Commit graph

11301 commits

Author SHA1 Message Date
Sabrina Dubroca
05283e7a6f mka: Simplify ieee802_1x_mka_dist_sak_body_present()
No need for an if statement to figure out Boolean return value.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:43 +03:00
Sabrina Dubroca
87b19c8d88 mka: Replace participant->kay with a local kay variable
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:36 +03:00
Sabrina Dubroca
f9ea083be3 mka: Fix typos in grammar in variable names and comments
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:59:58 +03:00
Sabrina Dubroca
921171f51c mka: Use named initializers for mka_body_handler[]
Also move the struct definition to be next to this array definition.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:57:23 +03:00
Sabrina Dubroca
86bef17c94 mka: Remove unused enum mka_created_mode values
DISTRIBUTED and CACHED were not used anywhere.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:56:44 +03:00
Sabrina Dubroca
ec958aee32 mka: Remove cs_len argument from the set_current_cipher_suite functions
This is a known constant value (CS_ID_LEN, i.e., the length of the EUI64
identifier) and does not need to be provided separately in these
function calls.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:55:34 +03:00
Sabrina Dubroca
46bbda2b83 mka: Clean up ieee802_1x_mka_decode_potential_peer_body()
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:50:49 +03:00
Sabrina Dubroca
cf375eb2da mka: Simplify ieee802_1x_mka_encode_icv_body() memory copying
There is no need to maintain two os_memcpy() calls to cover different
cmac lengths.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:47:25 +03:00
Sabrina Dubroca
8b4a148842 mka: Simplify ieee802_1x_mka_sak_use_body_present()
to_use_sak is a Boolean variable, so there is no need for an if
statement to figure out whether to return TRUE or FALSE.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:46:19 +03:00
Sabrina Dubroca
b3df7836e8 mka: Reorganize loops in number of KaY functions
Use for loop to remove unnecessary goto use and similar cleanup to
simplify the loops in ieee802_1x_mka_i_in_peerlist(),
ieee802_1x_mka_decode_live_peer_body(), and
ieee802_1x_kay_decode_mkpdu().

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:44:04 +03:00
Sabrina Dubroca
de7f5337f4 mka: Remove unused body_peer incrementation
Each loop iteration resets body_peer in the beginning, so there is no
need to increment this pointer in the end.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:35:45 +03:00
Sabrina Dubroca
2b13bcad70 mka: Add reset_participant_mi() helper
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:34:56 +03:00
Sabrina Dubroca
3ceb458254 mka: Clean up printf formats
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:31:10 +03:00
Sabrina Dubroca
8fab9e1cae mka: Use named initializers for static structs
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:30:48 +03:00
Sabrina Dubroca
d4f668fded mka: Add MKA_ALIGN_LENGTH macro
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:29:20 +03:00
Sabrina Dubroca
1de7a9f882 mka: Add helper functions for dumping and creating peer
This allows more code reuse for creating live/potential peer and dumping
peer entries.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:58 +03:00
Sabrina Dubroca
d9639d1a4e mka: Clean up ieee802_1x_kay_get_cipher_suite() lookup function
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
7c547cff6b mka: Refactor the get_*_peer() functions
Add ieee802_1x_kay_get_potential_peer() similarly to the previously used
ieee802_1x_kay_get_live_peer() and use these helper functions more
consistently to avoid multiple implementations of peer lookups.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
515bc1aec1 mka: Fix a typo in mka_body_handler (mak to mka)
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
a33e3c3214 mka: Add a helper function, sci_equal(), for sci comparison
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
cefeb8e382 mka: Use less bitfields in the IEEE 802.1X-2010 structs
This splits the u32 bitfields into u8 variables and using bitfields only
for the cases where under 8-bit fields are used.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
2e9448989f mka: Fix a typo in macsec_capbility
Spell "capability" correctly in the variable name.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:29:15 +03:00
Jouni Malinen
cb320a6d2d tests: Allow regdb missing some op classes in mbo_supp_oper_classes
Not all installed regdb files include channels for global operating
classes 121-123, and 129.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-22 19:22:01 +03:00
Jouni Malinen
d952f02136 tests: Make FST kill_pid() more robust
It looks like the attempt to read the process id from a PID file can
return empty data. This resulted in kill_pid() failing to kill the
process and all the following FST test cases using the extra interface
failing. While the PID file is really supposed to have a valid PID value
when we get this far, it is better to try multiple times to avoid
failing large number of test cases.

