.send_confirm = 0;
wpa_s->sme.sae_group_index = 0;
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (sme_handle_external_auth_start(wpa_s, data) < 0)
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
} else if (data->external_auth.action == EXT_AUTH_ABORT) {
/* Report failure to driver for the wrong trigger */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
}
}
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
{
int *groups = wpa_s->conf->sae_groups;
int default_groups[] = { 19, 20, 21, 0 };
int i;
if (!groups)
groups = default_groups;
for (i = 0; groups[i] > 0; i++) {
if (groups[i] == group)
return 1;
}
return 0;
}
static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
const struct wpabuf *groups)
{
size_t i, count;
const u8 *pos;
if (!groups)
return 0;
pos = wpabuf_head(groups);
count = wpabuf_len(groups) / 2;
for (i = 0; i < count; i++) {
int enabled;
u16 group;
group = WPA_GET_LE16(pos);
pos += 2;
enabled = sme_sae_is_group_enabled(wpa_s, group);
wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
group, enabled ? "enabled" : "disabled");
if (enabled)
return 1;
}
return 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
u16 status_code, const u8 *data, size_t len,
int external, const u8 *sa)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
int *groups;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
"status code %u", auth_transaction, status_code);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
(external || wpa_s->current_bss) && wpa_s->current_ssid) {
SAE: Enable only groups 19, 20, and 21 in station mode Remove groups 25 (192-bit Random ECP Group) and 26 (224-bit Random ECP Group) from the default SAE groups in station mode since those groups are not as strong as the mandatory group 19 (NIST P-256). In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:23:58 +01:00
int default_groups[] = { 19, 20, 21, 0 };
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
u16 group;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
const u8 *token_pos;
size_t token_len;
int h2e = 0;
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
groups = wpa_s->conf->sae_groups;
if (!groups || groups[0] <= 0)
groups = default_groups;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
data, len);
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
if (len < sizeof(le16)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Too short SAE anti-clogging token request");
return -1;
}
group = WPA_GET_LE16(data);
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: SAE anti-clogging token requested (group %u)",
group);
if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
WLAN_STATUS_SUCCESS) {
wpa_dbg(wpa_s, MSG_ERROR,
"SME: SAE group %u of anti-clogging request is invalid",
group);
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
token_pos = data + sizeof(le16);
token_len = len - sizeof(le16);
if (wpa_s->sme.sae.tmp)
h2e = wpa_s->sme.sae.tmp->h2e;
if (h2e) {
if (token_len < 3) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Too short SAE anti-clogging token container");
return -1;
}
if (token_pos[0] != WLAN_EID_EXTENSION ||
token_pos[1] == 0 ||
token_pos[1] > token_len - 2 ||
token_pos[2] != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Invalid SAE anti-clogging token container header");
return -1;
}
token_len = token_pos[1] - 1;
token_pos += 3;
}
wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
wpa_s->sme.sae_token);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external)
sme_send_authentication(wpa_s, wpa_s->current_bss,
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
wpa_s->current_ssid, 2);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
else
sme_external_auth_send_sae_commit(
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
wpa_s, wpa_s->sme.ext_auth_bssid,
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->current_ssid);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 0;
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
(external || wpa_s->current_bss) && wpa_s->current_ssid) {
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
SAE: Collect list of rejected groups for H2E in STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
wpa_s->sme.sae.group);
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
wpa_s->sme.sae_group_index++;
if (sme_set_sae_group(wpa_s) < 0)
return -1; /* no other groups enabled */
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external)
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 1);
else
sme_external_auth_send_sae_commit(
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
wpa_s, wpa_s->sme.ext_auth_bssid,
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->current_ssid);
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return 0;
}
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
wpa_msg(wpa_s, MSG_INFO,
WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
MAC2STR(bssid));
return -1;
}
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (status_code != WLAN_STATUS_SUCCESS &&
status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return -1;
if (auth_transaction == 1) {
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
u16 res;
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
groups = wpa_s->conf->sae_groups;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if ((!external && wpa_s->current_bss == NULL) ||
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_s->current_ssid == NULL)
return -1;
SAE: Ignore commit message when waiting for confirm in STA mode Previously, an unexpected SAE commit message resulted in forcing disconnection. While that allowed recovery by starting from scratch, this is not really necessary. Ignore such unexpected SAE commit message instead and allow SAE confirm message to be processed after this. This is somewhat more robust way of handling the cases where SAE commit message might be retransmitted either in STA->AP or AP->STA direction. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-10-27 13:35:04 +01:00
if (wpa_s->sme.sae.state != SAE_COMMITTED) {
wpa_printf(MSG_DEBUG,
"SAE: Ignore commit message while waiting for confirm");
return 0;
}
SAE: Verify that appropriate Status Code is used in SAE commit (SME) Previous version accepted both 0 and 126 values in SAE commit message from the AP. Explicitly check that the value the AP uses matches what the STA started with to avoid unexpected cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-08 02:36:13 +01:00
if (wpa_s->sme.sae.tmp && wpa_s->sme.sae.tmp->h2e &&
status_code == WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG,
"SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
return -1;
}
if (wpa_s->sme.sae.tmp && !wpa_s->sme.sae.tmp->h2e &&
status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
wpa_printf(MSG_DEBUG,
"SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
return -1;
}
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (groups && groups[0] <= 0)
groups = NULL;
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
SAE: Tell sae_parse_commit() whether H2E is used This will be needed to help parsing the received SAE commit. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-07 17:33:02 +02:00
groups, status_code ==
WLAN_STATUS_SAE_HASH_TO_ELEMENT);
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
if (res == SAE_SILENTLY_DISCARD) {
wpa_printf(MSG_DEBUG,
"SAE: Drop commit message due to reflection attack");
return 0;
}
if (res != WLAN_STATUS_SUCCESS)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (wpa_s->sme.sae.tmp &&
sme_check_sae_rejected_groups(
wpa_s,
SAE H2E: Fix validation of rejected groups list check_sae_rejected_groups() returns 1, not -1, in case an enabled group is rejected. The previous check for < 0 could not have ever triggered. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 23:28:13 +01:00
wpa_s->sme.sae.tmp->peer_rejected_groups))
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
return -1;
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
if (sae_process_commit(&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
"commit");
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external)
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 0);
else
sme_external_auth_send_sae_confirm(wpa_s, sa);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return 0;
} else if (auth_transaction == 2) {
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (status_code != WLAN_STATUS_SUCCESS)
return -1;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
if (wpa_s->sme.sae.state != SAE_CONFIRMED)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Add processing of the confirm message This adds validation of the received confirm messages for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:31:19 +01:00
