Commit graph

14792 commits

Author SHA1 Message Date
Avraham Stern
15ab61eda0 WNM: Add option to configure candidates for BTM query candidate list
Add a mechanism to configure the candidates for BTM query candidate list
manually. This can be used to verify AP behavior for various candidates
preferences.

usage:
wnm_bss_query <reason> [neighbor=<BSSID>,<BSSID information>,
	                <operating class>,<channel number>,
			<PHY type>[,<hexdump of optional subelements>]]

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-11 10:47:28 +02:00
Avraham Stern
e044a9d1e0 common: Add candidate list parsing helper function
Add a helper function that parses candidate list from command line
arguments.

This function will be used (in the following commits) to add
a candidate list to BSS transition management query.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-11 10:36:15 +02:00
Avraham Stern
13bf18eda5 WNM: Use a dynamically allocated buffer for BTM query and response
BSS transition management query and response use a large static buffer
for the frame because the candidate list may require a lot of space.
However, in most cases the actually used space will be much less than
the buffer (since the candidate list is short or completely missing).

Use a dynamically allocated buffer instead and allocate it according
to the actual space needed.

While at it, remove unneeded filling of the MAC header in the Action
frames, since this gets ignored and wpa_drv_send_action() adds the MAC
header anyway.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-10 23:52:44 +02:00
Jouni Malinen
5d9fa5ead2 tests: MBO ANQP
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 18:59:12 +02:00
Jouni Malinen
34f2851902 MBO: Parse MBO ANQP-element on STA
This extends the GAS/ANQP parser in wpa_supplicant to process MBO
ANQP-elements and indicate received Cellular Data Connection Preference
values over the control interface.

When a valid MBO ANQP-element is received, the following control
interface message is sent:

RX-MBO-ANQP <BSSID> cell_conn_pref=<value>

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 18:57:12 +02:00
Jouni Malinen
941caed980 MBO: Add MBO ANQP-element processing on AP
This extends the GAS server to process MBO ANQP-elements and reply to a
query for the Cellular Data Connection Preference (if configured). The
new configuration parameter mbo_cell_data_conn_pref can be used to set
the value (0, 1, or 255) for the preference to indicate.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 18:33:51 +02:00
Jouni Malinen
2453f2517c tests: Extend ANQP_GET coverage for new functionality
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 17:03:55 +02:00
Jouni Malinen
8ecf2231fd ANQP: Extend ANQP_GET command to request without IEEE 802.11 elements
Previously, ANQP_GET required at least one IEEE 802.11 ANQP-element to
be requested. This is not really necessary, so allow a case where
num_ids == 0 as long as the request includes at least one Hotspot 2.0 or
MBO ANQP-element.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 17:02:22 +02:00
Avraham Stern
a9be28bf6b tests: Fix MBO ANQP cellular data preference query
The cellular data preference ANQP element subtype is now 2, so
fix the command to query the MBO cellular data preference.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-10 16:53:14 +02:00
Avraham Stern
2316cb358c MBO: Add option to add MBO query list to ANQP query
MBO techspec v0.0_r27 changed the MBO ANQP-element format. The MBO
element in ANQP query should now include an MBO Query List element that
contains a list of MBO elements to query.

Add API to add the MBO Query List to an ANQP query.

Format:
ANQP_GET <addr> <info_id>[,<info_id>]...[,mbo:<subtype>...]

Example for querying neighbor report with MBO cellular data
connection preference:
ANQP_GET <bssid> 272,mbo:2

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-10 16:53:10 +02:00
Jouni Malinen
f7c25d1a50 tests: Additional RADIUS accounting failure cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-10 12:23:25 +02:00
Vasanthakumar Thiagarajan
7cbb5f1a44 DFS: Handle pre-CAC expired event
As FCC DFS requirement does not explicitly mention about the validity of
the (pre-)CAC when channel is switched, it is safe to assume that the
pre-CAC result will not be valid once the CAC completed channel is
switched or radar detection is not active on the (CAC completed) channel
within a time period which is allowed (10 seconds - channel switch time)
as per FCC DFS requirement.

