Commit graph

10401 commits

Author SHA1 Message Date
Jouni Malinen
5a38a7fe43 tests: Roam between two WPA2-PSK APs and try to hit a disconnection race
This is a regression test case for hostapd bug where the
disconnection/deauthentication TX status callback timeout could be
forgotten after new association if no ACK frame was received and the STA
managed to reconnect within two seconds.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 19:34:58 +02:00
Jouni Malinen
03269d558a AP: Print interface name in more STA events
This makes it easier to follow a debug log from a hostapd process that
manages multiple interfaces.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 19:32:49 +02:00
Jouni Malinen
9e8fde2134 AP: Fix Deauth/Disassoc TX status timeout handling
The ap_sta_deauth_cb and ap_sta_disassoc_cb eloop timeouts are used to
clear a disconnecting STA from the kernel driver if the STA did not ACK
the Deauthentication/Disassociation frame from the AP within two
seconds. However, it was possible for a STA to not ACK such a frame,
e.g., when the disconnection happened due to hostapd pruning old
associations from other BSSes and the STA was not on the old channel
anymore. If that same STA then started a new authentication/association
with the BSS, the two second timeout could trigger during this new
association and result in the STA entry getting removed from the kernel.

Fix this by canceling these eloop timeouts when receiving an indication
of a new authentication or association.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 19:32:49 +02:00
Jouni Malinen
269f9d5d10 EAP peer: Use ifdef PCSC_FUNCS to get rid of compiler warnings
clang started warning about the use of || with constants that came from
PCSC_FUNCS not being enabled in the build. It seems to be easier to just
ifdef this block out completely since that has the same outcome for
builds that do not include PC/SC support.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 18:41:30 +02:00
Jouni Malinen
c6e0b4bb86 FST: Get rid of gcc extensions in structure/array initialization
These constructions were causing warnings when build with clang.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 18:40:21 +02:00
Jouni Malinen
2e3a41a53f hs20-osu-client: Fix check for osu_nai being available
This is an array, so the pointer is never NULL; need to check that the
first character is not '\0' instead.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 18:39:03 +02:00
Jouni Malinen
fb3db14a6f tests: Fix EAP-SAKE error test case coverage
This was missing the second eap_sake_compute_mic() call in
eap_sake_process_confirm().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 18:18:25 +02:00
Jouni Malinen
5b0ec907c1 tests: More EAP-MSCHAPv2 error coverage
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 17:42:13 +02:00
Jouni Malinen
eaef5861d7 tests: Fix wpas_ctrl_oom
The OpenSSL memory allocation changes broke this test case. Fix this by
removing the cases that do not get triggered anymore and add a separate
wpas_ctrl_error test case to cover the fail_test() versions of errors.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 16:27:13 +02:00
Jouni Malinen
ac2053b103 OpenSSL: Clean up openssl_digest_vector() to use a single implementation
Use compatibility wrapper functions to allow a single implementation
based on the latest OpenSSL API to be used to implement these functions
instead of having to maintain two conditional implementation based on
the library version.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 14:17:16 +02:00
Jouni Malinen
5c9a33702f OpenSSL: Clean up crypto_hash_*() to use a single implementation
Use compatibility wrapper functions to allow a single implementation
based on the latest OpenSSL API to be used to implement these functions
instead of having to maintain two conditional implementation based on
the library version.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 14:14:07 +02:00
Jouni Malinen
587b0457e0 LibreSSL: Fix build with LibreSSL
The changes needed for OpenSSL 1.1.0 had broken this since LibreSSL is
defining OPENSSL_VERSION_NUMBER in a manner that claims it to be newer
than the current OpenSSL version even though it does not support the
current OpenSSL API.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 14:06:46 +02:00
Jouni Malinen
0daa9f6a13 EAP-TTLS peer: Fix success after fragmented final Phase 2 message
If the final Phase 2 message needed fragmentation, EAP method decision
was cleared from UNCOND_SUCC or COND_SUCC to FAIL and that resulted in
the authentication failing when the EAP-Success message from the server
got rejected. Fix this by restoring the EAP method decision after