if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_ACCEPTED;
SAE: Free temporary buffers when moving to Accepted state Most of the variables are not needed anymore once the SAE instance has entered Accepted state. Free these to save memory. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-06 18:06:59 +01:00
sae_clear_temp_data(&wpa_s->sme.sae);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (external) {
/* Report success to driver */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_SUCCESS);
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return 1;
}
return -1;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
{
wpa_printf(MSG_DEBUG,
"SME: SAE completed - setting PMK for 4-way handshake");
wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
wpa_s->sme.sae.pmkid, bssid);
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
if (wpa_s->conf->sae_pmkid_in_assoc) {
/* Update the own RSNE contents now that we have set the PMK
* and added a PMKSA cache entry based on the successfully
* completed SAE exchange. In practice, this will add the PMKID
* into RSNE. */
if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_msg(wpa_s, MSG_WARNING,
"RSN: Not enough room for inserting own PMKID into RSNE");
return -1;
}
if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
wpa_s->sme.sae.pmkid) < 0)
return -1;
wpa_hexdump(MSG_DEBUG,
"SME: Updated Association Request IEs",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
}
return 0;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
const u8 *auth_frame, size_t len)
{
const struct ieee80211_mgmt *header;
size_t auth_length;
header = (const struct ieee80211_mgmt *) auth_frame;
auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
if (len < auth_length) {
/* Notify failure to the driver */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
return;
}
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
int res;
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
res = sme_sae_auth(
wpa_s, le_to_host16(header->u.auth.auth_transaction),
le_to_host16(header->u.auth.status_code),
header->u.auth.variable,
len - auth_length, 1, header->sa);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (res < 0) {
/* Notify failure to the driver */
sme_send_external_auth_status(
wpa_s, WLAN_STATUS_UNSPECIFIED_FAILURE);
return;
}
if (res != 1)
return;
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
if (sme_sae_set_pmk(wpa_s, wpa_s->sme.ext_auth_bssid) < 0)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
return;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
{
struct wpa_ssid *ssid = wpa_s->current_ssid;
if (ssid == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when network is not selected");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when not in authenticating state");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
"unexpected peer " MACSTR,
MAC2STR(data->auth.peer));
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
" auth_type=%d auth_transaction=%d status_code=%d",
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
MAC2STR(data->auth.peer), data->auth.auth_type,
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
data->auth.auth_transaction, data->auth.status_code);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
data->auth.ies, data->auth.ies_len);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
if (data->auth.auth_type == WLAN_AUTH_SAE) {
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
int res;
res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
data->auth.status_code, data->auth.ies,
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
data->auth.ies_len, 0, NULL);
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
if (res < 0) {
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
}
if (res != 1)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
SAE: Use PMK in 4-way handshake Use the PMK that is derived as part of the SAE authentication in the 4-way handshake instead of the PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:35:59 +01:00
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
if (sme_sae_set_pmk(wpa_s, wpa_s->pending_bssid) < 0)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
return;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
char *ie_txt = NULL;
if (data->auth.ies && data->auth.ies_len) {
size_t buflen = 2 * data->auth.ies_len + 1;
ie_txt = os_malloc(buflen);
if (ie_txt) {
wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
data->auth.ies_len);
}
}
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
SME: Remove null ie param from CTRL-EVENT-AUTH-REJECT Clean up the event message by removing the ie=<value> parameter when the IEs are not available instead of printing out "ie=(null)". Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-10 10:49:36 +01:00
" auth_type=%u auth_transaction=%u status_code=%u%s%s",
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
MAC2STR(data->auth.peer), data->auth.auth_type,
data->auth.auth_transaction, data->auth.status_code,
SME: Remove null ie param from CTRL-EVENT-AUTH-REJECT Clean up the event message by removing the ie=<value> parameter when the IEs are not available instead of printing out "ie=(null)". Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-10 10:49:36 +01:00
ie_txt ? " ie=" : "",
ie_txt ? ie_txt : "");
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
os_free(ie_txt);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
#ifdef CONFIG_FILS
if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
fils_connection_failure(wpa_s);
#endif /* CONFIG_FILS */
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
if (data->auth.status_code !=
WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
wpa_s->sme.auth_alg == data->auth.auth_type ||
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Set state to DISCONNECTED on auth/assoc failures Some of the authentication/association failure paths left wpa_state to its previous value. This can result in unexpected behavior when wpa_supplicant tries to find an AP to connect to since the uncleared state can result the in the selected BSS being ignored if it is same as the previously used BSS. This could happen, e.g., when wpa_supplicant SME was used and the AP rejected authentication. Fix this by explicitly setting state to DISCONNECTED on auth/assoc failures that did not yet do this. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-06-25 13:23:25 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
return;
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
}
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
Fix authentication algorithm negotiation in SME code Commit 6ac4b15ef8af434d216fd2dac62ec82948ab0fbd (wpa_radio work for connection) caused a regression for cases where multiple auth_alg values are set in a network block and wpa_supplicant-based SME is supposed to iterate through them. The connection radio work was not terminated when receiving authentication failure and this resulted in the following authentication attempt failing. Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-31 22:31:26 +01:00
wpas_connect_work_done(wpa_s);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
switch (data->auth.auth_type) {
case WLAN_AUTH_OPEN:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
case WLAN_AUTH_SHARED_KEY:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
default:
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#ifdef CONFIG_IEEE80211R
if (data->auth.auth_type == WLAN_AUTH_FT) {
FT: Support addition of RIC elements into Reassociation Request frame The new "SET ric_ies <hexdump>" control interface command can now be used to request wpa_supplicant to add the specified RIC elements into Reassociation Request frame when using FT protocol. This is mainly for testing purposes. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-18 20:14:10 +01:00
const u8 *ric_ies = NULL;
size_t ric_ies_len = 0;
if (wpa_s->ric_ies) {
ric_ies = wpabuf_head(wpa_s->ric_ies);
ric_ies_len = wpabuf_len(wpa_s->ric_ies);
}
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
data->auth.ies_len, 0,
FT: Support addition of RIC elements into Reassociation Request frame The new "SET ric_ies <hexdump>" control interface command can now be used to request wpa_supplicant to add the specified RIC elements into Reassociation Request frame when using FT protocol. This is mainly for testing purposes. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-18 20:14:10 +01:00
data->auth.peer,
ric_ies, ric_ies_len) < 0) {
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FT Authentication response processing failed");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#endif /* CONFIG_IEEE80211R */
FILS: Authentication frame processing (STA) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 23:14:13 +02:00
