Commit graph

112 commits

Author SHA1 Message Date
Helmut Schaa
36af1c7d31 hostapd: enable STBC only for STBC capable STAs
hostapd simply used its own STBC configuration in the STA's HT caps. This
resulted in TX STBC being used for STAs not supporting RX STBC, which in
turn resulted in the STA not receiving anything.

Fix this by handling the STBC flags in the same way mac80211 does. Mask
out RX STBC if we don't support TX STBC and vice versa.

Tested only with the nl80211 driver and a STBC incapable STA.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
2010-08-28 12:25:44 +03:00
Jouni Malinen
31fa4c6d98 Remove unused ieee802_11_send_deauth() 2010-08-25 21:18:54 +03:00
Jouni Malinen
5a1cc30f1a WPS: Add support for dynamic AP PIN management
A new hostapd_cli command, wps_ap_pin, can now be used to manage
AP PIN at runtime. This can be used to generate a random AP PIN and
to only enable the AP PIN for short period (e.g., based on user
action on the AP device). Use of random AP PIN that is only enabled
for short duration is highly recommended to avoid security issues
with a static AP PIN.
2010-08-24 16:35:37 +03:00
Jouni Malinen
944814106e WPS: Do not disable AP PIN permanently, only slow down attacks
As a compromise between usability and security, do not disable
AP PIN permanently based on failed PIN validations. Instead, go to
AP Setup Locked state for increasing amount of time between each
failure to slow down brute force attacks against the AP PIN.

This avoids problems with some external Registrars that may try
to use the same PIN multiple times without user input. Now, the
user will still be able to fix the PIN and try again later while
a real attack is delayed enough to make it impractical.
2010-08-24 15:24:05 +03:00
Jouni Malinen
43dd46b3bc Fix memory leak in AP WEP key configuration 2010-08-17 21:04:07 +03:00
Jouni Malinen
6195adda9b WPS: Allow AP to start in Enrollee mode without AP PIN for probing
In theory, this should not really be needed, but Windows 7 uses
Registrar mode to probe AP's WPS capabilities before trying to use
Enrollee and fails if the AP does not allow that probing to happen.
This allows the AP to start as an Enrollee and send M1, but refuse
to continue beyond that (M3 will not be sent if AP PIN is not known).
2010-07-26 18:12:08 -07:00
Jouni Malinen
67ccef7e6c FT: Send RRB data directly when managed by same hostapd process
This makes it easier (and a bit faster) to handle multiple local
radios with FT. There is no need to depend on l2_packet in that
case since the frame can be delivered as a direct function call.
2010-07-25 20:30:12 -07:00
Jouni Malinen
7f6ec672ea EAP server: Add support for configuring fragment size 2010-07-20 22:56:10 -07:00
Jouni Malinen
4e22adb4d1 WPS: Move from WLAN_STA_MAYBE_WPS to WLAN_STA_WPS based on EAP messages
If the station does not include WSC IE in Association Request, it
is marked with WLAN_STA_MAYBE_WPS flag. We can update that to
WLAN_STA_WPS if the station uses either of the WPS identity strings.
This enables some workarounds for WPS stations.
2010-07-18 16:10:08 -07:00
Jouni Malinen
3239706303 WPS: Force disconnection after provisioning step
This works around some problems where the station is unable to disconnect
for some reason (e.g., if EAP-Failure gets dropped).
2010-07-18 16:08:52 -07:00
Jouni Malinen
e9501a07c6 FT: Fix RRB messages to use correct endianness
The pairwise cipher field is supposed to be little endian, but the
message building functions did not swap the bytes on big endian
hosts while the message processing functions did. Fix this by using
little endian byte order in both places.
2010-07-17 17:48:32 -07:00
Jouni Malinen
2d8bf73298 Add new debug message level for excessive information
Some frequent debug prints are of limited use and make debug output
difficult to read. Make them use a new debug level so that -dd
provides more readable output (-ddd can now be used to enable
the excessive debug prints).
2010-07-05 12:21:48 -07:00
Jouni Malinen
9776475fb9 WPS: Do not proxy Probe Request frames to foreign SSIDs to Registrars
We must only indicate stations that are either probing the wildcard SSID
or our own SSID.
2010-06-10 22:36:34 -07:00
Jouni Malinen
84b2f9909f Fix driver operation order in configuration reloading
Some of the driver wrappers need to get set_ieee8021x() call before
they can configure keys. Reorder the operations in the reloading
of configuration case to match with that expectation.
2010-05-29 22:27:27 +03:00
Jouni Malinen
ed7a09f914 Add WPS IE into (Re)Association Response frame if WPS is used
If the associating station indicates that it is intents to use WPS
by including WPS IE in (Re)Association Request frame, include WPS IE
in (Re)Association Response frame.
2010-05-26 18:46:08 +03:00
Jouni Malinen
16e46ec043 Reassemble WPS IE(s) in (Re)Association Request if needed
Use a function that will take care of possible (though, very unlikely)
fragmentation of WPS TLVs in (Re)Association Request frames.
2010-05-26 18:17:13 +03:00
Andriy Tkachuk
6deb41e73f Update WPS IE on hostapd reconfiguration
This is needed to handle cases where WPS state may have changed and
hostapd is reloading its configuration.
2010-05-02 11:21:19 +03:00
Jouni Malinen
1bc774a12a hostapd: Reorder some IEs to get closer to IEEE 802.11 standard
Vendor-specific IEs are supposed to be in the end of the frame, so move
WMM into the end of Beacon, Probe Response, and (Re)Association Response
frames. In addition, move HT IEs to be later in (Re)Association
Response to match the correct order.

