Commit graph

2554 commits

Author SHA1 Message Date
Jouni Malinen
55046414b1 FT: Copy MDIE and FTIE from (Re)Association Response into EAPOL-Key 2/4
IEEE Std 802.11r-2008 requires that the message 2 includes FTIE and
MDIE from the AP's (Re)Association Response frame in the Key Data
field.
2010-04-10 16:48:40 +03:00
Jouni Malinen
d3ccead325 Make wpa_compare_rsn_ie() handle missing IEs 2010-04-10 16:47:29 +03:00
Jouni Malinen
1566ec4685 Parse EAPOL-Key msg 2/4 Key Data IEs/KDEs before checking RSN/WPA IE
This is needed to avoid incorrect validation errors on RSN/WPA IE
when using FT since there may be more than a single IE in the
Key Data field.
2010-04-10 16:46:17 +03:00
Jouni Malinen
e7846b6859 FT: Clean up wpa_sm_set_ft_params() by using common parse
Instead of parsing the IEs in the callers, use the already existing
parser in wpa_ft.c to handle MDIE and FTIE from initial MD association
response. In addition, this provides more complete access to association
response IEs to FT code which will be needed to fix FT 4-way handshake
message 2/4.
2010-04-10 11:36:35 +03:00
Jouni Malinen
0ae145cde8 FT: Validate FTIE fields in Reassociation Request
ANonce, SNonce, R0KH-ID, and R1KH-ID must match with the values
used in the previous FT authentication sequence message per
IEEE Std 802.11r-2008, 11A.8.4.
2010-04-09 17:14:27 +03:00
Jouni Malinen
8aaf894de2 FT: Validate protect IE count in FTIE MIC Control 2010-04-09 17:08:16 +03:00
Jouni Malinen
148fb67d5e FT: Validate SNonce and ANonce values during FT Protocol in supplicant 2010-04-09 17:02:13 +03:00
Jouni Malinen
579ce77122 FT: Deauthenticate in case of Reassoc Response validation error
If validation of the Reassociation Response frame fails during FT
Protocol, do not allow association to be completed; instead, force
deauthentication.
2010-04-09 16:59:27 +03:00
Jouni Malinen
f4ec630d1b FT: Set FT Capability and Policy properly in MDIE during initial MD assoc
This field needs to be copied from the scan results for the AP
per IEEE Std 802.11r-2008, 11A.4.2.
2010-04-09 16:41:57 +03:00
Jouni Malinen
76b7981d07 FT: Copy FT Capability and Policy to MDIE from target AP
This sets the FT Capability and Policy field in the MDIE to the values
received from the target AP (if available). This fixes the MDIE contents
during FT Protocol, but the correct value may not yet be used in initial
mobility domain association.
2010-04-09 16:26:20 +03:00
Jouni Malinen
3db6531436 FT: Add R1KH-ID into FT auth seq 3rd message (Reassoc Req)
This is a mandatory subelement per IEEE Std 802.11r-2008, 11A.8.4.
2010-04-09 16:08:50 +03:00
Jouni Malinen
6e80516ab9 FT: Fix Reassociation Response in FT Protocol to include ANonce/SNonce
These values are required to be included in the frame per
IEEE Std 802.11r-2008, 11A.8.5.
2010-04-09 13:36:06 +03:00
Jouni Malinen
1f6e69e07b FT: Do not add MIC to FTIE during initial MD association
We do not have any keys set at this point so there is no point in
adding the MIC. In addition, IEEE Std 802.11r-2008, 11A.4.2
describes this frame to have MIC IE count of 0 and MIC of 0.
2010-04-09 13:30:49 +03:00
Jouni Malinen
6de513fcd3 Fix compiler warning on non-802.11r build 2010-04-08 12:25:19 +03:00
Jouni Malinen
7733991281 nl80211: Start using NL80211_ATTR_LOCAL_STATE_CHANGE
This removes transmission of some unnecessary Deauthentication
frames in cases where we only need to clear the local state. In
addition, this resolves issues for 802.11r FT-over-DS by allowing
authentication state to be set locally even when no actual
Authentication frame is to be transmitted.
2010-04-08 11:31:37 +03:00
Jouni Malinen
27cf8871ad Sync with wireless-testing.git include/linux/nl80211.h
This adds NL80211_ATTR_LOCAL_STATE_CHANGE.
2010-04-08 11:29:54 +03:00
Jouni Malinen
39eb4d0877 FT: Fix GTK subelement format in FTIE
The Key Info field was changed from 1-octet field to 2-octet field
in 802.11r/D7.0, but that had not been updated in the implementation.
2010-04-07 23:57:39 +03:00
Jouni Malinen
26e23750b9 FT: Fix FT 4-Way Handshake to include PMKR1Name in messages 2 and 3
IEEE Std 802.11r-2008, 11A.4.2 describes FT initial mobility domain
association in an RSN to include PMKR1Name in the PMKID-List field
in RSN IE in messages 2/4 and 3/4. This makes the RSN IE not be
bitwise identical with the values used in Beacon, Probe Response,
(Re)association Request frames.