#ifdef CONFIG_FILS
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
u16 expect_auth_type;
expect_auth_type = wpa_s->sme.auth_alg ==
WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
WLAN_AUTH_FILS_SK;
if (data->auth.auth_type != expect_auth_type) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FILS Authentication response used different auth alg (%u; expected %u)",
data->auth.auth_type, expect_auth_type);
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
FILS: Fix BSSID in reassociation case The RSN supplicant implementation needs to be updated to use the new BSSID whenever doing FILS authentication. Previously, this was only done when notifying association and that was too late for the case of reassociation. Fix this by providing the new BSSID when calling fils_process_auth(). This makes PTK derivation use the correct BSSID. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:25:02 +01:00
if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
data->auth.ies, data->auth.ies_len) < 0) {
FILS: Authentication frame processing (STA) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 23:14:13 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FILS Authentication response processing failed");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
}
#endif /* CONFIG_FILS */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
sme_associate(wpa_s, ssid->mode, data->auth.peer,
data->auth.auth_type);
}
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
#ifdef CONFIG_IEEE80211R
static void remove_ie(u8 *buf, size_t *len, u8 eid)
{
u8 *pos, *next, *end;
pos = (u8 *) get_ie(buf, *len, eid);
if (pos) {
next = pos + 2 + pos[1];
end = buf + *len;
*len -= 2 + pos[1];
os_memmove(pos, next, end - next);
}
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
const u8 *bssid, u16 auth_type)
{
struct wpa_driver_associate_params params;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
struct ieee802_11_elems elems;
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
#ifdef CONFIG_FILS
u8 nonces[2 * FILS_NONCE_LEN];
#endif /* CONFIG_FILS */
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
struct ieee80211_ht_capabilities htcaps;
struct ieee80211_ht_capabilities htcaps_mask;
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
struct ieee80211_vht_capabilities vhtcaps;
struct ieee80211_vht_capabilities vhtcaps_mask;
#endif /* CONFIG_VHT_OVERRIDES */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(&params, 0, sizeof(params));
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
#ifdef CONFIG_FILS
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
if (auth_type == WLAN_AUTH_FILS_SK ||
auth_type == WLAN_AUTH_FILS_SK_PFS) {
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
struct wpabuf *buf;
const u8 *snonce, *anonce;
FILS: Allow FILS HLP requests to be added The new wpa_supplicant control interface commands FILS_HLP_REQ_FLUSH and FILS_HLP_REQ_ADD can now be used to request FILS HLP requests to be added to the (Re)Association Request frame whenever FILS authentication is used. FILS_HLP_REQ_ADD parameters use the following format: <destination MAC address> <hexdump of payload starting from ethertype> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:07:20 +01:00
const unsigned int max_hlp = 20;
struct wpabuf *hlp[max_hlp];
unsigned int i, num_hlp = 0;
struct fils_hlp_req *req;
dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
list) {
hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
wpabuf_len(req->pkt));
if (!hlp[num_hlp])
break;
wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
ETH_ALEN);
wpabuf_put_data(hlp[num_hlp],
"\xaa\xaa\x03\x00\x00\x00", 6);
wpabuf_put_buf(hlp[num_hlp], req->pkt);
num_hlp++;
if (num_hlp >= max_hlp)
break;
}
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
buf = fils_build_assoc_req(wpa_s->wpa, &params.fils_kek,
&params.fils_kek_len, &snonce,
FILS: Allow FILS HLP requests to be added The new wpa_supplicant control interface commands FILS_HLP_REQ_FLUSH and FILS_HLP_REQ_ADD can now be used to request FILS HLP requests to be added to the (Re)Association Request frame whenever FILS authentication is used. FILS_HLP_REQ_ADD parameters use the following format: <destination MAC address> <hexdump of payload starting from ethertype> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:07:20 +01:00
&anonce,
(const struct wpabuf **) hlp,
num_hlp);
for (i = 0; i < num_hlp; i++)
wpabuf_free(hlp[i]);
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
if (!buf)
return;
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
#ifdef CONFIG_IEEE80211R
if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
/* Remove RSNE and MDE to allow them to be overridden
* with FILS+FT specific values from
* fils_build_assoc_req(). */
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RSN);
wpa_hexdump(MSG_DEBUG,
"FILS: assoc_req after RSNE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_MOBILITY_DOMAIN);
wpa_hexdump(MSG_DEBUG,
"FILS: assoc_req after MDE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
}
#endif /* CONFIG_IEEE80211R */
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
/* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"FILS: Not enough buffer room for own AssocReq elements");
wpabuf_free(buf);
return;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(buf), wpabuf_len(buf));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
wpabuf_free(buf);
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
os_memcpy(nonces, snonce, FILS_NONCE_LEN);
os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
params.fils_nonces = nonces;
params.fils_nonces_len = sizeof(nonces);
}
#endif /* CONFIG_FILS */
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
#ifdef CONFIG_OWE
OWE: Allow DH Parameters element to be overridden for testing purposes This allows CONFIG_TESTING_OPTIONS=y builds of wpa_supplicant to override the OWE DH Parameters element in (Re)Association Request frames with arbitrary data specified with the "VENDOR_ELEM_ADD 13 <IE>" command. This is only for testing purposes. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-10 17:26:29 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
WLAN_EID_EXT_OWE_DH_PARAM)) {
wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
} else
#endif /* CONFIG_TESTING_OPTIONS */
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
if (auth_type == WLAN_AUTH_OPEN &&
wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
struct wpabuf *owe_ie;
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
u16 group;
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
if (wpa_s->current_ssid && wpa_s->current_ssid->owe_group) {
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in station This extends OWE support in wpa_supplicant to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). The group is configured using the new network profile parameter owe_group. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:39:08 +02:00
group = wpa_s->current_ssid->owe_group;
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
} else if (wpa_s->assoc_status_code ==
WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
if (wpa_s->last_owe_group == 19)
group = 20;
else if (wpa_s->last_owe_group == 20)
group = 21;
else
group = OWE_DH_GROUP;
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
} else {
group = OWE_DH_GROUP;
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
}
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
wpa_s->last_owe_group = group;
wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in station This extends OWE support in wpa_supplicant to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). The group is configured using the new network profile parameter owe_group. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:39:08 +02:00
owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
if (!owe_ie) {
wpa_printf(MSG_ERROR,
"OWE: Failed to build IE for Association Request frame");
return;
}
if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"OWE: Not enough buffer room for own Association Request frame elements");
wpabuf_free(owe_ie);
return;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(owe_ie), wpabuf_len(owe_ie));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
wpabuf_free(owe_ie);
}
#endif /* CONFIG_OWE */
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#ifdef CONFIG_DPP2
if (wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && wpa_s->current_ssid &&
