Add NULL checks to take care of issues reported by static analyzer tool
on potentially using NULL with printf format %s (which has undefined
behavior even though many compilers end up printing "(null)").
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Currently hostapd data structures aren't ready for multi-channel BSSes,
so make the command work now at least with single-channel multi-BSS
channel switching.
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
The current RADIUS server pointer was updated after each SET command
which broke parsing of multiple RADIUS servers over the control
interface. Fix this by doing the final RADIUS server pointer updates
only once the full configuration is available.
Signed-off-by: Jouni Malinen <j@w1.fi>
ctrl_ifname was not being freed and allocated consistently by using
proper functions: os_free() and os_strdup(). This can result in
segmentation fault when these OS specific wrappers use different
implementation (e.g., with CONFIG_WPA_TRACE=y).
Signed-off-by: Eduardo Abinader <eduardo.abinader@openbossa.org>
clang scan-build does not seem to like the 'd' suffix on floating
constants and ends up reporting analyzer failures. Since this suffix
does not seem to be needed, get rid of it to clear such warnings.
Signed-off-by: Jouni Malinen <j@w1.fi>
The conf->channel assignment was unreachable if CONFIG_ACS was not
defined, so move that to be under #else.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This avoids large number of undesired compiler warnings since Android
build system is added -Wextra.
Signed-off-by: Greg Hackmann <ghackmann@google.com>
This was used to fill in the "PSMP support" subfield that was defined
during P802.11n development. However, this subfield was marked reserved
in the published IEEE Std 802.11n-2009 and it is not supported by
current drivers that use hostapd for SME either. As such, there is not
much point in maintaining this field as ht_capab parameter within
hostapd either.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Some of the allocated configuration parameter did not free the previous
value if a configuration file or ctrl_iface SET command updated a
previously set value.
Signed-off-by: Jouni Malinen <j@w1.fi>
pos == NULL in almost all of the error cases here, so print the full
parameter value instead of the current position.
Signed-off-by: Jouni Malinen <j@w1.fi>
ap_sta_deauthenticate() does not necessarily send a Deauthentication
frame to the STA. Use ap_sta_disconnect() to drop the association so
that the notification frame goes out.
Signed-off-by: Jouni Malinen <j@w1.fi>
"user" MACACL "password" style lines in the eap_user file can now be
used to configured user entries for RADIUS-based MAC ACL.
Signed-off-by: Jouni Malinen <j@w1.fi>
Add support of vendor command to hostapd ctrl_iface.
Vendor command's format:
VENDOR <vendor id> <sub command id> [<hex formatted data>]
The 3rd argument will be converted to binary data and then passed as
argument to the sub command.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
This adds a pointer to hostapd.conf to using 'iw list' with the current
nl80211 drivers to determine supported interface combinations.
Signed-off-by: Jouni Malinen <j@w1.fi>
There is not much point in building devices with WPS 1.0 only supported
nowadays. As such, there is not sufficient justification for maintaining
extra complexity for the CONFIG_WPS2 build option either. Remove this by
enabling WSC 2.0 support unconditionally.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
ht_capab=[40-INTOLERANT] can now be used to advertise that the BSS is 40
MHz intolerant to prevent other 20/40 MHz co-ex compliant APs from using
40 MHz channel bandwidth.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This allows hostapd to set a different management group cipher than the
previously hardcoded default BIP (AES-128-CMAC). The new configuration
file parameter group_mgmt_cipher can be set to BIP-GMAC-128,
BIP-GMAC-256, or BIP-CMAC-256 to select one of the ciphers defined in
IEEE Std 802.11ac-2013.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Some of the parsing code was using a bit too complex design and could be
simplified after the earlier return-on-error cleanups.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
There is no need for trying to count the number of errors in this
function since this is not a loop anymore and the return value will be
either 0 or 1.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The configuration file parsing routines were moved to a separate
function a while back, but left at the old indentation level to avoid
showing large diffs in the commit and to avoid conflicts with parallel
development in other branches. There is never a perfect time for this
type of changes, but we might as well finally get rid of that extra
indentation now with Hotspot 2.0 Rel 2 changes pulled in.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Different channels allow different transmission power, at least in ETSI
countries. Also, ETSI requires a "channel plan" for DFS operation, and
channels should be randomly choosen from these channels.
