Commit graph

16624 commits

Author SHA1 Message Date
Jouni Malinen
c9dc075fcd dpp-nfc: Fix connection handover renegotiation
The use of the alternative channel list did not work properly for the
case were both ends were trying to initiate the negotiated connection
handover. Fix this by always starting a new connection handover client
thread for sending the alternative proposal and ignoring peer messages
(likely something from the first attempt) during this modified attempt.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-24 22:37:52 +03:00
Vinita S. Maloo
d0819a11cc FILS: Use FILS auth alg when connecting using PMKSA caching
When a PMKSA cache entry is available and used for connection with FILS
key management suite, use FILS authentication algorithm for connection
even if ERP keys are not available. This scenario may happen when
applications using wpa_supplicant cache persistently only PMKSA but not
ERP keys and reconfigures wpa_supplicant with PMKSA cache after
restarting wpa_supplicant.

The previous implementation correctly handles SME-in-wpa_supplicant
cases. However, SME-in-driver cases, complete FILS authentication
without PMKSA caching is performed.

Fix SME-in-driver behavior by setting authentication algorithm to
WPA_AUTH_ALG_FILS when connecting to a FILS AP using PMKSA caching.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-24 00:29:58 +03:00
Vinita S. Maloo
70b80c31f9 nl80211: Do not send FILS ERP sequence number without rRK
FILS ERP cannot be used without rRK, so include these attributes only
together.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-24 00:29:58 +03:00
Wu Gao
52a3257621 6 GHz: Change 6 GHz channels per IEEE P802.11ax/D6.1
The channel numbering/center frequencies was changed in IEEE
P802.11ax/D6.1. The center frequencies of the channels were shifted by
10 MHz. Also, a new operating class 136 was defined with a single
channel 2. Add required support to change the channelization as per IEEE
P802.11ax/D6.1.

Signed-off-by: Wu Gao<wugao@codeaurora.org>
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
2020-06-24 00:29:37 +03:00
Jouni Malinen
5908fedc10 dpp-nfc: Support channel list negotiation
If the peer's channel list in negotiated handover does not have any
common channels and the local end is configured with an alternative
channel list, try to initiate another negotiation handover with the
alternative channels.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-23 13:24:38 +03:00
Jouni Malinen
eddf22e1f2 dpp-nfc: Update debug print for tag-read-only operation
Be clearer about only a tag read being allowed when dpp-nfc is
configured to not allow connection handover.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-23 00:57:18 +03:00
Jouni Malinen
27ade59524 tests: sigma_dut sta_scan WaitCompletion,1
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 23:38:36 +03:00
Jouni Malinen
fc005be6c1 tests: sigma_dut DPP Configurator for dot1x
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 21:54:21 +03:00
Jouni Malinen
b62e46f690 DPP2: Fix DPP_CA_SET processing with authentication not having peer BI
Need to check for auth->peer_bi being set before using it here.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 21:45:10 +03:00
Jouni Malinen
4f4a52c3cc DPP: Clear bootstrap entries only after clearing authentication state
This fixes an issue where the pending authentication might have held a
reference to auth->tmp_peer_bi and dpp_auth_deinit() would try to free
that bootstrapping entry. This needs to happen before the call to
dpp_global_clear() to avoid double-removal of the bootstrapping entry
from the list.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 20:00:31 +03:00
Jouni Malinen
b649fa4f42 tests: nl80211 control port in AP mode disabled/enabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-21 18:07:54 +03:00
Markus Theil
67efd19e0a nl80211: Use control port TX (status) in AP mode if possible
Check if nl80211 control port TX status is available in the kernel and
enable control port TX if so. With this feature, nl80211 control path is
able to provide the same feature set as nl80211 (management) + AF_PACKET
socket (control) before.

