Commit graph

12480 commits

Author SHA1 Message Date
Beniamino Galvani
2b9891bd6e OpenSSL: Add build option to select default ciphers
Add a build option to select different default ciphers for OpenSSL
instead of the hardcoded default "DEFAULT:!EXP:!LOW".

This new option is useful on distributions where the security level
should be consistent for all applications, as in Fedora [1]. In such
cases the new configuration option would be set to "" or
"PROFILE=SYSTEM" to select the global crypto policy by default.

[1] https://fedoraproject.org/wiki/Changes/CryptoPolicy

Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
2017-07-17 11:55:22 +03:00
Ashwini Patil
65833d71a5 OCE: Add hostapd mode OCE capability indication if enabled
Add OCE IE in Beacon, Probe Response, and (Re)Association Response
frames if OCE is enabled in the configuration.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:27:00 +03:00
Ashwini Patil
332aadb8a2 STA: Add OCE capability indication attribute
Add OCE capability indication attribute in Probe Request and
(Re)Association Request frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:19:53 +03:00
Ashwini Patil
fb718f94d6 nl80211: Check if driver supports OCE specific features
Check if device supports OCE STA/STA-CFON/AP specific mandatory
features. This commit includes checking based on the QCA vendor
attributes.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:13:22 +03:00
vamsi krishna
46b15e470e Add vendor flags for OCE feature support indication
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:11:35 +03:00
Vidyullatha Kanchanapally
b377ec2585 FILS: Fix issuing FILS connect to a non-FILS AP in driver-FILS case
If an AP is not FILS capable and wpa_supplicant has a saved network
block for the network with FILS key management and a saved erp info,
wpa_supplicant might end up issuing a FILS connection to a non-FILS AP.
Fix this by looking for the presence of FILS AKMs in wpa_s->key_mgmt,
i.e., after deciding on the AKM suites to use for the current
connection.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:11:35 +03:00
Sunil Dutt
9f44f7f3b5 Introduce a vendor attribute to represent the PNO/EPNO Request ID
This request ID was wrongly referred from the REQUEST_ID in
enum qca_wlan_vendor_attr_gscan_config_params which is mapped to
QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM in PNO Config.
Hence define a different attribute to represent the request ID
for PNO Config.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-14 21:11:35 +03:00
Emmanuel Grumbach
881a92e8b8 FILS: Fix compilation with CONFIG_NO_WPA
wpa_fils_is_completed() was not defined.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
2017-07-08 16:21:38 +03:00
Jouni Malinen
c1361765fd tests: Additional EAP-TTLS error path
This is a regression test for a memory leak on an error path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-07-08 16:21:38 +03:00
Jouni Malinen
1f2ae8cff5 EAP-TTLS: Fix a memory leak on error paths
The allocated challenge needs to be freed on these error paths as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-07-08 16:21:38 +03:00
Ilan Peer
83e003a913 EAP-TTLS: Fix possible memory leak in eap_ttls_phase2_request_mschap()
The msg buffer needs to be freed on these two error paths.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-07-08 16:19:36 +03:00
Ilan Peer
422570eec8 MBO: Fix possible memory leak in anqp_send_req()
In case that an mbo object is allocated, but there is a failure
to resize the wpabuf, need to free the mbo object.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-07-08 16:14:03 +03:00
Jouni Malinen
e4e99927bf tests: Additional LEAP error path
This is a regression test for a memory leak on an error path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-07-08 16:14:03 +03:00
Ilan Peer
96e595a9f1 EAP-LEAP: Fix possible memory leak in eap_leap_process_request()
Free 'resp' object in case of a failure to derive the response.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-07-08 16:14:03 +03:00
Avraham Stern
23eead4d74 RRM: Filter scan results by parent TSF only if driver supports it
Scan results with parent TSF older than the scan start TSF are not added
to the beacon report since they are considered as scan results from
previous scans. However, for drivers that report the scan start TSF but
not the parent TSF of each scan result, the parent TSF will be zero so
valid scan results will be dropped.

Fix this by filtering scan results by the parent TSF only if the
driver supports reporting the parent TSF for each scan result.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2017-07-08 16:06:38 +03:00
Naftali Goldstein
3f8e3a5486 ap: Fix invalid HT40 channel pair fallback
In case of incorrect HT40 configuration as part of an attempt to create
a 80 MHz AP, iface->conf->vht_oper_centr_freq_seg0_idx and
iface->conf->vht_oper_centr_freq_seg1_idx are zero'ed, but
iface->conf->vht_oper_chwidth remains VHT_CHANWIDTH_80MHZ. This causes
the logic in dfs_get_start_chan_idx to fail.

