Commit graph

11065 commits

Author SHA1 Message Date
Jouni Malinen
7f03ecc884 tests: Scan failures
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-23 18:43:58 +03:00
Jouni Malinen
6dc3206ef0 scan: Fix a memory leak on an error path
If preassoc_mac_addr is used and updating the MAC address fails in
wpas_trigger_scan_cb(), the cloned scan parameters were leaked. Fix that
and also send a CTRL-EVENT-SCAN-FAILED event in this and another error
case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-23 18:29:55 +03:00
Jouni Malinen
9ce3e61091 nl80211: Add TEST_FAIL() to nl80211_set_mac_addr()
This makes it easier to test some error paths in wpa_supplicant.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-22 18:08:55 +03:00
Jouni Malinen
88802405f3 scan: Clean up code a bit - phase1 is used in all WPS cases
There is no need to have a separate if statement to skip the cases where
phase1 is not set. Just check it with the strstr comparison since this
case is not really used in practice.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-22 17:44:28 +03:00
Jouni Malinen
e1ae2876d5 scan: Clean up code a bit - ssid cannot be NULL here
wpa_s->current_ssid is set to a non-NULL ssid pointer value here, so
there is no need for the extra if statement.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-22 16:23:28 +03:00
Jouni Malinen
a1703947b1 Update ChangeLog files for v2.6
This adds a summary of changes since the v2.5 release.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-21 20:26:56 +03:00
Lior David
a26c9c2e71 Fix sending non-Public Action frames over P2P Device interface
The P2P Device interface can only send Public Action frames. Non-Public
Action frames must be sent over a group interface. The previous
implementation sometimes tried to send non-Public Action frames such as
GO Discoverability over the P2P Device interface, however, the source
address of the frame was set to the group interface address so the code
in offchannel.c knew to select the correct interface for the TX.

The check breaks when the P2P Device and group interfaces have the same
MAC address. In this case the frame will be sent over the P2P Device
interface and the send will fail.

Fix this problem in two places:
1. In offchannel, route non-Public Action frames to the GO
   interface when the above conditions are met.
2. When a TX_STATUS event arrives on such routed frame, it will
   arrive on the GO interface but it must be handled by the P2P Device
   interface since it has the relevant state logic.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-05-21 00:17:45 +03:00
Kanchanapally, Vidyullatha
4d916ed6c5 nl80211: Register for only for specific Action frames in AP mode
This makes changes such that hostapd (and wpa_supplicant AP mode)
registers to kernel for specific Action frames instead of generically
registering for all Action frames. This makes it easier for other
programs to register for some Action frames that hostapd does not handle
today without having to somehow coordinate directly with hostapd.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-21 00:07:42 +03:00
Jouni Malinen
a68a749322 tests: P2P group formation using P2PS method without specifying PIN
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-20 23:37:51 +03:00
Purushottam Kushwaha
31d7fb14af P2PS: Allow P2P_CONNECT command for P2PS connection with/without PIN
This allows using P2PS config method with or without PIN for connection.
wpa_supplicant should internally handle the default PIN "12345670" and
shall also allow connection irrespective of PIN used in P2P_CONNECT.

