Previously, this was initialized in hostapd_setup_bss() which made it
possible for a REMOVE_NEIGHBOR control interface command to be issued
prior to the list head pointers having been set. That resulted in a NULL
pointer dereference. Fix this by initializing the list head at the time
the data structure gets allocated.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
All the 3 control interfaces: socket based, dbus & binder needs to
perform the same sequence of steps for network add/remove. So, move
these to a common utility method in |wpa_supplicant.c| instead of
duplicating the code everywhere.
Signed-off-by: Roshan Pius <rpius@google.com>
Accoding to the comment of struct wpa_driver_mesh_bss_params, the
max_peer_links parameter should be under that struct.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Previously, secondary channel offset could be non zero even though
disable_ht40=1. This patch fixes it.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Move out the disconnect command handling from |ctrl_iface.c| to
|wpa_supplicant.c| so that it can be reused across the different
control interfaces (socket, dbus & binder).
Signed-off-by: Roshan Pius <rpius@google.com>
The new network profile parameter group_rekey can now be used to specify
the group rekeying internal in seconds for IBSS.
Signed-off-by: Jouni Malinen <j@w1.fi>
If the driver indicates a roamed event with already completed
authorization, altAccept = TRUE could have resulted in the EAP state
machine ending up in the FAILURE state from the INITIALIZE state. This
is not correct behavior and similar cases were already addressed for FT
and WPA-PSK. Fix the offloaded roamed+authorized (EAP/PMKSA caching)
case by doing similar changes to EAPOL/EAP state variable updates during
association event handling.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add a ".clang-format" file which is pretty close to the rest of
wpa_supplicant code base and reformat the binder codebase.
Signed-off-by: Roshan Pius <rpius@google.com>
Restructure the binder related makefile sections to expose a separate
|libwpa_binder_interface| which can be imported by clients/tests.
While there,
Change the name of the binder service to the name used in the selinux
permissions.
Signed-off-by: Roshan Pius <rpius@google.com>
In preparation for adding further command completion support
to hostapd_cli move some cli related utility functions out of
wpa_cli into a new common cli file.
Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sonymobile.com>
wpas_p2p_persistent_group() returns non-zero for persistent groups. This
value happens to be 2 instead of 1 due to the
P2P_GROUP_CAPAB_PERSISTENT_GROUP value. This ended up with D-Bus code
trying to encode 2 as a DBUS_TYPE_BOOLEAN value which results in an
assert from the library. Fix this by modifying
wpas_p2p_persistent_group() to return 0 or 1 instead of 0 or an
arbitrary non-zero.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This makes wpa_supplicant set default scan IEs to the driver (if the
vendor command is supported). The driver can use these IEs in the scan
requests initiated by the driver itself. Also the driver can merge these
IEs into further scan requests that it receives, in case if the scan
request doesn't carry any of the IEs sent in this command.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Previously, HT capability IE and HT information IE were included in
Beacon and Mesh Peering Open/Confirm frames even if HT is disabled with
disable_ht=1. This patch removes these.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Previously, mesh power management functionality works only with kernel
MPM. Because user space MPM did not report mesh peer AID to kernel,
the kernel could not identify the bit in TIM element. So this patch
reports mesh peer AID to kernel.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
The local found variable is not used in this case. Commit
653d227e9f ('MBO: Improve supported
operating class generation') introduced this variable and unnecessarily
set it here. Remove the write-only assignment to silence static
analyzers.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
If no new sme_sa_query_timer() callback is scheculed,
sme_stop_sa_query() needs to be called to allow new SA Query operations
to be started after the failure.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is needed for hwsim test cases to allow multiple STA-initiated SA
Query operations in short amount of time.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is mainly for testing purposes to allow multiple FETCH_OSU ANQP
operations to be ran without having to wait for full scan between each
query.
Signed-off-by: Jouni Malinen <j@w1.fi>
These control interface event message are used by external programs, so
define them a bit more formally in the header file.
Signed-off-by: Jouni Malinen <j@w1.fi>
If base64_encode() fails (e.g., due to memory allocation failure), the
return value needs to be checked against NULL before using the (not
really) returned length value. The error path here ended up reading
uninitialized variable.
