Commit graph

10518 commits

Author SHA1 Message Date
Jouni Malinen
446dd7486c tests: REQ_HS20_ICON and DEL_HS20_ICON
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-19 18:34:01 +02:00
Jan Nordqvist
8dd5c1b4e9 HS 2.0: Add a command to retrieve icon with in-memory storage
This adds a new command based Hotspot 2.0 icon retrieval option.

In short, here is the new command sequence:
1. REQ_HS20_ICON <bssid> <file-name>
2. event: RX-HS20-ICON <bssid> <file-name> <size>
3. GET_HS20_ICON <bssid> <file-name> <offset> <size>
   (if needed, repeat with larger offset values until full icon is
   fetched)
5. DEL_HS20_ICON <bssid> <file-name>

REQ_HS20_ICON is a new command that is analogous to HS20_ICON_REQUEST
with the slight difference that an entry to store the icon in memory is
prepared. The RX-HS20-ICON event has been augmented with BSSID,
file-name and size, and GET_HS20_ICON is used to retrieve a chunk of up
to <size> bytes of icon data at offset <offset>. Each chunk is returned
as a base64 encoded fragment, preceded by "HS20-ICON-DATA", BSSID, and
file-name as well as the starting offset of the data.

If there is no entry prepared for the icon when the ANQP result comes
back, hs20_process_icon_binary_file falls back to legacy behavior.

Finally the DEL_HS20_ICON command deletes (all) icons associated with
BSSID and file-name (there could be several if retries are used and they
have different dialog tokens).

Signed-off-by: Jan Nordqvist <jannq@google.com>
2015-12-19 18:34:01 +02:00
Ilan Peer
2e99239bd9 tests: Add rfkill tests for P2P Device operations
Add a couple of tests for rfkill with P2P Device operations
(with and without P2P Device interface).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-18 22:26:18 +02:00
Johannes Berg
0e92fb8fae rfkill: Match only the correct expected wiphy rfkill
On systems that have multiple WLAN rfkill instances, the rfkill code
can become confused into thinking that the device was unblocked when
in fact it wasn't, because it only matches on the WLAN type.

Since it then stores the new (unblocked) state from the wrong rfkill
instance, it will never retry the failing IFF_UP operation and the
user has to toggle rfkill again, or otherwise intervene manually, in
this case to get back to operational state.

Fix this by using the existing (but unused) ifname argument when the
rfkill instance is created to match to a specific rfkill index only.

As a P2P Device interface does not have a netdev interface associated
with it, use the name of a sibling interface to initialize the rfkill
context for the P2P Device interface. For nl80211, as the wiphy index
is known only after getting the driver capabilities from the kernel,
move the initialization of the rfkill object to
wpa_driver_nl80211_finish_drv_init().

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-18 22:26:18 +02:00
Ilan Peer
6da504a1f5 nl80211: Handle rfkill for P2P Device interface
The rfkill processing in nl80211 driver assumes that the
INTERFACE_ENABLED/DISABLED will be also issued, so does not do much in
the rfkill callbacks. However, as a P2P Device interface is not
associated with a network interface, these events are not issued for it.

Handle rfkill events for the P2P_DEVICE interface by faking the
INTERFACE_ENABLED/DISABLED.

Signed-off-by: Moshe Benji <Moshe.Benji@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-18 22:26:18 +02:00
Jouni Malinen
9f052d805d tests: Prepare ap_open_out_of_memory for modified rfkill init path
The rfkill initialization will be moved out from
wpa_driver_nl80211_drv_init() which would break one step in this OOM
test case due to the memory allocation not existing anymore. Fix this by
skipping that OOM step to avoid causing false failures with the
following commits.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 22:26:18 +02:00
Jouni Malinen
27f6b03115 tests: wpa_supplicant SIGNAL_MONITOR command
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 21:02:37 +02:00
Dmitry Shmidt
96e8d831a5 wpa_supplicant: Add SIGNAL_MONITOR command
SIGNAL_MONITOR THRESHOLD=DD HYSTERESIS=DD command will request signal
strength monitoring events based on there having been requested amount
of drop in the signal strength. The threshold value is the RSSI
threshold in dBm for the event to be sent. 0 threshold can be used to
disable monitoring. The hysteresis value is RSSI hysteresis in dB to
specify the minimum amount of change before a consecutive event is
reported.

With nl80211 driver interface, these values map to the
NL80211_CMD_SET_CQM command with NL80211_ATTR_CQM_RSSI_THOLD and
NL80211_ATTR_CQM_RSSI_HYST attributes to the driver.

