Do not try to determine the length of the T&C Server URL before checking
that the URL is available. This got broken in a change to move the
handling to the AS. hostapd could potentially have hit a NULL pointer
dereference if the authentication server sent an unconsistent set of T&C
information.
Fixes: d4e39c51f8 ("HS 2.0: Move Terms and Conditions Server URL generation from AP to AS")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Earlier, the OCE flags were checked during hostapd initialization. This
doesn't address few cases like for example when the interface is added
from control interface. Move the OCE flag checks to the functions that
are forming the MBO/OCE IEs to cover all the different paths for
enabling a BSS. Also use macros as appropriate for readability.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
hs20-osu-client refused to do anything if it could not find devinfo.xml
from the current working directory. This is a bit excessive since that
file was used in init_ctx() only to fill in ctx->devid which is used
when constructing OMA DM messages.
Move the check for ctx->devid into OMA DM specific code so that other
hs20-osu-client functionality can be used without the devinfo.xml file.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add support for negotiating WNM Collocated Interference Reporting. This
allows hostapd to request associated STAs to report their collocated
interference information and wpa_supplicant to process such request and
reporting. The actual values (Collocated Interference Report Elements)
are out of scope of hostapd and wpa_supplicant, i.e., external
components are expected to generated and process these.
For hostapd/AP, this mechanism is enabled by setting
coloc_intf_reporting=1 in configuration. STAs are requested to perform
reporting with "COLOC_INTF_REQ <addr> <Automatic Report Enabled> <Report
Timeout>" control interface command. The received reports are indicated
as control interface events "COLOC-INTF-REPORT <addr> <dialog token>
<hexdump of report elements>".
For wpa_supplicant/STA, this mechanism is enabled by setting
coloc_intf_reporting=1 in configuration and setting Collocated
Interference Report Elements as a hexdump with "SET coloc_intf_elems
<hexdump>" control interface command. The hexdump can contain one or
more Collocated Interference Report Elements (each including the
information element header). For additional testing purposes, received
requests are reported with "COLOC-INTF-REQ <dialog token> <automatic
report enabled> <report timeout>" control interface events and
unsolicited reports can be sent with "COLOC_INTF_REPORT <hexdump>".
This commit adds support for reporting changes in the collocated
interference (Automatic Report Enabled == 1 and partial 3), but not for
periodic reports (2 and other part of 3).
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
If driver supports self-managed regulatory domain, read reg-domain
information for that specific wiphy interface instead the global
information which may be different which such drivers. This fixes issues
where a regulatory update with a self-managed regulatory domain driver
ended up building incorrect list of supported channels for upper layer
hostapd/wpa_supplicant operations.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add a flag indicating if the device has the self-managed regulatory
support. Set the flag if NL80211_ATTR_WIPHY_SELF_MANAGED_REG attribute
is set when reading wiphy info.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
On Linux this flag will make sure that no file descriptor is
accidentally leaked into potential child processes. While this is not a
problem right now, it is considered to be good practice these days when
dealing with file descriptors on Linux.
Signed-off-by: Karol Babioch <karol@babioch.de>
Previously the file permissions for the debug log file were not
explicitly set. Instead it was implicitly relying on a secure umask,
which in most cases would result in a file that is world-readable. This
is a violation of good practices, since not every user should have
access to sensitive information that might be contained in the debug log
file.
Explicitly set sane default file permissions in case the file is newly
created.
Unfortunately the fopen(3) function does not provide such a facility, so
the approach needs to be changed in the following way:
1) The file descriptor needs to be created manually using the open(3)
function with the correct flags and the desired mode set.
2) fdopen(3) can then be used on the file descriptor to associate a file
stream with it.
Note: This modification will not change the file permissions of any
already existing debug log files, and only applies to newly created
ones.
Signed-off-by: Karol Babioch <karol@babioch.de>
P2P related configuration should be done on a global control interface.
