Commit graph

11581 commits

Author SHA1 Message Date
Denton Gentry
04059ab844 Passive Client Taxonomy
Implement the signature mechanism described in the paper
"Passive Taxonomy of Wifi Clients using MLME Frame Contents"
published by Denton Gentry and Avery Pennarun.

http://research.google.com/pubs/pub45429.html
https://arxiv.org/abs/1608.01725

This involves:
1. Add a CONFIG_TAXONOMY compile option. Enabling taxonomy incurs
   a memory overhead of up to several kilobytes per associated
   station.
2. If enabled, store the Probe Request and (Re)Associate Request frame in
   struct sta_info.
3. Implement code to extract the ID of each Information Element,
   plus selected fields and bitmasks from certain IEs, into a
   descriptive text string. This is done in a new source file,
   src/ap/taxonomy.c.
4. Implement a "signature qq:rr:ss:tt:uu:vv" command
   in hostapd_cli to retrieve the signature.

Signatures take the form of a text string. For example, a signature
for the Nexus 5X is:
  wifi4|probe:0,1,127,45,191,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:338061b2,
  vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:00000a0201000040|assoc:0,1,48,45,
  221(0050f2,2),191,127,htcap:01ef,htagg:03,htmcs:0000ffff,vhtcap:339071b2,
  vhtrxmcs:030cfffa,vhttxmcs:030cfffa,extcap:0000000000000040

Signed-off-by: dgentry@google.com (Denton Gentry)
Signed-off-by: denny@geekhold.com (Denton Gentry)
Signed-off-by: rofrankel@google.com (Richard Frankel)
Signed-off-by: richard@frankel.tv (Richard Frankel)
2016-09-22 00:45:24 +03:00
Jouni Malinen
5e993390f6 Initialize iface->sta_seen on allocation
Previously, struct hostapd_iface sta_seen list head was initialized only
when completing interface setup. This left a window for operation that
could potentially iterate through the list before the list head has been
initialized. While the existing code checked iface->num_sta_seen to
avoid this case, it is much cleaner to initialize the list when struct
hostapd_iface is allocated to avoid any accidental missing of the extra
checks before list iteration.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-09-22 00:45:24 +03:00
Jouni Malinen
4424aa5d7d P2P: Fix D-Bus persistent parameter in group started event on GO
When starting a P2P GO, the struct p2p_go_neg_results may use
persistent_group == 2 to indicate use of persistent reconnect. Setting
ssid->p2p_persistent_group based on this did not take into account this
special case and that ended up in D-Bus code trying to encode 2 as a
DBUS_TYPE_BOOLEAN value which results in an assert from the library. Fix
this by setting ssid->p2p_persistent_group to 0 or 1 instead of raw
params->persistent_group value without any filtering.

This is similar to an earlier fix in commit
112fdee738 ('P2P: Fix D-Bus persistent
parameter in group started event') that addressed another code path in
sending out this D-Bus signal.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-09-22 00:34:19 +03:00
Nick Lowe
81258efacb Remove unused generation of Request Authenticator in Account-Request
Do not generate an unused and invalid Request Authenticator (random
value) when constructing Accounting-Request packets. The correct Request
Authenticator is calculated subsequently in radius_msg_finish_acct()
using MD5(msg + shared secret).

Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-09-22 00:34:19 +03:00
Jonathan Afek
44a4c52c86 tests: Setup wlantest once for qosmap tests
Some tests call the check_qos_map() function more than once. Make sure
each test sets up wlantest only once before the first time the function
is called.

The wlantest setup sets the channel for the wlantest interface and
executes the wlantest executable. It is more efficient to do that only
once for each test.

Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
2016-09-17 22:14:06 +03:00
Jonathan Afek
c7ca843d05 tests: Increase timeout for remote tests
Some operations take longer time on real hardware than on hwsim. This
commit increases two timeouts so that the tests will pass on real
hardware, too.

Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
2016-09-17 22:12:35 +03:00
Jonathan Afek
67a0d4f94e tests: Increase connection timeouts for remote tests
Use increased timeouts for connect and disconnect since these operations
take a longer time on real harware than they do on hwsim.

Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
2016-09-17 22:09:36 +03:00
Rafał Miłecki
ea19b39f60 Revert "nl80211: Remove duplicated check in nl80211_setup_ap()"
This reverts commit 647862eb60.

The second check of device_ap_sme looks like duplicated, but it isn't
actually. The trick is nl80211_create_monitor_interface may change that
variable value and the second evaluation may give a different result.

This definitely isn't a very clear code, but that change caused a
regression for drivers that:
1) Don't report NL80211_ATTR_DEVICE_AP_SME
2) Don't support monitor mode
3) Don't support subscribing for PROBE_REQ and/or ACTION frames
like brcmfmac. With such drivers hostapd doesn't start anymore.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2016-09-17 20:08:24 +03:00
Jouni Malinen
205d2d1ff5 Fix typos in wpa_supplicant configuration parameter documentation
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-09-10 21:09:52 +03:00
Sunil Dutt
660103eca9 nl80211: Use the monitor interface only without device_ap_sme support
The places using drv->use_monitor were already skipping creation of the
monitor interface if drv->device_ap_sme == 0. This means that the
monitor interface operations would not have worked anyway and it is safe
to set drv->use_monitor to zero for all such cases. This fixes an issue
with management frame subscription not happening properly for the case
where the AP SME is in the driver and the driver supports monitor
interfaces (for other purposes).

This commit also removes the check for monitor support and the
previously used workaround that cleared drv->use_monitor in
drv->device_ap_sme == 1 case if monitor interface was not supported
since that condition cannot occur anymore.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-09-08 23:19:07 +03:00
Jouni Malinen
4ef3325fb6 tests: Dynamic Interworking element update
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-09-08 19:48:44 +03:00
Dedy Lansky
c7f9d44825 FST: Fix search for peer's "other" connection
Upon receiving FST Setup Request from some peer on some interface,
search is made to see if same peer is connected on other interface with
specific band_id. With multiple peers, bug in
fst_group_does_iface_appear_in_other_mbies() caused wrong peer address
to be returned sometimes.

Fix this with a modified, simplified search algorithm of peer's "other"
connection.

Signed-off-by: Dedy Lansky <qca_dlansky@qca.qualcomm.com>
2016-09-08 11:17:45 +03:00
Lior David
a62dea4156 Fix mistakes in definition of QCA vendor commands for indoor location
Fix some mistakes in the previous commit for adding QCA vendor commands
for indoor location.

Note: The renamed enum value does not change the ABI, but the addition
of QCA_WLAN_VENDOR_ATTR_FTM_MEAS_INVALID in the beginning of enum
qca_wlan_vendor_attr_ftm_meas does renumber
QCA_WLAN_VENDOR_ATTR_FTM_MEAS_* values. The previous values were
committed yesterday and have not been used in any released code yet, so
this is a justifiable quick fix.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-09-06 23:38:47 +03:00
Joel Cunningham
711e3cab07 Handle NULL return from os_zalloc() in sta_track_add()
This adds handling for a memory allocation failure in sta_track_add().

Signed-off-by: Joel Cunningham <joel.cunningham@me.com>
2016-09-06 18:58:08 +03:00
Lior David
fcd85d9a3f Add QCA vendor commands/attributes for indoor location
Assign QCA vendor specific commands, attributes, and events for
supporting indoor location features.

These features include:

1. Fine timing measurement (FTM) - allows measurement of distance
between two stations. Based on IEEE P802.11-REVmc/D7.0, 11.24.6 FTM is
performed between two stations: one is an initiator, typically a client
that wants to measure distance to another AP, and one is a responder,
typically an AP which responds to measurement requests from other
clients. The responder can be configured to report its location, either
in absolute coordinates (LCI) or free-form description (LCR).