The current os_daemonize() implementation ends up calling daemon() first
and then writing the PID file from the remaining process that is running
in the background. This leaves a short race condition where an external
process that started hostapd/wpa_supplicant could end up trying to read
the PID file before it has been written.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-22 17:44:05 +03:00
Jouni Malinen
7509b550f6 tests: hostapd and ctrl_iface commands when BSS not yet fully enabled
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-22 17:44:05 +03:00
Jouni Malinen
f2f8616e80 Initialize hapd->nr_db in hostapd_alloc_bss_data()
Previously, this was initialized in hostapd_setup_bss() which made it
possible for a REMOVE_NEIGHBOR control interface command to be issued
prior to the list head pointers having been set. That resulted in a NULL
pointer dereference. Fix this by initializing the list head at the time
the data structure gets allocated.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-22 17:44:05 +03:00
Jouni Malinen
30e0745bf7 Fix TRACK_STA_LIST before BSS enabled
This hostapd control interface command could hit a NULL pointer
dereference if issued before the BSS was enabled.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-19 16:26:48 +03:00
Jouni Malinen
1f3b8b4edb Check for driver initialization before doing driver operations
Number of hostapd control interface commands (e.g., STATUS-DRIVER) could
result in NULL pointer dereference when issued on not yet enabled BSS.
Fix this by checking that the driver interface has been initialized
before calling the driver_ops function.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-19 16:08:00 +03:00
Eduardo Abinader
833d0d45e8 radius: Sanity check for NULL pointer segfault
When the RADIUS client has not yet been fully enabled, MIB command was
segfaulting hostapd.

Signed-off-by: Eduardo Abinader <eduardoabinader@gmail.com>
2016-08-19 12:16:20 +03:00
Roshan Pius
d015bb05df Move network add/remove operations to a common function
All the 3 control interfaces: socket based, dbus & binder needs to
perform the same sequence of steps for network add/remove. So, move
these to a common utility method in |wpa_supplicant.c| instead of
duplicating the code everywhere.

Signed-off-by: Roshan Pius <rpius@google.com>
2016-08-18 20:46:18 +03:00
Masashi Honma
052b8d38c5 mesh: Report HT operation mode to kernel
Report HT operation mode to kernel to broadcast correct IE in beacon
(for example HT operation IE).

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 20:46:15 +03:00
Masashi Honma
2bd6217173 mesh: Use WPA_DRIVER_MESH_CONF_FLAG_* as modification flag
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 20:40:13 +03:00
Masashi Honma
4ffb3f870d mesh: Do NL80211_MESHCONF_* setting in single function
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 20:37:38 +03:00
Masashi Honma
a1431ef8df mesh: Move max_peer_links parameter to appropriate struct
Accoding to the comment of struct wpa_driver_mesh_bss_params, the
max_peer_links parameter should be under that struct.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 20:33:39 +03:00
Jouni Malinen
548d280162 tests: IAPP and multiple BSSes
This verifies IAPP socket registration from multiple hostapd interfaces.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-18 20:07:17 +03:00
Petko Bordjukov
72a652d785 IAPP: Set SO_REUSEADDR on listening socket
Make it possible for several instances of hostapd to listen on the same
network interface.

Signed-off-by: Petko Bordjukov <bordjukov@gmail.com>
2016-08-18 20:01:48 +03:00
Christopher Wiley
9d5d1c5dd2 Add init fragment for hostapd on Android
This fragment defines how the Android init system should start hostapd
as a standalone service. Previously, hostapd was fork/exec'd from
Android's netd. This left hostapd with some dangling file descriptors
and a process parent minimally interested in acting as init for child
processes.

