Commit graph

10288 commits

Author SHA1 Message Date
Bob Copeland
6c33eed3ee mesh: Fix PMKID to match the standard
IEEE Std 802.11-2012 11.3.5.4 specifies the PMKID for SAE-derived keys
as:

   L((commit-scalar + peer-commit-scalar) mod r, 0, 128)

This is already calculated in the SAE code when the PMK is derived, but
not saved anywhere. Later, when generating the PMKID for plink action
frames, the definition for PMKID from 11.6.1.3 is incorrectly used.
Correct this by saving the PMKID when the key is generated and use it
subsequently.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
ede7770180 wpa_supplicant: Do not wait for monitor on P2P Device interface
External programs are not aware of the creation of a
dedicated P2P Device interface, so it does not make sense
to wait for a monitor to connect on such an interface.

Fix this by not waiting on a dedicated P2P Device interface
for monitor to attach.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
1c94570f1b Do not wait for monitor to attach if no control interface
In case an interface has started without a control interface
initialized, skip waiting for monitor to attach at the start of
wpa_supplicant (-W).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
f98674aa37 Clone default LIBS value to LIBS_* for other tools
If LIBS is set with some global build system defaults, clone those for
LIBS_c, LIBS_h, LIBS_n, and LIBS_p to cover wpa_cli, wpa_passphrase,
hostapd_cli, hlr_auc_gw, and nt_password_hash as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
161c8515cc tests: Make ap_wps_probe_req_ie_oom more robust
It was possible to hit a race condition between WPS_CANCEL and
immediately following WPS_PIN command. Wait for a disconnection event to
avoid that. This was seen with the following test case sequence:
ap_wpa2_psk_supp_proto_wrong_group_key_len ap_wps_probe_req_ie_oom

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
33dfdcbae7 tests: wpa_supplicant AP mode with ACS
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 22:24:05 +02:00
Jouni Malinen
7d2f67433d Add "GET_CAPABILITY acs" to allow ACS build option to be detected
This allows upper layer software to check whether wpa_supplicant can use
ACS for AP mode.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
d99097177a wpa_supplicant: Enable Automatic Channel Selection support for AP mode
Since hostapd supports ACS now, let's enable its support in
wpa_supplicant as well when starting AP mode.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
[u.oelmann@pengutronix.de: adjusted added text in defconfig]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
96bc508684 Handle survey event properly in wpa_supplicant
Let's reuse hostapd code for such handling. This will be useful to get
ACS support into wpa_supplicant where this one needs to handle the
survey event so it fills in the result ACS subsystem will require.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 21:35:54 +02:00
Johannes Berg
be9fe3d8af tests: vm: Output everything on console
When running tests, make printk put all messages, including debug
messages, onto the serial console to go into the console file.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-24 21:27:24 +02:00
Jouni Malinen
d39f796f43 EAP-TNC peer: Remove dead code related to fragmentation
The data->state == WAIT_FRAG_ACK case is already handling all cases
where data->out_buf could be non-NULL, so this additional check after
the WAIT_FRAG_ACK steps cannot be reached. Remove the duplicated dead
code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
662512e027 P2PS: Remove dead code
Commit f8a80e39b3 ('P2PS: Change
connection capability handling') added the identical P2PS_SETUP_CLIENT
check into two places within p2ps_group_capability(). However, only the
first one of these can be reached. In the second case, role can only
have values 0 or P2PS_SETUP_NEW and as such, the P2PS_SETUP_CLIENT case
is not possible. It looks like the first part of the commit is
sufficient, so remove the dead code added by the second part.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
0c8eacd1ab tests: EAP-TNC protocol tests
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
abbbaa4997 TNC: Print received IF-TNCCS message as debug ASCII hexdump
This makes it easier to see what TNCC is processing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 18:33:19 +02:00
Jouni Malinen
d745f02e0e EAP-TNC peer: Allow fragment_size to be configured
Previously, a fixed 1300 fragment_size was hardcoded. Now the EAP
profile parameter fragment_size can be used to override this.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 14:19:23 +02:00
Jouni Malinen
e85bb01998 tests: Move P2P-REMOVE-AND-REFORM-GROUP cases more robust
Wait for the AP-DISABLED and AP-ENABLED group events before reading the
current group operation frequency after P2P-REMOVE-AND-REFORM-GROUP.
This reduces a possibility of a race condition making a test case fail
with the returned frequency being 0 when reading this before the
reformed group is fully up. This may help avoid false error reports for
the following test cases: p2p_go_move_reg_change p2p_go_move_scm
p2p_go_move_scm_peer_supports p2p_go_move_scm_multi.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 13:40:54 +02:00
Jouni Malinen
a67e7e533a RADIUS: Add EACCES to list of recognized send() errno values
This allows RADIUS failover to be performed if send() return EACCES
error which is what happens after a recent Linux kernel commit
0315e382704817b279e5693dca8ab9d89aa20b3f ('net: Fix behaviour of
unreachable, blackhole and prohibit') for a local sender when route type
is prohibit.

