Commit graph

8503 commits

Author SHA1 Message Date
Jouni Malinen
2dd4f3aede Fix STA re-bind to another VLAN on reauthentication
Previously, the old VLAN ID could have been deleted before the STA was
bound to the new VLAN in case the RADIUS server changed the VLAN ID
during an association. This did not exactly work well with mac80211, so
reorder the operations in a way that first binds the STA to the new VLAN
ID and only after that, removes the old VLAN interface if no STAs remain
in it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 01:09:51 +02:00
Jouni Malinen
4437f8fc77 Free old eap_user_file data on configuration change
This fixes a memory leak if hostapd eap_user_file parameter is modified.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 00:54:40 +02:00
Jouni Malinen
3b86e9d52c tests: PMKSA caching OOM error cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 00:14:57 +02:00
Jouni Malinen
915135e055 tests: hostapd OOM loop tests for WPA2-PSK and WPA2-EAP connection
These verify number of previously uncovered error paths.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:33:25 +02:00
Jouni Malinen
1180dd66a9 WPA auth: Disconnect STA if MSK cannot be fetched
Previously, it was possible for some corner cases to leave the WPA
authenticator state machine running if PMK could not be derived. Change
this to forcefully disconnect the STA to get more consistent behavior
and faster notification of the error.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:31:41 +02:00
Jouni Malinen
40aaa64f9f WPA auth: Clear temporary MSK storage from stack explicitly
This reduces the duration of time a key may remain unnecessarily in
memory.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:24:27 +02:00
Jouni Malinen
01b481aff3 Convert couple of remaining printf to wpa_printf in ap_list
This type of error reporting cases should use wpa_printf() to get
consistent debug logging behavior.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 21:12:51 +02:00
Jouni Malinen
cdebd24db6 tests: OLBC AP table error cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 21:11:41 +02:00
Jouni Malinen
496a7a6ff9 tests: hostapd OOM loop targeting RADIUS accounting
The hostapd_oom_wpa2_eap test case did not always catch these code
paths, so add a variant of that test case explicitly targeting RADIUS
functions.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 20:52:30 +02:00
Jouni Malinen
2c528e9690 tests: cfg80211 DEL_STATION issued externally to hostapd
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 16:26:31 +02:00
Jouni Malinen
4a4cd04cad tests: RADIUS MAC ACL and accounting enabled
This ends up using the special User-Name = STA MAC address case for
Accounting-Request. In addition, add Chargeable-User-Identity for one of
the STAs.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 15:55:48 +02:00
Jouni Malinen
ef318402f6 tests: EAP-MSCHAPv2 server out-of-memory cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 16:17:25 +02:00
Jouni Malinen
bfaefd5174 EAP-PEAP server: Fix Phase 2 TLV length in error case
The payload length in a Phase 2 TLV message reporting error was not set
correctly. Fix this to not include the TLVs that are included only in
success case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 16:15:58 +02:00
Jouni Malinen
95a15d793e tests: EAP-GTC server error cases
In addition, no-password-configured coverage extended to EAP-MD5 and
EAP-MSCHAPv2 as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 15:59:36 +02:00
Bob Copeland
745d93695b mesh: Create new station entry on popen frames
Currently, there is a race in open mesh networks where mesh STA A
receives a beacon from B and sends a peering open frame to initiate
peering. STA B, having not yet received a beacon from A and thus
created the corresponding station entry, will ignore all such open
frames. If the beacon interval is sufficiently long then peering
will not succeed as a result.

In fact B can simply create the station entry when the popen is
received, as is done in Linux's in-kernel MPM, avoiding the issue.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-28 13:09:31 +02:00
Bob Copeland
41bff862d9 mesh: Always free the station if peering failed
Previously, we would only free the station entry if a peering close
frame was received (freeing the station entry causes the kernel to
start sending peer candidate events again when suitable beacons are
received, triggering peering or authentication to restart).