Fix this by setting iface->conf->vht_oper_chwidth to
VHT_CHANWIDTH_USE_HT when zero'ing the center frequency parameters.

Signed-off-by: Naftali Goldstein <naftali.goldstein@intel.com>
2017-07-08 16:06:38 +03:00
Ilan Peer
6d3e24d3e3 ap: Fix return value in hostapd_drv_switch_channel()
The documentation in driver.h state that in case of an error
-1 is returned.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2017-07-08 16:06:38 +03:00
Adiel Aloni
0b6cbc4e64 tests: Use global control interface in test_p2p_channel.py
Previously p2p_channel_drv_pref_* tests would fail
if dedicated P2P device is used, since the SET commands
were sent to incorrect interface.
Fix this by using a global control interface instead.

Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
2017-07-08 16:06:38 +03:00
Andrei Otcheretianski
d02e4c8ac8 P2P: Clear get_pref_freq_list_override on P2P Device
Clear the get_pref_freq_list_override in p2p_ctrl_flush(). This fixes
the case when a dedicated P2P device interface is used.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2017-07-08 16:06:28 +03:00
Johannes Berg
100d334f43 tests: Print higher debug level on console
We capture the dmesg that contains everything, but if a test
causes a kernel crash we will miss all logging at higher levels
like debug. Change the printk level to catch all of that too.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-07-08 15:19:24 +03:00
Johannes Berg
a95d5fdbe1 tests: Catch various lockdep warnings
Lockdep no longer prints "INFO:" but now prints "WARNING:".
Also add the "*** DEADLOCK ***" string it usually prints so
if it changes again we can keep finding that string.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-07-08 15:18:40 +03:00
Andrei Otcheretianski
bfbc41eace DPP: Fix compilation without openssl
dpp.h file requires openssl in order to compile, which breaks
compilation on systems without it.
Move DPP_OUI_TYPE to ieee802_11_defs.h and don't include dpp.h when
not really needed.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2017-07-07 23:37:45 +03:00
Andrei Otcheretianski
4874f5bad3 tests: Skip dpp_pkex_config dpp_pkex_config2 tests correctly
When CONFIG_DPP is not defined these tests would fail. Skip them.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2017-07-07 23:37:13 +03:00
Sunil Dutt
cc6088463a P2P: Allow auto GO on DFS channels if driver supports this
If a DFS forced frequency is provided in 'p2p_group_add' and the driver
supports DFS offload, the frequency was rejected in
wpas_p2p_init_go_params(). However, it was accepted in
wpas_p2p_select_go_freq() and wpas_p2p_group_add(). To make the behavior
consistent, the DFS frequency is now accepted in
wpas_p2p_init_go_params() similar to the way done in
wpas_p2p_select_go_freq().

Redundant check in wpas_p2p_group_add() for DFS forced frequency is
removed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-07 13:49:01 +03:00
Vidyullatha Kanchanapally
fe3e0bac1f FILS: Advertize FILS capability based on driver capability
Add changes to control interface command get_capability to advertize
FILS capability, FILS AKMs suites, and FILS Authentication algorithms
based on the driver capabilities.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-07 13:39:05 +03:00
Jouni Malinen
5579c11c3e Fix a typo in vendor attribute documentation
The attribute is QCA_WLAN_VENDOR_ATTR_SAR_LIMITS_SAR_ENABLE, not
QCA_WLAN_VENDOR_ATTR_SAR_LIMITS_SELECT.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-07 13:26:45 +03:00
Jeffin Mammen
8b5ddda5fb FILS: Add HLP support with driver-based AP SME
This allows HLP processing to postpone association processing in
hostapd_notify_assoc().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-06 15:24:42 +03:00
Jeffin Mammen
31ec556cef FILS: Fix the IP header protocol field in HLP DHCP response
The IP header should indicate that UDP is used in the message.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-06 14:00:30 +03:00
Vidyullatha Kanchanapally
9d3eb21ec4 tests: FILS ERP authentication followed by PMKSA caching
This test case verifies that both wpa_supplicant and hostapd are adding
a PMKSA cache entry based on FILS shared key authentication using ERP.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 17:55:33 +03:00
Jouni Malinen
b3e567c890 FILS: ERP-based PMKSA cache addition on AP
hostapd did not add a new PMKSA cache entry when FILS shared key
authentication was used, i.e., only the initial full authentication
resulted in a PMKSA cache entry being created. Derive the PMKID for the
ERP case as well and add a PMKSA cache entry if the ERP exchange
succeeds.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 17:52:23 +03:00
Jouni Malinen
bfe448331f FILS: Fix a frame name in a debug print
The EAP message included in FILS Wrapped Data from the non-AP STA to the
AP is EAP-Initiate/Re-auth.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 17:29:44 +03:00
Jouni Malinen
6d49aeb762 MBO: Whitespace cleanup
Fix couple of previously missed whitespace issues.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 02:02:35 +03:00
Ashwini Patil
f2cdb41b81 OCE: Define OCE attributes and other related macros
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 02:02:35 +03:00
Jouni Malinen
1c13be83d3 tests: Scan for a specific BSSID
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 02:02:35 +03:00
Ashwini Patil
267fc0dd33 Add wpa_supplicant ctrl iface support to scan for a specific BSSID
Add support to scan for a specific BSSID through the wpa_supplicant
control interface.