Add a channel list configuration option for users to add channels
hostapd may pick from.
Signed-hostap: Simon Wunderlich <sw@simonwunderlich.de>
Previously, EAP-SIM/AKA/AKA' did not work with number of crypto
libraries (GnuTLS, CryptoAPI, NSS) since the required FIPS 186-2 PRF
function was not implemented. This resulted in somewhat confusing error
messages since the placeholder functions were silently returning an
error. Fix this by using the internal implementation of FIP 186-2 PRF
(including internal SHA-1 implementation) with crypto libraries that do
not implement this in case EAP-SIM/AKA/AKA' is included in the build.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This error path must not try to free the user entry since that entry was
already added to the BSS list and will be freed when BSS is freed.
Signed-off-by: Jouni Malinen <j@w1.fi>
If eap_user_file is configured to point to an SQLite database, RADIUS
server code can use that database for log information.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This extends the design already available for Access-Request packets to
the RADIUS server and Access-Accept messages. Each user entry can be
configured to add arbitrary RADIUS attributes.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Commit 354c903f8e added setting of
driver_ap_teardown on the hostapd exit path without taking into account
that this may also be called on an error path where the interface has
not been initialized. Fix the resulting NULL pointer dereference to
allow hostapd to exit cleanly in error case.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
As per IEEE Std 802.11ac-2013, 'Maximum A-MPDU Length Exponent' field
value is in the range of 0 to 7. Previous implementation assumed EXP0 to
be the maximum length (bits 23, 24 and 25 set) what is incorrect.
This patch adds options to set it up within the 0 to 7 range.
Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
This commit adds an option to optimize AP teardown by leaving the
deletion of keys (including group keys) and stations to the driver.
This optimization option should be used if the driver supports stations
and keys removal when stopping an AP.
For example, the optimization option will always be used for cfg80211
drivers since cfg80211 shall always remove stations and keys when
stopping an AP (in order to support cases where the AP is disabled
without the knowledge of wpa_supplicant/hostapd).
Signed-off-by: Moshe Benji <moshe.benji@intel.com>
The new hostapd.conf parameter subscr_remediation_url can be used to
define the URL of the Subscription Remediation Server that will be added
in a WFA VSA to Access-Accept message if the SQLite user database
indicates that the user need subscription remediation.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
hostapd can now be configured to advertise OSU Providers with the
new osu_* confgiuration parameters.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
hostapd can now be configured to provide access for icon files
(hs20_icon config file parameter) for OSU. The hs20_icon data contains
additional meta data about the icon that is not yet used, but it will be
needed for the OSU Providers list ANQP element.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
If the RADIUS server includes deauthentication request in Access-Accept,
send a WNM-Notification frame to the station after 4-way handshake and
disconnect the station after configurable timeout.
A new control interface command, WNM_DEAUTH_REQ, is added for testing
purposes to allow the notification frame to sent based on local request.
This case does not disconnect the station automatically, i.e., a
separate control interface command would be needed for that.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Subscription remediation notification can now be sent from hostapd with:
hostapd_cli hs20_wnm_notif 02:00:00:00:00:00 http://example.com/foo/
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The HS 2.0 Indication element from hostapd now includes the release
number field and the new ANQP Domain ID field. This ID can be configured
with anqp_domain_id parameter in hostapd.conf.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
After adding or removing a MAC address from a list, the
corresponding station was not deauthenticated as expected.
Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com>
It is already possible to add MAC addresses at runtime. This patch
allows also to remove some of them by using the prefix "-" in the
address file.