The end result is the same in any case regardless of close reason:
if we leave holding state then peering has started again, so go
ahead and remove the station in all cases.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-28 13:09:31 +02:00
Masashi Honma
871ff0b746 mesh: Sync plink state with kernel
The plink_state exists both wpa_supplicant and kernel. Synchronize them
with wpa_mesh_set_plink_state().

Signed-off-by: Kenzoh Nishikawa <Kenzoh.Nishikawa@jp.sony.com>
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
467775c5ac tests: Pending EAP peer processing with VENDOR-TEST
This extends the VENDOR-TEST EAP method peer implementation to allow
pending processing case to be selected at run time. The
ap_wpa2_eap_vendor_test test case is similarly extended to include this
option as the second case for full coverage.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 13:09:31 +02:00
Jouni Malinen
ba4226130e Simplify eapol_sm_notify_pmkid_attempt()
Drop the unneeded 'attempt' argument. This was originally used for
indicating an aborted PMKID caching attempt, but a fix in 2006 removed
the only such user and since that time, only attempt == 1 has been used.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 13:09:31 +02:00
Jouni Malinen
a08fdb17aa tests: EAPOL supplicant invalid frame handling
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
48bb2e68c0 tests: STATUS-VERBOSE
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
993a865407 Add eap_session_id to wpa_supplicant STATUS output
This makes the current EAP Session-Id available for external programs.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
f19c907822 OpenSSL: Implement aes_wrap() and aes_unwrap()
This replaces the implementation in aes-wrap.c and aes-unwrap.c with
OpenSSL AES_wrap_key() and AES_unwrap_key() functions when building
hostapd or wpa_supplicant with OpenSSL.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
fee31f76cd OpenSSL: Remove support for versions older than 0.9.8
These have reached out-of-life status in the OpenSSL project and there
is no need to maintain support for them in hostapd/wpa_supplicant
either.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
8bf3030af6 OpenSSL: Use a common helper function for HMAC
There is no need to duplicate this construction for each hash algorithm.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
983c6a606b OpenSSL: Replace internal HMAC-MD5 implementation
Use OpenSSL HMAC_* functions to implement HMAC-MD5 instead of depending
on the src/crypto/md5.c implementation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
3f56a2b746 Ignore pmf=1 default if driver does not support PMF
Connection with a PMF enabled AP will fail if we try to negotiate PMF
while the local driver does not support this. Since pmf=1 does not
require PMF for a successful connection, it can be ignored in such a
case to avoid connectivity issues with invalid configuration. This makes
it somewhat easier to allow upper layer programs to use pmf=1 default
regardless of driver capabilities.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 12:38:52 +02:00
Jouni Malinen
fa38860c5e nl80211: Fix build with libnl 1.1
Commit 630b3230c8 ('nl80211: Increase
netlink receive buffer size') added unconditional use of
nl_socket_set_buffer_size() which was not included in libnl 1.1. Fix use
of that old version by making this conditional on CONFIG_LIBNL20.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:50:02 +02:00
Jouni Malinen
937403b581 Update copyright notices for the new year 2015
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:55 +02:00
Jouni Malinen
37551fe374 tests: Suite B 192-bit profile
This adds a Suite B test case for 192-bit level.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:55 +02:00
Jouni Malinen
4113a96bba tests: Complete Suite B 128-bit coverage
Enable BIP-GMAC-128 and enforce Suite B profile for TLS.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:55 +02:00
Jouni Malinen
f918b95b9d tests: Fix ft_psk_key_lifetime_in_memory with new PTK derivation debug
PTK is not printed out anymore as a single entry, so fetch KCK, KEK, and
TK separately.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:55 +02:00
Jouni Malinen
399e61353a Add Suite B AKMs to key_mgmt capability list
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:55 +02:00
Jouni Malinen
5e3b5197cc Add Suite B 192-bit AKM
WPA-EAP-SUITE-B-192 can now be used to select 192-bit level Suite B into