For example,
 1. P2P_CONNECT 02:2a:fb:22:22:33 p2ps
 2. P2P_CONNECT 02:2a:fb:22:22:33 xxxxxxxx p2ps
Where the second one is maintained for backwards compatibility.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-19 19:16:26 +03:00
Purushottam Kushwaha
467fc149d3 P2PS: Correct config_methods for different P2P cases
Add P2PS config flag only when config_methods are set. This restores the
pre-P2PS behavioer for the cases where Display or Keypad config method
is specified for a peer (i.e., do not add the new P2PS method in that
case).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-19 19:16:10 +03:00
Jouni Malinen
9d136b00ac EAP-SAKE: Do not debug print result if eap_sake_compute_mic() fails
This gets rid of a valgrind warning on uninitialized memory read in the
eap_proto_sake_errors test case where the result was used after the
failed eap_sake_compute_mic() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 22:26:37 +03:00
Jouni Malinen
0884633577 EAP-PAX: Do not debug print result if eap_pax_mac() fails
This gets rid of a valgrind warning on uninitialized memory read in the
eap_proto_pax_errors test case where the result was used after the
failed eap_pax_mac() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 22:25:25 +03:00
Jouni Malinen
92abe3782f EAP-FAST: Check sha1_t_prf() result in eap_fast_get_cmk()
This gets rid of a valgrind warning on uninitialized memory read in the
eap_proto_fast_errors test case where the result was used after the
failed sha1_t_prf() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 22:24:01 +03:00
Jouni Malinen
636a23881b WPS: Check sha256_vector() result in wps_build_oob_dev_pw()
This gets rid of a valgrind warning on uninitialized memory read in the
wpas_ctrl_error test case where the result was used after the failed
sha256_vector() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 21:06:44 +03:00
Jouni Malinen
2c3d95c7e0 Check md5_vector() result in decrypt_ms_key()
This gets rid of a valgrind warning on uninitialized memory read in the
hostapd_oom_wpa2_eap_connect test case where the result is used after
failed md5_vector() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 20:08:53 +03:00
Jouni Malinen
38eee0f599 Check hmac_md5() result in radius_msg_verify_msg_auth()
This gets rid of a valgrind warning on uninitialized memory read in the
hostapd_oom_wpa2_eap_connect test case where memcmp is used after failed
hmac_md5() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 20:07:58 +03:00
Jouni Malinen
05dad946b3 Check md5_vector() result in radius_msg_verify()
This gets rid of a valgrind warning on uninitialized memory read in the
hostapd_oom_wpa2_eap test case where memcmp is used after failed
md5_vector() call.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 20:07:53 +03:00
Jouni Malinen
aae125e2cf WPS: Fix debug prints in wps_derive_psk() error case
Check for hmac_sha256() failures and exit from wps_derive_psk() without
printing out the derived keys if anything fails. This removes a valgrind
warning on uninitialized value when running the ap_wps_m3_oom test case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 19:35:03 +03:00
Jouni Malinen
7d1007a674 Fix external radio work debug printing on removal
work->type was pointing to the allocated work->ctx buffer and the debug
print in radio_work_free() ended up using freed memory if a started
external radio work was removed as part of FLUSH command operations. Fix
this by updating work->type to point to a constant string in case the
dynamic version gets freed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-16 19:04:54 +03:00
Jouni Malinen
f260ce4be8 tests: wpa_supplicant AP mode - WPS disabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-14 19:43:30 +03:00
Lior David
b6317b417f wpa_supplicant: Add wps_disabled parameter to network block
Add a new parameter wps_disabled to network block (wpa_ssid). This
parameter allows WPS functionality to be disabled in AP mode.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-05-14 19:43:30 +03:00
Jouni Malinen
23d71a0286 Set wpa_psk_set in wpa_supplicant AP mode is PSK is available
While this is unlikely to make any practical difference, it is better to
keep consistent with hostapd configuration parser.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-14 19:43:30 +03:00
Jouni Malinen
6641954321 Fix AP mode key_mgmt configuration in wpa_supplicant default case
If the network profile key_mgmt parameter was not set, wpa_supplicant
defaulted to enabling both WPA-PSK and WPA-EAP. This is not correct for
AP mode operations, so remove WPA-EAP in such a case to fix WPA-PSK
without explicit key_mgmt parameter.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-14 19:43:30 +03:00
Jouni Malinen
ad6cee3fa0 P2P: Do not enable P2P group processing for non-P2P AP mode
wpa_supplicant was starting P2P group processing for all AP mode
interfaces in CONFIG_P2P=y builds. This is unnecessary and such
operations should be enabled only for actual GO interfaces.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-14 19:43:30 +03:00
Jouni Malinen
50d06776c6 tests: Fix WEXT testing
Commit afb2e8b891 ('tests: Store P2P
Device ifname in class WpaSupplicant') did not take into account the
possibility of capa.flags not existing in get_driver_status() and broke
WEXT test cases. Fix this by checking that capa.flags is present before
looking at its value.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-05-14 18:59:47 +03:00
Janusz Dziedzic
a185e9b10b tests/remote: Add hwsim wrapper
This allow to run hwsim test cases.