Usage: wpa_cli scan bssid=ab:bc:cd🇩🇪ef:12

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-05 02:02:32 +03:00
Jouni Malinen
854d0de3d7 tests: DPP configurator signing own connector
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 17:49:29 +03:00
Jouni Malinen
f522bb2377 DPP: Add DPP_CONFIGURATOR_SIGN to generate own connector
The DPP Configurator can use this new command to generate its own signed
connector for the network that it manages.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 17:48:44 +03:00
Jouni Malinen
dc7fc09ccd DPP: Add control interface commands into hostapd_cli
These are copied from wpa_cli.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 15:56:43 +03:00
Jouni Malinen
97136c83e8 tests: DPP_BOOTSTRAP_INFO with hostapd
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 15:56:43 +03:00
Jouni Malinen
a86fb43ca3 DPP: DPP_BOOTSTRAP_INFO for hostapd
This extends the hostapd control interface to support the
DPP_BOOTSTRAP_INFO command that was recently added for wpa_supplicant.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 15:56:38 +03:00
Jouni Malinen
484788b875 DPP: Share bootstrap type to string helper function
This can be used in hostapd as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 15:45:03 +03:00
Jouni Malinen
623f95685d DPP: Allow wpa_cli DPP_CONFIGURATOR_ADD without arguments
All the arguments to this command are optional, so do not mandate at
least one to be included in wpa_cli.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-04 15:38:52 +03:00
Jouni Malinen
65fa9d96ae tests: Clear ignore_old_scan_res after sigma_dut test cases
sigma_dut can end up setting ignore_old_scan_res=1 and that can result
in some of the consecutive test cases failing. Fix this by explicitly
clearing ignore_old_scan_res after sigma_dut cases that may have ended
up setting the parameter.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 15:58:58 +03:00
Jouni Malinen
0f842044ee tests: key_mgmt values OWE and DPP
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 14:33:58 +03:00
Jouni Malinen
8885023252 Add new key_mgmt values for wpa_supplicant STATUS command
Recently added OWE and DPP were missing from the key_mgmt string list.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 14:33:16 +03:00
Jouni Malinen
1b3f536dbc tests: mgmt_group_cipher in STATUS
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 14:29:10 +03:00
Jouni Malinen
3a5954ef98 Add mgmt_group_cipher to wpa_supplicant STATUS command
This can be used to check which management group cipher is used in an
association that uses PMF.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 14:28:24 +03:00
Jouni Malinen
90f837b0bf Update default wpa_group_rekey to once-per-day when using CCMP/GCMP
The default value for GTK rekeying period was previously hardcoded to
600 seconds for all cases. Leave that short value only for TKIP as group
cipher while moving to the IEEE 802.11 default value of 86400 seconds
(once-per-day) for CCMP/GCMP.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 13:42:55 +03:00
Jouni Malinen
787615b381 DPP: Set PMKSA expiration based on peer connector
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 13:29:59 +03:00
Jouni Malinen
0651dfb76c tests: DPP configurator in hostapd
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-07-03 13:15:12 +03:00