Commit graph

3353 commits

Author SHA1 Message Date
Jouni Malinen
90cba4e7ab hostapd: Define CONFIG_SHA256 for SHA256 builds
wpa_supplicant was already doing this and hostapd will need to define
this for future additions.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-27 21:10:06 +02:00
Jouni Malinen
dcff088df7 Add SHA256-hash functions to generic crypto_hash_* functions
Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-27 21:10:06 +02:00
Jouni Malinen
b32a8d1dfe test-https: Fix memory leaks in TLS processing
Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-27 18:33:11 +02:00
Jouni Malinen
e770c497eb TLS: Add a debug information on unsupported private key format
Provide easier to understand reason for failure to use the old
OpenSSL encrypted private key format.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-27 13:21:36 +02:00
Dmitry Shmidt
e670738ae0 wpa_cli: Add action script call on P2P-GO-NEG-FAILURE events
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2011-11-25 23:56:18 +02:00
Jouni Malinen
527a398866 wext: Define some new values if linux/wireless.h is too old
IW_ENCODE_ALG_PMK and IW_ENC_CAPA_4WAY_HANDSHAKE are not defined in the
Android tree, so add compatibility defines for these.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-25 23:56:15 +02:00
Dmitry Shmidt
8a5e75f60f P2P: Send STA connected/disconnected events to parent ctrl_iface
Send the connection events from P2P group to both the group interface
and parent interface ctrl_ifaces to make it easier for external monitor
programs to see these events without having to listen to all group
interfaces when virtual group interfaces are used.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2011-11-25 23:56:13 +02:00
Jouni Malinen
fcd1684787 Fix sched_scan filter setting for max_match_sets == 0
The previous implementation was trying to add the first SSID
to a zero-length array. Avoid this with an explicit validation
of the array length.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-11-25 18:12:04 +02:00
Jouni Malinen
fb67eec6f8 nl80211: Do not set sched_scan filter if driver does not support it
cfg80211 will reject the NL80211_CMD_START_SCHED_SCAN if too many
match sets are requested. To avoid being completely unable to start
any scheduled scans, skip setting these filters if the driver did
not advertise support for large enough number of match sets.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-11-25 17:46:00 +02:00
Jouni Malinen
29f338af26 nl80211: Implement set_p2p_powersave for legacy_ps changes
This adds initial implementation of set_p2p_powersave to allow legacy PS
mode to be configured. P2P PS parameters are not yet supported.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-11-25 13:11:22 +02:00
Jouni Malinen
0bf927a03e Use wpa_key_mgmt_*() helpers
This cleans up the source code and makes it less likely that new AKM
addition misses some needed changes in the future.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 22:47:46 +02:00
Jouni Malinen
8e8280bd5e Do not save an invalid network block in wpa_supplicant.conf
wpa_supplicant is going to reject a configuration file that uses
WPA/WPA2-Personal (the default key_mgmt), but does not define
passphrase/PSK. Refuse to save such a configuration to avoid getting
stuck with a configuration that wpa_supplicant will reject.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 22:47:32 +02:00
Jouni Malinen
a769b094d7 Do not write all zeros device_type
This is the default value if device_type is not set, so do not
write it to the wpa_supplicant configuration file when saving
updated configuration.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 22:22:16 +02:00
Jouni Malinen
71093e5ea9 WPS: Include WSC IE in (Re)Association Response for maybe-WPS case
If the station is indicating use of WPS, WSC IE should be added into the
(Re)Association Response frame. This is clear for the case when WSC IE
was included in the (Re)Association Request frame. However, even the
WLAN_STA_MAYBE_WPS case may actually indicate use of WPS. Assume that to
be the case when WPA/WPA2 is enabled (i.e., when the STA does not
include WPA/RSN/WSC IE while AP has WPA/RSN enabled).