hostapd_eid_wpa() adds multiple IEs and the end result may not always be
correct. If WPA is enabled, WPA IE (vendor-specific) gets added in the
middle of the frame and not in the end. This would require a larger
change to spliut the IEs from WPA module into separate locations when
constructing Beacon and Probe Response frames. This is not yet addressed.
2010-05-02 10:53:01 +03:00
Jouni Malinen
439d4bf960 Fix EAPOL_SM_USES_WPA flag to be set correctly
Commit c02d52b405 removed direct calls
to the WPA authenticator, but the change here was incorrect.
EAPOL_SM_USES_WPA was supposed to be set based on sta->wpa_sm being
set, i.e., no need to check for PMKSA entries for that.

While this could potentially change EAPOL Key TX state machine behavior,
no clear problems have been identified so far. Anyway, better fix this
to get the correct flags set for EAPOL authenticator state machine.
2010-05-01 17:12:59 +03:00
Jouni Malinen
3ab72b626b Fix WPA state machine initialization on WPA_REAUTH if needed
When using WPS, we may end up here if the STA manages to re-associate
without the previous STA entry getting removed. Consequently, we need to
make sure that the WPA state machines gets initialized properly at this
point.
2010-04-23 16:49:50 +03:00
Jouni Malinen
2de5a860a3 Fix build without CONFIG_FULL_DYNAMIC_VLAN 2010-04-17 21:01:35 +03:00
Jouni Malinen
7992b07f6a Remove unnecessary SUBDIRS loops from src/*/Makefile
There are no subdirectories in any of these directories or plans
for adding ones. As such, there is no point in running the loop
that does not do anything and can cause problems with some shells.
2010-04-17 17:10:31 +03:00
Jouni Malinen
e34ce1683c VLAN: Reorder init to get same behavior for all VLAN interfaces
Both the wildcard VLAN entry and the statically configured VLAN
interfaces should behave in the same way. Initializing the
full dynamic VLAN code before adding the statically configured VLAN
interfaces allows the same processing to be applied to both statically
and dynamically added VLAN interface (i.e., also the statically
configured ones will be added to a bridge).
2010-04-17 09:48:27 +03:00
Jouni Malinen
0249c988bb VLAN: Set statically configured VLAN interfaces up
This is needed to be able to bind stations to them with mac80211.
2010-04-17 09:45:18 +03:00
Jouni Malinen
b9c3e576cb VLAN: Fix bridge interface clean up for no tagged_interface case 2010-04-16 01:13:46 +03:00
M. Braun
20e2cb0ae0 VLAN: Decrease bridge forwarding delay to avoid EAPOL timeouts 2010-04-16 00:48:32 +03:00
M. Braun
37ba0928d5 VLAN: Set dynamic VLAN up to fix STA bind and key setup 2010-04-15 23:54:41 +03:00
Jouni Malinen
4254100d6c Stop processing if STA VLAN bind fails 2010-04-15 23:44:10 +03:00
Jouni Malinen
91faf6b948 VLAN: Clean up debug code and error messages 2010-04-15 20:35:51 +03:00
Jouni Malinen
c47cf42e4b WPS: Fix association when both WPS and WPA/RSN IE are included
The WPS IE was overriding the WPA/RSN IE in driver based MLME case
(hostapd_notif_assoc), but the MLME code here was not using WPS IE
correctly, i.e., it allowed the WPA/RSN IE override the operation.
2010-04-15 12:55:34 +03:00
Jouni Malinen
843123590a Fix hostapd build without WPS 2010-04-12 15:15:17 +03:00
Jouni Malinen
c706d5aa17 Add wpa_supplicant AP mode events for Public Action frames 2010-04-11 20:33:33 +03:00
Jouni Malinen
195420b8d1 Add WPS Registrar success callback 2010-04-11 20:21:08 +03:00
Jouni Malinen
b3db190fa2 Started to make set_ap_wps_ie() capable of adding multiple IEs
This mechanism can be used to add various IEs to Beacon and Probe
Response frames and it should be made clear that it is not reserved
only for WPS IE.
2010-04-11 20:16:43 +03:00
Jouni Malinen
f3585c8a85 Simplify driver_ops for virtual interface add/remove
There is no absolute requirement for separating address allocation
into separate functions, so simplify the driver wrapper interface
to use just if_add and if_remove instead of adding the new
alloc_interface_addr() and release_interface_addr() functions.

if_add() can now indicate if the driver forced a different interface
name or address on the virtual interface.
2010-04-11 19:23:09 +03:00
Yogesh Ashok Powar
721abef9b3 Allow advertising of U-APSD functionality in Beacon
hostapd does not implement UAPSD functionality. However, if U-APSD
functionality is implemented outside hostapd, add support to advertise
the functionality in beacon.