DPP2: Allow station to require or not allow PFS The new wpa_supplicant network profile parameter dpp_pfs can be used to specify how PFS is applied to associations. The default behavior (dpp_pfs=0) remains same as it was previously, i.e., try to use PFS if the AP supports it. PFS use can now be required (dpp_pfs=1) or disabled (dpp_pfs=2). This is also working around an interoperability issue of DPP R2 STA with certain hostapd builds that included both OWE and DPP functionality. That issue was introduced by commit 09368515d130 ("OWE: Process Diffie-Hellman Parameter element in AP mode") and removed by commit 16a4e931f03e ("OWE: Allow Diffie-Hellman Parameter element to be included with DPP"). hostapd builds between those two commits would reject DPP association attempt with PFS. The new wpa_supplicant default (dpp_pfs=0) behavior is to automatically try to connect again with PFS disabled if that happens. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-28 14:06:15 +01:00
wpa_s->current_ssid->dpp_netaccesskey &&
wpa_s->current_ssid->dpp_pfs != 2 &&
!wpa_s->current_ssid->dpp_pfs_fallback) {
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
struct wpa_ssid *ssid = wpa_s->current_ssid;
dpp_pfs_free(wpa_s->dpp_pfs);
wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
ssid->dpp_netaccesskey_len);
if (!wpa_s->dpp_pfs) {
wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
/* Try to continue without PFS */
goto pfs_fail;
}
if (wpa_s->sme.assoc_req_ie_len +
wpabuf_len(wpa_s->dpp_pfs->ie) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"DPP: Not enough buffer room for own Association Request frame elements");
dpp_pfs_free(wpa_s->dpp_pfs);
wpa_s->dpp_pfs = NULL;
goto pfs_fail;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->dpp_pfs->ie),
wpabuf_len(wpa_s->dpp_pfs->ie));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
}
pfs_fail:
#endif /* CONFIG_DPP2 */
wpa_supplicant: Add Multi-AP backhaul STA support Advertise vendor specific Multi-AP IE in (Re)Association Request frames and process Multi-AP IE from (Re)Association Response frames if the user enables Multi-AP fuctionality. If the (Re)Association Response frame does not contain the Multi-AP IE, disassociate. This adds a new configuration parameter 'multi_ap_backhaul_sta' to enable/disable Multi-AP functionality. Enable 4-address mode after association (if the Association Response frame contains the Multi-AP IE). Also enable the bridge in that case. This is necessary because wpa_supplicant only enables the bridge in wpa_drv_if_add(), which only gets called when an interface is added through the control interface, not when it is configured from the command line. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:53 +01:00
if (wpa_s->current_ssid && wpa_s->current_ssid->multi_ap_backhaul_sta) {
size_t multi_ap_ie_len;
multi_ap_ie_len = add_multi_ap_ie(
wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len,
MULTI_AP_BACKHAUL_STA);
if (multi_ap_ie_len == 0) {
wpa_printf(MSG_ERROR,
"Multi-AP: Failed to build Multi-AP IE");
return;
}
wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
}
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.bssid = bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ssid = wpa_s->sme.ssid;
params.ssid_len = wpa_s->sme.ssid_len;
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq = wpa_s->sme.freq;
Allow background scan period to be configured A network block specific background scan period can now be configured for drivers that implement internal background scan mechanism for roaming and BSS selection. Signed-hostap: Bala Shanmugam <bkamatch@qca.qualcomm.com>
2012-03-30 14:20:35 +02:00
params.bg_scan_period = wpa_s->current_ssid ?
wpa_s->current_ssid->bg_scan_period : -1;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
wpa_s->sme.assoc_req_ie : NULL;
params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
params.wpa_ie, params.wpa_ie_len);
Get rid of duplicated cipher suite and AKM definitions WPA_CIPHER_* and CIPHER_* are used for the exact same set of cipher suites with the main difference being that the WPA_CIPHER_* version is suitable to be used as a bitfield. Similarly, WPA_KEY_MGMT_* and KEY_MGMT_* have similar design for AKMs. There is no need to maintain two separate copies of the definitions since the bitfield compatible version can be used for both needs. Get rid of the CIPHER_* and KEY_MGMT_* versions to clean up the implementation by getting rid of unnecessary mapping functions. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-30 18:33:39 +01:00
params.pairwise_suite = wpa_s->pairwise_cipher;
params.group_suite = wpa_s->group_cipher;
Add group_mgmt network parameter for PMF cipher selection The new wpa_supplicant network parameter group_mgmt can be used to specify which group management ciphers (AES-128-CMAC, BIP-GMAC-128, BIP-GMAC-256, BIP-CMAC-256) are allowed for the network. If not specified, the current behavior is maintained (i.e., follow what the AP advertises). The parameter can list multiple space separate ciphers. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-26 16:36:33 +02:00
params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
nl80211: Indicate HS 2.0 OSEN AKM in connect/associate command This allows drivers that build the WPA/RSN IEs internally to use similar design for building the OSEN IE. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-25 16:57:54 +01:00
params.key_mgmt_suite = wpa_s->key_mgmt;
params.wpa_proto = wpa_s->wpa_proto;
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
os_memset(&htcaps, 0, sizeof(htcaps));
os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
params.htcaps = (u8 *) &htcaps;
params.htcaps_mask = (u8 *) &htcaps_mask;
wpa_supplicant_apply_ht_overrides(wpa_s, wpa_s->current_ssid, &params);
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
os_memset(&vhtcaps, 0, sizeof(vhtcaps));
os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
params.vhtcaps = &vhtcaps;
params.vhtcaps_mask = &vhtcaps_mask;
wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
#endif /* CONFIG_VHT_OVERRIDES */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
WLAN_EID_RIC_DATA)) {
/* There seems to be a pretty inconvenient bug in the Linux
* kernel IE splitting functionality when RIC is used. For now,
* skip correct behavior in IE construction here (i.e., drop the
* additional non-FT-specific IEs) to avoid kernel issues. This
* is fine since RIC is used only for testing purposes in the
* current implementation. */
wpa_printf(MSG_INFO,
"SME: Linux kernel workaround - do not try to include additional IEs with RIC");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.ft_ies;
params.wpa_ie_len = wpa_s->sme.ft_ies_len;
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
} else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
const u8 *rm_en, *pos, *end;
size_t rm_en_len = 0;
u8 *rm_en_dup = NULL, *wpos;
/* Remove RSNE, MDE, FTE to allow them to be overridden with
* FT specific values */
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RSN);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_MOBILITY_DOMAIN);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_FAST_BSS_TRANSITION);
rm_en = get_ie(wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RRM_ENABLED_CAPABILITIES);
if (rm_en) {
/* Need to remove RM Enabled Capabilities element as
* well temporarily, so that it can be placed between
* RSNE and MDE. */
rm_en_len = 2 + rm_en[1];
rm_en_dup = os_memdup(rm_en, rm_en_len);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RRM_ENABLED_CAPABILITIES);
}
wpa_hexdump(MSG_DEBUG,
"SME: Association Request IEs after FT IE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"SME: Not enough buffer room for FT IEs in Association Request frame");
os_free(rm_en_dup);
return;
}
os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
rm_en_len,
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
pos = wpa_s->sme.ft_ies;
end = pos + wpa_s->sme.ft_ies_len;
wpos = wpa_s->sme.assoc_req_ie;
if (*pos == WLAN_EID_RSN) {
os_memcpy(wpos, pos, 2 + pos[1]);
wpos += 2 + pos[1];
pos += 2 + pos[1];
}
if (rm_en_dup) {
os_memcpy(wpos, rm_en_dup, rm_en_len);
wpos += rm_en_len;
os_free(rm_en_dup);
}
os_memcpy(wpos, pos, end - pos);
wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
rm_en_len;
params.wpa_ie = wpa_s->sme.assoc_req_ie;
params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
wpa_hexdump(MSG_DEBUG,
"SME: Association Request IEs after FT override",
params.wpa_ie, params.wpa_ie_len);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.mode = mode;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.mgmt_frame_protection = wpa_s->sme.mfp;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
params.rrm_used = wpa_s->rrm.rrm_used;
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.prev_bssid_set)
params.prev_bssid = wpa_s->sme.prev_bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
SME: Handle association without own extra IEs Need to check for this before calling ieee802_11_parse_elems().