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 22:05:33 +02:00
Dmitry Shmidt
6ce937b8cf Add 'get country' command
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2011-11-24 21:33:24 +02:00
David Spinadel
9a6ade33d4 wpa_cli: Correct return value of wpa_cli_cmd_p2p_peers
Signed-off-by: David Spinadel <david.spinadel@intel.com>
2011-11-24 21:19:52 +02:00
Jouni Malinen
f551fa8d50 Add test program for RC4 (test vectors from RFC 6229)
Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 20:54:20 +02:00
Dmitry Shmidt
20b2161d5b Android: Move WPA_BUILD check in Android.mk
This is part of commit e61a2d6db6113da5fad91660764afdb0596dbc46 from
Android wpa_supplicant_8.git.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2011-11-23 17:58:44 +02:00
Jeff Brown
4482f1fbc4 Android: Remove the simulator target from all makefiles
This is commit bbda627478b0e9a312fea4662cd7cd8d6bdf82bf from
Android wpa_supplicant_8.git.
2011-11-23 17:56:41 +02:00
Jouni Malinen
1323ee314e Move wpa_sm_remove_pmkid() call to PMKSA cache entry freeing
This makes it clearer that the PMKSA caching entry gets removed from
the driver regardless of how the internal entry from wpa_supplicant
gets cleared. In practice, this call was skipped only for the case
when the entry for the current AP was being updated, so the previous
version was likely to work with all drivers. Anyway, it is cleaner
to explicitly remove the old entry even in that case before the new
entry gets added.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-20 12:53:29 +02:00
Jouni Malinen
bf689a409f Fix wired EAPOL authenticator
Commit 940a0ce970 moved the STA associated
check from driver_*.c into ieee802_1x_receive(), but failed to take into
account that wired networks and driver_wired.c do not mark the STA entry
associated. Fix this by skipping the check if the driver wrapper is
using a wired network.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-20 12:42:47 +02:00
Jouni Malinen
d5cbee412c Avoid possible compiler warning in os_gmtime()
Use time_t instead of os_time_t variable with the gmtime() call to
avoid possible compiler warnings.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-20 12:19:28 +02:00
Kel Modderman
ef992bbd3b wpa_gui-qt4: Improve scan results signal display
Display signal strength in dBm with visual indicator in the form of a
bar for scan results displayed by wpa_gui-qt4. Any signal > -35dBm is
treated as full signal bar, signals between range of -95<->-35dBm are
displayed linearly. Convert WEXT signal level value to scale that
nl80211 typically reports in dBm. The condition which differentiates
8-bit WEXT dBm and regular dBm is probably fragile, but there is
currently no way to know what the driver is going to report for signal
strength.

Signed-off-by: Kel Modderman <kel@otaku42.de>
2011-11-19 20:10:37 +02:00
Johannes Berg
88df0ef74f nl80211: Set offchannel-OK selectively
It's not really valid to send off-channel in all cases,
so pass whether it should be allowed or not and don't
set it in the AP case.

Also, to get the right ifindex for hostapd, pass a bss
pointer instead of the drv pointer.

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 19:56:34 +02:00
Johannes Berg
221a59c9b6 nl80211: Move preq NL handle into BSS
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 19:48:49 +02:00
Jouni Malinen
ddc5327139 nl80211: Add no_ack support for NL80211_CMD_FRAME
This is needed to allow no-ACK operation with Probe Response frames
in P2P Listen state.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-19 19:32:05 +02:00
Helmut Schaa
fab2533604 nl80211: Implement noack policy for send_mlme
Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
2011-11-19 19:22:13 +02:00
Jouni Malinen
9dbf53fe35 P2P: Send Listen state Probe Response frames without retries
Use the no-ACK send_mlme request to transmit Probe Response frames
in P2P Listen state. This reduces number of unnecessary transmissions
if the peer device has already moved away from the channel. It will most
likely go through Search state multiple times anyway, so even if the
response were to be lost, a new retry will happen at higher layer.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-19 19:15:10 +02:00
Helmut Schaa
9a898ee879 Avoid excessive probe response retries
Some client implementations only wait a few ms after sending a probe
request while scanning. Since probe responses are always sent at a low
rate this can eat quite some airtime and it might be impossible to get
the frame out before the client leaves the channel again. If the client
leaves before all probe reponses where acked this can cause the probe
reponse to be retried quite often consuming even more airtime.

Hence, add a new noack flag to the driver's send_mlme callback that
allows hostapd to request whether the driver should expect an ACK for
this frame or not.

Use the new noack-policy only for broadcast probe requests that contain
a wildcard SSID.

Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
2011-11-19 19:09:49 +02:00
Helmut Schaa
8cfa3527e1 Allow MLME frames to be sent without expecting an ACK (no retries)
In some situations it might be benefical to send a unicast frame without
the need for getting it ACKed (probe responses for example). In order to
achieve this add a new noack parameter to the drivers send_mlme callback
that can be used to advise the driver to not wait for an ACK for this
frame.

Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
2011-11-19 19:02:05 +02:00
Jouni Malinen
3f56f3a496 Do not try to add wildcard SSID into active sched_scan
Even though scan_ssid should not really be set for wildcard SSID,
better verify that here explicitly insead of assuming that the
SSID is set.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-19 17:01:53 +02:00
Jouni Malinen
5419d6afed EAP-pwd: Remove struct eap_pwd_hdr
This structure was not really used for anything apart from figuring out
length of the EAP-pwd header (and even that in a way that would not work
with fragmentation). Since the bitfields in the structure could have
been problematic depending on target endianness, remove this unnecessary
structure.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-19 16:52:52 +02:00
Dan Harkins
e547e071e1 EAP-pwd: Fix zero-padding of input to H()
Another niceness of OpenSSL is that if the high-order bit of a 521-bit
big num is not set then BN_bn2bin() will just return 65 bytes instead of
66 bytes with the 1st (big endian, after all) being all zero. When this
happens the wrong number of octets are mixed into function H(). So
there's a whole bunch of "offset" computations and BN_bn2bin() dumps the
big number into a buffer + offset. That should be obvious in the patch
too.
2011-11-19 16:47:25 +02:00
Dan Harkins
18f5f3de03 EAP-pwd: Fix KDF for group 21
The previous EAP-pwd KDF implemented has an issue with group 21, that is
an elliptic curve group based on a 521 bit prime. 521 is not an even
multiple of 8, and therein lies the problem.

OpenSSL's BN library interprets a string of bits as in big-endian format
so all the calls of BN_bin2bn() will take the binary blob of bits and
turn it into a big number in big-endian format. In the EAP-pwd KDF, I am
stretching the key to "primebitlen". When that is not an even multiple
of 8 I have to mask off the excess. But I was masking off the excess
bits in the 1st octet (big endian after all) but that isn't right. The
KDF produces a string of endian-less bits. The 521st bit is the first
bit in the last octet, not the 7th bit in the first octet. So that has
been fixed and you can see in the attached diff what I'm doing.
2011-11-19 16:43:49 +02:00
Dan Harkins
4301163930 EAP-pwd: Document group configuration for hostapd authentication server 2011-11-19 16:32:21 +02:00
Johannes Berg
397188521d nl80211: Support in-kernel station poll
If the kernel supports this, don't use manual null
data frame transmissions. This is one thing to get
rid of cooked monitor interfaces.

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 14:23:46 +02:00
Johannes Berg
d12dab4c6f nl80211: Use non-receiving socket for EAPOL TX
The non-monitor TX currently uses a normal L2 abstraction
socket, but that will also receive frames we don't want,
so use a plain socket that isn't bound for RX. This might
be possible using the L2 abstraction, but we need a plain
socket later for getting TX status events here.

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 14:00:53 +02:00
Johannes Berg
61cbe2ffd8 nl80211: Use device AP SME capability
This changes the auto-detection of whether or not the device contains
the AP SME away from monitor interface addition failing to the explicit
attribute in nl80211. Keep the old auto-detection for a little while so
that ath6kl isn't broken right away.

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 13:42:49 +02:00
Jouni Malinen
7a5257bbc9 nl80211: Sync with wireless-testing.git linux/nl80211.h
Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-19 13:40:07 +02:00
Johannes Berg
dd840f793c AP: Add explicit EAPOL TX status event
The new event can be used when EAPOL TX status can't be reported as a
complete 802.11 frame but is instead reported as just the EAPOL data as
originally passed to hapd_send_eapol().

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-19 13:00:30 +02:00
Maciej Szmigiero
6589774746 OpenSSL: Read certificate chain from server_cert file
Currently OpenSSL implementation of TLS in hostapd loads only top
certificate in server certificate file. Change this to try to the
whole chain first and only if that fails, revert to old behavior.

Signed-off-by: Maciej Szmigiero <mhej@o2.pl>
2011-11-19 12:06:59 +02:00
Alan T. DeKok
8205c82a48 wpa_supplicant: Make objects depend on the .config file
The source code compiles into different objects depending on
the contents of .config. Therefore, the objects should depend
on .config.

