Commit graph

16582 commits

Author SHA1 Message Date
Jouni Malinen
0c4ffce464 Allow transition_disable updates during the lifetime of a BSS
This is mainly for testing purposes to allow more convenient checking of
station behavior when a transition mode is disabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 17:06:52 +03:00
Jouni Malinen
6d72833236 tests: SAE-PK mixed deployment
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 16:50:09 +03:00
Jouni Malinen
5f48d36b4a SAE-PK: Select SAE-PK network over SAE without PK
If there is an acceptable BSS with SAE-PK enabled in the same ESS,
select that over a BSS that does not enable SAE-PK when the network
profile uses automatic SAE-PK selection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 16:49:07 +03:00
Jouni Malinen
d654ca24de Clean up wpa_scan_res_match()
Move the BSS-against-SSID matching into a separate helper function to
make this overly long function a bit more readable and to allow that
helper function to be used for other purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 16:30:32 +03:00
Jouni Malinen
0f2d5867e3 tests: SAE-PK password, but no PK on AP
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 12:04:14 +03:00
Jouni Malinen
f179475bf7 tests: Share a single definition of SAE-PK Sec=2 values
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 12:01:52 +03:00
Jouni Malinen
5ee94a997e tests: Replace sae_pk_only with sae_pk to match implementation
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 11:55:16 +03:00
Jouni Malinen
9ad010c290 SAE-PK: Allow automatic SAE-PK to be disabled
This replaces the previously used sae_pk_only configuration parameter
with a more generic sae_pk that can be used to specify how SAE-PK is
negotiated. The default behavior (sae_pk=0) is to automatically
negotiate SAE-PK whenever the AP supports it and the password is in
appropriate format. sae_pk=1 allows only SAE-PK to be used and sae_pk=2
disables SAE-PK completely.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 11:55:16 +03:00
Purushottam Kushwaha
85ca13ebcf wpa_cli: Add all_bss command to print all scan results (BSS entries)
The wpa_supplicant control interface returns maximum of 4 kB of response
data and, thus, limits maximum number of scan entries as part of
SCAN_RESULTS to approximately 60. Add a new all_bss command to use a
more robust iteration of the BSS table entries with the BSS command to
to get all scan entries and print them in the same format as the
scan_results command.

Signed-off-by: Purushottam Kushwaha <pkushwah@codeaurora.org>
2020-06-06 17:07:24 +03:00
Jouni Malinen
f38146e559 tests: PMKSA cache control interface for external management (FT)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 16:48:57 +03:00
Jouni Malinen
215b4d8a72 FT: Do not add PMKID to the driver for FT-EAP if caching is disabled
wpa_supplicant disables PMKSA caching with FT-EAP by default due to
known interoperability issues with APs. This is allowed only if the
network profile is explicitly enabling caching with
ft_eap_pmksa_caching=1. However, the PMKID for such PMKSA cache entries
was still being configured to the driver and it was possible for the
driver to build an RSNE with the PMKID for SME-in-driver cases. This
could result in hitting the interop issue with some APs.

Fix this by skipping PMKID configuration to the driver fot FT-EAP AKM if
ft_eap_pmksa_caching=1 is not used in the network profile so that the
driver and wpa_supplicant behavior are in sync for this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 16:48:57 +03:00
Min Liu
5cf91afeeb QCA vendor attribute for dynamic bandwidth adjustment
Define QCA vendor attribute in SET(GET)_WIFI_CONFIGURATION to
dynamically configure capabilities for dynamic bandwidth adjustment.

Signed-off-by: Min Liu <minliu@codeaurora.org>
2020-06-06 15:18:13 +03:00
Min Liu
1a28589b28 QCA vendor attributes for setting channel width
Define QCA vendor attribute in SET(GET)_WIFI_CONFIGURATION to
dynamically configure capabilities for channel width.

Signed-off-by: Min Liu <minliu@codeaurora.org>
2020-06-06 15:18:13 +03:00
Tanmay Garg
63653307df Add support for indicating missing driver AKM capability flags
Add support for missing driver AKM capability flags from the list of
RSN_AUTH_KEY_MGMT_* flags and make these available through the
'GET_CAPABILITY key_mgmt' control interface command.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Veerendranath Jakkam
18f3f99ac4 Add vendor attributes to configure testing functionality for FT/OCV/SAE
Add new QCA vendor attributes to configure RSNXE Used (FTE), ignore CSA,
and OCI frequency override with QCA vendor command
QCA_NL80211_VENDOR_SUBCMD_WIFI_TEST_CONFIGURATION for STA testbed role.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Min Liu
e53756a64e Fix a typo vendor attribute documentation
Fix a typo in comment of enum qca_wlan_tspec_ack_policy.

