Commit graph

13968 commits

Author SHA1 Message Date
Ben Greear
22d1b2ecdb HTTP (curl): Fix build with newer OpenSSL versions
The SSL_METHOD patching hack to get proper OCSP validation for Hotspot
2.0 OSU needs cannot be used with OpenSSL 1.1.0 and newer since the
SSL_METHOD structure is not exposed anymore. Fall back to using the
incomplete CURLOPT_SSL_VERIFYSTATUS design to fix the build.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2019-01-01 20:24:07 +02:00
Ben Greear
37f487bb41 HTTP (curl): Use DEFINE_STACK_OF() with newer OpenSSL versions
SKM_sk_num() is not available anymore, so use DEFINE_STACK_OF() to get
the appropriate accessor functions.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2019-01-01 20:14:53 +02:00
Ben Greear
9805bb1bdb HTTP (curl): Use SSL_get_SSL_CTX() helper
The direct ssl->ctx access are not allowed anymore in newer OpenSSL
versions, so use the SSL_get_SSL_CTX() helper for this.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2019-01-01 20:07:19 +02:00
Ben Greear
a898113823 HS 2.0: Fix EST compilation with OpenSSL 1.1.0 and newer
SKM_sk_value() is not available anymore, so use DEFINE_STACK_OF() to get
the appropriate accessor functions.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2019-01-01 19:56:19 +02:00
Jouni Malinen
b2f1e5458b hostap: Silence compiler warnings about IFNAMSIZ buffers
Report interface name truncation and reject such cases in Host AP driver
initialization of the AP interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 19:38:58 +02:00
Jouni Malinen
2ea1fce3d6 OCE: RSSI-based rejection to consider Authentication frames (AP)
Try to make RSSI-based rejection of associating stations a bit less
likely to trigger false rejections by considering RSSI from the last
received Authentication frame. Association is rejected only if both the
Authentication and (Re)Association Request frames are below the RSSI
threshold.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 18:18:53 +02:00
Beni Lev
7021d33c9e tests: Add RSSI based association rejection tests
Signed-off-by: Beni Lev <beni.lev@intel.com>
2019-01-01 18:18:53 +02:00
Beni Lev
080035d1db tests: Add a command for setting TX power/RSSI
With this command, RSSI signal can be controlled. Due to restrictions in
kernel, only values in the range of [-30, -50] can be used. The command
is implemented by changing the TX power.

Signed-off-by: Beni Lev <beni.lev@intel.com>
2019-01-01 18:18:53 +02:00
Beni Lev
076f1ea1d9 OCE: Add RSSI based association rejection support (AP)
An AP might reject a STA association request due to low RSSI. In such
case, the AP informs the STA the desired RSSI improvement and a retry
timeout. The STA might retry to associate even if the RSSI hasn't
improved if the retry timeout expired.

Signed-off-by: Beni Lev <beni.lev@intel.com>
2019-01-01 18:18:50 +02:00
Beni Lev
19677b77c3 OCE: Add RSSI based association rejection support (STA)
An AP might refuse to connect a STA if it has a low RSSI. In such case,
the AP informs the STA with the desired RSSI delta and a retry timeout.
Any subsequent association attempt with that AP (BSS) should be avoided,
unless the RSSI level improved by the desired delta or the timeout has
expired.

Defined in Wi-Fi Alliance Optimized Connectivity Experience technical
specification v1.0, section 3.14 (RSSI-based association rejection
information).

Signed-off-by: Beni Lev <beni.lev@intel.com>
2019-01-01 17:56:25 +02:00
Jouni Malinen
2994ecfb5f tests: P2P cancel join-group using p2pdev and no separate group interface
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 16:58:11 +02:00
Aloni, Adiel
dc9b7d217c P2P: Set global->p2p_group_formation in wpas_p2p_join_start() for p2pdev
When a dedicated P2P device interface is used, the
global->p2p_group_formation was not set in wpas_p2p_join_start() if no
separate group interface is used. This would cause that in case of a
failure in group formation, the cleaning of p2p_in_provisioning is done
on the wrong interface. Furthermore, P2P_CANCEL command could not be
used to stop such a group-join operation. Fix this by setting the
global->p2p_group_formation correctly in case that the group interface
is reusing wpa_s->parent.