2010-04-11 11:19:02 +02:00
if (params.wpa_ie == NULL ||
ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
< 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
os_memset(&elems, 0, sizeof(elems));
}
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
if (elems.rsn_ie) {
params.wpa_proto = WPA_PROTO_RSN;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
elems.rsn_ie_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else if (elems.wpa_ie) {
params.wpa_proto = WPA_PROTO_WPA;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
elems.wpa_ie_len + 2);
HS 2.0R2: Add OSEN client implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:24:05 +02:00
} else if (elems.osen) {
params.wpa_proto = WPA_PROTO_OSEN;
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
elems.osen_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
if (elems.rsnxe)
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
elems.rsnxe_len + 2);
else
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
P2P: Set p2p auth/assoc parameter based on connection type Fix the previous code that was hardcoding the p2p parameter based on the driver P2P capability regardless of whether the connection was really used for P2P or not.
2011-07-17 19:52:49 +02:00
if (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group)
P2P: Let the driver wrapper know if association is for P2P group
2010-07-18 23:30:25 +02:00
params.p2p = 1;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
P2P: Add a separate pointer to the P2P Device instance In many places in the code there was a reference to wpa_s->parent to get from group interface to p2p_dev interface. These places can break if P2P_DEVICE interface would need to be used with the primary interface as the group interface, since the parent of the primary interface points to itself and not the p2p_dev interface. Fix this by adding a separate "p2pdev" pointer to wpa_supplicant, it will be the same as parent pointer in most cases but whenever the primary interface is used as a group interface, change it to point to the correct p2p_dev interface. Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-01-24 16:36:49 +01:00
if (wpa_s->p2pdev->set_sta_uapsd)
params.uapsd = wpa_s->p2pdev->sta_uapsd;
P2P: Add mechanism for configuring UAPSD parameters for group This is needed to be able to change parameters for dynamically created interfaces between the creation of the interface and association/start AP commands. Following ctrl_interface commands can now be used: P2P_SET client_apsd disable - disable configuration (i.e., use driver default) in client mode P2P_SET client_apsd <BE>,<BK>,<VI>,<VO>;<max SP Length> - enable UASPD with specific trigger configuration (0/1) per AC (max SP Length is currently ignored) P2P_SET go_apsd disable - disable configuration (i.e., use driver default) in AP mode P2P_SET go_apsd <0/1> - disable/enable APSD in AP mode
2010-07-28 19:18:52 +02:00
else
params.uapsd = -1;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_associate(wpa_s, &params) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
"driver failed");
SME: Optimize recovery from assocication command failures mac80211 can indicate this mainly because of channel selection conflicts with other vifs. If there is another BSS on another channel, we should try to connect to it instead.
2010-11-26 16:37:22 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Set state to DISCONNECTED on auth/assoc failures Some of the authentication/association failure paths left wpa_state to its previous value. This can result in unexpected behavior when wpa_supplicant tries to find an AP to connect to since the uncleared state can result the in the selected BSS being ignored if it is same as the previously used BSS. This could happen, e.g., when wpa_supplicant SME was used and the AP rejected authentication. Fix this by explicitly setting state to DISCONNECTED on auth/assoc failures that did not yet do this. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-06-25 13:23:25 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
SME: Optimize recovery from assocication command failures mac80211 can indicate this mainly because of channel selection conflicts with other vifs. If there is another BSS on another channel, we should try to connect to it instead.
2010-11-26 16:37:22 +01:00
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
NULL);
Allow last (Re)Association Request frame to be replayed for testing The new wpa_supplicant RESEND_ASSOC command can be used to request the last (Re)Association Request frame to be sent to the AP to test FT protocol behavior. This functionality is for testing purposes and included only in builds with CONFIG_TESTING_OPTIONS=y. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-10-15 22:25:55 +02:00
#ifdef CONFIG_TESTING_OPTIONS
wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
wpa_s->last_assoc_req_wpa_ie = NULL;
if (params.wpa_ie)
wpa_s->last_assoc_req_wpa_ie =
wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
#endif /* CONFIG_TESTING_OPTIONS */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
const u8 *ies, size_t ies_len)
{
if (md == NULL || ies == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_free(wpa_s->sme.ft_ies);
wpa_s->sme.ft_ies = NULL;
wpa_s->sme.ft_ies_len = 0;
wpa_s->sme.ft_used = 0;
return 0;
}
os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
os_free(wpa_s->sme.ft_ies);
Use os_memdup() This leads to cleaner code overall, and also reduces the size of the hostapd and wpa_supplicant binaries (in hwsim test build on x86_64) by about 2.5 and 3.5KiB respectively. The mechanical conversions all over the code were done with the following spatch: @@ expression SIZE, SRC; expression a; @@ -a = os_malloc(SIZE); +a = os_memdup(SRC, SIZE); <... if (!a) {...} ...> -os_memcpy(a, SRC, SIZE); Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 10:17:23 +01:00
wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_s->sme.ft_ies == NULL)
return -1;
wpa_s->sme.ft_ies_len = ies_len;
return 0;
}
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_deauth(struct wpa_supplicant *wpa_s)
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
{
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
int bssid_changed;
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
WLAN_REASON_DEAUTH_LEAVING) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
"failed");
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
}
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
wpa_s->sme.prev_bssid_set = 0;
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
"status code %d", MAC2STR(wpa_s->pending_bssid),
data->assoc_reject.status_code);
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
#ifdef CONFIG_SAE
if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
wpa_sm_aborted_cached(wpa_s->wpa);
wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
if (wpa_s->current_bss) {
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
WLAN_REASON_DEAUTH_LEAVING);
wpas_connect_work_done(wpa_s);
wpa_supplicant_mark_disassoc(wpa_s);
wpa_supplicant_connect(wpa_s, bss, ssid);
return;
}
}
#endif /* CONFIG_SAE */
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
/*
* For now, unconditionally terminate the previous authentication. In
* theory, this should not be needed, but mac80211 gets quite confused
* if the authentication is left pending.. Some roaming cases might
* benefit from using the previous authentication, so this could be
* optimized in the future.