This fixes the hwsim test case radius_failover when running against a
kernel build that includes that commit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:43:05 +02:00
Jouni Malinen
44f4394296 tests: RADIUS Accounting and non-ASCII SSID
This shows an example of Called-Station-Id in Access-Request and
Accounting-Request with non-ASCII characters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:19:41 +02:00
Jouni Malinen
5bd9be4d17 Fix RADIUS Called-Station-Id to not escape SSID
Commit 986de33d5c ('Convert remaining SSID
routines from char* to u8*') started using wpa_ssid_txt() to print out
the SSID for the Called-Station-Id attribute in RADIUS messages. This
was further modified by commit 6bc1f95613
('Use printf escaping in SSID-to-printable-string conversion') to use
printf escaping (though, even without this, wpa_ssid_txt() would have
masked characters).

This is not desired for Called-Station-Id attribute. While it is defined
as a "String", RFC 2865 indicates that "a robust implementation SHOULD
support the field as undistinguished octets.".

Copy the SSID as an array of arbitrary octets into Called-Station-Id to
avoid any kind of masking or escaping behavior. This goes a step further
from the initial implementation by allowing even the possible (but
unlikely in practical use cases) 0x00 octet in the middle of an SSID.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:15:36 +02:00
Jouni Malinen
52811b8c90 tests: EAP-TLS with intermediate CAs and OCSP multi
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
0764dd6849 TLS client: Multi-OCSP check to cover intermediate CAs
This extends multi-OCSP support to verify status for intermediate CAs in
the server certificate chain.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
d6b536f7e5 Add ocsp=3 configuration parameter for multi-OCSP
ocsp=3 extends ocsp=2 by require all not-trusted certificates in the
server certificate chain to receive a good OCSP status. This requires
support for ocsp_multi (RFC 6961). This commit is only adding the
configuration value, but all the currently included TLS library wrappers
are rejecting this as unsupported for now.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
02683830b5 TLS: Move variable declaration to the beginning of the block
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
98d125cafa tests: Minimal testing of OCSP stapling with ocsp_multi
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-23 00:32:52 +02:00
Jouni Malinen
b5677752b2 TLS client: OCSP stapling with ocsp_multi option (RFC 6961)
This adds a minimal support for using status_request_v2 extension and
ocsp_multi format (OCSPResponseList instead of OCSPResponse) for
CertificateStatus. This commit does not yet extend use of OCSP stapling
to validate the intermediate CA certificates.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 20:44:56 +02:00
Jouni Malinen
8ea6a27003 TLS server: OCSP stapling with ocsp_multi option (RFC 6961)
This allows hostapd with the internal TLS server implementation to
support the extended OCSP stapling mechanism with multiple responses
(ocsp_stapling_response_multi).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 20:44:52 +02:00
Jouni Malinen
5addb0df59 Server configuration for OCSP stapling with ocsp_multi (RFC 6961)
This adds a new hostapd configuration parameter
ocsp_stapling_response_multi that can be used similarly to the existing
ocsp_stapling_response, but for the purpose of providing multiple cached
OCSP responses. This commit adds only the configuration parameter, but
does not yet add support for this mechanism with any of the supported
TLS implementations.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 19:42:07 +02:00
Jouni Malinen
bca0872dd5 TLS server: OCSP stapling
This adds support for hostapd-as-authentication-server to be build with
the internal TLS implementation and OCSP stapling server side support.
This is more or less identical to the design used with OpenSSL, i.e.,
the cached response is read from the ocsp_stapling_response=<file> and
sent as a response if the client requests it during the TLS handshake.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 17:53:45 +02:00
Jouni Malinen
8adce07a73 tests: Add dh_file parameter for integrated EAP server
This is needed for number of EAP test cases at least when using the
internal TLS server implementation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 17:51:54 +02:00
Jouni Malinen
9532bd2b44 GnuTLS: OCSP stapling on the server side
This adds support for hostapd-as-authentication-server to be build
against GnuTLS with OCSP stapling server side support. This is more or
less identical to the design used with OpenSSL, i.e., the cached
response is read from the ocsp_stapling_response=<file> and sent as a
response if the client requests it during the TLS handshake.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 16:47:29 +02:00
Jouni Malinen
6241766709 Use wpa_msg() for the "RSN: PMKID mismatch" message
This message is sent at MSG_INFO level and it is supposed to go out even
even debug messages were to be removed from the build. As such, use
wpa_msg() instead of wpa_dbg() for it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 11:22:19 +02:00
Jouni Malinen
e161451fc8 EAP-EKE: Merge identical error return paths
There is no need to maintain multiple copies of the same error return
path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-22 00:10:22 +02:00
Jouni Malinen
13cb0a66d5 EAP-EKE: Reject too long Prot() data when building a frame
This error case in own buffer lengths being too short was not handled
properly. While this should not really happen since the wpabuf
allocation is made large for the fixed cases that are currently
supported, better make eap_eke_prot() safer if this functionally ever
gets extended with a longer buffer need.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-22 00:10:22 +02:00
Jouni Malinen
3b6f3b37b8 tests: WPA2-Enterprise connection using EAP-EKE (many connections)
This tries to make it more likely to hit the special case of pub_len <
prime_len for additional code coverage.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-21 23:57:16 +02:00
Jouni Malinen
2fd377dea1 tests: EAP protocol tests with expanded header
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-21 23:31:15 +02:00
Jouni Malinen
0ab0de88e8 Document previously missing key_mgmt values
Number of key_mgmt options were missing from the documentation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-21 17:45:57 +02:00
Jouni Malinen
47eac38a63 tests: Add AP Location Public Identifier into gas_anqp_extra_elements
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-21 11:56:56 +02:00
Jouni Malinen
f2dfb1dafa tests: GAS fragmentation and comeback delay
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
c24f8e8e75 GAS: Do not cancel initial offchannel wait with comeback delay 1
The minimum comeback delay 1 is used to indicate that fragmentation is
needed instead of indicating that the response is going to be available
only after some time. Do not cancel offchannel wait for this case
between the initial and comeback exchanges to avoid delaying the full
operation unnecessarily.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
70f2a3f4ab tests: GAS fragmentation with mac80211_hwsim MCC enabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
35c146bc1b tests: Update gas_anqp_oom_hapd to match new implementation
Since wpa_supplicant is now retrying GAS comeback failures once, the
gas_anqp_oom_hapd test case started failing. Fix this by updating the
test case to expect success (on the retry).