Signed-off-by: Adiel Aloni <adiel.aloni@intel.com>
2019-01-01 16:56:22 +02:00
Jouni Malinen
7f90a850ff tests: Clear regdom state in go_neg_forced_freq_diff_than_bss_freq
Be more careful with cleaning up the regdom state in cfg80211.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 16:35:42 +02:00
Jouni Malinen
5a5529c9f4 tests: Make dpp_pkex_no_responder handle enabled 5 GHz channels
It was possible for the 5 GHz PKEX channels to be enabled, e.g., when
running "ap_ht40_csa2 dpp_pkex_no_responder" test sequence, and that
resulted in a failure in dpp_pkex_no_responder due to the unexpectedly
long wait needed for the DPP-FAIL event. Increase the wait time to allow
for 5 GHz PKEX channels to be probed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 16:17:13 +02:00
Jouni Malinen
32bb47faa1 Update wpa_supplicant channel list on FLUSH
Try to make sure the driver channel list state is synchronized with
wpa_supplicant whenever explicitly clearing state (e.g., between hwsim
test cases).

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 15:58:46 +02:00
Jouni Malinen
d8dda601f0 nl80211: Debug print channel list
This makes it a bit easier to figure out how channel list update from
the kernel is taken into use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 15:51:10 +02:00
Jouni Malinen
c55799e54c tests: Check per-wiphy specific country code between test cases
This allows more accurate logging of failures related to the cfg80211
country=98 (intersection) case. This version is trying to give some more
time to allow the country code to clear, but that does not seem to be
sufficient with the current cfg80211 implementation for country=98 (but
might be for other cases).

The additional check for country=98 at the beginning of each test case
is an attempt to force cfg80211 to restore world roaming state with a
new association and disconnection at the station side detected after the
AP side has already stopped. This is needed after the Linux kernel
commit 113f3aaa81bd ("cfg80211: Prevent regulatory restore during STA
disconnect in concurrent interfaces").

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 11:46:50 +02:00
Jouni Malinen
ba3146e154 tests: Wait a bit after 'iw reg set 00' at the end of test cases
This is needed to avoid leaving unexpected cfg80211 regulatory country
code in place at the point when a test case terminates.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 11:46:50 +02:00
Jouni Malinen
003716ec7b tests: Clear regdom changes more robustly in FST test cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 11:35:43 +02:00
Jouni Malinen
2fa2b90aaf tests: Clear regulatory setting in ap_ht_op_class_* more robustly
Avoid exiting the test case with regulatory domain set to something else
than 00 (world roaming).

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 10:57:50 +02:00
Jouni Malinen
fea49f8f93 nl82011: Make wiphy-specific country (alpha2) available in STATUS-DRIVER
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 16:41:24 +02:00
Jouni Malinen
02d53ac351 nl80211: Debug print details from the beacon hint events
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 16:29:16 +02:00
Sam Voss
dd5d325b0a hostapd: Add configuration option check_crl_strict
Add the ability to ignore time-based CRL errors from OpenSSL by
specifying a new configuration parameter, check_crl_strict=0.

This causes the following:

- This setting does nothing when CRL checking is not enabled.

- When CRL is enabled, "strict mode" will cause CRL time errors to not
  be ignored and will continue behaving as it currently does.

- When CRL is enabled, disabling strict mode will cause CRL time
  errors to be ignored and will allow connections.

By default, check_crl_strict is set to 1, or strict mode, to keep
current functionality.

Signed-off-by: Sam Voss <sam.voss@rockwellcollins.com>
2018-12-31 12:51:51 +02:00
Ben Greear
3518e3623f wpa_cli: Allow reconnect to global interface
Old code would just re-connect to a particular interface, even if user
had started wpa_cli with the '-g' option. Refactor global control
interface connection routine to allow it to be used in
wpa_cli_reconnect().