Signed-off-by: Emanuel Taube <emanuel.taube@gmail.com>
Add configuration of Spectrum Management subfield in the Capability
Information of Beacon, Probe Response, and Association Response frames.
Spectrum Management bit is set when directly requested by new
configuration option spectrum_mgmt_required=1 or when AP is running on
DFS channels. In the future, also TPC shall require this bit to be set.
Signed-hostap: Srinivasan <srinivasanb@posedge.com>
Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com>
Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
Add Power Constraint information element to Beacon and Probe Response
frames when hostapd is configured on 5 GHz band and Country information
element is also added. According to IEEE Std 802.11-2012 a STA shall
determine a local maximum transmit power for the current channel based
on information derived from Country and Power Constraint elements.
In order to add Power Constraint element ieee80211d option need to be
enabled and new local_pwr_constraint config option need to be set to
unsigned value in units of decibels. For now this value is statically
configured but the future goal is to implement dynamic TPC algorithm
to control local power constraint.
Signed-hostap: Srinivasan <srinivasanb@posedge.com>
Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com>
Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
CONFIG_MODULE_TESTS=y build option can now be used to build in module
tests into hostapd and wpa_supplicant binaries. These test cases will be
used to get better testing coverage for various details that are
difficult to test otherwise through the control interface control. A
single control interface command is used to executed these tests within
the hwsim test framework. This commit adds just the new mechanism, but no
module tests are yet integrated into this mechanism.
Signed-off-by: Jouni Malinen <j@w1.fi>
Using binutils >= 2.24.x and setting
CONFIG_WPA_TRACE/CONFIG_WPA_TRACE_BDF causes both builds to fail with
"#error config.h must be included before this header" message.
Since version 2.24.x, the bfd header checks for PACKAGE and
PACKAGE_VERSION macros.
As suggested in http://sourceware.org/bugzilla/show_bug.cgi?id=14243
projects that use bfd and don't use autotools should define a PACKAGE
macro.
Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
IEEE 802.11w is ratified since 2009 already, so this comment does not
seem to be valid anymore.
Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
The current nfcpy version does not support new WSC connection handover
message format and the handover server fails to process the request due
to a debug print. As a temporary workaround, override
HandoverServer::_process_request() with a version that avoids pretty()
print of the handover messages. This can be removed once nfcpy has been
updated to support the new format.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
In hostapd_logger_cb(), module_str is checked for NULL (on a path that
does not get executed in practice), and then possibly dereferenced in
snprintf() anyway.
Signed-hostap: Eytan Lifshitz <eytan.lifshitz@intel.com>
"hostapd -u<MAC Address>" can now be used to display the UUID that will
be generated based on a MAC Address (i.e., when hostapd configuration
does not set a specific UUID).
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
nfcpy does not yet support all the new message formats, so some of the
pretty() calls can result in exceptions.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
If CONFIG_WPS_TESTING=y is enabled in build configuration, the new
wps_corrupt_pkhash parameter (similar to wps_testing_dummy_cred) can be
used to request public key hash to be corrupted in all generated OOB
Device Password attributes. This can be used for testing purposes to
validate public key hash validation steps.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The new NFC connection handover design requires the AP/Registrar to
process the connection handover request message received from the
Enrollee. Add control interface commands for handling this.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
It is possible for the configuration to be temporarily invalid when
adding a new AP through SET commands followed by ENABLE. Avoid this
issue by using less strict validation on SET commands and perform full
configuration validation only on ENABLE. Use cases with configuration
file maintain their previous behavior, i.e., full validation after the
file has been read.
Signed-hostap: Jouni Malinen <j@w1.fi>
This is just like the same command in wpa_supplicant, i.e., "hostapd_cli
status driver" can be used to fetch information about the driver status
and capabilities.
Signed-hostap: Jouni Malinen <j@w1.fi>
Need to use common EAP_GPSK_SHA256 define for this instead of the
server-specific EAP_SERVER_GPSK_SHA256 which was not really used
anywhere.
