Commit graph

13761 commits

Author SHA1 Message Date
Ilan Peer
170244a1cd SME: Fix order of WPA IE in association request
In case that the protocol used for association is WPA the WPA IE was
inserted before other (non vendor specific) IEs. This is not in
accordance to the standard that states that vendor IEs should be placed
after all the non vendor IEs are placed. In addition, this would cause
the low layers to fail to properly order information elements.

To fix this, if the protocol used is WPA, store the WPA IE and reinsert
it after all the non vendor specific IEs were placed.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-10-20 11:26:13 +03:00
Jouni Malinen
c3da381526 tests: AP Channel Switch and DISABLE command before completion
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 21:26:03 +03:00
Sriram R
7b2ca5cf0d hostapd: Reset channel switch parameters on interface disable
Previously, when an AP interface was disabled through a control
interface DISABLE command during a channel switch window, the interface
could not be reenabled due to beacon setup failure (which validates if
CSA is in progress).

Fix this by clearing channel switch parameters while disabling the
hostapd interface.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
2018-10-19 21:26:03 +03:00
Peng Xu
2f186d598a Define vendor specific NDP attribute for peer NDPE support
Add NAN NDP attribute QCA_WLAN_VENDOR_ATTR_PEER_NDPE_SUPPORT which
indicates if NDP remote peer supports NDPE attribute or not.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 20:44:44 +03:00
Jouni Malinen
ba7d3fe920 HS 2.0: Record policy update into users table
This makes it easier to track whether a policy update has been
successfully completed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 19:00:37 +03:00
Jouni Malinen
4939e2bb97 HS 2.0: Rename PPS/Credential1 node to Cred01
This makes it a bit easier to use existing hardcoded PPS MO files for
testing purposes when the subscription remediation and policy update
operations target the same path.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 18:07:37 +03:00
Jouni Malinen
950cafafb2 HS 2.0: Fix SubscriptionUpdate UpdateMethod value in OSU server
This node was modified long time ago to include "SPP-" prefix. Fix the
OSU server implementation to use the correct value.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 18:00:02 +03:00
Jouni Malinen
55e5084d9e HS 2.0: OSU server test functionality for incorrect behavior (policy)
Extend test=<value> special incorrect behavior testing capabilities in
the OSU server to include the fingerprint of the policy update trust
root: test=corrupt_polupd_hash.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-19 17:57:39 +03:00
Jouni Malinen
a9574f0f99 HS 2.0: OSU server test functionality for incorrect behavior
Add a mechanism to allow special incorrect behavior to be requested from
OSU server by adding an optional parameter test=<value> to the initial
signup URL. This is for protocol testing purposes for the OSU client.

This commit adds two special behavior cases: corrupt_aaa_hash and
corrupt_subrem_hash. These can be used to generate PPS MO with invalid
CertSHA256Fingerprint values for AAAServerTrustRoot and
SubscriptionUpdate nodes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-17 19:08:12 +03:00
Jouni Malinen
de7bcb9bc9 HS 2.0: Reject PPS MO if polupd or AAA trust root is invalid
Previously, this was done only for the subscription remediation/update
trust root. The other downloaded files were also verified, but the OSU
server was not notified if the files were found to be invalid.

Modify hs20-osu-client behavior to explicitly notify the OSU server if
any of the three trust root types cannot be successfully downloaded.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-17 19:07:27 +03:00
Jouni Malinen
2cbaf0de22 tests: Work around tshark bug in wpas_mesh_max_peering
It looks like tshark parser was broken at some point for
wlan.mesh.config.cap which is now (tshark 2.6.3) pointing to incorrect
field (same as wlan.mesh.config.ps_protocol). This used to work with
tshark 2.2.6.

For now, assume the capability field ends up being the last octet of the
frame.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-17 12:33:11 +03:00
Jouni Malinen
e384b156dc tests: Update tshark wlan_mgmt compatibility code for new version
It looks like at least tshark 2.6.3 uses a different error message for
unknown display filter fields:
tshark: Neither "wlan_mgt.fixed.category_code" nor "4" are field or protocol names.
and a different status exit code (2 instead of 1).

Add a new handler for this combination to allow automatic wlan_mgt to
wlan conversion to happen.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-16 18:21:07 +03:00
Andrei Otcheretianski
68500d8159 AP: Warn about VLAN interface name truncations
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2018-10-16 12:56:04 +03:00
Andrei Otcheretianski
d577f7f3d5 nl80211: Warn about interface name truncations
This is something useful to know and also eliminates format truncation
warnings.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2018-10-16 12:53:15 +03:00
Andrei Otcheretianski
16b5413f2b tests: Make ap_reconnect_auth_timeout test more robust
This test starts two identical APs and assumes a connection to the first
one, though it is not necessary true. Fix that by starting the second AP
only after the connection is established.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2018-10-16 12:49:11 +03:00
Jouni Malinen
ad369d77ba tests: ap_vht_csa_vht40 to check for unexpected disconnection
This test case had an error that hit an unexpected disconnection. Add an
explicit check to verify that this does not happen anymore.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-16 12:44:48 +03:00
Andrei Otcheretianski
7b1adf2cba tests: Fix ap_vht_csa_vht40 test
The channel configuration in CHAN_SWITCH command was incorrect. This
resulted in switching to HT40+ channel, while announcing HT40- in the
secondary channel IE. This caused a disconnection after the channel
switch. Fix that.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2018-10-16 12:44:32 +03:00
Johannes Berg
94919da24d RSN: Use COMPACT_MACSTR to match MAC2STR
We shouldn't open-code the %02x... when we have COMPACT_MACSTR.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-10-16 12:33:22 +03:00
Jouni Malinen
02342a2a2a tests: WMM advertisement parameter change
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-16 12:30:57 +03:00
Beni Lev
86a6f5f888 WMM: Update WMM parameter advertisement on the fly
Update the Beacon frame template once WMM parameters have been changed
and the AP is already up.

Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-10-16 12:26:59 +03:00
Jouni Malinen
182a0b4dae tests: EAP-pwd local error case in eap_pwd_perform_confirm_exchange()
This is a regression test case for a memory leak on these error paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-16 12:22:58 +03:00
Nishant Chaprana
391d922bcf EAP-pwd peer: Fix memory leak in eap_pwd_perform_confirm_exchange()
hash variable is allocated memory using eap_pwd_h_init(), but there are
couple of error case code paths which skips deallocation of hash. The
memory of hash is deallocated using eap_pwd_h_final(). Fix this by
calling eap_pwd_h_final() at the end of the function if execution got
there through one of those error cases.

Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2018-10-16 12:11:32 +03:00
Jouni Malinen
30a67736dc tests: VHT with 80 MHz channel width reconfigured to 2.4 GHz HT
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-16 00:51:21 +03:00
Sathishkumar Muruganandam
72a09d43fe Fix 5 GHz to 2.4 GHz channel switch with hostapd through DISABLE/ENABLE
When moving a 5 GHz VHT AP to 2.4 GHz band with VHT disabled through the
hostapd control interface DISABLE/reconfig/ENABLE commands, enabling of
the AP on 2.4 GHz failed due to the previously configured VHT capability
being compared with hardware VHT capability on 2.4 GHz band:

hw vht capab: 0x0, conf vht capab: 0x33800132
Configured VHT capability [VHT_CAP_MAX_MPDU_LENGTH_MASK] exceeds max value supported by the driver (2 > 0)
ap: interface state DISABLED->DISABLED

Since VHT (ieee80211ac) config is already disabled for the 2.4 GHz band,
add fix this by validating vht_capab only when VHT is enabled.

Fixes: c781eb8428 ("hostapd: Verify VHT capabilities are supported by driver")
Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
2018-10-16 00:50:40 +03:00
Jouni Malinen
349c49bac4 tests: OWE group negotiation with PMF
Verify that PMF does not end up reporting unexpected status code 30
(temporary rejection; SA Query).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-16 00:33:20 +03:00
Ashok Kumar
edb28006c4 PMF: Do not start SA Query procedure if there is no association
Previous implementation ended up triggering PMF check for previous
association and SA Query procedure incorrectly in cases where there is a
STA entry in hostapd, but that STA is not in associated state. This
resulted in undesired temporary rejection of the association with status
code 30.

This ended up breaking OWE group negotiation when PMF is in use since
the check for the OWE group would have happened only after this earlier
PMF check and rejection (i.e., the station got status code 30 instead of
the expected 77).

For example, when the AP is configured with OWE group 21 and a station
tries groups 19, 20, and 21 (in this sequence), the first two
Association Request frames should be rejected with status code 77.
However, only the first one got that status code while the second one
got status code 30 due to that issue with PMF existing association
check.

Furthermore, hostapd was continuing with SA Query procedure with
unencrypted Action frames in this type of case even though there was no
existing association (and obviously, not an encryption key either).

Fix this by checking that the STA entry is in associated state before
initiating SA Query procedure based on the PMF rules.

Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-10-16 00:33:20 +03:00
Jouni Malinen
97e27300f4 tests: Maximum number of cred roaming_consortiums
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 20:48:32 +03:00
Andrei Otcheretianski
ac0ac1ddfd wpa_supplicant: Fix buffer overflow in roaming_consortiums
When configuring more than 36 roaming consortiums with SET_CRED, the
stack is smashed. Fix that by correctly verifying the
num_roaming_consortiums.

Fixes: 909a948b ("HS 2.0: Add a new cred block parameter roaming_consortiums")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2018-10-14 20:47:35 +03:00
Johannes Berg
40432e6eb3 nl80211: Implement netlink extended ACK support
Implement netlink extended ACK support to print out the error
message (if any).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2018-10-14 20:20:11 +03:00
Jouni Malinen
c481e1cbb7 tests: SAE and MFP enabled without sae_require_mfp
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 20:14:30 +03:00
Hauke Mehrtens
74eebe93d0 SAE: Do not ignore option sae_require_mfp
Without this patch sae_require_mfp is always activate, when ieee80211w
is set to optional all stations negotiating SAEs are being rejected when
they do not support PMF. With this patch hostapd only rejects these
stations in case sae_require_mfp is set to some value and not null.