Signed-off-by: Ben Greear <greearb@candelatech.com>
2018-12-31 12:32:14 +02:00
Jouni Malinen
4fb6963b39 tests: Build tests for wpa_supplicant and hostapd
Allow multiple build configurations to be tested automatically.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 12:03:53 +02:00
Jouni Malinen
52e78198b7 Add internal HMAC-SHA512 implementation to fix NEED_SHA512 builds
Build configurations with CONFIG_TLS=internal and NEED_SHA512 failed due
to missing sha512.c file. Add that file even though this is not really
used in the currently available configuration combinations since DPP and
OWE are the only users of it and the internal crypto implementation
supports neither.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 11:57:37 +02:00
Michal Privoznik
1b8ed2cac1 wpa_supplicant: Fix build with !CONFIG_AP and CONFIG_CTRL_IFACE_DBUS_NEW
If the CONFIG_CTRL_IFACE_DBUS_NEW is enabled but CONFIG_AP is
disabled the build fails. This is because dbus getters try to
access ap_iface member of wpa_supplicant struct which is defined
if and only if CONFIG_AP is enabled.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2018-12-31 11:41:26 +02:00
Jouni Malinen
a1417c7f96 mka: Log MI update failure in debug log
One of the reset_participant_mi() callers did not log the error. Make
this more consistent with the other callers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 01:09:02 +02:00
Jouni Malinen
f9052d6ea5 nl80211: Note interface-removal-from-bridge errors in debug log
One of the linux_br_del_if() calls did not log nl80211-specific entry.
Make this more consistent with the other cases even though
linux_br_add_if() function itself is logging an error in the ioctl()
failure case (but not in the interface not found case).

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-31 01:05:23 +02:00
Jouni Malinen
544b5a0d39 tests: hostapd configuration reload from file when disabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-30 17:35:54 +02:00
Hristo Venev
d01203cafc hostapd: Add openssl_ecdh_curves configuration parameter
This makes it possible to use ECDSA certificates with EAP-TLS/TTLS/etc.
It should be noted that when using Suite B, different mechanism is used
to specify the allowed ECDH curves and this new parameter must not be
used in such cases.

Signed-off-by: Hristo Venev <hristo@venev.name>
2018-12-30 17:27:34 +02:00
Hristo Venev
0521c6ebb3 OpenSSL: Add openssl_ecdh_curves parameter
Some versions of OpenSSL need server support for ECDH to be explicitly
enabled, so provide a new parameter for doing so and all
SSL_{,CTX_}set_ecdh_auto() for versions that need it to enable automatic
selection.

Signed-off-by: Hristo Venev <hristo@venev.name>
2018-12-30 17:21:55 +02:00
Jouni Malinen
b98933eafc HS 2.0: DHCP broadcast-to-unicast conversion before address learning
handle_dhcp() was first trying to learn the IP address of an associated
STA before doing broadcast-to-unicast conversion. This could result in
not converting some DHCPACK messages since the address learning part
aborts processing by returning from the function in various cases.

Reorder these operations to allow broadcast-to-unicast conversion to
happen even if an associated STA entry is not updated based on a
DHCPACK.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-30 01:05:18 +02:00
Jouni Malinen
0456b7d312 tests: Add UDP checksum into DHCP frames in ProxyARP/DGAF disabled case
Previously, the special value 0 was used to indicate no UDP checksum.
Replace that with the calculated checksum for more like use case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-30 01:04:58 +02:00
Jaap Keuter
23693c9dac mka: Make ICV Indicator dependant on ICV length
IEEE Std 802.1X-2010, 11.11 describes that the ICV is separate from the
parameter sets before it. Due to its convenient layout the ICV Indicator
'body part' is used to encode the ICV as well.

IEEE Std 802.1X-2010, 11.11.3 describes the encoding of MKPDUs. In
bullet e) is desribed that the ICV Indicator itself is encoded when the
ICV is not 16 octets in length. IEEE Std 802.1Xbx-2014, Table 11-7 note
e) states that it will not be encoded unless the Algorithm Agility
parameter specifies the use of an ICV that is not 16 octets in length.

Therefore the length calculation for the ICV indicator body part must
take into account if the ICV Indicator is to be encoded or not. The
actual encoder of the ICV body already takes care of the rest.