*/
sme_deauth(wpa_s);
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
}
void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
}
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
void sme_event_disassoc(struct wpa_supplicant *wpa_s,
Clean up wpa_supplicant_event() with deauth/disassoc helper functions wpa_supplicant_event() has grown overly large, so it is useful to split it into smaller pieces. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-07-21 15:40:40 +02:00
struct disassoc_info *info)
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
Remove user space client MLME This code was used only with driver_test.c to allow MLME operations in hostapd to be tested without having to use a real radio. There are no plans on extending this to any other use than testing and mac80211_hwsim has now obsoled the need for this type of testing. As such, we can drop this code from wpa_supplicant to clean up the implementation of unnecessary complexity.
2011-10-22 21:45:38 +02:00
if (wpa_s->sme.prev_bssid_set) {
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
/*
* cfg80211/mac80211 can get into somewhat confused state if
* the AP only disassociates us and leaves us in authenticated
* state. For now, force the state to be cleared to avoid
* confusing errors if we try to associate with the AP again.
*/
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
"driver state");
sme: Check for prev_bssid from sme_event_disassoc wpa_s->bssid is already cleared by mark_disassoc() when we're getting the disassociation event for the case where wpa_supplicant requested disassociation. wpa_s->sme.prev_bssid holds the BSSID we need to check for, so use that instead. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-18 20:23:26 +02:00
wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
WLAN_REASON_DEAUTH_LEAVING);
}
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
sme_deauth(wpa_s);
}
}
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_ASSOCIATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
sme_deauth(wpa_s);
}
}
void sme_state_changed(struct wpa_supplicant *wpa_s)
{
/* Make sure timers are cleaned up appropriately. */
if (wpa_s->wpa_state != WPA_ASSOCIATING)
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
if (wpa_s->wpa_state != WPA_AUTHENTICATING)
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
}
void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s,
const u8 *prev_pending_bssid)
{
/*
* mac80211-workaround to force deauth on failed auth cmd,
* requires us to remain in authenticating state to allow the
* second authentication attempt to be continued properly.
*/
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication "
"to proceed after disconnection event");
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
/*
* Re-arm authentication timer in case auth fails for whatever reason.
*/
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
NULL);
}
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
{
wpa_s->sme.prev_bssid_set = 0;
#ifdef CONFIG_SAE
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
sae_clear_data(&wpa_s->sme.sae);
#endif /* CONFIG_SAE */
#ifdef CONFIG_IEEE80211R
FT: Clear SME FT data on disassoc SME ft_used flag is sometimes not cleared on disassoc. For example, after initial FT connection, ft_used is set while ft_ies stays NULL. Later on, upon disassoc, sme_update_ft_ies() is not invoked and ft_used is not cleared. Fix this by invoking sme_update_ft_ies() also in case ft_used is set. This is needed to fix an issue with drivers that use nl80211 Connect API with FT and expect to the NL80211_AUTHTYPE_OPEN specified in the Connect command for the initial mobility domain association. Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
2018-04-30 12:42:04 +02:00
if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
sme_update_ft_ies(wpa_s, NULL, NULL, 0);
#endif /* CONFIG_IEEE80211R */
Stop SA Query on disconnection SA Query wasn't stopped after disconnection, which could potentially result in an unexpected SA timeout firing later when already connected to another AP. Fix that by stopping SA Query when an association is terminated. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2019-04-03 17:17:14 +02:00
sme_stop_sa_query(wpa_s);
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_deinit(struct wpa_supplicant *wpa_s)
{
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
sme_clear_on_disassoc(wpa_s);
SAE: Collect list of rejected groups for H2E in STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
#ifdef CONFIG_SAE
os_free(wpa_s->sme.sae_rejected_groups);
wpa_s->sme.sae_rejected_groups = NULL;
#endif /* CONFIG_SAE */
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
}
static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
const u8 *chan_list, u8 num_channels,
u8 num_intol)
{
struct ieee80211_2040_bss_coex_ie *bc_ie;
struct ieee80211_2040_intol_chan_report *ic_report;
struct wpabuf *buf;
SME: Add more debug prints for OBSS scans and 20/40 MHz co-ex report This makes it easier to debug wpa_supplicant behavior when reporting 20/40 MHz co-ex information based on OBSS scans. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:56:50 +01:00
wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
" (num_channels=%u num_intol=%u)",
MAC2STR(wpa_s->bssid), num_channels, num_intol);
wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
chan_list, num_channels);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
buf = wpabuf_alloc(2 + /* action.category + action_code */
sizeof(struct ieee80211_2040_bss_coex_ie) +
sizeof(struct ieee80211_2040_intol_chan_report) +
num_channels);
if (buf == NULL)
return;
wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
bc_ie->length = 1;
if (num_intol)
bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
if (num_channels > 0) {
ic_report = wpabuf_put(buf, sizeof(*ic_report));
ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
ic_report->length = num_channels + 1;
ic_report->op_class = 0;
os_memcpy(wpabuf_put(buf, num_channels), chan_list,
num_channels);
}
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
wpa_msg(wpa_s, MSG_INFO,
"SME: Failed to send 20/40 BSS Coexistence frame");
}
wpabuf_free(buf);
}
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
int sme_proc_obss_scan(struct wpa_supplicant *wpa_s,
struct wpa_scan_results *scan_res)
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
{
const u8 *ie;
u8 chan_list[P2P_MAX_CHANNELS], channel;
u8 num_channels = 0, num_intol = 0, i;
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
size_t j;
int pri_freq, sec_freq;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (!wpa_s->sme.sched_obss_scan)
return 0;
wpa_s->sme.sched_obss_scan = 0;
if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
return 1;
/*
* Check whether AP uses regulatory triplet or channel triplet in
* country info. Right now the operating class of the BSS channel
* width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
* based on the assumption that operating class triplet is not used in
* beacon frame. If the First Channel Number/Operating Extension
* Identifier octet has a positive integer value of 201 or greater,
* then its operating class triplet.
*
* TODO: If Supported Operating Classes element is present in beacon
* frame, have to lookup operating class in Annex E and fill them in
* 2040 coex frame.