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
364282c8c9 GAS: Retry full GAS query if comeback response is not received
It is possible for a comeback response to get lost especially when going
through a large GAS exchange fragmented to multiple frames in an
environment with interference or other traffic. Make this less likely to
fail the full exchange by trying full GAS query again and using longer
wait time on the GAS comeback exchanges.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
f9a9304479 tests: Modify gas_malformed_comeback_resp to allow GAS retries
This is in preparation of a wpa_supplicant change to allow GAS retries
which can result in the previous test case design showing failures due
to "unexpected" management frames (GAS Initial Request from the retry).

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
a587666cba GAS server: Replenish temporary STA entry timeout on comeback request
Previously, the five second timeout was added at the beginning of the
full GAS query and it was not replenished during fragmented exchanges.
This could result in timing out a query if it takes significant time to
go through the possibly multiple fragments and long comeback delay.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 19:43:23 +02:00
Matti Gottlieb
8fb718a748 GAS: Shorten the duration of the wait for GAS comeback response
When exchanging GAS frames with the AP, the initial response from the AP
may take a while to come, since the AP may need to fetch the info from a
server. The next fragments/comeback response frames should take much
less time since the AP already has all of the info, so the wait time
for these frames can be reduced.

In addition, some drivers, e.g., mac80211, try to combine ROC based flows,
to improve medium utilization. For example, if the requested ROC fits
entirely in a previous requested ROC they can be combined. Thus, reducing
the wait time for the next frames can improve medium utilization.

Shorten the duration of GAS comeback to improve medium utilization and
overall GAS exchange times.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2015-12-20 19:42:12 +02:00
Jouni Malinen
c012567df6 GAS: Clear offchannel_tx_started when ending remain-on-channel
Commit 2c0d0ae370 ('GAS: End
remain-on-channel due to delayed GAS comeback request') started ending
the remain-on-channel operation between the initial request and the
following comeback request. However, it did not check or update the
offchannel_tx_started variable. While this alone would not necessarily
be problematic, this makes it more difficult to optimize wait time for
offchannel TX operations, so make sure the internal tracking variable
gets updated.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 19:40:01 +02:00
Jouni Malinen
d5f5d260b8 tests: EAP-PEAP phase1 TLS flags
This adds some more test coverage for phase1 parameters that had not
previously been included in any of the test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 17:36:51 +02:00
Jouni Malinen
5382712518 tests: EAP-TTLS with unsupported Phase 2 EAP method in configuration
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 17:33:03 +02:00
Jouni Malinen
cb73008594 EAP-TTLS/PEAP/FAST: Reject unsupported Phase 2 method in configuration
Instead of using default list of methods, reject a configuration with an
unsupported EAP method at the time the main TLS method is being
initialized.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 17:32:10 +02:00
Jouni Malinen
18704f6cdc EAP-TLS: Merge common error paths
There is no need to keep these identical error paths separate.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 17:25:41 +02:00