This way this test can be reused also when a dedicated P2P device
interface is used.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
In case the protocol used for the BSS is WPA, the WPA vendor IE should
be placed after all the non vendor IEs. Fix this for Beacon and Probe
Response frames.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
In case that the protocol used for association is WPA the WPA IE was
inserted before other (non vendor specific) IEs. This is not in
accordance to the standard that states that vendor IEs should be placed
after all the non vendor IEs are placed. In addition, this would cause
the low layers to fail to properly order information elements.
To fix this, if the protocol used is WPA, store the WPA IE and reinsert
it after all the non vendor specific IEs were placed.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Previously, when an AP interface was disabled through a control
interface DISABLE command during a channel switch window, the interface
could not be reenabled due to beacon setup failure (which validates if
CSA is in progress).
Fix this by clearing channel switch parameters while disabling the
hostapd interface.
Signed-off-by: Sriram R <srirrama@codeaurora.org>
Add NAN NDP attribute QCA_WLAN_VENDOR_ATTR_PEER_NDPE_SUPPORT which
indicates if NDP remote peer supports NDPE attribute or not.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This makes it a bit easier to use existing hardcoded PPS MO files for
testing purposes when the subscription remediation and policy update
operations target the same path.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This node was modified long time ago to include "SPP-" prefix. Fix the
OSU server implementation to use the correct value.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Extend test=<value> special incorrect behavior testing capabilities in
the OSU server to include the fingerprint of the policy update trust
root: test=corrupt_polupd_hash.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Add a mechanism to allow special incorrect behavior to be requested from
OSU server by adding an optional parameter test=<value> to the initial
signup URL. This is for protocol testing purposes for the OSU client.
This commit adds two special behavior cases: corrupt_aaa_hash and
corrupt_subrem_hash. These can be used to generate PPS MO with invalid
CertSHA256Fingerprint values for AAAServerTrustRoot and
SubscriptionUpdate nodes.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Previously, this was done only for the subscription remediation/update
trust root. The other downloaded files were also verified, but the OSU
server was not notified if the files were found to be invalid.
Modify hs20-osu-client behavior to explicitly notify the OSU server if
any of the three trust root types cannot be successfully downloaded.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
It looks like tshark parser was broken at some point for
wlan.mesh.config.cap which is now (tshark 2.6.3) pointing to incorrect
field (same as wlan.mesh.config.ps_protocol). This used to work with
tshark 2.2.6.
For now, assume the capability field ends up being the last octet of the
frame.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
It looks like at least tshark 2.6.3 uses a different error message for
unknown display filter fields:
tshark: Neither "wlan_mgt.fixed.category_code" nor "4" are field or protocol names.
and a different status exit code (2 instead of 1).
Add a new handler for this combination to allow automatic wlan_mgt to
wlan conversion to happen.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is something useful to know and also eliminates format truncation
warnings.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
This test starts two identical APs and assumes a connection to the first
one, though it is not necessary true. Fix that by starting the second AP
only after the connection is established.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
This test case had an error that hit an unexpected disconnection. Add an
explicit check to verify that this does not happen anymore.
Signed-off-by: Jouni Malinen <j@w1.fi>
The channel configuration in CHAN_SWITCH command was incorrect. This
resulted in switching to HT40+ channel, while announcing HT40- in the
secondary channel IE. This caused a disconnection after the channel
switch. Fix that.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
hash variable is allocated memory using eap_pwd_h_init(), but there are
couple of error case code paths which skips deallocation of hash. The
memory of hash is deallocated using eap_pwd_h_final(). Fix this by
calling eap_pwd_h_final() at the end of the function if execution got
there through one of those error cases.
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
When moving a 5 GHz VHT AP to 2.4 GHz band with VHT disabled through the
hostapd control interface DISABLE/reconfig/ENABLE commands, enabling of
the AP on 2.4 GHz failed due to the previously configured VHT capability
being compared with hardware VHT capability on 2.4 GHz band:
hw vht capab: 0x0, conf vht capab: 0x33800132
Configured VHT capability [VHT_CAP_MAX_MPDU_LENGTH_MASK] exceeds max value supported by the driver (2 > 0)
ap: interface state DISABLED->DISABLED
Since VHT (ieee80211ac) config is already disabled for the 2.4 GHz band,
add fix this by validating vht_capab only when VHT is enabled.