Signed-off-by: Christopher Wiley <wiley@google.com>
2016-08-18 10:50:59 +03:00
Masashi Honma
ecba4509d9 mesh: Simplify HT40 check code
The ht40 variable can only have values -1 or 1 here, so need to try to
address ht40 == 0 case.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 10:46:39 +03:00
Masashi Honma
05aed438cd mesh: Set correct secondary channel offset if HT40 is disabled
Previously, secondary channel offset could be non zero even though
disable_ht40=1. This patch fixes it.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-08-18 10:43:19 +03:00
Jouni Malinen
6b6286eb78 tests: hostapd and MIB ctrl_iface command with open network
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-18 10:42:56 +03:00
Johannes Berg
81372e347a ap: Use is_multicast_ether_addr() more
Various checks should use is_multicast_ether_addr() instead
of hardcoding the equivalent, change it.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-17 13:43:31 +03:00
Eduardo Abinader
647862eb60 nl80211: Remove duplicated check in nl80211_setup_ap()
Just removing a duplicated condition.

Signed-off-by: Eduardo Abinader <eduardoabinader@gmail.com>
2016-08-17 13:42:11 +03:00
Jouni Malinen
26820b4fc1 tests: IEEE 802.1X + WEP reauthentication
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-17 13:40:40 +03:00
Johannes Berg
e3429c0b15 nl80211: Fix control port protocol no-encrypt setting
Previously, driver_nl80211 sets NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT in
AP mode, to get EAPOL frames out unencrypted when using IEEE 802.1X/WEP.
However, due to the way nl80211/cfg80211 is implemented, this attribute
is ignored by the kernel if NL80211_ATTR_CONTROL_PORT_ETHERTYPE isn't
specified as well. Fix this by including
NL80211_ATTR_CONTROL_PORT_ETHERTYPE set to ETH_P_PAE. This can be done
unconditionally, since the kernel will allow ETH_P_PAE to be set even
when the driver didn't advertise support for arbitrary ethertypes.

Additionally, the params->pairwise_ciphers appear to not be set at
this point, so relax the check and allow them to be zero.

In client mode, this whole thing was missing, so add it. Again, the
pairwise suite can be WPA_CIPHER_NONE, so allow that case as well.

This fixed IEEE 802.1X/WEP EAP reauthentication and rekeying to use
unencrypted EAPOL frames which is the de facto way of implementing this
in wireless networks.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2016-08-17 13:40:40 +03:00
Jouni Malinen
e5d3e13a5c tests: Fix ap_wps_er_http_proto max concurrent requests case
Commit 2d6a526ac3 ('tests: Make
ap_wps_er_http_proto more robust') tried to work around the timeouts
here, but that was not really the best approach since the one second
timeout that was used here for connect() ended up being very close to
the limit even before the kernel change. The longer connect() time is
caused by a sequence where the listen() backlog ignores the connection
instead of accept() followed by close() within the wpa_supplicant ER
HTTP connection handling. The time to retransmit the SYN changed a bit
in the kernel from 1.0 sec to about 1.03 sec. This was enough to push
that over the one second timeout.

Fix this by using a sufficiently long timeout (10 sec) to allow SYN
retransmission to occur to recover from the listen() backlog case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-08-17 13:37:25 +03:00
Jouni Malinen
50348c5c32 tests: More coverage for IBSS RSN OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-14 00:22:50 +03:00
Jouni Malinen
b97a541087 IBSS: Fix a memory leak on RSN error path
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-13 21:29:53 +03:00
Roshan Pius
5f040be4ff Move disconnect command handling to a common place
Move out the disconnect command handling from |ctrl_iface.c| to
|wpa_supplicant.c| so that it can be reused across the different
control interfaces (socket, dbus & binder).

Signed-off-by: Roshan Pius <rpius@google.com>
2016-08-13 21:11:04 +03:00
David Benjamin
478441bf81 OpenSSL: Fix OpenSSL 1.1.0 compatibility functions
To be consistent with OpenSSL 1.1.0, the free functions should
internally check for NULL. EVP_MD_CTX_free also was missing an
EVP_MD_CTX_cleanup, so this leaked a little.

OpenSSL 1.1.0 also has given get_rfc3526_prime_1536 a better namespace
with get_rfc3526_prime_1536 as a compatibility-only name. Use that
instead in 1.1.0.

Signed-off-by: David Benjamin <davidben@google.com>
2016-08-13 21:07:05 +03:00
Jouni Malinen
a412157262 tests: IBSS RSN group rekeying
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-13 16:29:07 +03:00