fragmentation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 13:37:15 +02:00
Jouni Malinen
1a6f86593b tests: Clean up eap_proto_ikev2
Use helper variable to indicate end of the test case instead of having
to use a fixed length of the loop.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 10:37:04 +02:00
Jouni Malinen
35372f6cd6 tests: EAP-IKEv2 with default fragment_size
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 10:36:41 +02:00
Jouni Malinen
7843ae4456 tests: More EAP-SIM and EAP-AKA local error coverage
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-15 01:15:11 +02:00
Jouni Malinen
7cbc8e6719 tests: fail_test instead of alloc_fail for aes_{encrypt,decrypt}_init
This is needed to fix ap_wpa2_eap_psk_oom, ap_wpa2_eap_sim_oom,
eap_proto_psk_errors, and ap_ft_oom with the new OpenSSL dynamic memory
allocation design.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-14 20:10:16 +02:00
Jouni Malinen
465196ebd2 tests: aes_encrypt_init() and aes_decrypt_init() to use TEST_FAIL
Now the these functions cannot be made to fail by forcing the memory
allocation fail since the OpenSSL-internal version is used, add
TEST_FAIL check to allow OOM test cases to be converted to use the
TEST_FAIL mechanism without reducing coverage.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-14 19:44:47 +02:00
Jouni Malinen
1eb87ae48d OpenSSL: Use EVP_CIPHER_CTX_new() to work with OpenSSL 1.1.0
The EVP_CIPHER_CTX structure will be made opaque in OpenSSL 1.1.0, so
need to use EVP_CIPHER_CTX_new() with it instead of stack memory. The
design here moves the older OpenSSL versions to use that dynamic
allocation design as well to minimize maintenance effort.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-14 19:30:24 +02:00
Jouni Malinen
3fb3bea8e9 OpenSSL: Update session_secret callback to match OpenSSL 1.1.0 API
The SSL_CIPHER **cipher argument was marked const in OpenSSL 1.1.0
pre-release 2 similarly to how this is in BoringSSL. Fix build with that
in preparation for supporting OpenSSL 1.1.0.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-14 19:28:33 +02:00
Jouni Malinen
72a4c5ceb6 tests: Additional EAP-pwd error case coverage
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-14 12:12:14 +02:00
Jouni Malinen
814f43cff5 EAP server: Simplify EAP method registration call
Free the allocated structure in error cases to remove need for each EAP
method to handle the error cases separately. Each registration function
can simply do "return eap_server_method_register(eap);" in the end of
the function.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 23:35:53 +02:00
Jouni Malinen
49a26bb3e3 EAP peer: Simplify EAP method registration call
Free the allocated structure in error cases to remove need for each EAP
method to handle the error cases separately. Each registration function
can simply do "return eap_peer_method_register(eap);" in the end of the
function.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 23:30:25 +02:00
Jouni Malinen
7ce5603251 EAP-WSC peer: Remove unused state values
The FRAG_ACK and DONE state were not used at all, so remove them.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 22:09:08 +02:00
Jouni Malinen
d8e5a55f1e tests: WPS and EAP-WSC in network profile
This goes through some error paths that do not really show up in real
WPS use cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 22:08:04 +02:00
Jouni Malinen
992007c515 tests: Fix ERP anonymous_identity test cases
These need to be run without realm in the identity value to allow the
realm from the anonymous_identity to be used.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 22:03:23 +02:00
Jouni Malinen
6a95f5e2e4 tests: EAP-WSC protocol tests
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 22:03:23 +02:00
Jouni Malinen
4e34f56f3c tests: Renew the expired OCSP responder certificate
This certificate expired and that makes couple of test cases fail.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 00:38:29 +02:00
Jouni Malinen
dc441c0fc8 tests: EAP protocol tests for canned EAP-Success after identity
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 00:17:27 +02:00
Jouni Malinen
e70e16b5de tests: ERP and local error cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 00:17:27 +02:00
Jouni Malinen
1e22dc7428 tests: ERP and anonymous identity
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 00:17:27 +02:00
Roy Marples
449a31662d bsd: Optimize socket use
Create global init to handle socket calls and route messages.
Register each interface inside the global driver so that
routing messages can find the interface based on rtm_ifindex.

