Add support for user remediation to request a new password from the user
for username/password credentials that have been configured not use use
machine managed password.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Order the rows based on identity and use a bit smaller font for some of
the fields to make the table fit on the screen more easily.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Instead of defaulting to machine remediation, reject a request to do
subscription remediation if that has not been configured to be required.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This extends the last_msk testing functionality in the RADIUS server to
work with EAP-TLS based on "cert-<serial_num>" form user names in the
database.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This can be used to fetch the serial number of the peer certificate in
the EAP server. For now, this is implemented only with OpenSSL.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
The Single SSID case can only use OSEN, so reject the case where OSU_NAI
is not set and open OSU connection would be used since that connection
cannot succeed.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Extend hs20-osu-client to support the new osu_nai2 value for OSU
connection with the shared BSS (Single SSID) case.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Extend wpa_supplicant to use a separate OSU_NAI information from OSU
Providers NAI List ANQP-element instead of the OSU_NAI information from
OSU Providers list ANQP-element when connecting to the shared BSS
(Single SSID) for OSU.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Extend hostapd to allow the new OSU Provider NAI List ANQP-element to be
advertised in addition to the previously used OSU Providers list
ANQP-element. The new osu_nai2 configurator parameter option is used to
specify the OSU_NAI value for the shared BSS (Single SSID) case while
osu_nai remains to be used for the separate OSU BSS.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Driver/firmware does roam scan when it finds the need to roam to a
different BSS. Add a QCA vendor event to indicate such roam scan events
from driver/firmware to user space.
Please note that some drivers may not send these events in few cases,
e.g., if the host processor is sleeping when this event is generated in
firmware to avoid undesired wakeups.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Explicitly set the PMF configuration to 0 (NO_MGMT_FRAME_PROTECTION) for
non-RSN associations. This specifically helps with OWE transition mode
when the network block is configured with PMF set to required, but the
BSS selected is in open mode. There is no point to try to enable PMF for
such an association.
This fixes issues with drivers that use the NL80211_ATTR_USE_MFP
attribute to set expectations for PMF use. The combination of non-RSN
connection with claimed requirement for PMF (NL80211_MFP_REQUIRED) could
cause such drivers to reject the connection in OWE transition mode.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This verifies that wpa_supplicant and hostapd behave consistently with
PMKSA caching when Suite B AKMs end up deriving a new PMKID from each
4-way handshake.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
PMKID derivation with the Suite B AKMs is a special case compared to
other AKMs since that derivation uses KCK instead of PMK as an input.
This means that the PMKSA cache entry can be added only after KCK has
been derived during 4-way handshake. This also means that PMKID would
change every time 4-way handshake is repeated even when maintaining the
same PMK (i.e., during PTK rekeying and new associations even if they
use PMKSA caching).
wpa_supplicant was previously replacing the PMKSA cache entry whenever a
new PMKID was derived. This did not match hostapd expectations on the AP
side since hostapd did not update the PMKSA cache entry after it was
created. Consequently, PMKSA caching could be used only once (assuming
no PTK rekeying happened before that). Fix this by making wpa_supplicant
behave consistently with hostapd, i.e., by adding the Suite B PMKSA
cache entries with the PMKID from the very first 4-way handshake
following PMK derivation and then not updating the PMKID.
IEEE Std 802.11-2016 is somewhat vague in this area and it seems to
allow both cases to be used (initial PMKID or any consecutive PMKID
derived from the same PMK). While both cases could be supported that
would result in significantly more complex implementation and need to
store multiple PMKID values. It looks better to clarify the standard to
explicitly note that only the first PMKID derived after PMK derivation
is used (i.e., match the existing hostapd implementation).
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This was used during initial EST development time testing, but the same
information is available in the debug log and since this separate file
is deleted automatically, just remove its generation completely to
simplify implementation.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This is a regression test case for a memory leak on DPP_CONFIGURATOR_ADD
error path in dpp_keygen_configurator() when an unsupported curve is
specified.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
The external session_id and emsk from eap_proxy_get_eap_session_id() and
eap_proxy_get_emsk() need to be freed consistently in all code paths
within eap_peer_erp_init() and outside it in the case ERP is not
initialized.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
The temporary EC_POINT 'sum' needs to be freed at the end of the
function with the other OpenSSL allocations.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Flush the PMKSA upon receiving assoc reject event without timeout
in the event data, to avoid trying the subsequent connections
with the old PMKID. Do not flush PMKSA if assoc reject is
received with timeout as it is generated internally from the
driver without reaching the AP.
This extends commit d109aa6cac ("SAE:
Flush PMKSA if an assoc reject without timeout is received") to handle
also the DPP AKM.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
It looks like at least OpenSSL 1.1.0i includes the extra checks in
EC_POINT_set_affine_coordinates_GFp() that break the previously used
mechanism for generating invalid keys. Fix this by using the alternative
design that was used with OpenSSL 1.1.1 and BoringSSL.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Parse the Venue URL ANQP-element payload and report it with the new
RX-VENUE-URL event messages if the query was done using PMF.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
It was possible for the wait loop to exit early due to the $row[0] == 1
check returning false if the database value was not yet set. Fix this by
updated the $waiting default value only if the database actually has a
value for this field.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This allows hs20-osu-client to be requested to select a specific OSU
SSID with the new command line argument (-o<OSU_SSID>). This is useful
for testing single SSID transition mode cases.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
When the AP is detected to have single BSS shared for RSN and OSEN, use
that BSS for OSU by default instead of the one based on the OSU_SSID in
the OSU Providers list.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This adds the second SSID (the one used by the shared BSS) for OSU
connection when generating osu-providers.txt. External tools can use
that to configure multiple network profiles for OSU to cover the cases
where transition mode is used.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
CONFIG_RADIUS_TEST builds can now update the user SQLite database based
on authentication result from the last attempt. If the database has a
last_msk column, that will be set to the hexdump of the MSK whenever
authentication succeeds and to "FAIL" whenever authentication fails.
This can be used for testing purposes by having an external program
track authentication status per user.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Use explode() instead of split() because split() has been removed from
PHP 7.0.0 and there is no need for using full regular expression here.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This fixes some validation issues against DM_ddf DTD that were caused by
the conversion from the internal tree structure to TNDS. Only the leaf
nodes are supposed to have the Value node.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Define a new QCA vendor specific test config attribute to configure the
support for receiving the MPDU with operating mode control subfield.
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