In practice, this change will remove the ICV Indicator parameter set (4
octets before the ICV value itself) since the only defined algorithm
agility value uses an ICV of 16 octets. IEEE Std 802.1X-2010 MKPDU
validation and decoding rules in 11.11.2 and 11.11.4 require the
receipient to handle both cases of ICV Indicator being included or not.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2018-12-30 01:03:30 +02:00
Jouni Malinen
cd803b6ccd tests: Clear regulatory Beacon hints more robustly in TDLS test cases
The ap_open_tdls_vht* test cases could leave some pending regulatory
Beacon hints waiting to be cleared during the following test case. This
would result in a failure if the following test case expected specific
regdom event behavior. For example, this caused "ap_open_tdls_vht160
dbus_country" sequence to result in failure in dbus_country. Fix this by
using more robust sequence in clearing regdom state at the end of the
TDLS test cases that have the AP advertising a country code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 17:02:54 +02:00
Jouni Malinen
90eb910ef5 tests: MKA MIB information
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 16:52:56 +02:00
Jouni Malinen
948ba8c294 mka: MIB information
Provide MKA information through the wpa_supplicant control interface MIB
command.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 16:52:31 +02:00
Jouni Malinen
a2acadf605 tests: MACsec PSK with bridge interface
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 12:26:52 +02:00
Jouni Malinen
0d09bd0832 tests: Use more robust way to determine MKA is done for MACsec testing
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 12:18:41 +02:00
Jouni Malinen
8c652ecfbe mka: Provide more status information over control interface
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 11:05:39 +02:00
Jouni Malinen
626bc1fac2 mka: Stop trying to generate and distribute new SAK when not key server
It was possible for a participant to first be elected as a key server
and schedule a new SAK to be generated and distributed just to be
followed by another participant being elected as the key server. That
did not stop the participant that disabled key server functionality to
stop generating the new SAK and then trying to distribute it. That is
not correct behavior, so make these steps conditional on the participant
still being a key server when going through the timer.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 11:05:39 +02:00
Jouni Malinen
4060cb272b mka: Add more debug print details
This makes it a bit easier to try to figure out what is going on with
KaY operations and MKA setup.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 11:05:39 +02:00
Jouni Malinen
27859f5203 mka: Fix deleteSAs clearing of principal->new_key
This pointer needs to be cleared when the matching SAK is being removed
from the SAK list. The previous implementation was doing something
pretty strange in the loop by clearing the pointer for any non-matching
key that happened to be iterated through before finding the matching
key. This could probably result in incorrect behavior, but not clearing
the pointer for the matching key could do more harm by causing freed
memory to be referenced.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 11:05:39 +02:00
Jouni Malinen
4d91d4a7cc mka: Derive MACsec cipher suite and MKA algorithm table index
Instead of using a specifically set index value from table definition,
use the actual real index of the table entry. This removes need for
maintaining these index values separately. Furthermore, the
mka_alg_tbl[] index was already off-by-one (but not used anywhere).

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-29 11:05:39 +02:00
Asbjørn Sloth Tønnesen
594b7fbdde wpa_supplicant: Document nl80211 driver in the man page
Signed-off-by: Asbjørn Sloth Tønnesen <hostap@asbjorn.st>
2018-12-27 16:03:46 +02:00
Jaap Keuter
a0bec739f1 mka: Clean up KaY log output
When running wpa_supplicant (with logging for testing) the log output is
somewhat disorganized for KaY related items. E.g., items are not
aligned, inconsistent type handling, wrong wording, missing labels, etc.
This change tries to clean up the log output, so it is somewhat more
accessible.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2018-12-27 16:03:46 +02:00
Jouni Malinen
344929a9ca tests: MACsec PSK local failures in CP state machine
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-27 16:03:46 +02:00
Jouni Malinen
1cb5082567 mka: Do not force entry into INIT state on CP state machine creation
Go through the SM_STEP_RUN() global transition to get into the INIT
state to follow the state machine design more closely.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-27 11:33:46 +02:00
Jouni Malinen
785b219abd mka: Remove unused authorization data from CP
While IEEE Std 802.1X-2010 talks about arbitrary authorization data that
could be passed to the CP from sources like RADIUS server, there is not
much point in trying to implement this as an arbitrary memory buffer in
wpa_supplicant. Should such data be supported in the future, it would
much more likely use more detailed data structures that encode the
received data in easier to use form.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-27 11:26:27 +02:00