Commit graph

10351 commits

Author SHA1 Message Date
Jouni Malinen
dafe0b6429 tests: Clean up at the end of connect_cmd_disconnect_event
This test case used to leave the dynamically added wlan5 interface in a
state where it was still trying to reconnect to a network. This could
result in the following test cases being unable to clear the cfg80211
scan cache. Avoid this type of issues by explicitly stopping the
connection attempt and making sure that there are no scan results in the
cache at the end of connect_cmd_disconnect_event.

The following test case sequence triggered a failure due to the
remaining BSS table entry:
connect_cmd_disconnect_event connect_cmd_wep ap_hs20_random_mac_addr

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 13:29:32 +02:00
Dedy Lansky
071e3bf116 FST: Fix handling of Rx FST Setup Request when session already exists
When we receive FST Setup Request when session already exists, the
following validations take place:
1. we drop the frame if needed according to MAC comparison
2. we drop the frame if the session is "not pending", i.e., if FST
   Setup Response was already exchanged (sent or received).

There are two issues with the above:
1. MAC comparison is relevant only before the Setup Response exchange.
   In other words, Setup Request should not be dropped due to MAC
   comparison after Setup Response has been exchanged.
2. Receiving Setup Request after Setup Response exchange most likely
   means that FST state machine is out of sync with the peer. Dropping
   the Setup Request will not help solve this situation.

The fix is:
1. do MAC comparison only if session is "pending", i.e., Setup Response
   was not yet exchanged.
2. In case Setup Response was already exchanged, reset our session and
   handle the Setup Request as if it arrived when session doesn't exist.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-29 18:41:35 +02:00
Jouni Malinen
324ade51e1 TLS: Make tls_cert_chain_failure_event() more robust
Explicitly check for the failure event to include a certificate before
trying to build the event.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 18:31:11 +02:00
Jouni Malinen
c6231b5e1e TLS: Remove storing of never-read value
While this could in theory be claimed to be ready for something to be
added to read a field following the server_write_IV, it does not look
likely that such a use case would show up. As such, just remove the
unused incrementing of pos at the end of the function to get rid of a
useless static analyzer complaint.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 18:15:18 +02:00
Jouni Malinen
15a68138c1 Remove unnecessary cleanup assignment in SHA1Final()
This makes some static analyzers complain about stored value never being
read. While it is good to clear some other temporary variables, this
local variable i has no security private information (it has a fixed
value of 20 here) and trying to clear it to 0 does not add any value.
Remove that part of the "wipe variables" to avoid one useless static
analyzer complaint.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 18:12:03 +02:00
Jouni Malinen
b90b3eab1f tests: Clear ignore_old_scan_res explicitly in test cases where it is used
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:48:01 +02:00
Jouni Malinen
49d51a0dcb tests: Clear p2p_pref_chan explicitly in test cases where it is used
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:43:46 +02:00
Jouni Malinen
db3070d289 tests: Clear p2p_go_intent explicitly in test cases where it is used
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:40:25 +02:00
Jouni Malinen
cf3a9d8f06 tests: Clear p2p_add_cli_chan explicitly in test cases where it is used
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:33:17 +02:00
Jouni Malinen
721ec02da5 tests: Clear p2p_no_go_freq explicitly in test cases where it is used
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:33:09 +02:00
Ilan Peer
ef3866ab01 nl80211: Don't call linux_iface_up() for a dedicated P2P Device
As a dedicated P2P Device interface does not have a network
interface associated with it, trying to call linux_iface_up()
on it would always fail so this call can be skipped for
such an interface.

Getting interface nlmode can be done only after bss->wdev_id is
set, so move this call to wpa_driver_nl80211_finish_drv_init(),
and do it only in case the nlmode != NL80211_IFTYPE_P2P_DEVICE.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
c2ed779748 mesh: Document Mesh Peering Management element structure in more detail
Provide details on the pointers to the subfields and rename "pmk" to
"chosen_pmk" and use SAE_PMKID_LEN macro with it to make the code more
readable.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Bob Copeland
b2817cd5c2 mesh: Check PMKID in AMPE Action frames
From IEEE Std 802.11-2012 13.3.5:

   If the incoming Mesh Peering Management frame is for AMPE and the
   Chosen PMK from the received frame contains a PMKID that does not
   identify a valid mesh PMKSA, the frame shall be silently discarded.

We were not checking the PMKID previously, and we also weren't parsing
it correctly, so fix both.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-28 17:21:08 +02:00
Bob Copeland
6c33eed3ee mesh: Fix PMKID to match the standard
IEEE Std 802.11-2012 11.3.5.4 specifies the PMKID for SAE-derived keys
as:

   L((commit-scalar + peer-commit-scalar) mod r, 0, 128)

This is already calculated in the SAE code when the PMK is derived, but
not saved anywhere. Later, when generating the PMKID for plink action
frames, the definition for PMKID from 11.6.1.3 is incorrectly used.
Correct this by saving the PMKID when the key is generated and use it
subsequently.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
ede7770180 wpa_supplicant: Do not wait for monitor on P2P Device interface
External programs are not aware of the creation of a
dedicated P2P Device interface, so it does not make sense
to wait for a monitor to connect on such an interface.