For debugging and testing, this can explicitly be disabled with
the driver parameter control_port_ap=0.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-06-21 18:07:54 +03:00
Jouni Malinen
569497bf4f nl80211: Work around misdelivered control port TX status
The kernel commit "mac80211: support control port TX status reporting"
seems to be delivering the TX status events for EAPOL frames over
control port using NL80211_CMD_FRAME_TX_STATUS due to incorrect check on
whether the frame is a Management or Data frame. Use the pending cookie
value from EAPOL TX operation to detect this incorrect behavior and
redirect the event internally to allow it to be used to get full TX
control port functionality available for AP mode.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-21 17:56:04 +03:00
Markus Theil
87065881b1 nl80211: Use ext ack handler for TX control port
Allow custom ack handler to be registered and use the ext ack handler
for TX control port to fetch the cookie information. If these cookies
are not supported by the current kernel, a value of 0 is returned.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-06-21 17:55:28 +03:00
Markus Theil
6f19cc4d78 nl80211: Handle control port TX status events over nl80211
In order to retransmit faster in AP mode, hostapd can handle TX status
notifications. When using nl80211, this is currently only possible with
socket control messages. Add support for receiving such events directly
over nl80211 and detecting, if this feature is supported.

This finally allows for a clean separation between management/control
path (over nl80211) and in-kernel data path.

A follow up commit enables the feature in AP mode.