Use the new driver event to allow the driver to notify expiry of the CAC
result on a channel. Move the DFS state of the channel to 'usable' when
processing pre-CAC expired event.  This means any future operation on
that channel will require a new CAC to be completed. This event is
applicable only when DFS is not offloaded to the kernel driver.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
2017-03-09 17:01:50 +02:00
Vasanthakumar Thiagarajan
62c8c7f721 nl80211: Handle pre-CAC expired event from the driver
Process the new nl80211 event NL80211_RADAR_PRE_CAC_EXPIRED to allow the
driver to notify expiry of the CAC result on a channel.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
2017-03-09 17:01:36 +02:00
Jouni Malinen
caaaee072b Sync with mac80211-next.git include/uapi/linux/nl80211.h
This brings in nl80211 definitions as of 2017-03-06.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-09 16:59:42 +02:00
Vasanthakumar Thiagarajan
3dcd735c1e DFS: Handle CAC completion event from other radio
When DFS channel state is shared across multiple radios on the system it
is possible that a CAC completion event is propagated from other radio
to us. When in enabled state, do not proceed with setup completion upon
processing CAC completion event with devices where DFS is not offloaded,
when in state other than enabled make sure the configured DFS channel is
in available state before start the AP.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
2017-03-09 16:46:30 +02:00
Purushottam Kushwaha
d0330d57f3 nl80211: Add option to delay start of schedule scan plans
The userspace may want to delay the the first scheduled scan.
This enhances sched_scan to add initial delay (in seconds) before
starting first scan cycle. The driver may optionally choose to
ignore this parameter and start immediately (or at any other time).

This uses NL80211_ATTR_SCHED_SCAN_DELAY to add this via user
global configurable option: sched_scan_start_delay.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-09 15:44:26 +02:00
Jouni Malinen
b696f791ac RRM: Fix wpas_rrm_send_msr_report() loop handling
The while (len) loop was updating the next pointer at the end even when
len == 0, i.e., when the new next value won't be used. This could result
in reading one octet beyond the end of the allocated response wpabuf.
While the read value is not really used in practice, this is not correct
behavior, so fix this by skipping the unnecessary next pointer update in
len == 0 case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-08 16:16:37 +02:00
Avraham Stern
891aa65b88 RRM: Use dynamically allocated buffer for beacon report
The maximum required size for each Beacon Report element is known in
advance: it is the size of the Beacon Report element fixed fields + the
size of the Reported Frame Body subelement.

Allocate the buffer used for constructing the Beacon Report element
dynamically with the maximum needed size, instead of using a very
large static buffer.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-08 16:05:52 +02:00
Jouni Malinen
732b57acb4 tests: Fix authsrv_errors_1 and authsrv_errors_3 when running on host
Use a non-existing directory in the path to avoid SQLite from being able
to create a new database file. The previous design worked in the VM case
due to the host file system being read-only, but a bit more is needed
for the case when this is running on the host.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-07 18:13:05 +02:00
Johannes Berg
a1f11e34c4 Use os_memdup()
This leads to cleaner code overall, and also reduces the size
of the hostapd and wpa_supplicant binaries (in hwsim test build
on x86_64) by about 2.5 and 3.5KiB respectively.

The mechanical conversions all over the code were done with
the following spatch:

    @@
    expression SIZE, SRC;
    expression a;
    @@
    -a = os_malloc(SIZE);
    +a = os_memdup(SRC, SIZE);
    <...
    if (!a) {...}
    ...>
    -os_memcpy(a, SRC, SIZE);

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 13:19:10 +02:00
Johannes Berg
dbdda355d0 Introduce os_memdup()
This can be used to clean the code and reduce size by converting
os_malloc() followed by os_memcpy() cases to use a single function call.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 13:18:49 +02:00
Johannes Berg
60be144e45 gitignore: Add parallel-vm.log
Ignore parallel-vm.log regardless of where in the tree
it was created.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 12:13:27 +02:00
Johannes Berg
6f6a3a03c1 ap-mgmt-fuzzer: Add .gitignore
Ignore the binary created here.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 12:12:20 +02:00
Jouni Malinen
40c8ad8058 wpadebug: Add .gitignore
Ignore the automatically generated build directories and files.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-07 12:10:11 +02:00
Kanchanapally, Vidyullatha
af8bc24da3 MBO: Add support for transition reject reason code
Add support for rejecting a BSS transition request using MBO reject
reason codes. A candidate is selected or rejected based on whether it is
found acceptable by both wpa_supplicant and the driver. Also accept any
candidate meeting a certain threshold if disassoc imminent is set in BTM
Request frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-07 00:34:14 +02:00
Kanchanapally, Vidyullatha
3ab484928a nl80211: Driver command for checking BTM accept/reject
Add driver interface command using the QCA vendor extensions to check
the driverr whether to accept or reject a BSS transition candidate. For
the reject case, report an MBO reject reason code.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-07 00:20:29 +02:00
Avraham Stern
ae2f1a9c0f tests: Make beacon report tests remote compatible
Use the new hostapd.add_ap() API (i.e., pass the ap device as a
parameter instead of the interface name) in beacon report tests to
make them remote compatible, and mark them appropriately.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-06 23:55:32 +02:00
Jouni Malinen
4fe798bd9d tests: Make wnm_bss_tm_req a bit more efficient and robust
Use a local variable for the STA address instead of fetching it
separately for each operation. Dump control interface monitor events
between each test message to avoid increasing the socket output queue
unnecessarily.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-06 23:53:33 +02:00
Beni Lev
ed432343f4 tests: Clean up wnm_bss_tm_req test not initialize unused AP
The second AP is not really needed in this test case that verifies
parsing of various different BSs Transition Management Request frame
payloads.