The previous versions of wpa_supplicant and hostapd did not add the
PMKR1Name value in EAPOL-Key frame and did not accept it if added
(due to bitwise comparison of RSN IEs). This commit fixes the
implementation to be compliant with the standard by adding the
PMKR1Name value into EAPOL-Key messages during FT 4-Way Handshake and
by verifying that the received value matches with the value derived
locally.

This breaks interoperability with previous wpa_supplicant/hostapd
versions.
2010-04-07 21:04:13 +03:00
Jouni Malinen
738a1cb286 FT: Do not include RSN IE in (Re)Assoc Resp during initial MD association
RSN IE is only supposed to be included in Reassociation Response frames
and only when they are part of a fast BSS transition.
2010-04-07 17:27:46 +03:00
Jouni Malinen
b242d398f8 Use more os.h wrapper functions in hostapd_cli 2010-04-07 11:40:34 +03:00
Gregory Detal
bae9217474 Add support for action scripts in hostapd_cli 2010-04-07 11:14:54 +03:00
Gregory Detal
bb437f282b AP: Add wpa_msg() events for EAP server state machine 2010-04-07 11:13:14 +03:00
Jouni Malinen
d9a27b0455 Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq
When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp
module was not informed of the WPA/RSN IE that was used in
(Re)Association Request frame. This broke roaming between APs that
use different security policy (e.g., changing between WPA/TKIP and
WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 10:31:06 +03:00
Jouni Malinen
68532a9ceb Avoid hostapd segfault on invalid driver association event
Running hostapd and wpa_supplicant on the same interface at the same
time is not expected to work, but it should not cause hostapd to crash.
Ignore station mode association events (no addr field) to avoid this.
2010-04-07 10:01:49 +03:00
Andriy Tkachuk
99f4ae67b7 Fix WPA/RSN IE update on reconfig with set_generic_elem()
IF WPA/RSN parameters were changed or WPA/RSN was disabled, the
WPA/RSN IE in Beacon/Probe Response frames was only update with
set_beacon(). We need to do this with set_generic_elem(), too, to
work with all driver wrappers.
2010-04-06 20:44:26 +03:00
Jouni Malinen
643743e215 WPS: Fix WPS IE update in Beacon frames for nl80211
Call ieee802_11_set_beacon() in addition to set_ap_wps_ie() when
processing WPS IE updates. This is needed with drivers that use
set_beacon() instead of set_ap_wps_ie() (i.e., nl80211).
2010-04-06 18:04:30 +03:00
Michael Buesch
2c657c8dcd hostapd: Use cp -f in make install
If hostapd is running, a make install fails with
cp: cannot create regular file `/usr/local/bin/hostapd': Text file busy