Signed-off-by: Jouni Malinen <j@w1.fi>
The previous version did not really work at all and it ended up crashing
if the os_strdup(field->name) call failed.
Signed-off-by: Jouni Malinen <j@w1.fi>
There is no need to maintain separate "return -1;" for each of the
wpa_config_set() calls that cannot really fail in practice.
Signed-off-by: Jouni Malinen <j@w1.fi>
This allows P2P Listen to be offloaded to device to enhance power
saving.
To start P2P listen offload, from wpa_cli interface, issue the command:
p2p_lo_start <freq> <period> <interval> <count>
To stop P2P listen offload, issue the command:
p2p_lo_stop
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Previously, wpa_set_scan_ssids() fully exhausted
wpa_driver_scan_params.ssid list when hidden network IDs are provided
via the control interface. This results in us exceeding the max size for
the list advertised by the driver when we add the "wildcard" scan SSID
entry. So, ensure that we leave space for one more scan SSID entry in
the list when we exit out of wpa_set_scan_ssids().
Signed-off-by: Roshan Pius <rpius@google.com>
Previously, 2.4 GHz operating class 81 was not added for US due to not
all of the channels (1-13 in this operating class) being supported.
Still, this operating class is the main operating class in the global
table for 2.4 GHz and it is the only option for indicating support for
the 2.4 GHz band channels in US.
Change the supported operating class building rules to include all
operating classes for which at least one channel is enabled. In
addition, fix the 80, 80+80, and 160 MHz channel checks (checking the
center frequency channel was failing since it is not a valid 20 MHz
channel).
Signed-off-by: Jouni Malinen <j@w1.fi>
{OPN,CNF,CLS}_IGNR events were removed during P802.11s draft development
process. Replace these with not generating a MPM FSM event. In addition,
add the standard REQ_RJCT event and option to pass in a specific reason
code to mesh_mpm_fsm().
Signed-off-by: Jouni Malinen <j@w1.fi>
During the P802.11s draft development, there were separate LISTEN and
IDLE states. However, the current IEEE 802.11 standards uses only the
IDLE state while the implementation called this LISTEN. Rename the state
in the implementation to match the one used in the standard to avoid
confusion. In addition, rename OPEN_{SENT,RCVD} to OPN_{SNT,RCVD} to
match the exact spelling of these states in the standard.
Signed-off-by: Jouni Malinen <j@w1.fi>
REVmc/D6.0 14.5.5.2.2 (Processing Mesh Peering Open frames for AMPE)
mandates the OPN_RJCT event to be invoked if AES-SIV decryption for
received Mesh Peering Open frame fails. This allows a Mesh Peering Close
frame to be sent in such a case.
Signed-off-by: Jouni Malinen <j@w1.fi>
These optional fields are supposed to be included in the Authenticated
Mesh Peering Exchange element only in Mesh Peering Open frames.
Previously, these were incorrectly included in Mesh Peering
Confirm/Close frames and also required to be present in all these
frames.
While this commit changes the receive processing to ignore the
unexpected extra fields, it should be noted that the previous
implementation required the fields to be present and as such, the fixed
implementation is not compatible with it for secure mesh.
Signed-off-by: Jouni Malinen <j@w1.fi>
If radio_add_work() fails, gas_query_req() ended up freeing the query
payload and returning an error. This resulted in also the caller trying
to free the query payload. Fix this by not freeing the buffer within
gas_query_req() in error case to be consistent with the other error
cases.
Signed-off-by: Jouni Malinen <j@w1.fi>
This function was added with the initial GAS implementation, but there
was no user for it at the time and no clear use now either, so remove
the unused function and the related GAS query reason code.
Signed-off-by: Jouni Malinen <j@w1.fi>
Apply the GAS specific rule of using Protected Dual of Public Action
frame only after having checked that the action code indicates this to
be a GAS response. Previously, non-GAS Public Action frames could have
been incorrectly dropped because of this check if received during an
association with PMF enabled.