Previously, only the executables depended on .config. This meant
that they were re-linked when .config changed. But that relink
process used the old (and now wrong) objects.
2011-11-19 11:46:39 +02:00
Jithu Jance
57ebba598d nl80211: Implement shared_freq
This patch implements shared_freq handler for driver_nl80211.c. If a
"p2p_group_add" happens after legacy STA association, then this patch
will help to start the GO on the same frequency. This is useful when
supplicant is started on multiple interface running over a singly "PHY"
and the station interface is not used for the P2P device operations.

For example, wpa_supplicant -iwlan0 ..  -N -iwlan1 ... and wlan0 is used
for station connection and wlan1 as the P2P device interface.

Signed-hostap: Jithu Jance <jithu@broadcom.com>
2011-11-19 11:23:49 +02:00
Ben Greear
3b7ea88047 nl80211: Make MLME failure messages unique
Without this, it is impossible to tell exactly which
MLME code returned the error.

Also, convert to wpa_dbg so that we get device names
in the messages.

Signed-hostap: Ben Greear <greearb@candelatech.com>
2011-11-18 23:41:52 +02:00
Johannes Berg
eb916eb899 P2P: Clear WPS method when GO negotiation fails
When GO negotation fails the WPS method is currently not cleared, which
can result in GO negotiation being resumed when a GO negotiation request
frame is received from the peer. That is unexpected as locally we
already gave up.

This manifests itself in getting

1319574733.955685: wlan0: P2P-GO-NEG-FAILURE status=-1
1319574733.955723: P2P: Removing pending group interface p2p-wlan0-0
...
1319574736.648378: wlan0: P2P: Starting GO Negotiation with previously
authorized peer
...
1319574736.650115: wlan0: P2P: Sending GO Negotiation Response
...
1319574736.988038: wlan0: P2P-GO-NEG-SUCCESS
1319574736.988233: P2P: No pending group interface
1319574736.988268: P2P: Create a new interface p2p-wlan0-1 for the group

Clear the WPS method to avoid this situation. I wasn't
able to test this though, but given the log I can only
assume this is how the situation happened.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-18 23:34:53 +02:00
Johannes Berg
6cad95db72 P2P: Simplify code in wpas_p2p_connect()
There's some duplicated code there that can be simplified
with just a single new variable.

Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2011-11-18 23:32:03 +02:00
Dan Williams
98ac6763ff nl80211: Fix UNSPEC signal quality reporting
r->level got assigned so it's clearly not INVALID; instead
r->qual should be invalid.

Signed-hostap: Dan Williams <dcbw@redhat.com>
2011-11-18 23:23:45 +02:00
Jithu Jance
5cfda25e44 P2P: Indicate GO Negotiation failure on peer expiration
If P2P device expires while a GO Negotiation is in progress, currently
p2p->go_neg_peer is cleared without indicating GO Nego failure. This
will result in pending group interfaces to be left over. This patch will
indicate GO Negotiation failure and will remove any pending group
interfaces.

This patch addresses a corner case in GO-Negotiation case. Consider the
scenario where two devices A and B are in discovery stage and Device B
vanishes [moves out of range] when a connect is issued on the Device A.
Then Device A keeps on retrying the GO Negotiation Request till the
retry limit is reached. On reaching retry limit, the pending group
interface is removed. But suppose if the peer entry in the device list
expires before the retry limit is reached, then pending group interface
was not removed.

Signed-off-by: Jithu Jance <jithu@broadcom.com>
2011-11-18 23:13:03 +02:00
Eyal Shapira
1966e3d1b7 sched scan: Fix passive scanning
Scan wasn't initiated in case the config contained only networks without
scan_ssid. In such a case we want scan to be initiated without any SSIDs
to actively scan but include all the SSIDs in the filter list. Also
added some debug logs to easily see which SSIDs were included in which
list.

Cc: Luciano Coelho <coelho@ti.com>
Signed-off-by: Eyal Shapira <eyal@wizery.com>
2011-11-18 23:05:57 +02:00
Jouni Malinen
e159cc5e9b Use NULL instead of 0 for pointers
Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-18 22:07:30 +02:00