Commit graph

14574 commits

Author SHA1 Message Date
Jouni Malinen
9f12271b2a FT: XXKey derivation for SHA384-based AKM
XXKey is the first 384 bits of MSK when using the SHA384-based FT AKM.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 19:29:52 +03:00
Jouni Malinen
a3e18dbb6a FT: Support variable length keys
This is a step in adding support for SHA384-based FT AKM.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 19:29:52 +03:00
Jouni Malinen
c22bb5bba6 FT: SHA384-based AKM in RSNE processing
This defines key lengths for SHA384-based FT AKM and handles writing and
parsing for RSNE AKMs with the new value.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-05 01:11:41 +03:00
Jouni Malinen
3a11c69e0d EAP-TLS: Derive Session-Id using TLS-Exporter when TLS v1.3 is used
This updates Session-Id derivation with TLS v1.3 per
draft-ietf-emu-eap-tls13-00.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-01 17:58:56 +03:00
Jouni Malinen
925584689b tests: ERP enabled on RADIUS server and peer using EAP-TLS v1.3
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-01 17:53:10 +03:00
Jouni Malinen
2d26434ac7 EAP-TLS server: Fix EMSK derivation with TLS v1.3
The new label string for TLS-Exporter was taken into use for MSK
derivation, but it was missed from EMSK deriation in the server side
implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-01 17:52:18 +03:00
Jouni Malinen
f8aed720e4 EAP-TLS: Update key derivation label per draft-ietf-emu-eap-tls13-00
The label strings used for deriving Key_Material with TLS v1.3 were
changed, so update the implementation to match the new values.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-06-01 17:41:59 +03:00
Sven Eckelmann
20c2ea412a wpa_supplicant: Fix parsing of max_oper_chwidth
The max_oper_chwidth is parsed in wpa_config_set as INT_RANGE (see
ssid_fields). The actual parsing for INT_RANGE is done by
wpa_config_parse_int which can only store the result as full integer.

max_oper_chwidth is stored as u8 (a single byte) in wpa_ssid. This means
that on little endian systems, the least significant byte of the parsed
value are really stored in the max_oper_chwidth. But on big endian
system, the only most significant byte is stored as max_oper_chwidth.
This means that 0 is always stored because the provided range doesn't
allow any other value for systems with multi-byte-wide integers.

This also means that for common systems with 4-byte-wide integers, the
remaining 3 bytes were written after the actual member of the struct.
This should not have influenced the behavior of succeeding members
because these bytes would have been part of the padding between the
members on most systems.

Increasing its size to a full int fixes the write operations outside of
the member and allows to use the max_oper_chwidth setting on big endian
systems.

Fixes: 0f29bc68d1 ("IBSS/mesh: Add support for VHT80P80 configuration")
Signed-off-by: Sven Eckelmann <sven.eckelmann@openmesh.com>
2018-05-31 16:14:28 +03:00
Jouni Malinen
13f69792b0 tests: Update mesh_oom to match implementation change
The initial direct allocation within wpa_supplicant_mesh_init() was
removed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-31 16:14:28 +03:00
Felix Fietkau
8fd29a0439 mesh: Fix crash with CONFIG_TAXONOMY enabled
wpa_s->ifmsh needs to be allocated using hostapd_alloc_iface() instead
of a direct call to os_zalloc(), otherwise the linked list for station
taxonomy items remains uninitialized, leading to a crash on the first
attempt to traverse that list

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2018-05-31 13:06:07 +03:00
Mikael Kanstrup
8518326b22 Add some missing driver flags strings
New WPA_DRIVER_FLAGS have been added but corresponding lookup
strings for driver_flags command were never added. Add the
missing strings.

Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sony.com>
2018-05-31 13:03:54 +03:00
Jouni Malinen
5fb016a219 tests: WNM Time Advertisement without time zone configuration
This is a regression test for a segfault in hostapd.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-31 12:55:49 +03:00
Markus Theil
b375b04b67 WNM: Fix time_zone advertisement without time_zone configuration
If time_advertisement=2 is included in hostapd configuration, but
time_zone is unset, the previous implementation tried to write the Time
Zone element into management frames. This resulted in segmentation fault
when trying to dereference a NULL pointer. Fix that by skipping addition
of this element when time_zone parameter is not set.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2018-05-31 12:53:43 +03:00
Peter Oh
0928b62944 nl80211: Allow mesh interface to send channel switch request
Add mesh type to nl80211 channel switch request, so mesh is able to send
the request to kernel drivers.

Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
2018-05-31 12:16:03 +03:00
Jouni Malinen
64224d5871 tests: Hotspot 2.0 OSEN-single-SSID connection
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 23:34:22 +03:00
Jouni Malinen
f5a602168f HS 2.0: Allow OSEN connection to be used in an RSN BSS
This allows a single BSS/SSID to be used for both data connection and
OSU. In wpa_supplicant configuration, the current proto=OSEN
key_mgmt=OSEN combination is now allowing both the old separate OSEN
BSS/IE and the new RSN-OSEN to be used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 23:34:22 +03:00
Jouni Malinen
8d660a4bac HS 2.0: Allow OSEN connection to be enabled in an RSN BSS
This allows a single BSS/SSID to be used for both data connection and
OSU. Instead of hostapd configuration osen=1, wpa_key_mgmt=OSEN (or more
likely, wpa_key_mgmt=WPA-EAP OSEN) is used to enable this new option.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-29 23:34:22 +03:00
xiaofeis
0fe3ede0a4 macsec_qca: Fix byte order of TX SCI port
Before calling HW macsec driver API, be_to_host16() should be used to
reverse the SCI port byte order. This was broken as part of the mka API
changes.

Fixes: 8ebfc7c2ba ("mka: Pass full structures down to macsec drivers' transmit SC ops")
Signed-off-by: xiaofeis <xiaofeis@codeaurora.org>
2018-05-28 22:17:58 +03:00
Jouni Malinen
5e597ed9f0 tests: EAP-pwd with salted passwords
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-28 22:15:20 +03:00
Dan Harkins
22ac3dfebf EAP-pwd: Mask timing of PWE derivation
Run through the hunting-and-pecking loop 40 times to mask the time
necessary to find PWE. The odds of PWE not being found in 40 loops is
roughly 1 in 1 trillion.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:15:15 +03:00
Dan Harkins
b8acd50114 EAP-pwd peer: Add SHA512 hash based salt mechanism
Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:09:20 +03:00
Dan Harkins
fb3675848c EAP-pwd peer: Add SHA256 hash based salt mechanism
Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:09:20 +03:00
Dan Harkins
7ef8adc7d8 EAP-pwd peer: Add SHA-1 hash based salt mechanism
Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:09:20 +03:00
Jouni Malinen
7280723fbf EAP-pwd peer: Check for unexpected state for ID exchange
Aborty processing if ID exchange processing is entered twice
unexpectedly. This avoids memory leaks in the function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-28 22:09:20 +03:00
Dan Harkins
44136f6ca2 EAP-pwd peer: Add support for salted password databases
These changes add support for salted password databases to EAP-pwd per
RFC 8146. This commits introduces the framework for enabling this and
the actual salting mechanisms are introduced in the following commits.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:09:20 +03:00
Jouni Malinen
b30639b77e tests: Adjust eap_proto_pwd_errors to match implementation changes
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-28 22:09:20 +03:00
Dan Harkins
0744e303cf EAP-pwd peer: Move PWE derivation to commit exchange
There is no need to do this during the ID exchange, so move PWE
deriation into the following commit exchange in preparation for adding
support for salted passwords.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:09:20 +03:00
Dan Harkins
d52ead3db7 EAP-pwd server: Add support for salted password databases
These changes add support for salted password databases to EAP-pwd per
RFC 8146. This commits introduces the framework for enabling this and
the salting mechanisms based on SHA-1, SHA256, and SHA512 hash
algorithms.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:08:51 +03:00
Dan Harkins
a8712ce5b3 EAP-pwd: Pre-processing method definitions from RFC 8146
Add new password pre-processing method definitions in preparation for
salted passwords with EAP-pwd.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 17:15:07 +03:00
Dan Harkins
2a5c291881 EAP-pwd: Move EC group initialization to earlier step
This is needed for adding support for salted passwords.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 17:15:07 +03:00
Sachin Ahuja
b829e4b694 Add a QCA vendor command attribute to enable/disable GTX
This commit adds a new vendor command attribute
QCA_WLAN_VENDOR_ATTR_CONFIG_GTX in
QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION to enable/disable green
Tx power saving feature.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-24 18:47:48 +03:00
Jouni Malinen
62566bc23d tests: WPA2-EAP-FT AP changing from 802.1X-only to FT-only
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-21 22:24:36 +03:00
Jouni Malinen
833bb2ab15 FT: Disable PMKSA caching with FT
PMKSA caching with FT is not fully functional, so disable the case for
now, so that wpa_supplicant does not end up trying to connect with a
PMKSA cache entry from another AKM. FT-EAP was already modified long
time ago to not add PMKSA cache entries itself.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-21 22:18:50 +03:00
Lior David
91db940ff0 fst: Fix compile error in fst_ctrl_aux.h with C++ compilers
Move enum fst_reason to be a top level type, since it is used as
argument in the function fst_reason_name() and having it as nested
type caused a compile error when fst_ctrl_aux.h was included from
a C++ source file.

