Commit graph

9240 commits

Author SHA1 Message Date
Jouni Malinen
5e0bedc63c tests: EAP-EKE with server OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 13:36:16 +03:00
Jouni Malinen
f7e3c17b68 tests: WPA2-Enterprise connection using EAP-EKE with serverid NAI
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 12:48:52 +03:00
Jouni Malinen
b4b2f300db tests: ERP with EAP-EKE
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 12:01:25 +03:00
Jouni Malinen
ca24117a5a EAP-EKE: Add Session-Id
While RFC 6124 does not define how Session-Id is constructed for
EAP-EKE, there seems to be consensus among the authors on the
construction. Use this Type | Nonce_P | Nonce_S construction based on
the following email:

 From: Yaron Sheffer <yaronf.ietf at gmail.com>
 To: ietf at ietf.org
 Date: Wed, 17 Nov 2010 13:13:42 +0200

Expanding on my previous response, I suggest to resolve Bernard's
concern by adding the following text:

5.6 EAP Key Generation

EAP-EKE can be used for EAP key generation, as defined by [RFC 5247].
When used in this manner, the values required to establish the key
hierarchy are defined as follows:

- Peer-Id is the EAP-EKE ID_P value.
- Server-Id is the EAP-EKE ID_S value.
- Session-Id is the concatenated Type | Nonce_P | Nonce_S, where Type is
  the method type defined for EAP-EKE in [Sec. 4.1], a single octet.

Thanks,
	Yaron

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 11:58:45 +03:00
Jouni Malinen
5748d1e5f8 tests: EAP-TTLS with server certificate valid beyond UNIX time 2^31
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 11:24:35 +03:00
Jouni Malinen
768ea0bc32 tests: DH params with 2048-bit key
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 11:03:42 +03:00
Jouni Malinen
7f2f3a67d2 Increase DH key size in the hostapd.conf example
OpenSSL is moving to use 2048-bit DH key size as the default with
dhparam. Increase the value in the hostapd.conf to match that to reduce
likelihood of ending up using a shorter key.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 10:47:21 +03:00
Jouni Malinen
75e41ab78a tests: Automatic channel selection with chanlist set
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 10:43:44 +03:00
Srinivasa Duvvuri
567098ec74 ACS: Scan only channels specified in the channel list
The ACS code part of hostapd scans all the channels even if the channel
list is specified in the hostapd.conf. Limit the ACS scan channels to
the list specified in the config file.

Signed-off-by: Srinivasa Duvvuri<sduvvuri@chromium.org>
2015-05-24 10:38:27 +03:00
Jouni Malinen
c7dafdf9b0 WPS: Fix build without CONFIG_WPS=y
Commit 5add410162 ('WPS: Use shorter
authentication timeout during no-SelReg iteration') broke the build with
WPS disabled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-24 10:33:26 +03:00
Jouni Malinen
38ad1ea317 tests: Fix persistent_group_per_sta_psk for P2P Device case
The dev[1] <--> dev[2] data connectivity test was using incorrect
function. dev[2] is also using a P2P group and as such, can have a
different group interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-08 18:33:20 +03:00
Jouni Malinen
36e6633415 tests: Fix go_neg_with_bss_connected with P2P Device
Group interface name was fetched from the results of an incorrect group
formation and because of this, group removal failed in case P2P Device
is used and dev[1] ends up getting different group ifname for the
groups.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-08 18:33:16 +03:00
Jouni Malinen
f033200e94 tests: Add P2P Device support for persistent_group
The network operations need to use the global control interface to be
performed on the interface that stores the network profiles for
persistent groups.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-08 18:33:11 +03:00
Ben Rosenfeld
622ef15b77 tests: Update group_ifname after group start
After P2P-GROUP-STARTED event, use group_form_result in order to update
the group_ifname for the device. This is needed when using P2P Device
for managing P2P operations which results in a separate group interface
being used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:32:34 +03:00
Ben Rosenfeld
6f27f79084 tests: Use list_networks with p2p=true in test_p2p_channel
In case that there is a need to list the persistent P2P networks,
the global control interface needs to be used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:31:05 +03:00
Ben Rosenfeld
9766d403a6 tests: Change persistent_go_client_list to use global interface
Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:30:45 +03:00
Ben Rosenfeld
85ef1f4345 tests: Use global interface in persistent_group_invite_removed_client
When removing a persistent P2P group, global interface needs to be used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:29:29 +03:00
Ben Rosenfeld
8e751cfa05 tests: Change list_networks() to use global interface with P2P
list_networks() always used the wlanX control interface to query for the
current list of networks. However, when a dedicated P2P Device is used,
the global control interface should be used when checking persistent
group network profiles.