This command cannot be used when bgscan module is in use since that
depends on being able to control the connection monitoring parameters.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2015-12-18 21:02:37 +02:00
Matti Gottlieb
2c0d0ae370 GAS: End remain-on-channel due to delayed GAS comeback request
During the sequence of exchanging GAS frames with the AP, the AP can
request to come back in X amount of time and resend the GAS request.

Previously, wpa_supplicant did not terminate the remain-on-channel
session, but rather waited until the requested comeback delay had
expired, and then tried to send the GAS frame (potentially to save the
time that is required to schedule a new remain on channel flow).

This might cause unnecessary idle time (can be close to 1000 ms) in
which the device might be off-channel. Ending the current
remain-on-channel session and then rescheduling makes better usage of
the time in this case.

End remain-on-channel session due to receiving a delayed GAS comeback
request from the AP.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2015-12-18 20:32:53 +02:00
Arik Nemtsov
dabdef9e04 TDLS: Ignore incoming TDLS Setup Response retries
The Setup Response timer is relatively fast (500 ms) and there are
instances where it fires on the responder side after the initiator has
already sent out the TDLS Setup Confirm frame. Prevent the processing of
this stale TDLS Setup Response frame on the initiator side.

Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
2015-12-18 20:32:39 +02:00
Jouni Malinen
0fc5707dde hlr_auc_gw: Simplify string parsers with str_token()
The helper function allows these string parsers to be made much simpler.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 20:13:39 +02:00
Jouni Malinen
d67e63d5a0 hlr_auc_gw: Fix a typo in an error message
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 19:56:21 +02:00
Jouni Malinen
59e71209f5 hlr_auc_gw: Remove unnecessary assignment
The pos variable is not used after the final parsed item, so no need to
set it here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 19:55:01 +02:00
Jouni Malinen
6e9554e307 tests: Detect invitation GO issues more quickly
This speeds up and clarifies error reporting for cases where the GO
fails to start in invitation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-18 16:14:55 +02:00
Eliad Peller
685ea2f60c wpa_cli: Send ALL_STA command to the correct interface
wpa_ctrl_command_sta(), called by the "ALL_STA" handler, didn't consider
ifname_prefix, resulting in various commands being sent to the global
control interface, rather than the specified interface when IFNAME=
prefix was used.

This in turn caused the unexpected "UNKNOWN COMMAND" result be
considered as valid station, resulting in infinite loop while trying to
get all stations.

Fix it by considering ifname_prefix, similarly to _wpa_ctrl_command().

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
2015-12-18 00:24:52 +02:00
Ayala Beker
0e6a2cf282 Disconnect before trying to switch to a different network
Previously, when wpa_supplicant received bgscan results with a preferred
network, it connected to that network without disconnecting from the
previous one. This might result in an inconsistent state of upper
layers.

Fix this by disconnecting from the current AP before connecting to the
new one when the network profile changes and there is an existing
connection.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-12-18 00:24:52 +02:00
Arik Nemtsov
706e11a485 Avoid network selection from scan during connection
If scan results arrive during the connection process, the network
selection function was called, interrupting the current connection.
While a regular scan is mutually exclusive with connection establishment
via the nature of radio work, there's no such protection for scheduled
scan. Prevent network selection while a connection is in progress.

Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
2015-12-18 00:24:52 +02:00
Ayala Beker
819ad5b70b utils: Fix NULL pointer dereference with unexpected kernel behavior
Fix mostly theoretical NULL pointer dereference in
wpa_debug_open_linux_tracing() if /proc/mounts were to return a
malformed line.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-12-18 00:24:52 +02:00
Ayala Beker
1b3dd69d93 P2P: Fix possible NULL pointer dereference
Fix wpas_p2p_invite() to call p2p_set_own_pref_freq_list() after the
NULL check, to avoid NULL pointer dereference if P2P initialization were
to have failed or P2P module getting deinitialized.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-12-18 00:24:51 +02:00
Johannes Berg
05736da8c6 tests: vm: Honor EPATH in uevent.sh
This is useful for testing CRDA since it means you can use EPATH to
redirect the test scripts to a different crda binary.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-18 00:24:51 +02:00
Jouni Malinen
c4e06b9b7b tests: EAP-TTLS with invalid phase2 parameter values
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 00:24:51 +02:00
Pali Rohár
f24e48861d EAP-TTLS peer: Fix parsing auth= and autheap= phase2 params
This patch fixes an issue with an invalid phase2 parameter value
auth=MSCHAPv2 getting interpreted as auth=MSCHAP (v1) which could
degrade security (though, only within a protected TLS tunnel). Now when
invalid or unsupported auth= phase2 parameter combinations are
specified, EAP-TTLS initialization throws an error instead of silently
doing something.