*/
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
if (ie && (ie[1] >= 6) && (ie[5] >= 201))
return 1;
os_memset(chan_list, 0, sizeof(chan_list));
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
pri_freq = wpa_s->assoc_freq;
switch (wpa_s->sme.ht_sec_chan) {
case HT_SEC_CHAN_ABOVE:
sec_freq = pri_freq + 20;
break;
case HT_SEC_CHAN_BELOW:
sec_freq = pri_freq - 20;
break;
case HT_SEC_CHAN_UNKNOWN:
default:
wpa_msg(wpa_s, MSG_WARNING,
"Undefined secondary channel: drop OBSS scan results");
return 1;
}
for (j = 0; j < scan_res->num; j++) {
struct wpa_scan_res *bss = scan_res->res[j];
Use a common frequency to channel conversion function Signed-hostap: Jouni Malinen <j@w1.fi>
2013-04-27 20:27:15 +02:00
enum hostapd_hw_mode mode;
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
int res;
/* Skip other band bss */
Use a common frequency to channel conversion function Signed-hostap: Jouni Malinen <j@w1.fi>
2013-04-27 20:27:15 +02:00
mode = ieee80211_freq_to_chan(bss->freq, &channel);
if (mode != HOSTAPD_MODE_IEEE80211G &&
mode != HOSTAPD_MODE_IEEE80211B)
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
continue;
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
res = check_bss_coex_40mhz(bss, pri_freq, sec_freq);
if (res) {
if (res == 2)
SME: Fix OBSS scan result processing for 20/40 MHz co-ex report The 40 MHz intolerant bit needs to be checked before skipping the BSS based on the channel already being in the lost (which could have happened due to another BSS that does not indicate 40 MHz intolerant). This fixed the 20/40 MHz co-ex report to indicate 20 MHz request properly if there are both 40 MHz tolerant and intolerant BSSes on the same channel. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:54:50 +01:00
num_intol++;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
/* Check whether the channel is already considered */
for (i = 0; i < num_channels; i++) {
if (channel == chan_list[i])
break;
}
if (i != num_channels)
continue;
chan_list[num_channels++] = channel;
}
}
sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
return 1;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
struct wpa_driver_scan_params *params)
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
{
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
/* Include only affected channels */
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
struct hostapd_hw_modes *mode;
int count, i;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int start, end;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
Enhance get_mode() to return correct hw_mode with 6 GHz support The 5 GHz channels are stored in one hw_features set with mode HOSTAPD_MODE_IEEE80211A while the 6 GHz channels will need to be stored in a separate hw_features set (but with same mode HOSTAPD_MODE_IEEE80211A) due to possibility of different HT/VHT/HE capabilities being available between the 5 GHz and 6 GHz bands. Iterate through all hw_features sets and check and match the band of channel supported by the hw_features set while getting the hw_features set in get_mode(). This allows both the 5 GHz and 6 GHz channels to be found and correct capabilities to be used in cases where the driver reports different capability values between 5 and 6 GHz channels. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-30 10:42:12 +01:00
HOSTAPD_MODE_IEEE80211G, 0);
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode == NULL) {
/* No channels supported in this band - use empty list */
params->freqs = os_zalloc(sizeof(int));
return;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
wpa_s->current_bss) {
const u8 *ie;
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
if (ie && ie[1] >= 2) {
u8 o;
o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
}
}
start = wpa_s->assoc_freq - 10;
end = wpa_s->assoc_freq + 10;
switch (wpa_s->sme.ht_sec_chan) {
case HT_SEC_CHAN_UNKNOWN:
/* HT40+ possible on channels 1..9 */
if (wpa_s->assoc_freq <= 2452)
start -= 20;
/* HT40- possible on channels 5-13 */
if (wpa_s->assoc_freq >= 2432)
end += 20;
break;
case HT_SEC_CHAN_ABOVE:
end += 20;
break;
case HT_SEC_CHAN_BELOW:
start -= 20;
break;
}
wpa_printf(MSG_DEBUG,
"OBSS: assoc_freq %d possible affected range %d-%d",
wpa_s->assoc_freq, start, end);
Convert os_zalloc() for an array to use os_calloc() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 19:44:21 +02:00
params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (params->freqs == NULL)
return;
for (count = 0, i = 0; i < mode->num_channels; i++) {
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
continue;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
freq = mode->channels[i].freq;
if (freq - 10 >= end || freq + 10 <= start)
continue; /* not affected */
params->freqs[count++] = freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
}
}
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
struct wpa_driver_scan_params params;
if (!wpa_s->current_bss) {
wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
return;
}
os_memset(&params, 0, sizeof(params));
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_obss_scan_freqs_list(wpa_s, &params);
nl80211: Use low-priority scan for OBSS scan Some drivers may support low-priority scans, if they do then use that for OBSS scanning. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-06-04 11:21:40 +02:00
params.low_priority = 1;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
if (wpa_supplicant_trigger_scan(wpa_s, &params))
wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
else
wpa_s->sme.sched_obss_scan = 1;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
os_free(params.freqs);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
}
void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
{
const u8 *ie;
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
struct hostapd_hw_modes *hw_mode = NULL;
int i;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
wpa_s->sme.sched_obss_scan = 0;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (!enable)
return;
Allow OBSS scan and 20/40 coex reports to non-SME drivers We enable this feature for non-SME drivers as well if they explicitly indicate need for it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com>
2012-11-24 17:08:48 +01:00
/*
* Schedule OBSS scan if driver is using station SME in wpa_supplicant
* or it expects OBSS scan to be performed by wpa_supplicant.