Fix this by adding an optional parameter indicating that the P2P
networks are requested, and in such a case use the global control
interface.

In addition update test_p2p_persistent to use the argument when needed.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:29:03 +03:00
Ben Rosenfeld
d7e2d79b1a tests: Change persistent_group_per_sta_psk to use global interface
This is required for cases that a dedicated P2P Device interface
is used and then the event will happen on the global interface.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:27:25 +03:00
Ben Rosenfeld
cbeab59c9f tests: Change test_p2p_persistent to use the global control interface
Send request to set persistent_reconnect on the global control
interface so it would also work when using a dedicated P2P Device
interface.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-08 18:27:04 +03:00
Ben Rosenfeld
cf5d768b33 tests: Change p2p_device_nfc_invite to use global interface
When testing P2P invitation flow, setting the NFC selector
should be done using the global control interface.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:35:29 +03:00
Ben Rosenfeld
cc259e2650 tests: Change p2p_device_misuses() to use group interface
Calling "DISASSOCIATE" should be done on the group interface.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:30:40 +03:00
Ilan Peer
6420643d45 tests: Skip some tests in P2PS when a dedicated P2P Device is used
Some tests in test_p2ps.py test a scenario where a separate P2P
group interface is not used. However, this is not a valid case
when a dedicated P2P Device interface is used, as in such a case
a separate group interface must be used.

Handle this by skipping such tests in case a dedicated P2P Device is
used.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-05-07 21:19:38 +03:00
Ilan Peer
5cef80647e tests: Fix test_p2ps.py to save group results
Call group_form_result() whenever a new group is started, so that
group_ifname gets updated and later, the group can be removed when
needed.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-05-07 21:17:31 +03:00
Ben Rosenfeld
09f60224a5 tests: Remove all P2P networks in call to reset
When resetting a device, remove all the P2P networks to prevent
unexpected behavior in following tests. This is needed for the case
where P2P Device interface is used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:14:31 +03:00
Ben Rosenfeld
6f96fdaefb tests: Change test_p2p_messages to use global interface
This is required for cases where P2P Device is used and the event
happens on the global interface.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:11:03 +03:00
Ben Rosenfeld
eb1d68eff0 tests: Change set_country() to use the global interface to get event
This is required for cases that multiple interfaces are used and the
event can happen on any of them, for example when a dedicated P2P Device
interface is used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:09:29 +03:00
Ben Rosenfeld
91d3483273 tests: Change p2p_set_ssid_postfix to use the group interface for SSID
This is required for cases where thea P2P Device interface is used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:07:20 +03:00
Ben Rosenfeld
3d5b1a6452 tests: Fix test_ap_pmf to use own_addr
The tests used p2p_dev_addr that can be different from own_addr,
if a dedicated P2P Device interface is used.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2015-05-07 21:02:37 +03:00
Ilan Peer
9b05135aa4 P2P: Fix association with an AP/P2P GO that is not a P2P manager
Do not add a P2P IE when a station interface is trying to associate
to an AP or P2P GO that publishes a P2P IE but does not include
a P2P manageability attribute.

This addresses an interoperability issue that was reported in
https://bugzilla.kernel.org/show_bug.cgi?id=96471, where a P2P GO
rejects association from a station interface without a specified
reason.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-05-07 21:00:22 +03:00
Matthias May
8884ce03bc hostapd: check validity of cwMin/cwMax values
Signed-off-by: Matthias May <matthias.may@neratec.com>
2015-05-07 20:57:32 +03:00
Michael Braun
9649b5342d vlan: Print libnl error message on vlan_add / vlan_del
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2015-05-07 20:54:26 +03:00
Sunil Dutt
279724d835 Add QCA vendor subcmd for Link Property Query
Link Property query vendor command shall facilitate the information
of the Wi-Fi link. MAC address of the Wi-Fi peer is given as an input
for querying the link properties.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-05-07 18:53:23 +03:00
Jouni Malinen
58606fd987 EAP-pwd server: Make sure in_frag_pos is cleared to zero on allocation
The cleanup code will handle this, but it is more robust to make sure
this is cleared to zero when allocating a new buffer.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
6aa5d95dab EAP-pwd peer: Make sure in_frag_pos is cleared to zero on allocation
The cleanup code will handle this, but it is more robust to make sure
this is cleared to zero when allocating a new buffer.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
28a069a545 EAP-pwd peer: Fix asymmetric fragmentation behavior
The L (Length) and M (More) flags needs to be cleared before deciding
whether the locally generated response requires fragmentation. This
fixes an issue where these flags from the server could have been invalid
for the following message. In some cases, this could have resulted in
triggering the wpabuf security check that would terminate the process
due to invalid buffer allocation.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
3035cc2894 EAP-pwd server: Fix Total-Length parsing for fragment reassembly
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.

