Commit graph

15860 commits

Author SHA1 Message Date
Jouni Malinen
33a28170a3 Recognize OWE Transition Mode element in IE parser
This silences the debug log entry on unknown WFA IE being ignored.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 17:27:32 +02:00
Jouni Malinen
7e43b6cbcf tests: RSNXE mismatch in EAPOL-Key msg 3/4
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 17:06:12 +02:00
Jouni Malinen
fad0449438 Report RSNXE mismatch in EAPOL-Key msg 3/4 more consistently with RSNE
Use the same reason code to indicate that IE different in 4-way
handshake and also print a hexdump of RSNXE in both Beacon/ProbeResp and
EAPOL-Key msg 3/4 in the log.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 17:05:01 +02:00
Jouni Malinen
9108e396a7 tests: RSNE mismatch in EAPOL-Key msg 3/4
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 16:58:29 +02:00
Jouni Malinen
4d64fd37b7 Allow RSNE in EAPOL-Key msg 3/4 to be replaced for testing purposes
The new hostapd configuration parameter rsne_override_eapol can now be
used similarly to the previously added rsnxe_override_eapol to override
(replace contents or remove) RSNE in EAPOL-Key msg 3/4. This can be used
for station protocol testing to verify sufficient checks for RSNE
modification between the Beacon/Probe Response frames and EAPOL-Key msg
3/4.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 16:45:52 +02:00
Jouni Malinen
3396a4529c tests: RSNXE missing from EAPOL-Key msg 3/4
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 16:42:47 +02:00
Jouni Malinen
9128b67269 Extend hostapd rsnxe_override_eapol to allow IE removal
Previous implementation was determining whether the override value was
set based on its length being larger than zero. Replace this with an
explicit indication of whether the parameter is set to allow zero length
replacement, i.e., remove of RSNXE from EAPOL-Key msg 3/4.

In addition, move IE replacement into a more generic helper function to
allow this to be used with other IEs as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 16:39:36 +02:00
Jouni Malinen
20cace9014 tests: WPA2-EAP AP with STA using 4addr mode
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 13:59:17 +02:00
Jouni Malinen
43ededa9c7 Do not override WDS VLAN assignment for STA
The 4-address frames WDS design in mac80211 uses VLAN interfaces
similarly to the way VLAN interfaces based on VLAN IDs are used. The EAP
authentication case ended up overriding the WDS specific assignment even
when the RADIUS server did not assign any specific VLAN for the STA.
This broke WDS traffic.

Fix this by skipping VLAN assignment to VLAN ID 0 for STAs that have
been detected to use 4-address frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 13:56:56 +02:00
Jouni Malinen
87998f80e7 HS 2.0 server: Allow OCSP responder to continue running after errors
By default, 'openssl ocsp' exits upon receiving a malformed request.
That's not really ideal for a server, so configure openssl to not do
that and instead, continue running to process other requests.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 13:26:56 +02:00
Jouni Malinen
ca8a51c4bb webkit2: Fix http://localhost:12345/ redirect handling
The resource-load-started cannot be used to replace the older
resource-request-starting signal and as such, the final redirect to the
special http://localhost:12345/ URL did not work. Use the decide-policy
signal for navigation action instead.

Also remove the attempt to modify the request URI from
resource-load-started since that is not going to work either. This is
not really critical for functionality, but could eventually be replaced
with a handler for the WebKitWebPage send-request signal.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-07 11:51:23 +02:00
Jouni Malinen
bdb2eaf876 tests: sigma_dut with OWE PTK workaround
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 21:44:31 +02:00
Alexander Wetzel
be15f33d07 Replace WPA_ALG_PMK with KEY_FLAG_PMK
Drop the no longer needed internal alg WPA_ALG_PMK and use KEY_FLAG_PMK
as replacement.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-06 21:44:31 +02:00
Alexander Wetzel
11b1fcd6ca nl80211: Drop outdated TDLS set_key() hack
wpa_tdls_set_key() did set the key_id to -1 to avoid a useless
NL80211_CMD_SET_KEY call that the updated nl80211 driver no longer
carries out. Remove the no longer required workaround.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-06 21:44:31 +02:00
Andrew Siplas
2dd72315d9 wpa_cli: Add missing quote around interface name
There was only an open quote present.

Signed-off-by: Andrew Siplas <andrew@asiplas.net>
2020-03-06 21:44:31 +02:00
Pravas Kumar Panda
f64b601c47 DFS: Add support for 80+80 MHz when going through channel switch
After a radar signal is detected, the AP should switch to another
channel, but in the case of 80+80 MHz, channel switch failed because
hostapd did not select the secondary channel in the process. Fix this by
selecting a secondary channel in the case of 80+80 MHz.