Control port TX status contains the original frame content for matching
with the current hostapd code. Furthermore, a cookie is included, which
allows for matching against outstanding cookies in the future. This
commit only prints the cookie value for debugging purposes on TX status
receive.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-06-21 17:55:26 +03:00
Markus Theil
f7c657b79f nl80211: Add custom ack handler arguments to send_and_recv()
This is a preliminary patch for using extack cookies for TX control port
handling. Custom ack handler arguments for send_and_recv() and friends
is introduced therefore. This commit does not actually use the provided
values, i.e., that will be added in a separate commit.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-06-21 16:57:45 +03:00
Jouni Malinen
73ea1ad7f2 nl80211: Clean up SO_WIFI_STATUS error reporting
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-21 16:57:45 +03:00
Jouni Malinen
948bd894f7 tests: EAP-TEAP with client certificate in Phase 1
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-20 18:08:12 +03:00
Jouni Malinen
cd99a8c432 EAP-TEAP (server): Allow Phase 2 skip based on client certificate
eap_teap_auth=2 can now be used to configure hostapd to skip Phase 2 if
the peer can be authenticated based on client certificate during Phase
1.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-20 18:07:04 +03:00
Jouni Malinen
5196293926 EAP-TEAP (client): Allow Phase 2 to be skipped if certificate is used
The EAP-TEAP server may skip Phase 2 if the client authentication could
be completed during Phase 1 based on client certificate. Handle this
similarly to the case of PAC use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-20 18:05:46 +03:00
Jouni Malinen
9593ce6587 OpenSSL: Provide access to peer subject and own certificate use
These are needed for EAP-TEAP server and client side implementation to
allow Phase 2 to be skipped based on client certificate use during Phase
1.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-20 18:04:51 +03:00
Jouni Malinen
b5dab03a13 Convert int to bool for throughput estimate tables
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-19 18:34:26 +03:00
Matthew Wang
b97aa038b7 Add WPA_EVENT_{DO,SKIP}_ROAM events
Add events for within-ESS reassociation. This allows us to monitor roam
events, both skipped and allowed, in tests.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 18:34:26 +03:00
Matthew Wang
d6b450e890 Refactor wpa_supplicant_need_to_roam()
Pull all the within-ESS roam code out of wpa_supplicant_need_to_roam()
and into its own function, wpa_supplicant_need_to_roam_within_ess().
This way, we avoid interleaving several #ifndef's in the original
function and wrap the new function in one big #ifndef. This also
modularizes the within-ESS roam code and makes it easier to test.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 18:30:08 +03:00
Matthew Wang
2ff5a1fdb1 Use lookup-table instead of macro for TX rate estimates
Change INTERPOLATE_RATE() macro to a lookup-table instead for the sake
of readability.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 16:59:13 +03:00
Jouni Malinen
fa09b85c4e DPP2: Remove forgetten development time debug prints
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:37:40 +03:00
Jouni Malinen
1046145093 tests: Copy subject from CSR to certificate
Instead of overriding the subject field with something arbitrary, use
the value that is included in the CSR now that there is something there.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:36:44 +03:00
Jouni Malinen
a758a66725 tests: DPP over TCP for enterprise provisioning
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
0bbab64656 DPP2: Fix dot1x config object parsing without trustedEapServerName
Need to check that the JSON node was found before using its value.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
8f88dcf050 DPP2: Add an automatic peer_bi entry for CSR matching if needed
This allows the DPP_CA_SET command to be targeting a specific DPP-CST
event in cases where the Configurator did not receive the bootstrapping
information for the peer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
b25ddfe9d3 DPP2: Add Enrollee name into CSR as the commonName
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
11aa77e00f DPP2: GAS comeback response processing for Enrollee over TCP
This is almost identical to processing of the GAS initial response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:37 +03:00
Jouni Malinen
18e013a93f DPP2: GAS comeback request processing for Configurator over TCP
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:37 +03:00
Jouni Malinen
68d9586a46 DPP2: GAS Comeback Request for the TCP case
Make the Enrollee handle GAS comeback delay when performing DPP over
TCP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 13:17:17 +03:00
Jouni Malinen
a352c7230d DPP2: Comeback delay response for certificate in over TCP case
Send out the GAS Initial Response with comeback delay when Configurator
is operating over TCP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 13:03:29 +03:00
Jouni Malinen
0f9463d6ee DPP2: CSR wait in Configurator when using TCP
Make Configurator wait for CSR (i.e., another Config Request) when using
DPP over TCP similarly to the over Public Action frame case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 12:56:51 +03:00
Jouni Malinen
1f86b2c248 DPP2: CSR generation in TCP Client/Enrollee
This was previously covered for the DPP over Public Action frames, but
the DPP over TCP case was missed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 12:10:23 +03:00
Jouni Malinen
697fa0c4bd DPP2: Do not try to proceed with GAS client if CSR building fails
This error path was supposed to stop instead of continuing to
wpas_dpp_start_gas_client().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 12:09:00 +03:00
Alan Chen
ffc8ae507e Define a new QCA vendor attribute for Optimized Power Management
Define a new attribute configuring Optimized Power Management.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 21:59:47 +03:00
Jouni Malinen
725d98a513 tests: DPP and enterprise provisioning and CSR getting rejected
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 21:42:35 +03:00
Jouni Malinen
3a3eded0dc DPP2: Allow CSR processing by CA/RA to reject configuration
"DPP_CA_SET name=status value=<int>" can now be used to explicitly
indicate that CSR was rejected by CA/RA.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 21:39:47 +03:00
Jouni Malinen
3b60f11741 DPP2: Validate CSR on Configurator before forwarding to CA/RA
Parse the received CSR, verify that it has been signed correctly, and
verify that the challengePassword is present and matches the derived cp.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 20:33:07 +03:00
Jouni Malinen
c98db9f1f8 DPP2: Add challengePassword into CSR
Derive challengePassword from bk and add it into the CSR.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 12:22:08 +03:00
Jouni Malinen
dbbb0d5b82 OpenSSL: Use EVP-based interface for ECDSA sign/verify
The low level ECDSA interface is not available in BoringSSL and has been
deprecetated in OpenSSL 3.0, so move to using a higher layer EVP-based
interface for performing the ECDSA sign/verify operations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:26:09 +03:00
Jouni Malinen
5abf8ad9b2 tests: DPP enterprise provisioning
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:26:09 +03:00
Jouni Malinen
ace3723d98 DPP2: Enterprise provisioning (Enrollee)
Add initial Enrollee functionality for provisioning enterprise (EAP-TLS)
configuration object. This commit is handling only the most basic case
and a number of TODO items remains to handle more complete CSR
generation and config object processing.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:26:06 +03:00
Jouni Malinen
6568e5d203 DPP2: Enterprise provisioning (Configurator)
Add Configurator functionality for provisioning enterprise (EAP-TLS)
configuration object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:24:23 +03:00
Jouni Malinen
4643b2feec DPP2: Enterprise provisioning definitions for dot1x AKM
Add shared AKM definitions for provisioning enterprise (EAP-TLS)
credentials.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:24:23 +03:00
Jouni Malinen
812d52ae27 OpenSSL: Support EC key from private_key blob
Try to parse the private_key blob as an ECPrivateKey in addition to the
previously supported RSA and DSA.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:24:23 +03:00
Jouni Malinen
4b834df5e0 OpenSSL: Support PEM encoded chain from client_cert blob
Allow a chain of certificates to be configured through a client_cert
blob.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:24:23 +03:00