In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
477c74395a EAP-pwd peer: Fix Total-Length parsing for fragment reassembly
The remaining number of bytes in the message could be smaller than the
Total-Length field size, so the length needs to be explicitly checked
prior to reading the field and decrementing the len variable. This could
have resulted in the remaining length becoming negative and interpreted
as a huge positive integer.

In addition, check that there is no already started fragment in progress
before allocating a new buffer for reassembling fragments. This avoid a
potential memory leak when processing invalid message.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
e28a58be26 EAP-pwd server: Fix payload length validation for Commit and Confirm
The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.

Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
dd2f043c9c EAP-pwd peer: Fix payload length validation for Commit and Confirm
The length of the received Commit and Confirm message payloads was not
checked before reading them. This could result in a buffer read
overflow when processing an invalid message.

Fix this by verifying that the payload is of expected length before
processing it. In addition, enforce correct state transition sequence to
make sure there is no unexpected behavior if receiving a Commit/Confirm
message before the previous exchanges have been completed.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
f79a5fa006 tests: Add a STA entry for ap-mgmt-fuzzer
This increases the coverage for AP mode management frame fuzzing by
allowing number of additional Action frame code paths to be executed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
6838452db8 tests: Invalid WMM Action frame
This is a regression test case for a AP mode WMM Action frame parsing
issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
ef566a4d4f AP WMM: Fix integer underflow in WMM Action frame parser
The length of the WMM Action frame was not properly validated and the
length of the information elements (int left) could end up being
negative. This would result in reading significantly past the stack
buffer while parsing the IEs in ieee802_11_parse_elems() and while doing
so, resulting in segmentation fault.

This can result in an invalid frame being used for a denial of service
attack (hostapd process killed) against an AP with a driver that uses
hostapd for management frame processing (e.g., all mac80211-based
drivers).

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
b204753115 tests: WPS HTTP protocol tests
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
8640cf7f8f WPS: Add more debug prints to httpread
These can be helpful when debugging HTTP error cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
1bd0d578a9 WPS: Replace the httpread_debug design with standard debug prints
The debug information from httpread can be helpful in figuring out error
cases in general and as such, should be enabled by default. Get rid of
the hardcoded httpread_debug value that would require source code
changes to enable.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
7da4f4b499 WPS: Check maximum HTTP body length earlier in the process
There is no need to continue processing a HTTP body when it becomes
clear that the end result would be over the maximum length.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
af185d0b57 WPS: Extra validation step for HTTP reader
Verify that ncopy parameter to memcpy is not negative. While this is not
supposed to be needed, it is a good additional protection against
unknown implementation issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Jouni Malinen
5acd23f458 WPS: Fix HTTP chunked transfer encoding parser
strtoul() return value may end up overflowing the int h->chunk_size and
resulting in a negative value to be stored as the chunk_size. This could
result in the following memcpy operation using a very large length
argument which would result in a buffer overflow and segmentation fault.

This could have been used to cause a denial service by any device that
has been authorized for network access (either wireless or wired). This
would affect both the WPS UPnP functionality in a WPS AP (hostapd with
upnp_iface parameter set in the configuration) and WPS ER
(wpa_supplicant with WPS_ER_START control interface command used).

Validate the parsed chunk length value to avoid this. In addition to
rejecting negative values, we can also reject chunk size that would be
larger than the maximum configured body length.

Thanks to Kostya Kortchinsky of Google security team for discovering and
reporting this issue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-05-03 18:26:50 +03:00
Avraham Stern
a5da657445 dbus: Stop ongoing scheduled scan when scan is requested
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-05-03 17:34:54 +03:00