Fix this by not waiting on a dedicated P2P Device interface
for monitor to attach.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
1c94570f1b Do not wait for monitor to attach if no control interface
In case an interface has started without a control interface
initialized, skip waiting for monitor to attach at the start of
wpa_supplicant (-W).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
f98674aa37 Clone default LIBS value to LIBS_* for other tools
If LIBS is set with some global build system defaults, clone those for
LIBS_c, LIBS_h, LIBS_n, and LIBS_p to cover wpa_cli, wpa_passphrase,
hostapd_cli, hlr_auc_gw, and nt_password_hash as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
161c8515cc tests: Make ap_wps_probe_req_ie_oom more robust
It was possible to hit a race condition between WPS_CANCEL and
immediately following WPS_PIN command. Wait for a disconnection event to
avoid that. This was seen with the following test case sequence:
ap_wpa2_psk_supp_proto_wrong_group_key_len ap_wps_probe_req_ie_oom

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
33dfdcbae7 tests: wpa_supplicant AP mode with ACS
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 22:24:05 +02:00
Jouni Malinen
7d2f67433d Add "GET_CAPABILITY acs" to allow ACS build option to be detected
This allows upper layer software to check whether wpa_supplicant can use
ACS for AP mode.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
d99097177a wpa_supplicant: Enable Automatic Channel Selection support for AP mode
Since hostapd supports ACS now, let's enable its support in
wpa_supplicant as well when starting AP mode.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
[u.oelmann@pengutronix.de: adjusted added text in defconfig]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
96bc508684 Handle survey event properly in wpa_supplicant
Let's reuse hostapd code for such handling. This will be useful to get
ACS support into wpa_supplicant where this one needs to handle the
survey event so it fills in the result ACS subsystem will require.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 21:35:54 +02:00
Johannes Berg
be9fe3d8af tests: vm: Output everything on console
When running tests, make printk put all messages, including debug
messages, onto the serial console to go into the console file.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2015-12-24 21:27:24 +02:00
Jouni Malinen
d39f796f43 EAP-TNC peer: Remove dead code related to fragmentation
The data->state == WAIT_FRAG_ACK case is already handling all cases
where data->out_buf could be non-NULL, so this additional check after
the WAIT_FRAG_ACK steps cannot be reached. Remove the duplicated dead
code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
662512e027 P2PS: Remove dead code
Commit f8a80e39b3 ('P2PS: Change
connection capability handling') added the identical P2PS_SETUP_CLIENT
check into two places within p2ps_group_capability(). However, only the
first one of these can be reached. In the second case, role can only
have values 0 or P2PS_SETUP_NEW and as such, the P2PS_SETUP_CLIENT case
is not possible. It looks like the first part of the commit is
sufficient, so remove the dead code added by the second part.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
0c8eacd1ab tests: EAP-TNC protocol tests
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
abbbaa4997 TNC: Print received IF-TNCCS message as debug ASCII hexdump
This makes it easier to see what TNCC is processing.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 18:33:19 +02:00
Jouni Malinen
d745f02e0e EAP-TNC peer: Allow fragment_size to be configured
Previously, a fixed 1300 fragment_size was hardcoded. Now the EAP
profile parameter fragment_size can be used to override this.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 14:19:23 +02:00
Jouni Malinen
e85bb01998 tests: Move P2P-REMOVE-AND-REFORM-GROUP cases more robust
Wait for the AP-DISABLED and AP-ENABLED group events before reading the
current group operation frequency after P2P-REMOVE-AND-REFORM-GROUP.
This reduces a possibility of a race condition making a test case fail
with the returned frequency being 0 when reading this before the
reformed group is fully up. This may help avoid false error reports for
the following test cases: p2p_go_move_reg_change p2p_go_move_scm
p2p_go_move_scm_peer_supports p2p_go_move_scm_multi.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 13:40:54 +02:00
Jouni Malinen
a67e7e533a RADIUS: Add EACCES to list of recognized send() errno values
This allows RADIUS failover to be performed if send() return EACCES
error which is what happens after a recent Linux kernel commit
0315e382704817b279e5693dca8ab9d89aa20b3f ('net: Fix behaviour of
unreachable, blackhole and prohibit') for a local sender when route type
is prohibit.

This fixes the hwsim test case radius_failover when running against a
kernel build that includes that commit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:43:05 +02:00
Jouni Malinen
44f4394296 tests: RADIUS Accounting and non-ASCII SSID
This shows an example of Called-Station-Id in Access-Request and
Accounting-Request with non-ASCII characters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:19:41 +02:00
Jouni Malinen
5bd9be4d17 Fix RADIUS Called-Station-Id to not escape SSID
Commit 986de33d5c ('Convert remaining SSID
routines from char* to u8*') started using wpa_ssid_txt() to print out
the SSID for the Called-Station-Id attribute in RADIUS messages. This
was further modified by commit 6bc1f95613
('Use printf escaping in SSID-to-printable-string conversion') to use
printf escaping (though, even without this, wpa_ssid_txt() would have
masked characters).