Signed-off-by: Jouni Malinen <j@w1.fi>
The GAS-QUERY-DONE event with result=INTERNAL_ERROR was reported on most
other error cases, but the failure triggered by not being able to
transmit a GAS Initial Request stopped the query silently. Make this
more consistent with other error cases by reporting the same event.
Signed-off-by: Jouni Malinen <j@w1.fi>
Now that mesh sets wpa_s->wpa_state = WPA_COMPLETED, it looks like this
getter can get called with wpa_s->current_ssid = NULL. That could result
in NULL pointer dereference, so need to protect that specific case.
Signed-off-by: Jouni Malinen <j@w1.fi>
This signal sends the peer properties to applications for discovered
peers. The signature of this event is "oa{sv}". This event is needed
because the current DeviceFound signal provides only the peer object
path. If there are many peers in range there will be many DeviceFound
signals and for each DeviceFound signal, applications would need to use
GetAll to fetch peer properties. Doing this many times would create
extra load over application as well as over wpa_supplicant, so it is
better to send peer properties in the event so that applications can
extract found peer information without extra steps.
The existing DeviceFound signal is left as-is to avoid changing its
signature.
The issue is not applicable to the control interface because the
P2P-DEVICE-FOUND event includes peer info in it, but over D-Bus
interface DeviceFound provides only the peer object.
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
In mesh interface, the wpa_supplicant state was either
DISCONNECT/SCANNING in non-secured connection or AUTHENTICATING in
secured connection. The latter prevented the scan. Update the
wpa_supplicant state in mesh to be COMPLETED upon initialization. This
is similar to the P2P GO case.
Signed-off-by: Maital Hahn <maitalm@ti.com>
In wpa_supplicant AP mode, allow configuration of the EAP fragment size
using the fragment_size member of network block (wpa_ssid), similar to
the fragment_size in hostapd configuration. bss->fragment_size default
value of 0 is treated specially in some EAP code paths (such as MTU
initialization in eap_pwd_init). In order to preserve the existing
behavior, bss->fragment_size will only be set if the network block
specified a value different from the default which is
DEFAULT_FRAGMENT_SIZE(1398) bytes.
Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
This is now annotated as be16, so use it as such in all cases instead of
first storing host byte order value and then swapping that to big endian
in other instances of the same structure. This gets rid of number of
sparse warnings.
Signed-off-by: Jouni Malinen <j@w1.fi>
This gets rid of number of sparse warnings and also allows the
compatibility of the declarations to be verified.
Signed-off-by: Jouni Malinen <j@w1.fi>
This gets rid of number of sparse warnings and also allows the
compatibility of the declarations to be verified.
Signed-off-by: Jouni Malinen <j@w1.fi>
In some cases parsing of the mesh scan info for a BSS or the P2P scan
info can fail. One reason can be that the Beacon/Probe Response frame
contained malformed length vendor IEs which are not parsed when adding
to the BSS table. Instead of skipping the whole BSS of the BSS command,
just skip the part that failed to parse.
Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
The "Accepting Additional Mesh Peerings bit == 0" means the peer cannot
accept any more peers, so suppress attempt to open a connection to such
a peer.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
This moves pairwise, group, and management group ciphers to various mesh
data structures to avoid having to hardcode cipher in number of places
through the code. While CCMP and BIP are still the hardcoded ciphers,
these are now set only in one location.
Signed-off-by: Jouni Malinen <j@w1.fi>
The AMPE element includes number of optional and variable length fields
and those cannot really be represented by a fixed struct
ieee80211_ampe_ie. Remove the optional fields from the struct and
build/parse these fields separately.
This is also adding support for IGTKdata that was completely missing
from the previous implementation. In addition, Key RSC for MGTK is now
filled in and used when configuring the RX MGTK for a peer.
Signed-off-by: Jouni Malinen <j@w1.fi>
The previous implementation was incorrect in forcing the MGTK to be used
as the IGTK as well. Define new variable for storing IGTK and use that,
if set, to configure IGTK to the driver. This commit does not yet fix
AMPE element parsing to fill in this information.
Signed-off-by: Jouni Malinen <j@w1.fi>
This extends the data structures to allow variable length MGTK to be
stored for RX. This is needed as an initial step towards supporting
different cipher suites.