2. Angle of arrival (AOA) - allows measurement of azimuth and elevation
between two stations.

The above features can be combined to allow a station to get an accurate
indoor location.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-09-05 21:59:18 +03:00
Jouni Malinen
30ee6cc436 tests: FTM capability indication
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-09-05 21:43:36 +03:00
Lior David
d1723c5566 wpa_supplicant: Allow FTM functionality to be published
Add configuration options that control publishing of fine timing
measurement (FTM) responder and initiator functionality via bits 70, 71
of Extended Capabilities element. Typically, FTM functionality is
controlled by a location framework outside wpa_supplicant. When
framework is activated, it will use wpa_supplicant to configure the
STA/AP to publish the FTM functionality. See IEEE P802.11-REVmc/D7.0,
9.4.2.27.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-09-05 21:27:23 +03:00
Lior David
faecb39236 hostapd: Allow FTM functionality to be published
Add configuration options that control publishing of fine timing
measurement (FTM) responder and initiator functionality via bits 70, 71
of Extended Capabilities element. Typically, FTM functionality is
controlled by a location framework outside hostapd. When framework is
activated, it will use hostapd to configure the AP to publish the FTM
functionality. See IEEE P802.11-REVmc/D7.0, 9.4.2.27.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-09-05 21:23:07 +03:00
Jouni Malinen
ff22993594 tests: VHT with 80 MHz channel width and use_sta_nsts=1
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-09-05 21:16:40 +03:00
Tamizh chelvam
fc72a48a63 hostapd: Use stations nsts capability in (Re)Association Response frame
Some deployed stations incorrectly consider nsts capability in
(Re)Association Response frame as required capability instead of maximum
capability and if it is greater than station's capability then beamform
will not happen in uplink traffic.

This commit adds support for an optional workaround to use station's
nsts capability in (Re)Association Response frame if the station's nsts
is less than AP by using the use_sta_nsts=1 configuration parameter.
This configuration is introduced in this commit and it is disabled by
default.

Signed-off-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
2016-09-05 21:14:40 +03:00
Zhang Qian
22950d0568 QCA vendor subcommand for LL_STATS extension
Some user space monitor wants to offload link layer statistics to
firmware. A new command QCA_NL80211_VENDOR_SUBCMD_LL_STATS_EXT and
associcated attributes are added. The monitor will use this new command
to configure monitoring paramters and get link layer statistics.
Attributes added in this change:
1. Parameters for FW to trigger the statistics report
2. Peer STA power state
3. TX failure statistics

Signed-off-by: Zhang Qian <zhangq@qti.qualcomm.com>
2016-09-05 20:50:10 +03:00
Jose Blanquicet
b44d9c760f D-Bus: Add ConfigFile parameter into the interface properties
This patch aims to expose the configuration file path as an interface
property, like is done with the driver and the bridge name. Doing so,
higher layer programs become responsible to recreate interfaces with the
correct configuration file path when programs need to remove them.

Signed-off-by: Jose Blanquicet <blanquicet@gmail.com>
2016-08-29 11:43:53 +03:00
Sabrina Dubroca
7dcec24881 mka: Clean up key allocation
Assign cs in ieee802_1x_mka_decode_dist_sak_body and reuse it.