This is not desired for Called-Station-Id attribute. While it is defined
as a "String", RFC 2865 indicates that "a robust implementation SHOULD
support the field as undistinguished octets.".

Copy the SSID as an array of arbitrary octets into Called-Station-Id to
avoid any kind of masking or escaping behavior. This goes a step further
from the initial implementation by allowing even the possible (but
unlikely in practical use cases) 0x00 octet in the middle of an SSID.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 12:15:36 +02:00
Jouni Malinen
52811b8c90 tests: EAP-TLS with intermediate CAs and OCSP multi
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
0764dd6849 TLS client: Multi-OCSP check to cover intermediate CAs
This extends multi-OCSP support to verify status for intermediate CAs in
the server certificate chain.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
d6b536f7e5 Add ocsp=3 configuration parameter for multi-OCSP
ocsp=3 extends ocsp=2 by require all not-trusted certificates in the
server certificate chain to receive a good OCSP status. This requires
support for ocsp_multi (RFC 6961). This commit is only adding the
configuration value, but all the currently included TLS library wrappers
are rejecting this as unsupported for now.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
02683830b5 TLS: Move variable declaration to the beginning of the block
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
98d125cafa tests: Minimal testing of OCSP stapling with ocsp_multi
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-23 00:32:52 +02:00
Jouni Malinen
b5677752b2 TLS client: OCSP stapling with ocsp_multi option (RFC 6961)
This adds a minimal support for using status_request_v2 extension and
ocsp_multi format (OCSPResponseList instead of OCSPResponse) for
CertificateStatus. This commit does not yet extend use of OCSP stapling
to validate the intermediate CA certificates.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 20:44:56 +02:00
Jouni Malinen
8ea6a27003 TLS server: OCSP stapling with ocsp_multi option (RFC 6961)
This allows hostapd with the internal TLS server implementation to
support the extended OCSP stapling mechanism with multiple responses
(ocsp_stapling_response_multi).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 20:44:52 +02:00
Jouni Malinen
5addb0df59 Server configuration for OCSP stapling with ocsp_multi (RFC 6961)
This adds a new hostapd configuration parameter
ocsp_stapling_response_multi that can be used similarly to the existing
ocsp_stapling_response, but for the purpose of providing multiple cached
OCSP responses. This commit adds only the configuration parameter, but
does not yet add support for this mechanism with any of the supported
TLS implementations.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 19:42:07 +02:00
Jouni Malinen
bca0872dd5 TLS server: OCSP stapling
This adds support for hostapd-as-authentication-server to be build with
the internal TLS implementation and OCSP stapling server side support.
This is more or less identical to the design used with OpenSSL, i.e.,
the cached response is read from the ocsp_stapling_response=<file> and
sent as a response if the client requests it during the TLS handshake.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 17:53:45 +02:00
Jouni Malinen
8adce07a73 tests: Add dh_file parameter for integrated EAP server
This is needed for number of EAP test cases at least when using the
internal TLS server implementation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 17:51:54 +02:00
Jouni Malinen
9532bd2b44 GnuTLS: OCSP stapling on the server side
This adds support for hostapd-as-authentication-server to be build
against GnuTLS with OCSP stapling server side support. This is more or
less identical to the design used with OpenSSL, i.e., the cached
response is read from the ocsp_stapling_response=<file> and sent as a
response if the client requests it during the TLS handshake.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 16:47:29 +02:00
Jouni Malinen
6241766709 Use wpa_msg() for the "RSN: PMKID mismatch" message
This message is sent at MSG_INFO level and it is supposed to go out even
even debug messages were to be removed from the build. As such, use
wpa_msg() instead of wpa_dbg() for it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-22 11:22:19 +02:00
Jouni Malinen
e161451fc8 EAP-EKE: Merge identical error return paths
There is no need to maintain multiple copies of the same error return
path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-22 00:10:22 +02:00
Jouni Malinen
13cb0a66d5 EAP-EKE: Reject too long Prot() data when building a frame
This error case in own buffer lengths being too short was not handled
properly. While this should not really happen since the wpabuf
allocation is made large for the fixed cases that are currently
supported, better make eap_eke_prot() safer if this functionally ever
gets extended with a longer buffer need.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-22 00:10:22 +02:00
Jouni Malinen
3b6f3b37b8 tests: WPA2-Enterprise connection using EAP-EKE (many connections)
This tries to make it more likely to hit the special case of pub_len <
prime_len for additional code coverage.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-21 23:57:16 +02:00
Jouni Malinen
2fd377dea1 tests: EAP protocol tests with expanded header
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-21 23:31:15 +02:00
Jouni Malinen
0ab0de88e8 Document previously missing key_mgmt values
Number of key_mgmt options were missing from the documentation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-21 17:45:57 +02:00
Jouni Malinen
47eac38a63 tests: Add AP Location Public Identifier into gas_anqp_extra_elements
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-21 11:56:56 +02:00