Signed-off-by: Xin Wang <xwangw@codeaurora.org>
Signed-off-by: Pravas Kumar Panda <kumarpan@codeaurora.org>
2020-03-06 21:44:31 +02:00
Jouni Malinen
72c34d23a4 tests: Automatic channel selection with fallback to 20 MHz
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 21:44:31 +02:00
Jouni Malinen
2fb59e77b5 tests: HT with 20 MHz channel width doing CSA to 40 MHz
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 21:44:31 +02:00
Jouni Malinen
154722e5b1 tests: Make ap_ht_40mhz_intolerant_ap more robust
Some test case sequences seemed to prevent the station from completing
the first OBSS scan (that scan was aborted) and that resulted in failing
the test case because the AP had not received any report in time. Wait
for scan completion and allow additional scans before timing out to
avoid indicating incorrect AP behavior in cases where the report was not
even received.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 21:44:31 +02:00
Hu Wang
0a76a0b965 OWE: Fix PTK derivation workaround for interoperability
The initial implementation of the PTK derivation workaround for
interoperability with older OWE implementations forced
WPA_KEY_MGMT_PSK_SHA256 to be used for all of PTK derivation. While that
is needed for selecting which hash algorithm to use, this was also
changing the length of the PTK components and by doing so, did not
actually address the backwards compatibility issue.

Fix this by forcing SHA256 as the hash algorithm in PTK derivation
without changing the PTK length calculation for OWE when
owe_ptk_workaround is enabled.

Fixes: 65a44e849a ("OWE: PTK derivation workaround in AP mode")
Fixes: 8b138d2826 ("OWE: PTK derivation workaround in STA mode")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 21:44:31 +02:00
Jouni Malinen
b27c7ac0eb tests: wpa_supplicant SAVE_CONFIG without config file
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 11:24:28 +02:00
Zhaoyang Liu
87775e32f6 Fix segmentation fault for NULL confname in SAVE_CONFIG
When wpa_supplicant interface is added without a configuration file, the
SAVE_CONFIG command causes a segmentation fault due to referencing a
NULL pointer if the update_config parameter is first explicitly enabled.

Fix the issue by checking the confname for NULL before saving
configuration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-06 11:21:58 +02:00
Alexander Wetzel
81621eab7c nl80211: Migrate from set_tx to key_flag API
Migrate nl80211 driver to key_flag API and add additional sanity checks.

I'm still not sure why we install unicast WEP keys also as default
unicast keys. Based on how I understand how mac80211 handles that it
should be pointless. I just stuck to how we do things prior to the patch
for WEP keys to not break anything. After all other drivers may need it.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:52:31 +02:00
Alexander Wetzel
9757f18db4 nl80211: Don't ignore when SET_KEY returns ENOENT
Always report an error when NL80211_CMD_SET_KEY can't set a key to
default.

The old ioctl-based design used a single command to add, set, and delete
a key and had to ignore ENOENT for key deletions. It looks like that
special handling was also ported for NL80211_CMD_NEW_KEY and
NL80211_CMD_SET_KEY instead only for NL80211_CMD_DEL_KEY.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:38:30 +02:00
Alexander Wetzel
98b8275d92 nl80211: Remove not needed netlink key attribute
Calling NL80211_CMD_NEW_KEY with NL80211_KEY_DEFAULT_TYPES attributes is
pointless. The information is not expected and therefore the kernel
never forwards it to the drivers. That attribute is used with
NL80211_CMD_SET_KEY.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:36:00 +02:00
Alexander Wetzel
8563f6f564 nl80211: Fix wrong return code in set_key error path
Allow to abort key installations with different error codes and fix one
misleading return code.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:28:50 +02:00
Alexander Wetzel
adf550ee4b nl80211: Ignore seq number for key deletion
Turns out we are sometime providing a seq when deleting the key. Since
that makes no sense on key deletion let's stop forwarding that to the
driver at least.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:27:48 +02:00
Alexander Wetzel
e9e69221c1 Validity checking function for key_flag API
Add masks for each key type to define which flags can be combined and
add a helper function to validate key_flag values.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:25:47 +02:00
Alexander Wetzel
5eb1632569 nl80211: Add a missing key_flag for WEP shared key authentication
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:24:55 +02:00
Alexander Wetzel
82eaa3e688 Remove the not yet needed KEY_FLAG_MODIFY
I decided to drop KEY_FLAG_MODIFY instead of allowing flag combinations not
yet used in the code and will simply recreate it with the Extended Key
ID patches once we get there. For that reason I also did not renumber
the flags.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:17:23 +02:00
Alexander Wetzel
982b9cf029 Fix a wrong key_flag when deleting 802.1X WEP keys
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:13:20 +02:00
Alexander Wetzel
d37c05e5b5 AP: Don't try to set NULL WEP default key
hostapd_broadcast_wep_set() can be called without a WEP key set.
Don't try to install a default key in that case.