Fixes: c781eb8428 ("hostapd: Verify VHT capabilities are supported by driver")
Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
Verify that PMF does not end up reporting unexpected status code 30
(temporary rejection; SA Query).
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Previous implementation ended up triggering PMF check for previous
association and SA Query procedure incorrectly in cases where there is a
STA entry in hostapd, but that STA is not in associated state. This
resulted in undesired temporary rejection of the association with status
code 30.
This ended up breaking OWE group negotiation when PMF is in use since
the check for the OWE group would have happened only after this earlier
PMF check and rejection (i.e., the station got status code 30 instead of
the expected 77).
For example, when the AP is configured with OWE group 21 and a station
tries groups 19, 20, and 21 (in this sequence), the first two
Association Request frames should be rejected with status code 77.
However, only the first one got that status code while the second one
got status code 30 due to that issue with PMF existing association
check.
Furthermore, hostapd was continuing with SA Query procedure with
unencrypted Action frames in this type of case even though there was no
existing association (and obviously, not an encryption key either).
Fix this by checking that the STA entry is in associated state before
initiating SA Query procedure based on the PMF rules.
Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
When configuring more than 36 roaming consortiums with SET_CRED, the
stack is smashed. Fix that by correctly verifying the
num_roaming_consortiums.
Fixes: 909a948b ("HS 2.0: Add a new cred block parameter roaming_consortiums")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Without this patch sae_require_mfp is always activate, when ieee80211w
is set to optional all stations negotiating SAEs are being rejected when
they do not support PMF. With this patch hostapd only rejects these
stations in case sae_require_mfp is set to some value and not null.
Fixes ba3d435fe4 ("SAE: Add option to require MFP for SAE associations")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This message was printed and MSG_INFO level which would be more
reasonable for error cases where hostapd has accepted authentication.
However, this is not really an error case for the cases where
authentication was rejected (e.g., due to MAC ACL). Drop this to use
MSG_DEBUG level.
Signed-off-by: Jouni Malinen <j@w1.fi>
When Probe Request frame handling was extended to use MAC ACL through
ieee802_11_allowed_address(), the MSG_INFO level log print ("Station
<addr> not allowed to authenticate") from that function ended up getting
printed even for Probe Request frames. That was not by design and it can
result in excessive logging and MSG_INFO level if MAC ACL is used.
Fix this by printing this log entry only for authentication and
association frames. In addition, drop the priority of that log entry to
MSG_DEBUG since this is not really an unexpected behavior in most MAC
ACL use cases.
Fixes: 92eb00aec2 ("Extend ACL check for Probe Request frames")
Signed-off-by: Jouni Malinen <j@w1.fi>
An OWE AP device that supports transition mode does not transmit the
SSID of the OWE AP in its Beacon frames and in addition the OWE AP does
not reply to broadcast Probe Request frames. Thus, the scan results
matching relies only on Beacon frames from the OWE open AP which can be
missed in case the AP's frequency is actively scanned.
To improve the discovery of transition mode APs, include their SSID in
the scan command to perform an active scan for the SSIDs learned from
the open mode BSSs.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Start scans more quickly if an open BSS advertising OWE transition mode
is found, but the matching OWE BSS has not yet been seen.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit introduces a threshold for OWE transition BSS selection,
which signifies the maximum number of selection attempts (scans) done
for finding OWE BSS.
This aims to do more scan attempts for OWE BSS and eventually select the
open BSS if the selection/scan attempts for OWE BSS exceed the
configured threshold.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
With new restriction in Android, if PATH env variable doesn't have
correct path of 'am' binary, execv() fails to launch wpadebug browser
(am starts, but something seems to fail within its internal processing).
This commit is a workaround to use execve() with custom environment PATH
which includes "/system/bin;/vendor/bin" to handle the cases where
hs20-osu-client fails to launch wpadebug browser through /system/bin/am.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