duts go to apdev while refs go to dev

For now I tested:
./run-tests.py -d hwsim0 -r hwsim1 -h ap_open -h dfs
./run-tests.py -r hwsim0 -r hwsim1 -h ibss_open -v
./run-tests.py -r hwsim0 -r hwsim1 -r hwsim2 -d hwsim3 -d hwsim4 -h ap_vht80 -v
./run-tests.py -r hwsim0 -r hwsim1 -r hwsim2 -d hwsim3 -d hwsim4 -h all -k ap -k vht

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:56:37 +03:00
Janusz Dziedzic
ff9bb8a210 tests/remote: Add test_example.py
This is simple example how to write a simple test case.

modprobe mac80211_hwsim radios=4
run example:
./run-tests.py -d hwsim0 -r hwsim1 -t example

run example with monitors:
./run-tests.py -d hwsim0 -r hwsim1 -t example -m all -m hwsim2

run example with trace record:
./run-tests.py -d hwsim0 -r hwsim1 -t example -T

run example with trace and perf:
./run-tests.py -d hwsim0 -r hwsim1 -t example -T -P

restart hw before test case run:
./run-tests.py -d hwsim0 -r hwsim1 -t example -R

run example verbose
./run-tests.py -d hwsim0 -r hwsim1 -t example -v

For perf/trace you need to write own hw specyfic scripts:
trace_start.sh, trace_stop.sh
perf_start.sh, perf_stop.sh

In any case you will find logs in the logs/current/ directory.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:56:37 +03:00
Janusz Dziedzic
a73fa13be2 tests/remote: Add utils file
Add rutils.py for remote tests.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:56:37 +03:00
Janusz Dziedzic
ede4719718 tests/remote: Add monitor.py
Add monitor support. This supports monitors added to the current
interfaces. This also support standalone monitor with multi interfaces
support. This allows to get logs from different channels at the same
time to one pcap file.

Example of t3-monitor added to config.py file.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:56:37 +03:00
Janusz Dziedzic
5865186e31 tests: Add remote directory to tests
Add tests/remote directory and files:
config.py - handle devices/setup_params table
run-tests.py - run test cases
test_devices.py - run basic configuration tests

You can add own configuration file, by default this is cfg.py, and put
there devices and setup_params definition in format you can find in
config.py file. You can use -c option or just create cfg.py file.

Print available devices/test_cases:
./run-tests.py

Check devices (ssh connection, authorized_keys, interfaces):
./run-test.py -t devices

Run sanity tests (test_sanity_*):
./run-test.py -d <dut_name> -t sanity

Run all tests:
./run-tests.py -d <dut_name> -t all

Run test_A and test_B:
./run-tests.py -d <dut_name> -t "test_A, test_B"

Set reference device, and run sanity tests:
./run-tests.py -d <dut_name> -r <ref_name> -t sanity

Multiple duts/refs/monitors could be setup:
e.g.
./run-tests.py -d <dut_name> -r <ref1_name> -r <ref2_name> -t sanity

Monitor could be set like this:
./run-tests.py -d <dut_name> -t sanity -m all -m <standalone_monitor>

You can also add filters to tests you would like to run
./run-tests.py -d <dut_name> -t all -k wep -k g_only
./run-tests.py -d <dut_name> -t all -k VHT80

./run-test.py doesn't start/terminate wpa_supplicant or hostpad,
test cases are resposible for that, while we don't know test
case requirements.

Restart (-R) trace (-T) and perf (-P) options available.
This request trace/perf logs from the hosts (if possible).

As parameters each test case get:
- devices - table of available devices
- setup_params
- duts - names of DUTs should be tested
- refs - names of reference devices should be used
- monitors - names of monitors list

Each test could return append_text.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:56:35 +03:00
Janusz Dziedzic
6a003eb2a6 tests: remotehost.py use join
Use join instead of for.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-05-14 17:19:59 +03:00
Ilan Peer
3b11ad34eb Send CTRL-EVENT-REGDOM-CHANGE event on the parent interface
The NL80211_CMD_WIPHY_REG_CHANGE can be handled by any of the
interfaces that are currently controlled by the wpa_supplicant.
However, some applications expect the REGDOM_CHANGE event to be
sent on the control interface of the initially added interface
(and do not expect the event on any of child interfaces).