Signed-off-by: Jouni Malinen <j@w1.fi>
Previous implementation was incorrectly using MGTK also as the IGTK and
doing this regardless of whether PMF was enabled. IGTK needs to be a
independent key and this commit does that at the local TX side.
The current AMPE element construction and parsing is quite broken, so
this does not get add the IGTKdata field there.
Signed-off-by: Jouni Malinen <j@w1.fi>
Clean up the mesh_rsn_derive_mtk() function by using proper macros and
pointer to the location within the context block.
Signed-off-by: Jouni Malinen <j@w1.fi>
mesh_rsn_derive_mtk() was hardcoded to use GCMP (even though CCMP was
hardcoded elsewhere) cipher suite selector instead of the selected AKM
suite selector. This resulted in incorrect MTK getting derived. Fix this
by used the SAE AKM suite selector in the input to the KDF.
Signed-off-by: Jouni Malinen <j@w1.fi>
Clean up the mesh_rsn_derive_aek() function by using proper macros and
pointer to the location within the context block.
Signed-off-by: Jouni Malinen <j@w1.fi>
mesh_rsn_derive_aek() was hardcoded to use GCMP (even though CCMP was
hardcoded elsewhere) cipher suite selector instead of the selected AKM
suite selector. This resulted in incorrect AEK getting derived. Fix this
by used the SAE AKM suite selector in the input to the KDF.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is initial step in fixing issues in how PMF configuration for RSN
mesh was handled. PMF is an optional capability for mesh and it needs to
be configured consistently in both hostapd structures (to get proper
RSNE) and key configuration (not included in this commit).
Signed-off-by: Jouni Malinen <j@w1.fi>
Fix possible memory leak in case if WPS is not enabled on the interface
for connection. This path was missed in commit
fae7b37260 ('WPS: Do not expire probable
BSSes for WPS connection').
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
When the BSS count reaches max_bss_count, the oldest BSS will be removed
in order to accommodate a new BSS. Exclude WPS enabled BSSes when going
through a WPS connection so that a possible WPS candidate will not be
lost.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Ditch the legacy syntax and manual engine mangling and just give an
example using simple PKCS#11 URIs that'll work with both GnuTLS and
OpenSSL.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
IEEE Std 802.11-2012, 10.19 (Public Action frame addressing) specifies
that the wildcard BSSID value is used in Public Action frames that are
transmitted to a STA that is not a member of the same BSS.
wpa_supplicant used to use the actual BSSID value for all such frames
regardless of whether the destination STA is a member of the BSS.
P2P does not follow this rule, so P2P Public Action frame construction
must not be changed. However, the cases using GAS/ANQP for non-P2P
purposes should follow the standard requirements.
Unfortunately, there are deployed AP implementations that do not reply
to a GAS request sent using the wildcard BSSID value. The previously
used behavior (Address3 = AP BSSID even when not associated) continues
to be the default, but the IEEE 802.11 standard compliant addressing
behavior can now be configured with gas_address3=1.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This allows minimal testing with 160 MHz channel with country code ZA
that happens to be the only one with a non-DFS 160 MHz frequency. DFS
with mesh is not yet supported.
Signed-off-by: Jouni Malinen <j@w1.fi>
ssid->frequency cannot be 0 in wpa_supplicant_mesh_init() since
wpas_supplicant_join_mesh() rejects such a configuration.
Signed-off-by: Jouni Malinen <j@w1.fi>
This adds the necessary changes to support extraction and use of the
extended capabilities specified per interface type (a recent
cfg80211/nl80211 extension). If that information is available,
per-interface values will be used to override the global per-radio
value.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add a new "timeout" argument to the event message if the nl80211 message
indicates that the connection failure is not due to an explicit AP
rejection message. This makes it easier for external programs to figure
out why the connection failed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
wpa_deinit() got called twice if the random_get_bytes() fails to
generate the MGTK. This resulted in double-freeing the rsn->auth
pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for
all error cases.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This adds an extra parameter in GroupStarted signal to indicate whether
the created group is Persistent or not. It is similar to the
[PERSISTENT] tag which comes in P2P-GROUP-STARTED over the control
interface.
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