This patch is not critical for the new API. With key_flag we just would
report an (ignored) error and do nothing. With the patch we simply do
nothing.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-05 00:03:56 +02:00
Alexander Wetzel
fa1a6aff22 Fix unicast argument for set_wep_key() from EAPOL supplicant
The unicast parameter in set_wep_key() is only expected to be set to 0
or 1. Without this patch we set unicast to 0x80 instead of 1. Since
unicast is used as boolean that is working fine but violates the
documented API.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-04 23:59:49 +02:00
Jouni Malinen
72fd30c4b9 tests: WPS PBC/PIN timeout on AP
Verify that AuthorizedMACs advertisement is removed when a PBC session
or a PIN times out.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-04 23:28:45 +02:00
Jouni Malinen
11dab0f37f WPS: Remove expired PINs on Selected Registrar timeout
This clears the AuthorizedMACs advertisement immediately when the
Selected Registrar timeout is hit and no more active PINs are present.
Previously, the AuthorizedMACs advertisement could remain in place
indefinitely since expired PINs were removed only when actually trying
to find a PIN for a new WPS exchange.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-04 23:26:02 +02:00
Jouni Malinen
dc054892a2 tests: sigma_dut special case for SAE Password Identifier with PWE looping
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-04 21:23:43 +02:00
Jouni Malinen
8f89e57ab5 DFS: More debug prints on channel selection after radar detection
This makes it easier to understand what is happening when a new channel
needs to be selected based on a radar detection event.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-03 18:58:08 +02:00
Jouni Malinen
9c244b542e tests: DFS channel bandwidth downgrade from VHT80 to VHT40
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-03 18:58:08 +02:00
Seevalamuthu Mariappan
4b37d24285 hostapd: Fix to downgrade bandwidth in radar detection
Upon radar detection we used to search channels with the same bandwidth.
This way we might not find any other channels. If there are no channels
available with that bandwidth the AP service will be stopped. To avoid
this problem, also search a suitable channel by downgrading the
bandwidth. This scenario is applicable during CAC as well.

Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
2020-03-03 18:37:16 +02:00
Seevalamuthu Mariappan
7242087d1c DFS: Do not process radar event while disabling an interface
In the normal case hostapd_disable_iface() and hostapd_enable_iface()
will be done while switching to another DFS channel upon radar
detection. In certain scenarios radar detected event can come while
hostapd_disable_iface() is in progress and iface->current_mode will be
NULL in that scenario. Previously, we did not check for this scenario
and proceeded with the radar detection logic which can trigger a
segmentation fault. To fix this, avoid proceeding the radar detection
event if iface->current_mode is NULL.

Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
2020-03-03 17:10:31 +02:00
Jouni Malinen
744a2f9846 tests: Specific vs. wildcard SSID in Probe Request frame in BSSID-scan
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-02 20:44:23 +02:00
Veerendranath Jakkam
5fdacce465 Allow wildcard SSID to be enforced for a specific BSSID scan
Specific BSSID scan was replacing wildcard SSID with the known SSID if
any BSS with the specified BSSID is available in the known BSSes list.

Add control interface support to force use of a wildcard SSID in a
specific BSSID scan by user with the new "wildcard_ssid=1" argument to
the SCAN command.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-03-02 20:33:52 +02:00
Jouni Malinen
97de4a0f9b tests: Verify that HE gets fully enabled for mesh
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-02 19:56:27 +02:00
Pradeep Kumar Chitrapu
43282f7329 mesh: Fix HE enablement on 5 GHz with VHT
Incorrect he_enabled parameter was being passed to
hostapd_set_freq_params() in mesh which caused HE to be not fully
enabled on the 5 GHz band. Fix this by setting freq->he_enabled instead
of vht_freq.he_enabled so that the hostapd_set_freq_params() uses the
correct he_enabled value (and then ends up copying this to
vht_freq.he_enabled in the success case).

Fixes: 6e711e7ab3 ("mesh: Do not enable HE on 5 GHz without VHT")
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2020-03-02 19:54:35 +02:00
Jouni Malinen
8b077a42e5 tests: wpa_supplicant config file writing with SAE
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-02 11:51:38 +02:00
Sachin Shelke
21f835e640 SAE: Allow SAE-only network profile with sae_password to be written
The commit a34ca59e (SAE: Allow SAE password to be configured separately
(STA)) added sae_password configuration option. We should also consider
sae_password in the wpa_config_write() function which stores the valid
network block details to an external database.

Fixes: a34ca59e4d ("SAE: Allow SAE password to be configured separately (STA)")
Signed-off-by: Sachin Shelke <sachin.shelke@nxp.com>
Signed-off-by: Cathy Luo <xiaohua.luo@nxp.com>
Signed-off-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
2020-03-02 11:49:19 +02:00
Jouni Malinen
5bad300565 privsep: Mask out control port capability flag
There is no support for using the control port for sending out EAPOL
frames through privsep yet, so mask out this capability to fall back to
the l2_packet based design.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-01 21:31:07 +02:00
Alexander Wetzel
c1a6b1e47e privsep: Add key_flag to set_key()
Pass through the new key_flag to wpa_priv.

Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-01 21:11:07 +02:00
Jouni Malinen
852d370f65 Silence a compiler warning in no-WEP and no-EAP builds
wep_keys_set was not used in wpas_start_assoc_cb() without
IEEE8021X_EAPOL, so need to make this local variable conditional on
build options.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-01 20:57:14 +02:00
Jouni Malinen
d9aafb75f1 tests: SAE and PSK with multiple passwords/passphrases
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-01 19:53:16 +02:00