To resolve this, when processing NL80211_CMD_WIPHY_REG_CHANGE,
find the highest parent in the chain, and use its control interface
to emit the CTRL-EVENT-REGDOM-CHANGE event.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-05-14 17:19:02 +03:00
Jouni Malinen
df49b90e35 tests: Secure mesh and the first plink Open dropped
This is a regression test case to verify that MTK is calculated properly
also in this unexpected sequence.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-13 20:54:51 +03:00
Jouni Malinen
4de70e2330 Add MGMT_RX_PROCESS test command for wpa_supplicant
This makes it easier to write hwsim test cases to verify management
frame processing sequences with dropped or modified frames. When
ext_mgmt_frame_handling is used, this new command can be used to request
wpa_supplicant to process a received a management frame, e.g., based on
information reported in the MGMT-RX events.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-13 20:54:51 +03:00
Peter Oh
f42c3ceb94 mesh: Calculate MTK before sending it to MAC in case Open is dropped
IEEE Std 802.11-2012 13.5.6.3 State transitions require an action
sending SETKEYS primitive to MAC when OPN_ACPT event occurs in CNF_RCVD
state in case of AMPE is used, but since MTK calculation is missed in
this condition, all zero valued key are passed to MAC and cause unicast
packet decryption error. This could happen if the first transmission of
plink Open frame is dropped and Confirm frame is processed first
followed by retransmitted Open frame.

Fix this by calculating the MTK also in this sequence of unexpected
messages.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2016-05-13 20:54:51 +03:00
Peter Oh
baa1213649 mesh: Add missing action to cancel timer
IEEE Std 802.11-2012 Table 13-2, MPM finite state machine requires to
clear retryTimer when CNF_ACPT event occurs in OPN_SNT state which is
missing, so add it to comply with the standard.

This was found while debugging an MTK issue and this commit fixes a
potential issue that mesh sends invalid event (PLINK_OPEN) which will
lead another invalid timer register such as MeshConfirm Timer. This
behaviour might lead to undefined mesh state.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2016-05-13 19:57:15 +03:00
Saurav Babu
e8a1b6b8e9 D-Bus: Check driver capability for IBSS in Modes property of Capabilities
Instead of hardcoding "ad-hoc" in the array of supported capabilities,
add this only if the driver indicates support for IBSS.

Signed-off-by: Saurav Babu <saurav.babu@samsung.com>
2016-05-13 18:53:04 +03:00
SiWon Kang
7a1887faec wpa_cli: Add backspace key process for some terminal
In some terminal, verified with gtkterm and teraterm, backspace key is
not properly processed. For instance, type 'abc', 3 times of backspace
key press then '123' shows the result of 'abc123' instead of '123'. To
fix this, add a routine to process '\b' character input when using
edit_simple.c instead of edit.c (i.e., without CONFIG_WPA_CLI_EDIT=y).