Signed-off-by: Lior David <liord@codeaurora.org>
2018-05-21 17:47:03 +03:00
Jouni Malinen
9a0ae89d62 tests: SAE with Password Identifier
This verifies SAE Password Identifier functionality in both the
infrastructure and mesh BSS cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:30:29 +03:00
Jouni Malinen
9be19d0b9c SAE: Add support for using the optional Password Identifier
This extends the SAE implementation in both infrastructure and mesh BSS
cases to allow an optional Password Identifier to be used. This uses the
mechanism added in P802.11REVmd/D1.0. The Password Identifier is
configured in a wpa_supplicant network profile as a new string parameter
sae_password_id. In hostapd configuration, the existing sae_password
parameter has been extended to allow the password identifier (and also a
peer MAC address) to be set. In addition, multiple sae_password entries
can now be provided to hostapd to allow multiple per-peer and
per-identifier passwords to be set.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:30:29 +03:00
Jouni Malinen
d6a65a83fb mesh: Register msg_ctx for hostapd/AP code
The use of hostapd code for a mesh interface did not register
hapd->msg_ctx. This needs to be done similarly to the existing cases in
wpa_supplicant AP and IBSS mode uses so that wpa_msg() calls from the
hostapd/AP code get delivered properly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:22:48 +03:00
Naveen Rawat
4e47eec5a9 Add QCA NAN vendor attributes to provide IPv6 information
Add NAN attributes to communicate IPv6 address, port, and protocol
between wifihal and host driver.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:10:15 +03:00
Jouni Malinen
6bf7a54754 tests: Brainpool curves in ap_wpa2_eap_pwd_groups with OpenSSL 1.1.x
The OpenSSL version check should not have been limited to 1.0.2 only.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:03:25 +03:00
Jouni Malinen
9973129646 wolfSSL: Fix crypto_bignum_rshift() wrapper
The n argument to this function is number of bits, not bytes, to shift.
As such, need to use mp_rshb() instead of mp_rshd(). This fixes EAP-pwd
with P-521 curve.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:02:02 +03:00
Sean Parkinson
4b2e03c42a wolfSSL: DH initialization to call TEST_FAIL() for error tests
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-17 20:08:22 +03:00
Sean Parkinson
2b01270c8a wolfSSL: Fix ECDH set peer to use the index when importing point
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-17 20:08:15 +03:00
Jouni Malinen
ffff7f7095 OWE: Mark connection failed in the unlikely no-bss-entry case
If no BSS entry can be found when processing association rejected event
from the driver for the special OWE case of unsupported
finite-cyclic-group, process the event as a connection failure instead
of just skipping the the OWE retry with another DH group.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 19:01:23 +03:00
Jouni Malinen
0cc41ee635 Move wpa_supplicant_event() EVENT_ASSOC_REJECT handling into a function
This cleans up the implementation a bit by making this functionality
easier to understand.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 18:52:17 +03:00
Jouni Malinen
27fa11615b tests: Additional VHT channel switch testing
Enable/disable VHT with CHAN_SWITCH.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Sathishkumar Muruganandam
bda9c08596 hostapd: Fix CHAN_SWITCH command for VHT20 and VHT40
Previously, hostapd CHAN_SWITCH command did not effect VHT configuration
for the following:

When VHT is currently disabled (ieee80211ac=0),

1. hostapd_cli -p /var/run/hostapd chan_switch 10 5180 \
                sec_channel_offset=1 center_freq1=5190 bandwidth=40 ht