Signed-hostap: Jouni Malinen <j@w1.fi>
This debugging mechanism has now been deprecated by the control
interface commands that can be used to fetch same internal information
from hostapd in a more convenient way. Leave the empty USR1 signal
handler and configuration file parameter for backwards compatibility.
They can be removed in future versions of hostapd.
Signed-hostap: Jouni Malinen <j@w1.fi>
The per-STA/Supplicant state information from the EAPOL authenticator
is now available through "STA <MAC Address> eapol" command.
Signed-hostap: Jouni Malinen <j@w1.fi>
There is no need to maintain two interfaces for fetching debug
information about hostapd state. The control interface is more
convenient for number of use cases, so prefer that over the dump_file
mechanism.
Signed-hostap: Jouni Malinen <j@w1.fi>
These were somewhat more hidden to avoid direct use, but there are now
numerous places where these are needed and more justification to make
the extern int declarations available from wpa_debug.h. In addition,
this avoids some warnings from sparse.
Signed-hostap: Jouni Malinen <j@w1.fi>
This can be useful for displaying the current STA state and also for
determining whether some operations are likely to fail or need
additional delay.
Signed-hostap: Jouni Malinen <j@w1.fi>
This makes it easier to trigger the ESS Disassociation Imminent
operation from different sources.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This makes it easier to enable various testing parameters and
functionality in build configuration.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This enables more convenient protocol testing of station side
functionality in various error cases and unexpected sequences without
having to implement each test scenario within hostapd.
ext_mgmt_frame_handle parameter can be set to 1 to move all management
frame processing into an external program through control interface
events (MGMT-RX and MGMT-TX-STATUS) and command (MGMT_TX).
Signed-hostap: Jouni Malinen <j@w1.fi>
In addition, update build rules to compile object files in the same
directory as the source code file if CONFIG_CODE_COVERAGE=y is set to
make lcov find the source code files.
Signed-hostap: Jouni Malinen <j@w1.fi>
Relative time shouldn't be calculated based on gettimeofday
because that clock can jump (e.g., when the time is adjusted
by the system administrator.)
On systems where that is available, use CLOCK_BOOTTIME (on
fairly recent Linux systems, this clock takes into account
the time spend suspended) or CLOCK_MONOTONIC (on Linux and
some POSIX systems, this clock is just freely running with
no adjustments.)
Reported-by: Holger Schurig <holgerschurig@gmail.com>
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
Add chan_switch to the control interface of wpa_supplicant and hostapd,
and also to wpa_cli and hostapd_cli.
Signed-hostap: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Add definitions of the Android specific directories used for control
interface sockets so that hostapd_cli can connect to the Android
hostapd.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Add a parameter to send the overlapping BSS scan parameter
information element. This will require clients to perform
background scans to check for neigbors overlapping this
HT40 BSS. Since the implementation is incomplete it should
only be used for testing.
Signed-hostap: Paul Stewart <pstew@chromium.org>
In case a control interface socket is detached because of sendmsg()
failing for the socket, function call to detach the socket uses a
pointer to the socket information in the structure to be freed. Reorder
code to print socket info before freeing the data to avoid use of freed
memory in case debug prints are enabled.
This is similar to the earlier wpa_supplicant fix in commit
a235aca316.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Limit the calls to eloop_terminate() to happen only for the
initialization failure from the interfaces that we specified on the
command line. This allows hostapd process to continue operating even if
a dynamically added interface fails to start up. This allows the upper
layer software to fix a configuration error and retry.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Commit ebd79f07c4 broke parsing of
configuration files that use the bss parameter to specify another BSS
entry. This resulted in crashing the process with NULL pointer
dereference since the new hostapd_config::bss design requires this
function to allocate a new hostapd_bss_config structure.
Signed-hostap: Jouni Malinen <j@w1.fi>
This is a per-BSS configuration parameter and as such, needs to be
configured to the driver from hostapd_setup_bss() instead of
hostapd_driver_init().