Cleanup of key allocation: ieee802_1x_kay_generate_new_sak() and
ieee802_1x_mka_decode_dist_sak_body() both allocate a struct key_conf,
fill it, and ask ieee802_1x_kay_init_data_key() to allocate and set up a
struct data_key. They also allocate multiple key buffers and copy the
same data around. Stop moving data from buffer to buffer, and just
allocate what we really need.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 22:24:33 +03:00
Sabrina Dubroca
95e9460d6a mka: Get rid of struct ieee802_1x_cp_conf
Instead of copying from kay to a temporary struct, and then from the
struct to the sm, just copy from kay to cp.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:56:17 +03:00
Sabrina Dubroca
07a6bfe1d2 mka: Store cipher suite ID in a u64 instead of u8 pointer
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:55:54 +03:00
Jouni Malinen
535a8b8712 mka: Make csindex unsigned
This avoids unnecessary typecasting while still being able to compare
the value to CS_TABLE_SIZE without compiler warnings.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-08-28 21:48:45 +03:00
Sabrina Dubroca
343eb3b036 mka: Reorganize live peer creation and key server election
This modifies ieee802_1x_kay_decode_mkpdu() check for peer including me
in its peer list.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:41:21 +03:00
Sabrina Dubroca
34dbe90ac5 mka: Share a single delete mka implementation
Share mka deletion implementation in ieee802_1x_participant_timer() for
the cak_life and mka_life expiration cases.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:31:28 +03:00
Sabrina Dubroca
0dabf79b5d mka: Introduce compare_priorities()
This takes care of priority comparison followed by MAC address
comparison if the priorities are identical.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:27:05 +03:00
Sabrina Dubroca
53080f770c mka: Clean up ieee802_1x_kay_mkpdu_sanity_check()
This drops one indentation level and makes the code a bit more readable.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:19:37 +03:00
Sabrina Dubroca
05283e7a6f mka: Simplify ieee802_1x_mka_dist_sak_body_present()
No need for an if statement to figure out Boolean return value.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:43 +03:00
Sabrina Dubroca
87b19c8d88 mka: Replace participant->kay with a local kay variable
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 21:17:36 +03:00
Sabrina Dubroca
f9ea083be3 mka: Fix typos in grammar in variable names and comments
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:59:58 +03:00
Sabrina Dubroca
921171f51c mka: Use named initializers for mka_body_handler[]
Also move the struct definition to be next to this array definition.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:57:23 +03:00
Sabrina Dubroca
86bef17c94 mka: Remove unused enum mka_created_mode values
DISTRIBUTED and CACHED were not used anywhere.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:56:44 +03:00
Sabrina Dubroca
ec958aee32 mka: Remove cs_len argument from the set_current_cipher_suite functions
This is a known constant value (CS_ID_LEN, i.e., the length of the EUI64
identifier) and does not need to be provided separately in these
function calls.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:55:34 +03:00
Sabrina Dubroca
46bbda2b83 mka: Clean up ieee802_1x_mka_decode_potential_peer_body()
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:50:49 +03:00
Sabrina Dubroca
cf375eb2da mka: Simplify ieee802_1x_mka_encode_icv_body() memory copying
There is no need to maintain two os_memcpy() calls to cover different
cmac lengths.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:47:25 +03:00
Sabrina Dubroca
8b4a148842 mka: Simplify ieee802_1x_mka_sak_use_body_present()
to_use_sak is a Boolean variable, so there is no need for an if
statement to figure out whether to return TRUE or FALSE.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:46:19 +03:00
Sabrina Dubroca
b3df7836e8 mka: Reorganize loops in number of KaY functions
Use for loop to remove unnecessary goto use and similar cleanup to
simplify the loops in ieee802_1x_mka_i_in_peerlist(),
ieee802_1x_mka_decode_live_peer_body(), and
ieee802_1x_kay_decode_mkpdu().

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:44:04 +03:00
Sabrina Dubroca
de7f5337f4 mka: Remove unused body_peer incrementation
Each loop iteration resets body_peer in the beginning, so there is no
need to increment this pointer in the end.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:35:45 +03:00
Sabrina Dubroca
2b13bcad70 mka: Add reset_participant_mi() helper
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:34:56 +03:00
Sabrina Dubroca
3ceb458254 mka: Clean up printf formats
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:31:10 +03:00
Sabrina Dubroca
8fab9e1cae mka: Use named initializers for static structs
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:30:48 +03:00
Sabrina Dubroca
d4f668fded mka: Add MKA_ALIGN_LENGTH macro
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 20:29:20 +03:00
Sabrina Dubroca
1de7a9f882 mka: Add helper functions for dumping and creating peer
This allows more code reuse for creating live/potential peer and dumping
peer entries.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:58 +03:00
Sabrina Dubroca
d9639d1a4e mka: Clean up ieee802_1x_kay_get_cipher_suite() lookup function
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
7c547cff6b mka: Refactor the get_*_peer() functions
Add ieee802_1x_kay_get_potential_peer() similarly to the previously used
ieee802_1x_kay_get_live_peer() and use these helper functions more
consistently to avoid multiple implementations of peer lookups.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
515bc1aec1 mka: Fix a typo in mka_body_handler (mak to mka)
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00
Sabrina Dubroca
a33e3c3214 mka: Add a helper function, sci_equal(), for sci comparison
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-08-28 19:49:57 +03:00