More then one auth= phase2 type cannot be specified and also both auth= and
autheap= options cannot be specified.

Parsing phase2 type is case sensitive (as in other EAP parts), so phase2
parameter auth=MSCHAPv2 is invalid. Only auth=MSCHAPV2 is correct.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
[Use cstr_token() to get rid of unnecessary allocation; cleanup]
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-18 00:24:30 +02:00
Matt Woods
47c1de20a4 atheros: Unify memory processing functions
There are two types of memory processing functions in the file
atheros_driver.c, such as memory and os_memory. Unify the processing
functions into one type which has the prefix "os_".

Signed-off-by: Matt Woods <matt.woods@aliyun.com>
2015-12-17 23:29:25 +02:00
Jouni Malinen
d386a9ace8 tests: TDLS with VHT 80, 80+80, and 160
This adds more coverage for TDLS testing for a case where the direct
link should use various VHT channel bandwidths.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-17 21:20:02 +02:00
Jouni Malinen
d06a35052f mesh: Fix VHT Operation information in peering messages
The full VHT channel information was not set in the hostapd data
structures which resulted in incorrect information (all zeros) being
used when building the VHT Operation element for peering messages while
the actual driver mode was set with the full details. We did not seem to
use the VHT information from peering messages, so this does not change
behavior with another wpa_supplicant-based mesh implementation. Anyway,
these elements should match the ones used in Beacon frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-17 21:20:02 +02:00
Jouni Malinen
7e40a8812b tests: Verify SIGNAL_POLL values in ap_vht80
This confirms that the station recognized and negotiated 80 MHz
channel use with VHT.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-17 21:20:02 +02:00
Jouni Malinen
138903f91f tests: Run OCSP test cases with internal TLS library
There is no sufficient OCSP support to go through these test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 21:19:59 +02:00
Jouni Malinen
8ba8c01d0c TLS: Report OCSP rejection cases when no valid response if found
This adds a CTRL-EVENT-EAP-TLS-CERT-ERROR and CTRL-EVENT-EAP-STATUS
messages with 'bad certificate status response' for cases where no valid
OCSP response was received, but the network profile requires OCSP to be
used.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 11:47:38 +02:00
Jouni Malinen
f163ed8bae TLS: Process OCSP SingleResponse(s)
This completes OCSP stapling support on the TLS client side. Each
SingleResponse value is iterated until a response matching the server
certificate is found. The validity time of the SingleResponse is
verified and certStatus good/revoked is reported if all validation step
succeed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 11:28:38 +02:00
Jouni Malinen
8e3271dcd1 TLS: Store DER encoded version of Subject DN for X.509 certificates
This is needed for OCSP issuerNameHash matching.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 11:28:38 +02:00
Jouni Malinen
32ce69092e TLS: Share digest OID checkers from X.509
These will be used by the OCSP implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 11:28:38 +02:00
Jouni Malinen
b72a36718f TLS: Support longer X.509 serialNumber values
This extends the old support from 32 or 64 bit value to full 20 octets
maximum (RFC 5280, 4.1.2.2).