Signed-off-by: yogeshp@marvell.com
2010-04-11 11:32:15 +03:00
Jouni Malinen
0f857f43df FT: Validate MDIE and FTIE in FT 4-way handshake message 2/4 2010-04-10 22:40:35 +03:00
Jouni Malinen
86dfabb809 FT: Add FTIE, TIE[ReassocDeadline], TIE[KeyLifetime] to EAPOL-Key 3/4
These are mandatory IEs to be included in the FT 4-Way Handshake
Message 3.
2010-04-10 21:42:54 +03:00
Jouni Malinen
1566ec4685 Parse EAPOL-Key msg 2/4 Key Data IEs/KDEs before checking RSN/WPA IE
This is needed to avoid incorrect validation errors on RSN/WPA IE
when using FT since there may be more than a single IE in the
Key Data field.
2010-04-10 16:46:17 +03:00
Jouni Malinen
0ae145cde8 FT: Validate FTIE fields in Reassociation Request
ANonce, SNonce, R0KH-ID, and R1KH-ID must match with the values
used in the previous FT authentication sequence message per
IEEE Std 802.11r-2008, 11A.8.4.
2010-04-09 17:14:27 +03:00
Jouni Malinen
8aaf894de2 FT: Validate protect IE count in FTIE MIC Control 2010-04-09 17:08:16 +03:00
Jouni Malinen
6e80516ab9 FT: Fix Reassociation Response in FT Protocol to include ANonce/SNonce
These values are required to be included in the frame per
IEEE Std 802.11r-2008, 11A.8.5.
2010-04-09 13:36:06 +03:00
Jouni Malinen
1f6e69e07b FT: Do not add MIC to FTIE during initial MD association
We do not have any keys set at this point so there is no point in
adding the MIC. In addition, IEEE Std 802.11r-2008, 11A.4.2
describes this frame to have MIC IE count of 0 and MIC of 0.
2010-04-09 13:30:49 +03:00
Jouni Malinen
39eb4d0877 FT: Fix GTK subelement format in FTIE
The Key Info field was changed from 1-octet field to 2-octet field
in 802.11r/D7.0, but that had not been updated in the implementation.
2010-04-07 23:57:39 +03:00
Jouni Malinen
26e23750b9 FT: Fix FT 4-Way Handshake to include PMKR1Name in messages 2 and 3
IEEE Std 802.11r-2008, 11A.4.2 describes FT initial mobility domain
association in an RSN to include PMKR1Name in the PMKID-List field
in RSN IE in messages 2/4 and 3/4. This makes the RSN IE not be
bitwise identical with the values used in Beacon, Probe Response,
(Re)association Request frames.

The previous versions of wpa_supplicant and hostapd did not add the
PMKR1Name value in EAPOL-Key frame and did not accept it if added
(due to bitwise comparison of RSN IEs). This commit fixes the
implementation to be compliant with the standard by adding the
PMKR1Name value into EAPOL-Key messages during FT 4-Way Handshake and
by verifying that the received value matches with the value derived
locally.

This breaks interoperability with previous wpa_supplicant/hostapd
versions.
2010-04-07 21:04:13 +03:00
Jouni Malinen
738a1cb286 FT: Do not include RSN IE in (Re)Assoc Resp during initial MD association
RSN IE is only supposed to be included in Reassociation Response frames
and only when they are part of a fast BSS transition.
2010-04-07 17:27:46 +03:00
Gregory Detal
bb437f282b AP: Add wpa_msg() events for EAP server state machine 2010-04-07 11:13:14 +03:00
Jouni Malinen
68532a9ceb Avoid hostapd segfault on invalid driver association event
Running hostapd and wpa_supplicant on the same interface at the same
time is not expected to work, but it should not cause hostapd to crash.
Ignore station mode association events (no addr field) to avoid this.
2010-04-07 10:01:49 +03:00
Andriy Tkachuk
99f4ae67b7 Fix WPA/RSN IE update on reconfig with set_generic_elem()
IF WPA/RSN parameters were changed or WPA/RSN was disabled, the
WPA/RSN IE in Beacon/Probe Response frames was only update with
set_beacon(). We need to do this with set_generic_elem(), too, to
work with all driver wrappers.
2010-04-06 20:44:26 +03:00
Jouni Malinen
643743e215 WPS: Fix WPS IE update in Beacon frames for nl80211
Call ieee802_11_set_beacon() in addition to set_ap_wps_ie() when
processing WPS IE updates. This is needed with drivers that use
set_beacon() instead of set_ap_wps_ie() (i.e., nl80211).
2010-04-06 18:04:30 +03:00