*/
if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
wpa_supplicant: Fix type for ssid->mode comparisons The ssid->mode is from type enum wpas_mode and all its constants start with WPAS_MODE_*. Still some of the code sections used the IEEE80211_MODE_* defines instead of WPAS_MODE_*. This should have no impact on the actual code because the constants for INFRA, IBSS, AP and MESH had the same values. Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-14 16:49:19 +02:00
ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
Allow OBSS scan and 20/40 coex reports to non-SME drivers We enable this feature for non-SME drivers as well if they explicitly indicate need for it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com>
2012-11-24 17:08:48 +01:00
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
if (!wpa_s->hw.modes)
return;
/* only HT caps in 11g mode are relevant */
for (i = 0; i < wpa_s->hw.num_modes; i++) {
hw_mode = &wpa_s->hw.modes[i];
if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
break;
}
/* Driver does not support HT40 for 11g or doesn't have 11g. */
if (i == wpa_s->hw.num_modes || !hw_mode ||
!(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
return; /* Not associated on 2.4 GHz band */
/* Check whether AP supports HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
if (!ie || ie[1] < 2 ||
!(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return; /* AP does not support HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss,
WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
if (!ie || ie[1] < 14)
return; /* AP does not request OBSS scans */
wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
if (wpa_s->sme.obss_scan_int < 10) {
wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
"replaced with the minimum 10 sec",
wpa_s->sme.obss_scan_int);
wpa_s->sme.obss_scan_int = 10;
}
wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
wpa_s->sme.obss_scan_int);
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
static const unsigned int sa_query_max_timeout = 1000;
static const unsigned int sa_query_retry_timeout = 201;
OCV: Perform an SA Query after a channel switch After the network changed to a new channel, perform an SA Query with the AP after a random delay if OCV was negotiated for the association. This is used to confirm that we are still operating on the real operating channel of the network. This commit is adding only the station side functionality for this, i.e., the AP behavior is not changed to disconnect stations with OCV that do not go through SA Query. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:35 +02:00
static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
{
u32 tu;
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
struct os_reltime now, passed;
os_get_reltime(&now);
os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
tu = (passed.sec * 1000000 + passed.usec) / 1024;
if (sa_query_max_timeout < tu) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
wpa_supplicant_deauthenticate(
wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
return 1;
}
return 0;
}
static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
const u8 *trans_id)
{
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
MACSTR, MAC2STR(wpa_s->bssid));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
trans_id, WLAN_SA_QUERY_TR_ID_LEN);
req[0] = WLAN_ACTION_SA_QUERY;
req[1] = WLAN_SA_QUERY_REQUEST;
os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct wpa_channel_info ci;
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info for OCI element in SA Query Request frame");
return;
}
if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
return;
req_len += OCV_OCI_EXTENDED_LEN;
}
#endif /* CONFIG_OCV */
P2P: Add option for offloading off-channel TX to the driver With the new kernel functionality coming to Linux to allow off-channel TX, we can take advantage of that in the P2P code that currently uses remain-on-channel. If a driver advertises support for it, it will be asked to handle off-channel TX by itself. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2010-12-29 12:59:17 +01:00
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_s->own_addr, wpa_s->bssid,
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
req, req_len, 0) < 0)
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
"Request");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
unsigned int timeout, sec, usec;
u8 *trans_id, *nbuf;
if (wpa_s->sme.sa_query_count > 0 &&
sme_check_sa_query_timeout(wpa_s))
return;
Convert os_realloc() for an array to use os_realloc_array() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 20:21:23 +02:00
nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
wpa_s->sme.sa_query_count + 1,
WLAN_SA_QUERY_TR_ID_LEN);
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
if (nbuf == NULL) {
sme_stop_sa_query(wpa_s);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (wpa_s->sme.sa_query_count == 0) {
/* Starting a new SA Query procedure */
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
os_get_reltime(&wpa_s->sme.sa_query_start);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
wpa_s->sme.sa_query_trans_id = nbuf;
wpa_s->sme.sa_query_count++;
SME: Verify that os_get_random() succeeds for SA Query Be more consistent on checking os_get_random() return value (CID 72706). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-09-07 17:27:42 +02:00
if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
sme_stop_sa_query(wpa_s);
SME: Verify that os_get_random() succeeds for SA Query Be more consistent on checking os_get_random() return value (CID 72706). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-09-07 17:27:42 +02:00
return;
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
timeout = sa_query_retry_timeout;
sec = ((timeout / 1000) * 1024) / 1000;
usec = (timeout % 1000) * 1024;
eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
wpa_s->sme.sa_query_count);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_send_sa_query_req(wpa_s, trans_id);
}
static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
{
sme_sa_query_timer(wpa_s, NULL);
}
Mark local functions static These functions are not used outside the file in which they are defined. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-18 20:53:36 +01:00
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
{
Add debug print on stopping SA Query procedure This makes it easier to debug SA Query behavior. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-15 23:42:09 +02:00
if (wpa_s->sme.sa_query_trans_id)
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
os_free(wpa_s->sme.sa_query_trans_id);
wpa_s->sme.sa_query_trans_id = NULL;
wpa_s->sme.sa_query_count = 0;
}
void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
const u8 *da, u16 reason_code)
{
struct wpa_ssid *ssid;
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
struct os_reltime now;
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (wpa_s->wpa_state != WPA_COMPLETED)
return;
ssid = wpa_s->current_ssid;
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
return;
if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
return;
if (wpa_s->sme.sa_query_count > 0)
return;
Allow SA Query to be disabled for testing purposes The new wpa_supplicant control interface SET parameter disable_sa_query can now be used to disable SA Query on receiving unprotected disconnection event. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-21 17:12:02 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->disable_sa_query)
return;
#endif /* CONFIG_TESTING_OPTIONS */
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
os_get_reltime(&now);
if (wpa_s->sme.last_unprot_disconnect.sec &&
!os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
return; /* limit SA Query procedure frequency */
wpa_s->sme.last_unprot_disconnect = now;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
"possible AP/STA state mismatch - trigger SA Query");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_start_sa_query(wpa_s);
}
OCV: Perform an SA Query after a channel switch After the network changed to a new channel, perform an SA Query with the AP after a random delay if OCV was negotiated for the association. This is used to confirm that we are still operating on the real operating channel of the network. This commit is adding only the station side functionality for this, i.e., the AP behavior is not changed to disconnect stations with OCV that do not go through SA Query. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:35 +02:00
void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
{
unsigned int usec;
u32 _rand;
if (wpa_s->wpa_state != WPA_COMPLETED ||
!wpa_sm_ocv_enabled(wpa_s->wpa))
return;
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Channel switch completed - trigger new SA Query to verify new operating channel");
sme_stop_sa_query(wpa_s);
if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
_rand = os_random();
usec = _rand % (sa_query_ch_switch_max_delay + 1);
eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
}
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
const u8 *sa, const u8 *data,
size_t len)
{
u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
MACSTR, MAC2STR(wpa_s->bssid));
resp[0] = WLAN_ACTION_SA_QUERY;
resp[1] = WLAN_SA_QUERY_RESPONSE;
os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct wpa_channel_info ci;
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info for OCI element in SA Query Response frame");
return;
}
if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
return;
resp_len += OCV_OCI_EXTENDED_LEN;
}
#endif /* CONFIG_OCV */
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
resp, resp_len, 0) < 0)
wpa_msg(wpa_s, MSG_INFO,
"SME: Failed to send SA Query Response");
}
static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
const u8 *sa, const u8 *data,
size_t len)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
{
int i;
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
if (!wpa_s->sme.sa_query_trans_id)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
return;
for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
if (os_memcmp(wpa_s->sme.sa_query_trans_id +
i * WLAN_SA_QUERY_TR_ID_LEN,
data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
break;
}
if (i >= wpa_s->sme.sa_query_count) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
"transaction identifier found");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
"from " MACSTR, MAC2STR(sa));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
}
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *sa,
const u8 *data, size_t len)
{
if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
return;
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct ieee802_11_elems elems;
struct wpa_channel_info ci;
if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
&elems, 1) == ParseFailed) {
wpa_printf(MSG_DEBUG,
"SA Query: Failed to parse elements");
return;
}
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info to validate received OCI in SA Query Action frame");
return;
}
if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
channel_width_to_int(ci.chanwidth),
ci.seg1_idx) != 0) {
wpa_printf(MSG_WARNING, "%s", ocv_errorstr);
return;
}
}
#endif /* CONFIG_OCV */
if (data[0] == WLAN_SA_QUERY_REQUEST)
sme_process_sa_query_request(wpa_s, sa, data, len);
else if (data[0] == WLAN_SA_QUERY_RESPONSE)
sme_process_sa_query_response(wpa_s, sa, data, len);
}
Reference in a new issue Copy permalink