Signed-hostap: Jouni Malinen <j@w1.fi>
This was an unnecessary wrapper functions for calling two functions from
a single place in the code. It is cleaner to just call those two
functions directly.
Signed-hostap: Jouni Malinen <j@w1.fi>
Use hostapd_interface_init2() for all interfaces instead of the
previously used different paths for per-interface-config and
per-BSS-config cases. This moves the calls to hostapd_driver_init() and
hostapd_setup_interface() to happen after all configuration files have
been read.
Signed-hostap: Jouni Malinen <j@w1.fi>
If hostapd is build with CONFIG_TESTING_OPTIONS=y, the RADAR control
interface command can be used to test hostapd behavior on arbitrary
driver radar events.
Signed-hostap: Jouni Malinen <j@w1.fi>
This allows log-to-file (-f command line option) to be used to redirect
these messages to the same file with all the other stdout debug.
Signed-hostap: Jouni Malinen <j@w1.fi>
Just like wpa_supplicant, give hostapd the -T option to
send all debug messages into the Linux tracing buffer.
Enable this option for hwsim test builds by default.
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
This allows the configuration validation routines to be called from
src/ap/*.c for runtime updates of configuration without reprocessing the
full configuration file.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This provides a new option for configuring multiple virtual interfaces
(BSS) that share a single radio. The new command line parameter
-b<phyname>:<config file name> is used to define one or more virtual
interfaces for each PHY. The first such entry for a new PHY is used to
initialize the interface structure and all consecutive parameters that
have the same PHY name will be added as virtual BSS entries to that
interface. The radio parameters in the configuration files have to be
identical.
This can be used as an alternative for the bss=<ifname> separator and
multiple BSSes in a single configuration file design while still
allowing hostapd to control the PHY (struct hostapd_iface) as a group of
virtual interfaces (struct hostapd_data) so that common radio operations
like OLBC detection and HT40 co-ex scans can be done only once per real
radio.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This makes it more convenient to move BSS configuration entries between
struct hostapd_config instances to clean up per-BSS configuration file
design.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This may be needed if the wpa_psk information for previously derived
from passphrase and either the SSID or the passphrase has changed.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
VHT_CAP_BEAMFORMEE_STS_MAX, VHT_CAP_SOUNDING_DIMENSION_OFFSET, and
VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT were not defined properly (wrong
name/size). Fix that and update the hostapd.conf parsing accordingly.
Signed-hostap: Eliad Peller <eliadx.peller@intel.com>
This can be used instead of SIM-REQ-AUTH to derive Kc and SRES values
from a previously assigned set of RAND values.
Signed-hostap: Jouni Malinen <j@w1.fi>
The new bss_load_test parameter can be used to configure hostapd to
advertise a fixed BSS Load element in Beacon and Probe Response frames
for testing purposes. This functionality is disabled in the build by
default and can be enabled with CONFIG_TESTING_OPTIONS=y.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This allows QoS Map Set element to be added to (Re)Association Response
frames and in QoS Map Configure frame. The QoS Mapping parameters are
also made available for the driver interface.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Add DFS structures/events handlers, CAC handling, and radar detection.
By default, after radar is detected or the channel became unavailable, a
random channel will be chosen.
This patches are based on the original work by Boris Presman and
Victor Goldenshtein. Most of the DFS code is moved to a new dfs.c/dfs.h
files.
Cc: Boris Presman <boris.presman@ti.com>
Cc: Victor Goldenshtein <victorg@ti.com>
Signed-hostap: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-hostap: Janusz Dziedzic <janusz.dziedzic@tieto.com>
This allows hlr_auc_gw to be used to run a single operation without
having to use it as a server. This can be useful, e.g., for generating
GSM authentication triplets for external programs. For example:
./hlr_auc_gw -m hlr_auc_gw.milenage_db "SIM-REQ-AUTH 232010000000000"
Signed-hostap: Jouni Malinen <j@w1.fi>
The notes about using only fixed GSM authentication triplets were not
really up-to-date with the implementation. Milenage and GSM-Milenage
were available for EAP-SIM, EAP-AKA, and EAP-AKA'.