Fixes ba3d435fe4 ("SAE: Add option to require MFP for SAE associations")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2018-10-14 20:13:16 +03:00
Jouni Malinen
dc1b1c8db7 Drop logging priority for handle_auth_cb no-STA-match messages
This message was printed and MSG_INFO level which would be more
reasonable for error cases where hostapd has accepted authentication.
However, this is not really an error case for the cases where
authentication was rejected (e.g., due to MAC ACL). Drop this to use
MSG_DEBUG level.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 20:03:55 +03:00
Jouni Malinen
6588f71222 Reduce undesired logging of ACL rejection events from AP mode
When Probe Request frame handling was extended to use MAC ACL through
ieee802_11_allowed_address(), the MSG_INFO level log print ("Station
<addr> not allowed to authenticate") from that function ended up getting
printed even for Probe Request frames. That was not by design and it can
result in excessive logging and MSG_INFO level if MAC ACL is used.

Fix this by printing this log entry only for authentication and
association frames. In addition, drop the priority of that log entry to
MSG_DEBUG since this is not really an unexpected behavior in most MAC
ACL use cases.

Fixes: 92eb00aec2 ("Extend ACL check for Probe Request frames")
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 19:57:22 +03:00
Jouni Malinen
4816bd3b22 tests: OWE transition mode and need for multiple scans
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-12 19:59:26 +03:00
Ilan Peer
c04562e67e OWE: Improve discovery of OWE transition mode AP
An OWE AP device that supports transition mode does not transmit the
SSID of the OWE AP in its Beacon frames and in addition the OWE AP does
not reply to broadcast Probe Request frames. Thus, the scan results
matching relies only on Beacon frames from the OWE open AP which can be
missed in case the AP's frequency is actively scanned.

To improve the discovery of transition mode APs, include their SSID in
the scan command to perform an active scan for the SSIDs learned from
the open mode BSSs.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-10-12 19:59:26 +03:00
Jouni Malinen
a5e6270f25 OWE: Use shorter scan interval during transition mode search
Start scans more quickly if an open BSS advertising OWE transition mode
is found, but the matching OWE BSS has not yet been seen.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-12 19:59:26 +03:00
Sunil Dutt
91073ccaaa OWE: Attempt more scans for OWE transition SSID if expected BSS not seen
This commit introduces a threshold for OWE transition BSS selection,
which signifies the maximum number of selection attempts (scans) done
for finding OWE BSS.

This aims to do more scan attempts for OWE BSS and eventually select the
open BSS if the selection/scan attempts for OWE BSS exceed the
configured threshold.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-12 19:59:26 +03:00
Purushottam Kushwaha
e8581183f9 HS 2.0: Use execve() with custom env PATH to launch browser using 'am'
With new restriction in Android, if PATH env variable doesn't have
correct path of 'am' binary, execv() fails to launch wpadebug browser
(am starts, but something seems to fail within its internal processing).

This commit is a workaround to use execve() with custom environment PATH
which includes "/system/bin;/vendor/bin" to handle the cases where
hs20-osu-client fails to launch wpadebug browser through /system/bin/am.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-12 15:51:05 +03:00
Visweswara Tanuku
77fcd74753 QCA vendor subcommand and attributes to configure capture of CFR data
Add a subcommand for Channel Frequency Response (CFG) Capture
Configuration and define attributes for configuring CFR capture
parameters per peer and enabling/disabling CFR capture.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
44fa13b17f tests: SSID with 32 octets with nul at the end
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
cc5f797593 HS 2.0 server: Subscription remediation with user selected new password
Add support for user remediation to request a new password from the user
for username/password credentials that have been configured not use use
machine managed password.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
f718e5e22c HS 2.0 server: Show whether credential is machine managed
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
eb83e81e31 HS 2.0 server: Make user list more readable
Order the rows based on identity and use a bit smaller font for some of
the fields to make the table fit on the screen more easily.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
af284f8a8e HS 2.0 server: Clarify signup page options
Make it clearer that there are three different types of credentials that
can be provisioned.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
dd76afff65 HS 2.0 server: Do not perform subrem if not requested to
Instead of defaulting to machine remediation, reject a request to do
subscription remediation if that has not been configured to be required.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
7770a9dd6a RADIUS: Support last_msk with EAP-TLS
This extends the last_msk testing functionality in the RADIUS server to
work with EAP-TLS based on "cert-<serial_num>" form user names in the
database.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
063cbb87a6 EAP server: Add eap_get_serial_num()
This can be used to fetch the serial number of the peer certificate
during TLS-based EAP session.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
0ec3e77a13 TLS: Add tls_connection_peer_serial_num()
This can be used to fetch the serial number of the peer certificate in
the EAP server. For now, this is implemented only with OpenSSL.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
18003b315b AS: Add an event_cb() callback handler
This provides debug log information on TLS events on the server side.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
2ff952a5dd OpenSSL: Make serial number of peer certificate available in event_cb
Add serial number to the event_cb() information for the peer certificate
chain.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00