====> Comes up in HT40

2. hostapd_cli -p /var/run/hostapd chan_switch 10 5765 \
                sec_channel_offset=-1 center_freq1=5775 bandwidth=40 vht

====> Comes up in HT40

3. hostapd_cli -p /var/run/hostapd chan_switch 10 5200 center_freq1=5200 \
                                                  bandwidth=20 vht

====> Comes up in HT20

When VHT is currently enabled (ieee80211ac=1),

1. hostapd_cli -p /var/run/hostapd chan_switch 10 5180 \
                sec_channel_offset=1 center_freq1=5190 bandwidth=40 ht

====> Comes up in VHT40

2. hostapd_cli -p /var/run/hostapd chan_switch 10 5200 center_freq1=5200 \
                                                  bandwidth=20 ht

====> Comes up in VHT20

This is since VHT config from chan_switch is processed only for
bandwidths 80 and above (80P80, 160) and for VHT20, VHT40 cases, only
NLA chan type and chan width are updated.

There is no NL attribute for determining if it is HT or VHT for
bandwidths 20 & 40 and currently they are updated as HT20, HT40 (+ or -
depending on offset). Same is notified back via
NL80211_CMD_CH_SWITCH_NOTIFY.

Instead of adding new NL attribute for tracking HT/VHT enabled config,
we are adding new hostapd VHT config parameter to save the chan_switch
config and use only for chan_switch case of VHT20 and VHT40.

Tested with all combinations of chan_switch (noHT->20->40->80->) HT/VHT
and confirmed to be working.

Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
2018-05-16 01:16:54 +03:00
Srinivas Dasari
16d5c9637c OWE: Get the bss from bssid of assoc_reject to try for next group
On an assoc_reject from the BSS with the status=77, a connection attempt
with the next supported group happens. The BSS considered here is from
current_bss which may be NULL at this point of time with SME-in-driver
case. Address this by getting the BSS from the bssid obtained in
association reject indication and skip the step if no BSS entry can be
found.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Karthikeyan Periyasamy
c4dd3afa3c ACS: Avoid invalid interference factor when survey channel time is zero
When the channel time is zero the interference factor calculation falls
under divide by zero operation which results in invalid (NaN =
not-a-number) interference factor value. This leads to wrong ideal
channel selection in ACS during the scenario described below.

Scenario:

In VHT80 mode, the channel 36 (first channel) gets the channel time as
zero which causes the interfactor factor to be an invalid number (NaN).
Any operations (like addition, mulitplication, divide, etc.) with NaN
value results in a NaN value, so that average factor for the primary
channel 36 got the invalid value (NaN). Since channel 36 is the first
channel, ideal factor is assigned as NaN in the first iteration. The
following iteration condition check (factor < ideal_factor) with a NaN
value fail for all other primary channels. This results in channel 36
being chosen as the ideal channel in ACS which holds a NaN value.

Logs:

ACS: Survey analysis for channel 36 (5180 MHz)
ACS: 1: min_nf=-103 interference_factor=nan nf=0 time=0 busy=0 rx=0
ACS: 2: min_nf=-103 interference_factor=0.615385 nf=-102 time=13 busy=8 rx=0
ACS: 3: min_nf=-103 interference_factor=2.45455 nf=0 time=22 busy=16 rx=0
ACS: 4: min_nf=-103 interference_factor=0.785714 nf=-103 time=42 busy=33 rx=0
ACS: 5: min_nf=-103 interference_factor=nan nf=0 time=0 busy=0 rx=0
ACS:  * interference factor average: nan
...
ACS:  * channel 36: total interference = nan
..
ACS:  * channel 149: total interference = 5.93174e-21
..
ACS: Ideal channel is 36 (5180 MHz) with total interference factor of nan

Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
2018-05-16 01:16:54 +03:00
Jeff Johnson
6965705bf5 Fix style issues in qca-vendor.h
Over time a number of style issues have crept into qca-vendor.h,
so fix most of them. There are some identifiers and comments which
exceed 80 columns, but these are left as-is for readability.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Kiran Kumar Lokere
7d66e7c408 Define new QCA feature flag for self managed regulatory support
This can be used to determine which mechanism to use for configuring
country code from trusted sources.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00