use as the key management method.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:43:52 +02:00
Jouni Malinen
97ae35a848 Add HMAC-SHA384
For now, this is only implemented with OpenSSL.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:26:51 +02:00
Jouni Malinen
98cd3d1c3b Preparations for variable length KCK and KEK
This modifies struct wpa_ptk to allow the length of KCK and KEK to be
stored. This is needed to allow longer keys to be used, e.g., with
Suite B 192-bit level.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-27 01:26:49 +02:00
Jouni Malinen
287eb3f9d7 tests: Group management frame cipher suites
This extends testing coverage of PMF group management cipher suites to
include all the cases supported by the driver (existing BIP =
AES-128-CMAC and the new BIP-GMAC-128, BIP-GMAC-256, BIP-CMAC-256).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-24 19:37:42 +02:00
Jouni Malinen
0e1aa64dba wlantest: Extend BIP validation to support GMAC-128 and GMAC-256
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-24 19:37:42 +02:00
Jouni Malinen
cd3b5cc079 wlantest: New mgmt_group_cipher values for BSS info and debug log
This adds BIP-GMAC-128, BIP-GMAC-256, and BIP-CMAC-256 to info_bss
command and debug log.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-24 19:37:42 +02:00
Jouni Malinen
cb80fadaa7 wlantest: Extend BIP support to cover BIP-CMAC-256
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-24 19:37:42 +02:00
Jouni Malinen
30bff1d0f4 Extend AES-CMAC routines to support 256-bit keys
omac1_aes_256() and omac1_aes_vector() can now be used to perform
256-bit CMAC operations similarly to the previously supported 128-bit
cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-24 19:37:42 +02:00
Jouni Malinen
86f9b1c706 nl80211: Fix default group key management index configuration
The correct nl80211 flag for group key management cipher was set only
for BIP (AES-CMAC-128). The same flag needs to be used with the newer
ciphers BIP-CMAC-256, BIP-GMAC-128, and BIP-GMAC-256.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-24 19:37:42 +02:00
Jouni Malinen
b5f045deee Show supported group_mgmt capabilities
This extends GET_CAPABILITY command to allow the supported group
management frame cipher suites to be listed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-24 19:37:42 +02:00
Ben Greear
893e152e64 Interworking: More debug messages
And convert some wpa_printf to wpa_msg.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-01-24 19:37:42 +02:00
Ben Greear
f45bae5b81 Interworking: Add logging to track nai_realm_find_eap failures
There are lots of reasons we can fail to match an EAP credential, so add
logging to help determine why it is happening in various cases.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-01-24 19:37:42 +02:00
Jouni Malinen
5a5aab7f40 Interworking: Remove unnecessary NULL check
nai_realm_find_eap() is called only in cases where the cred pointer is
not NULL.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-24 19:37:42 +02:00
Ben Greear
400de9b1fe hostapd: Debug messages for dodgy RADIUS servers
These were helpful when tracking down why hostapd did not work
properly with a RADIUS server.

Signed-hostap: Ben Greear <greearb@candelatech.com>
2015-01-23 01:48:27 +02:00
Adrian Nowicki
ad905e4a79 wpa_gui: Sort frequency and signal numerically in the scan results dialog
Signal strength was sorted lexically rather than numerically, which
put "-100 dBm" before "-50 dBm" if sorted in descending order.
This change fixes that. It also treats frequency in the same
manner, preparing it for the IEEE 802.11ah.

Signed-off-by: Adrian Nowicki <adinowicki@gmail.com>
2015-01-23 01:24:25 +02:00
Jouni Malinen
fba25c99a5 tests: Make ap_wps_er_pbc_overlap more robust
Reorder scanning in a way that allows the ER behavior to be more
predictable. The first Probe Request report is for a previously received
frame on the AP and this new sequence avoids leaving either of the PBC
test STAs to be that one.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-23 00:52:56 +02:00
Jouni Malinen
90ad11e625 tests: Make active scans more robust
This makes testing under very heavy load or under extensive kernel
debugging options more robust by allowing number of test cases to scan
multiple times before giving up on active scans. The main reason for
many of the related test failures is in Probe Response frame from
hostapd not getting out quickly enough especially when multiple BSSes
are operating.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-23 00:52:40 +02:00