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 01:41:45 +02:00
Jouni Malinen
58a406202a tests: OCSP certificate signed OCSP response using key ID
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 00:49:26 +02:00
Jouni Malinen
af4eba16ce TLS: Parse and validate BasicOCSPResponse
This adds the next step in completing TLS client support for OCSP
stapling. The BasicOCSPResponse is parsed, a signing certificate is
found, and the signature is verified. The actual sequence of OCSP
responses (SignleResponse) is not yet processed in this commit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-17 00:48:34 +02:00
Jouni Malinen
8e416cecdb tests: Make key-lifetime-in-memory more robust for GTK check
The decrypted copy of a GTK from EAPOL-Key is cleared from memory only
after having sent out CTRL-EVENT-CONNECTED. As such, there was a race
condition on the test case reading the wpa_supplicant process memory
after the connection. This was unlikely to occur due to the one second
sleep, but even with that, it would be at least theorically possible to
hit this race under heavy load (e.g., when using large number of VMs to
run parallel testing). Avoid this by running a PING command to make sure
wpa_supplicant has returned to eloop before reading the process memory.
This should make it less likely to report false positives on GTK being
found in memory.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-14 17:23:47 +02:00
Jouni Malinen
f089cdf98e tests: Add more memory details on key-lifetime-in-memory
This makes it easier to see where in memory the key was found and what
there is in memory around that location.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-14 15:49:01 +02:00
Jouni Malinen
06f14421ea TLS: Parse OCSPResponse to extract BasicOCSPResponse
This adds the next step for OCSP stapling. The received OCSPResponse is
parsed to get the BasicOCSPResponse. This commit does not yet process
the BasicOCSPResponse.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
d560288a44 TLS: Parse CertificateStatus message
This allows the internal TLS client implementation to accept
CertificateStatus message from the server when trying to use OCSP
stapling. The actual OCSPResponse is not yet processed in this commit,
but the CertificateStatus message is accepted to allow the TLS handshake
to continue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
eeba168453 TLS: Add status_request ClientHello extension if OCSP is requested
This allows the internal TLS implementation to request server
certificate status using OCSP stapling. This commit is only adding code
to add the request. The response is not yet used.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
4303d531a8 TLS: Parse ServerHello extensions
This prints the received ServerHello extensions into the debug log and
allows handshake to continue even if such extensions are included.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
16c43d2a8f tests: Run PKCS#12 tests with internal TLS crypto
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
6b7bb42923 TLS: Add minimal support for PKCS #12
This allows the internal TLS implementation to parse a private key and a
certificate from a PKCS #12 file protected with
pbeWithSHAAnd3-KeyTripleDES-CBC.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
5ce2941bfe TLS: Extend PKCS #5 to support PKCS #12 style key decryption
This adds support for decrypting private keys protected with the old
PKCS #12 mechanism using OID pbeWithSHAAnd3-KeyTripleDES-CBC.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
f6a62df8e1 TLS: Fix and complete ASN.1 tag list
One of the unused defines had incorrect value and couple of tags were
missing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-13 22:12:07 +02:00
Jouni Malinen
ca27ee0998 tests: External server certificate chain validation
This tests tls_ext_cert_check=1 behavior with EAP-TLS, EAP-TTLS,
EAP-PEAP, and EAP-FAST.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-13 21:12:20 +02:00
Jouni Malinen
3c108b7573 EAP peer: External server certificate chain validation
This adds support for optional functionality to validate server
certificate chain in TLS-based EAP methods in an external program.
wpa_supplicant control interface is used to indicate when such
validation is needed and what the result of the external validation is.

This external validation can extend or replace the internal validation.
When ca_cert or ca_path parameter is set, the internal validation is
used. If these parameters are omitted, only the external validation is
used. It needs to be understood that leaving those parameters out will
disable most of the validation steps done with the TLS library and that
configuration is not really recommend.

By default, the external validation is not used. It can be enabled by
addingtls_ext_cert_check=1 into the network profile phase1 parameter.
When enabled, external validation is required through the CTRL-REQ/RSP
mechanism similarly to other EAP authentication parameters through the
control interface.

The request to perform external validation is indicated by the following
event:
CTRL-REQ-EXT_CERT_CHECK-<id>:External server certificate validation needed for SSID <ssid>

Before that event, the server certificate chain is provided with the
CTRL-EVENT-EAP-PEER-CERT events that include the cert=<hexdump>
parameter. depth=# indicates which certificate is in question (0 for the
server certificate, 1 for its issues, and so on).

The result of the external validation is provided with the following
command:
CTRL-RSP-EXT_CERT_CHECK-<id>:<good|bad>

It should be noted that this is currently enabled only for OpenSSL (and
BoringSSL/LibreSSL). Due to the constraints in the library API, the
validation result from external processing cannot be reported cleanly
with TLS alert. In other words, if the external validation reject the
server certificate chain, the pending TLS handshake is terminated
without sending more messages to the server.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 18:24:27 +02:00
Jouni Malinen
be90370bd5 tests: Fix wpas_ctrl_country and dbus_country with valid db.txt
init=CORE was previously used due to invalid db.txt data for 00. For
now, allow both it and the new init=USER after fixed db.txt.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 12:45:30 +02:00
Jouni Malinen
5b7784a89c tests: EAP-FAST local error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 12:42:44 +02:00
Jouni Malinen
b6e5e14fd4 EAP-FAST peer: Fix PAC parser error messages
Do not override the parsing error with the "PAC block not terminated
with END" message if the reason for the END line not yet being seen is
in failure to parse an earlier line.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 12:00:28 +02:00
Jouni Malinen
5b904b3e42 EAP-FAST: Check T-PRF result in MSK/EMSK derivation
Pass the error return from sha1_t_prf() to callers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 11:20:05 +02:00