Signed-off-by: Roy Marples <roy@marples.name>
2016-01-13 00:17:27 +02:00
Rafał Miłecki
4653ceb750 nl80211: Report disassociated STA / lost peer for the correct BSS
We shouldn't use drv->ctx as it always points to the first BSS. When
using FullMAC driver with multi-BSS support it resulted in incorrect
treating nl80211 events. I noticed with with brcmfmac and BCM43602.

Before my change I was getting "disassociated" on a wrong interface:
wlan0-1: STA 78:d6:f0:00:11:22 IEEE 802.11: associated
wlan0-1: STA 78:d6:f0:00:11:22 WPA: pairwise key handshake completed (RSN)
wlan0: STA 78:d6:f0:00:11:22 IEEE 802.11: disassociated

With this patch it works as expected:
wlan0-1: STA 78:d6:f0:00:11:22 IEEE 802.11: associated
wlan0-1: STA 78:d6:f0:00:11:22 WPA: pairwise key handshake completed (RSN)
wlan0-1: STA 78:d6:f0:00:11:22 IEEE 802.11: disassociated

This doesn't apply to hostapd dealing with SoftMAC drivers when handling
AP SME & MLME is done it hostapd not the firmware.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
2016-01-13 00:17:27 +02:00
Jouni Malinen
38af0423cb Drop OpenSSL 0.9.8 patches to add EAP-FAST support
The OpenSSL project will not support version 0.9.8 anymore. As there
won't be even security fixes for this branch, it is not really safe to
continue using 0.9.8 and we might as well drop the EAP-FAST patches for
it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 00:17:27 +02:00
Jouni Malinen
c397edf2bb tests: EAP-SIM/AKA with external GSM/UMTS auth failing
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-08 18:04:29 +02:00
Jouni Malinen
40c654cc1d tests: EAP-SIM with external GSM auth and replacing SIM
These test cases verify that EAP-SIM with external GSM auth supports the
use case of replacing the SIM. The first test case does this incorrectly
by not clearing the pseudonym identity (anonymous_identity in the
network profile) while the second one clears that and shows successful
connection.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-08 18:03:11 +02:00
Jouni Malinen
21cb63fffd OpenSSL: Fix client certificate chain building after PKCS#12 use
If wpa_supplicant was first configured with PKCS #12 -based client
certificate chain and then used with another network profile that used a
different certificate chain from a X.509 certificate PEM file instead of
PKCS#12, the extra certificate chain was not reconstructed properly with
older versions of OpenSSL that 1.0.2. This could result in the
authentication failing due to the client certificate chain not being
complete or including incorrect certificates.

Fix this by clearing the extra certificate chain when setting up a new
TLS connection with OpenSSL 1.0.1. This allows OpenSSL to build the
chain using the default mechanism in case the new TLS exchange does not
use PKCS#12.

The following hwsim test case sequence was able to find the issue:
ap_wpa2_eap_tls_pkcs12 ap_wpa2_eap_tls_intermediate_ca_ocsp