Signed-off-by: Siwon Kang <kkangshawn@gmail.com>
2016-05-13 18:48:45 +03:00
Johannes Berg
3dd0e9e4e4 wpa_supplicant: Fix CONFIG_AP build without CTRL_IFACE
wpas_ap_pmksa_cache_list() and wpas_ap_pmksa_cache_flush() should be
under the #ifdef since they're only called for the control iface and
use functionality that otherwise isn't available.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
2016-05-13 18:31:01 +03:00
Johannes Berg
d58b60da87 drivers: Add NEED_RADIOTAP
If there's ever a driver that, like nl80211, requires radiotap,
we need to have a NEED_RADIOTAP variable to avoid trying to link
the radiotap helpers twice. Introduce that.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
2016-05-13 18:29:01 +03:00
Jouni Malinen
6a9681e90c OpenSSL: Make dh5_init() match the generic implementation
Commit 4104267e81 ('Fix memory leak on NFC
DH generation error path') modified the generic (non-OpenSSL)
implementation of dh5_init() to free the previously assigned public key,
if any. However, that commit did not modify the OpenSSL specific version
of this function. Add the same change there to maintain consistent
behavior between these two implementations of the same function.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-13 18:25:57 +03:00
Rujun Wang
46bac6520d WPS: Fix segmentation fault in new DH key derivation
Commit 4104267e81 ('Fix memory leak on NFC
DH generation error path') modified dh5_init() behavior in the
non-OpenSSL implementation to free the public key (if any was previously
set). However, this did not update one of the callers to make sure the
publ argument in the call is initialized. This could result in trying to
free invalid pointer and segmentation fault when hostapd or
wpa_supplicant was built against some other crypto library than OpenSSL.

Signed-off-by: Rujun Wang <chinawrj@gmail.com>
2016-05-13 18:25:47 +03:00
David Benjamin
e4471338c6 OpenSSL: BoringSSL has SSL_get_client_random(), etc.
BoringSSL added OpenSSL 1.1.0's SSL_get_client_random() and friends in
working towards opaquifying the SSL struct. But it, for the moment,
still looks more like 1.0.2 than 1.1.0 and advertises
OPENSSL_VERSION_NUMBER as such. This means that there is no need to
define those in BoringSSL and defining them causes conflicts. (C does
not like having static and non-static functions with the same name.)

As requested, this is conditioned on defined(BORINGSSL_API_VERSION) so
wpa_supplicant may continue to support older BoringSSLs for a time.
(BoringSSL revisions without the accessors predate BoringSSL maintaining
a BORINGSSL_API_VERSION.)

Also add a missing opensslv.h include. tls_openssl.c is sensitive to
OPENSSL_VERSION_NUMBER, so it should include the header directly rather
than rely on another header to do so.

Signed-off-by: David Benjamin <davidben@google.com>
2016-05-10 19:36:46 +03:00
Jouni Malinen
9524e7e5a4 tests: Open network connection with pmf=2
This verifies that pmf=2 is ignored for a non-RSN network while a
network profile specific ieee80211w=2 is enforced.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-06 00:35:08 +03:00
Sunil Dutt
03626e9157 Skip connection attempt for non-RSN networks if PMF is set to required
Since ieee80211w=2 is an explicit configuration to wpa_supplicant, the
connection attempt for such non-PMF (non-RSN) capable networks should be
skipped.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-05 21:09:08 +03:00
Jouni Malinen
22950049e4 Ignore pmf=1/2 parameter for non-RSN networks
PMF is available only with RSN and pmf=2 could have prevented open
network connections. Change the global wpa_supplicant pmf parameter to
be interpreted as applying only to RSN cases to allow it to be used with
open networks.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-05 21:09:08 +03:00
Jouni Malinen
2dc754e170 tests: wpa_supplicant config file parsing of arbitrary global values
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-02 11:08:25 +03:00
Jouni Malinen
2a3f56502b Reject SET commands with newline characters in the string values
Many of the global configuration parameters are written as strings
without filtering and if there is an embedded newline character in the
value, unexpected configuration file data might be written.

This fixes an issue where wpa_supplicant could have updated the
configuration file global parameter with arbitrary data from the control
interface or D-Bus interface. While those interfaces are supposed to be
accessible only for trusted users/applications, it may be possible that
an untrusted user has access to a management software component that
does not validate the value of a parameter before passing it to
wpa_supplicant.

This could allow such an untrusted user to inject almost arbitrary data
into the configuration file. Such configuration file could result in
wpa_supplicant trying to load a library (e.g., opensc_engine_path,
pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user
controlled location when starting again. This would allow code from that
library to be executed under the wpa_supplicant process privileges.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-02 11:08:25 +03:00
Jouni Malinen
596a3fef83 tests: Use \t instead of \n in discovery_ctrl_char_in_devname
This is needed to allow the SET command to be modified to reject newline
characters.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-05-02 11:08:25 +03:00