Use cp -f to avoid this error and force-override the file.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
2010-04-06 17:12:17 +03:00
Jouni Malinen
2c59362905 WPS: Add a workaround for incorrect NewWLANEventMAC format
Some ER implementation (e.g., some versions of Intel PROSet) seem to
use incorrect format for WLANEventMAC variable in PutWLANResponse.
Work around this by allowing various MAC address formats to be used
in this variable (debug message will be shown if the colon-deliminated
format specified in WFA WLANConfig 1.0 is not used).
2010-04-06 10:38:37 +03:00
Jouni Malinen
448a0a19d7 Add a more flexible version of hwaddr_aton: hwaddr_aton2()
This version of the MAC address parser allows number of different
string formats for the address (e.g., 00:11:22:33:44:55, 0011.2233.4455,
001122334455, 00-11-22-33-44-55). It returns the number of characters
used from the input string in case of success.
2010-04-06 10:37:13 +03:00
Jouni Malinen
81a658d754 FT: Re-set PTK on reassociation
It turns out that this is needed for both FT-over-DS and FT-over-air
when using mac80211, so it looks easiest to just unconditionally
re-configure the keys after reassociation when FT is used.
2010-04-04 09:34:14 +03:00
Jouni Malinen
2220821113 FT: Use bridge interface (if set) for RRB connection
This fixes receiving of RRB messages between FT APs
2010-04-04 09:31:13 +03:00
Jouni Malinen
21c9b6903e FT: Set WLAN_AUTH_FT auth_alg on FT-over-DS case
This is needed to allow reassociation processing to skip 4-way handshake
when FT-over-DS is used with an AP that has a previous association state
with the STA.
2010-04-04 09:17:57 +03:00
Jouni Malinen
d8ad6cb966 FT: Force key configuration after association in FT-over-DS
This seems to be needed at least with mac80211 when a STA is using
FT-over-DS to reassociate back to the AP when the AP still has the
previous association state.
2010-04-04 09:16:11 +03:00
Jouni Malinen
9a3cb18d74 Add AP-STA-DISCONNECT event for driver-based MLME 2010-04-04 08:14:22 +03:00
Jouni Malinen
c41a1095b5 Allow hostapd_notif_assoc() to be called with all IEs
This makes the call simpler for driver wrappers since there is no need
to parse the IEs anymore before indicating association. In addition,
this allows association processing to be extended to use other IEs
in the future.
2010-04-04 08:14:18 +03:00
Jouni Malinen
0823031750 Fix Windows compilation issues with AP mode code 2010-04-04 08:14:14 +03:00
Jouni Malinen
ade07077ec Add address to hostapd_logger output in wpa_supplicant as AP case 2010-04-04 08:14:09 +03:00
Jouni Malinen
93368ca4a2 WPS: Do not include Label in default Config Methods
This avoids conflict with both Label and Display being included at
the same time (which would make it difficult to figure out which
PIN was actually used).
2010-04-04 08:14:02 +03:00
Jouni Malinen
11356a2ab5 WPS: Fix PBC session overlap detection to use Device Password Id
Active PBC mode is indicated by Device Password Id == 4, not Config Methods
attribute.
2010-04-04 08:13:59 +03:00
Jouni Malinen
f8130b07bb driver_osx: Update set_key arguments to fix build 2010-04-04 08:13:46 +03:00
Jouni Malinen
7b1080dadd MFP: Fix IGTK PN in group rekeying
IGTK get_seqnum needs to be skipped in the same way as GTK one when
rekeying group keys. Previously, the old PN value (the one from the
previous key) was indicated and that resulted in MMIE replay detection
at the station.
2010-03-29 22:57:10 -07:00
Jouni Malinen
32d5295f9d Add a drop_sa command to allow 802.11w testing
This drops PTK and PMK without notifying the AP.
2010-03-29 15:42:04 -07:00
Jouni Malinen
358c3691cf MFP: Add SA Query Request processing in AP mode 2010-03-29 14:05:25 -07:00
Jouni Malinen
b91ab76e8c Add test commands for sending deauth/disassoc without dropping state
This can be used to test 802.11w by sending a protected or unprotected
deauth/disassoc frame.

hostapd_cli deauth <dst addr> test=<0/1>
hostapd_cli disassoc <dst addr> test=<0/1>

test=0: unprotected
test=1: protected
2010-03-29 12:01:40 -07:00
Jouni Malinen
90a3206a14 Add deauthenticate/disassociate ctrl_iface commands 2010-03-29 11:14:57 -07:00
Jouni Malinen
e820cf952f MFP: Add MFPR flag into station RSN IE if 802.11w is mandatory 2010-03-29 10:48:01 -07:00
Jouni Malinen
a042f8447d Fix ctrl_iface get-STA-MIB for WPS disabled case
The previous version would crash here on NULL pointer dereference if
WPS was disabled.
2010-03-29 09:59:16 -07:00
Jouni Malinen
e2f74005f5 bgscan: Add signal strength change events
This allows bgscan modules to use more information to decide on when
to perform background scans. bgscan_simple can now change between
short and long background scan intervals based on signal strength
and in addition, it can trigger immediate scans when the signal
strength is detected to be dropping.

bgscan_simple takes following parameters now:
short interval:signal strength threshold:long interval
For example:
	bgscan="simple:30:-45:300"
2010-03-28 15:32:34 -07:00
Jouni Malinen
b625473c6c Add driver command and event for signal strength monitoring 2010-03-28 15:31:04 -07:00
Jouni Malinen
93910401c9 nl80211: Parse CQM events 2010-03-28 13:56:40 -07:00