Signed-off-by: Beni Lev <beni.lev@intel.com>
2017-03-06 23:48:02 +02:00
Avraham Stern
23cddd7519 wpa_supplicant: Fix non_pref_chan example
The parsing code expects non_pref_chan to be non-quoted.
Fix the example in wpa_supplicant.conf not to include
quotes.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-03-06 23:41:26 +02:00
Andrei Otcheretianski
79f846a7a9 tests: Rename ap_wpa2_psk_file test
There are two different tests with the same name in test_ap_psk.py.
Fix that.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2017-03-06 23:38:48 +02:00
Jouni Malinen
c90c62e5d3 tests: hostapd authentication server test cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-05 16:51:04 +02:00
Jouni Malinen
b9fd3c244e tests: Add TEST_FAIL() to radius_msg_add_attr()
This makes it easier to test error paths for RADIUS message
construction.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-05 16:37:52 +02:00
Jouni Malinen
de01f254a6 RADIUS server: Fix error paths in new session creation
radius_server_session_free() does not remove the session from the
session list and these radius_server_get_new_session() error paths ended
up leaving a pointer to freed memory into the session list. This
resulted in the following operations failing due to use of freed memory.

Fix this by using radius_server_session_remove() which removes the entry
from the list in addition to calling radius_server_session_free().

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-05 16:18:57 +02:00
Jouni Malinen
a47f214e3f tests: Automatic channel selection failures
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:15 +02:00
Jouni Malinen
468a247774 tests: Automatic channel selection for VHT160
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:15 +02:00
Jouni Malinen
4c803dfcd7 ACS: Fix memory leak if interface is disabled during scan
The survey data was not freed if hostapd interface got disabled during
an ACS scan.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:15 +02:00
Jouni Malinen
31b398e05f tests: Automatic channel selection for VHT40
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:14 +02:00
Jouni Malinen
5f45caae24 tests: Automatic channel selection for HT40- channel
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:14 +02:00
Jouni Malinen
29be2c090e ACS: Simplify code paths
This removes some unnecessarily duplicated return paths and simplifies
code paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 17:30:10 +02:00
Jouni Malinen
9960434dcf tests: ProxyARP error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 11:44:55 +02:00
Jouni Malinen
fa07d2d463 tests: Add TEST_FAIL() checks in l2_packet
This enables additional test coverage for error paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 11:43:58 +02:00
Jouni Malinen
d4359923e1 Fix DHCP/NDISC snoop deinit followed by failing re-init
It was possible to hit a double-free on the l2_packet socket if
initialization of DHCP/NDISC snoop failed on a hostapd interface that
had previously had those enabled successfully. Fix this by clearing the
l2_packet pointers during deinit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 11:42:15 +02:00
Jouni Malinen
6baab31c6c tests: P2P autonomous GO and NoA
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-04 10:57:28 +02:00
Alexei Avshalom Lazar
160dca0784 Add QCA vendor command/attr for BRP antenna limit control
Add QCA_NL80211_VENDOR_SUBCMD_BRP_SET_ANT_LIMIT for setting the number
of antennas that will be active in different modes for each connection.

Signed-off-by: Alexei Avshalom Lazar <qca_ailizaro@qca.qualcomm.com>
2017-03-02 15:05:46 +02:00
Jouni Malinen
c7a7218951 tests: Scan failures for TYPE=ONLY
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-01 16:42:56 +02:00
Hu Wang
57d3c5913a Clear scan_res_handler on no-retry failure
Previously it was possible for wpa_s->scan_res_handler to remain set to
its old value in case wpa_drv_scan() failed and no retry for the scan
trigger was scheduled (i.e., when last_scan_req == MANUAL_SCAN_REQ).
This could result in getting stuck with the next connection attempt
after a failed "SCAN TYPE=ONLY" operation when wpa_s->scan_res_handler
was set to scan_only_handler().

Fix this by clearing wpa_s->scan_res_handler if wpa_drv_scan() fails and
no retry is scheduled.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-01 16:39:30 +02:00
Jouni Malinen
c97d7c2a60 tests: Wi-Fi Display extensions to P2P with R2 subelems
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-01 12:16:10 +02:00
Amarnath Hullur Subramanyam
e9518ae749 WFD: Add WFD R2 Subelements
Define and add support for WFD R2 Subelements.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-01 11:59:57 +02:00
Gaole Zhang
21ac782797 QCA nl80211 vendor attribute for specific sub-20 MHz channel width
Define a new attribute QCA_WLAN_VENDOR_ATTR_CONFIG_SUB20_CHAN_WIDTH.
This attribute can set a station device to work in 5 or 10 MHz channel
width while in disconnect state.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-03-01 11:55:04 +02:00