Signed-hostap: Jouni Malinen <j@w1.fi>
This allows Hotspot 2.0 and Interworking strings that use language:name
string (e.g., venue_name) to be encoded using printf format to enter
special characters like newline.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
The language string length needs to be validated to hit into the
three-octet lang field in struct hostapd_lang_string before copying
this. Invalid configuration entries in hostapd.conf could have resulted
in buffer overflow.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
Some drivers fail to work if WEP keys are configured in a WPA network.
To avoid potentially confusing error cases, reject hostapd configuration
that enables WPA and includes parameters that would imply that WEP keys
would be set.
Signed-hostap: Jouni Malinen <j@w1.fi>
This adds ACS support to hostapd. Currently only survey-based
algorithm is available.
To use ACS you need to enable CONFIG_ACS=y in .config and use
channel=0 (or channel=acs_survey) in hostapd.conf.
For more details see wiki page [1] or comments in src/ap/acs.c.
[1]: http://wireless.kernel.org/en/users/Documentation/acs
Signed-hostap: Michal Kazior <michal.kazior@tieto.com>
This replaces number of perror() calls with wpa_printf() to get the
error messages embedded within rest of the debug messages in the same
stream instead of pushing these to stderr which may get directed to
another location.
Signed-hostap: Jouni Malinen <j@w1.fi>
The new wps_get_status command can be used to fetch the result of the
latest WPS operation and the current PBC state from hostapd.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
In a AP/STA concurrent setup, if the STA interface is continually
scanning, trying to connect to a network, the AP interface
is basically broken since beaconing would be erratic.
This option can be used in a WDS setup where one AP acts as a
Client/AP-Repeater. The Repeater AP interface has to start beaconing
only after the Client interface has established a WDS link with the
"Root AP".
Signed-hostap: Sujith Manoharan <c_manoha@qca.qualcomm.com>
The new server_id parameter in hostapd.conf can now be used to specify
which identity is delivered to the EAP peer with EAP methods that
support authenticated server identity.
Signed-hostap: Jouni Malinen <j@w1.fi>
When using OpenSSL with TLS-based EAP methods, wpa_supplicant can now be
configured to use OCSP stapling (TLS certificate status request) with
ocsp=1 network block parameter. ocsp=2 can be used to require valid OCSP
response before connection is allowed to continue.
hostapd as EAP server can be configured to return cached OCSP response
using the new ocsp_stapling_response parameter and an external mechanism
for updating the response data (e.g., "openssl ocsp ..." command).
This allows wpa_supplicant to verify that the server certificate has not
been revoked as part of the EAP-TLS/PEAP/TTLS/FAST handshake before
actual data connection has been established (i.e., when a CRL could not
be fetched even if a distribution point were specified).
Signed-hostap: Jouni Malinen <j@w1.fi>
Currently by default, all BSS share the bridge brvlan%d.
While this is sane when no tagged-interface is given, this
is insane when different tagged interfaces are given, as
it would result in bridging those tagged interfaces.
This patch therefore uses br%s%d with %s=tagged_interface
and %d=VLAN ID as bridge name when a tagged-interface is given.
Signed-hostap: Michael Braun <michael-dev@fami-braun.de>
Currently, when different BSS using different tagged vlan
interfaces, they are forced to share the bridge brvlan#,
which is not desirable.
This patch fixes this by making the bridge name configurable.
Signed-hostap: Michael Braun <michael-dev@fami-braun.de>
This cleans up debug log by not including comments about failed
operations in case the operation is known to fail due to not being
supported by the driver.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This was previously claimed to be in ms, but the field in BSS Transition
Management Request frame is in number of TBTTs (beacon interval). Use
that unit in the ESS_DISASSOC control interface command to be able to
specify any value and just modify the timeout value to be calculated
based on beacon interval.
Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