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 17:54:23 +02:00
Jouni Malinen
12a81b64e1 ACS: Remove unreachable case from a debug print
n_chans can have only values 1, 2, or 4 in this function, so the -1 case
could never be reached. Remove the unreachable case to get rid of static
analyzer warnings.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 16:50:53 +02:00
Jouni Malinen
896607d36b Remove a pointer check that can never be true
chan is set to the result of pointer arithmetic (pointer to an entry in
an array) that can never be NULL. As such, there is no need to check for
it to be non-NULL before deference. Remove this check to avoid
complaints from static analyzers.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 16:47:17 +02:00
Jouni Malinen
a95cc47a92 ACS: Be more consistent with iface->current_mode checks
Offloading of ACS to the driver changed the design a bit in a way that
iface->current_mode could actually be NULL when the offloaded ACS
mechanism supports band selection in addition to channel selection. This
resulted in a combination that is too complex for static analyzers to
notice. While acs_init() can be called with iface->current_mode == NULL
that is only in the case where WPA_DRIVER_FLAGS_ACS_OFFLOAD is in use.
In other words, the actual ACS functions like acs_cleanup() that would
dereference iface->current_mode are not used in such a case.

Get rid of static analyzer warnings by explicitly checking
iface->current_mode in acs_init() for the case where ACS offloading is
not used.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 16:39:10 +02:00
Jouni Malinen
6014e59c08 P2P: Print find_start in debug log when ignoring old scan results
This makes it easier to debug issues with old scan results being ignored
during P2P_FIND. A single rx_time would have been fine with
os_gettime(), but with os_get_reltime(), both rx_time and find_start
values are needed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 13:41:15 +02:00
Jouni Malinen
64845c1f1a l2_packet: Extend bridge workaround RX processing to cover two frames
There was a race condition in how the l2_packet sockets got read that
could result in the same socket (e.g., non-bridge) to process both the
EAP-Success and the immediately following EAPOL-Key msg 1/4 instead of
each frame going in alternative order between the bridge and non-bridge
sockets. This could be hit, e.g., if the wpa_supplicant process did not
have enough CPU to process all the incoming frames without them getting
buffered and both sockets reporting frames simultaneously.

This resulted in the duplicated EAP-Success frame getting delivered
twice for processing and likely also the EAPOL-Key msg 1/4 getting
processed twice. While the latter does not do much harm, the former did
clear the EAP authentication state and could result in issues.

Fix this by extended the l2_packet Linux packet socket workaround for
bridge to check for duplicates against the last two received frames
instead of just the last one.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-07 13:30:59 +02:00
Jouni Malinen
447fb0b0da tests: Make eap_check_auth() error on missing selectedMethod clearer
It was possible to hit an error case in ap_wpa2_eap_in_bridge where the
selectedMethod STATUS field was not available. This resulted in not very
helpful "'selectedMethod'" message in the test log file. Make this
clearer by dumping all received STATUS fields and a clearer exception
message indicating that selectedMethod was missing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-07 00:27:50 +02:00
Jouni Malinen
4a539abdbd l2_packet: Improve bridge workaround RX processing
It was possible for the packet socket on the bridge interface to receive
own transmitted frames between the bridge and non-bridge sockets
receiving the same incoming frame from a foreign host. This resulted in
the hash checksum validation step failing to notice a duplicate RX due
to the own frame updating the store hash value.

The own frame did get dropping in RX EAPOL processing, but that was too
late to address the issue with duplicate RX. Fix this by dropping own
frames already in l2_packet layer before checking and updating the last
RX hash value.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-07 00:24:10 +02:00
Jouni Malinen
2626666ad7 tests: EAP-PAX local error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 21:12:59 +02:00
Jouni Malinen
7a36f1184e EAP-PAX: Check hmac_sha1_vector() return value
This function can fail at least in theory, so check its return value
before proceeding. This is mainly helping automated test case coverage
to reach some more error paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 21:12:08 +02:00
Jouni Malinen
1e35aa15a4 tests: WPS and EAP-WSC error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 20:57:31 +02:00
Jouni Malinen
2386bb9776 tests: EAP-OTP local error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 20:21:29 +02:00
Jouni Malinen
ac713c0929 tests: WPA2-Enterprise connection using EAP-TTLS/EAP-GTC (OOM)
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 20:11:15 +02:00
Jouni Malinen
491e2d260d tests: EAP-EKE peer OOM in building ID message
The previous attempt at testing this path ended up selecting a different
wpabuf_alloc() call.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 20:05:11 +02:00