Signed-off-by: Min Liu <minliu@codeaurora.org>
2020-06-06 15:18:13 +03:00
Sunil Dutt
960e8e5334 QCA vendor attribute to configure NSS
Defines the attribute in SET(GET)_WIFI_CONFIGURATION to dynamically
configure NSS.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
747c69fa90 tests: SAE-PK transition disable indication
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
8d1cbaaff7 SAE-PK: Transition mode disabled indication processing
Allow AP to disable transition mode for SAE-PK (i.e., prevent SAE
authentication without SAE-PK).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
7937160d24 tests: Verify SAE-PK use more explicitly
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
a752695290 SAE: Add sae_h2e and sae_pk to wpa_supplicant STATUS command
This provides additional information on which options were used during
SAE authentication.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
cc22fb1b86 SAE: Move H2E and PK flags to main sae_data
This maintains knowledge of whether H2E or PK was used as part of the
SAE authentication beyond the removal of temporary state needed during
that authentication. This makes it easier to use information about which
kind of SAE authentication was used at higher layer functionality.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
bc908daace Document more network profile parameters
Some of the recently added wpa_supplicant network profile parameters
were not documented in wpa_supplicant.conf. Add these there based on the
documentation in config_ssid.h.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
4ea4df529d tests: SAE-PK only
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
1c846d647e SAE-PK: Allow SAE authentication without PK to be disabled
The new wpa_supplicant network profile parameter sae_pk_only=1 can now
be used to disable use of SAE authentication without SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
b96a4fa996 tests: Report unknown WpaSupplicant::connect() arguments
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:48:09 +03:00
Jouni Malinen
db23b8f95b tests: sigma_dut and SAE-PK
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-05 16:58:25 +03:00
Jouni Malinen
c55a52a85d tests: sigma_dut controlled GTK rekeying
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-05 15:35:44 +03:00
Jouni Malinen
37a5b50de3 tests: Fix sigma_dut ap_get_mac_address result parsing
Get only the actual BSSID part from the response string.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-05 13:41:59 +03:00
Jouni Malinen
cb43c9bfd0 tests: sigma_dut controlled AP using OCV
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-05 13:39:41 +03:00
Jouni Malinen
40240735bd WPS UPnP: Do not update Beacon frames unnecessarily on subscription removal
There is no need to update the WPS IE in Beacon frames when a
subscription is removed if that subscription is not for an actual
selected registrar. For example, this gets rids of unnecessary driver
operations when a subscription request gets rejected when parsing the
callback URLs.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-04 23:53:55 +03:00
Jouni Malinen
c85b39ec50 SAE-PK: Increment the minimum password length to 9
While this is not explicitly defined as the limit, lambda=8 (i.e., 9
characters with the added hyphen) is needed with Sec=5 to reach the
minimum required resistance to preimage attacks, so use this as an
implicit definition of the password length constraint.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-04 23:53:55 +03:00
Jouni Malinen
2c7b5a2c5f tests: Skip too short SAE-PK passwords in positive testing
Lambda >= 12 is needed with Sec = 2, so drop the shorter password
lengths in the sae_pk and module_wpa_supplicant test cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-04 23:53:33 +03:00
Jouni Malinen
d777156e1f SAE-PK: Determine hash algorithm from K_AP group instead of SAE group
While the current implementation forces these groups to be same, that is
not strictly speaking necessary and the correct group to use here is
K_AP, not the SAE authentication group.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-03 17:30:36 +03:00
Jouni Malinen
c3f894ad00 tests: Fix eapol-supp fuzzing tool build
Boolean handling was changed to use "true" instead of "TRUE", but this
location was missed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:48:37 +03:00
Jouni Malinen
fca9ef3fee tests: SAE-PK
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:48:37 +03:00
Jouni Malinen
fb09ec87f2 SAE-PK: A tool for generating SAE-PK Modifier and password
sae_pk_gen can be used to generate Modifier (M) and password for SAE-PK
based on a previously generated EC private key, Sec value (2..5), and
SSID.

For example, these commands can be used to generate the private key and
the needed hostapd configuration parameter options:

make sae_pk_gen
openssl ecparam -genkey -outform DER -out saepk.der -name prime256v1
./sae_pk_gen saepk.der 3 "SAE-PK test"

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
b6bcd74e53 Show SAE capabilities in control interface
Indicate local support for SAE H2E and SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
9bf576870e Show SAE flags in scan results
Indicate AP support for SAE H2E and SAE-PK in scan results.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
e7aeb6d8ac SAE-PK: STA functionality
This adds STA side functionality for SAE-PK. This version enables SAE-PK
automatically based on the configured SAE password value if the selected
AP advertises support for SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
20ccf97b3d SAE-PK: AP functionality
This adds AP side functionality for SAE-PK. The new sae_password
configuration parameters can now be used to enable SAE-PK mode whenever
SAE is enabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
00e4fbdcc5 tests: Module test for SAE-PK
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
6b9e99e571 SAE-PK: Extend SAE functionality for AP validation
This adds core SAE functionality for a new mode of using SAE with a
specially constructed password that contains a fingerprint for an AP
public key and that public key being used to validate an additional
signature in SAE confirm from the AP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
b6dcbd01a6 SAE-PK: Identifier definitions
Add the assigned identifiers for SAE-PK elements and fields.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 17:56:45 +03:00
Jouni Malinen
aed01b82d3 OpenSSL: Additional EC functionality for SAE-PK
These will be needed for implementing SAE-PK ECDSA signing and signature
verification operations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 17:56:45 +03:00
Jouni Malinen
30885edb7e wpaspy: Be a bit more careful on detaching the control interface
Check that the client socket is still open before trying to detach the
control interface to avoid undesired exceptions on cleanup paths on
unexpected errors due to the socket getting closed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-01 22:25:12 +03:00
Jouni Malinen
8019033fc5 tests: OCV channel mismatch validation by STA
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 00:38:03 +03:00
Jouni Malinen
8c1f61e820 OCV: Report OCI validation failures with OCV-FAILURE messages (STA)
Convert the previously used text log entries to use the more formal
OCV-FAILURE prefix and always send these as control interface events to
allow upper layers to get information about unexpected operating channel
mismatches.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 00:24:15 +03:00
Jouni Malinen
661e661186 OCV: Allow OCI channel to be overridden for testing (AP)
Add hostapd configuration parameters oci_freq_override_* to allow the
OCI channel information to be overridden for various frames for testing
purposes. This can be set in the configuration and also updated during
the runtime of a BSS.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 00:04:53 +03:00
Jouni Malinen
d10a57f6e9 DPP2: Derive a separate key for enveloped data
Derive a new key from bk to be used as the password for PBKDF2 instead
of using ke for this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-29 21:42:33 +03:00