Commit graph

10321 commits

Author SHA1 Message Date
Jouni Malinen
e1246a6e2c tests: Make ap_open_select_twice less likely to fail
It looks like a previous P2P test case can cause the initial single
channel scan in ap_open_select_twice take more than five seconds in some
cases. While that is not really expected behavior, this test case should
not fail. Increase the timeout to avoid reporting false failures here.

This could be triggered with the following test case sequence:
p2p_msg_unexpected_go_neg_resp ap_open_select_twice

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-22 20:14:06 +02:00
Jouni Malinen
05bc2b44c1 tests: INTERFACE_ADD create testing coverage
This covers an invalid interface type and interface type 'sta'.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-22 17:59:54 +02:00
Ilan Peer
061190308d tests: wpa_supplicant interface creation in AP mode
Add a test case that creates a new interface in AP mode.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-11-22 17:54:07 +02:00
Avraham Stern
cadffacb3f wpa_cli: Add an option to set created interface type
Add an option to set the interface type when creating
a driver interface.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:50:05 +02:00
Avraham Stern
0f039e3432 Add an option to create interface of a certain type with INTERFACE_ADD
Some drivers do not support having two station interfaces, so the fact
that wpa_supplicant always creates a new interface in station mode, even
if it will be used as another type of interface, may prevent
wpa_supplicant from creating new interfaces. Allow setting the interface
type when a new interface is created so that interfaces of supported
types can be created.

Currently supported types are station ("sta") and AP ("ap"). If the
interface type is not specified, a station interface will be created.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:46:54 +02:00
Avraham Stern
d8a3b66d7f driver: Make setting up AP optional when creating AP interface
When an AP interface it created, it is also setup and subscribes
for management frames etc. However, when the interface is added by
wpa_supplicant, setting up for AP operations is redundant because
it will be done by wpa_supplicant on wpa_drv_init() when setting
the interface mode to AP.

In addition, it may cause wpa_supplicant to fail initializing the
interface as it will try to subscribe for management frames on this
interface but the interface is already registered.

Change this, so when adding an AP interface, make setting up the AP
optional, and use it only when the interface is added by hostapd but not
when it is added by wpa_supplicant.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:42:59 +02:00
Marek Behún
36e820605f Check for LIBRESSL_VERSION_NUMBER in tls_openssl.c
LibreSSL does not yet support the new API, so do not use it
when LIBRESSL_VERSION_NUMBER macro is defined.

Signed-off-by: Marek Behun <kabel@blackhole.sk>
2015-11-22 12:00:53 +02:00
Jouni Malinen
29fb191cfd tests: Clear scan cache at the start of ap_vht80*
These test cases depend on the HT40 co-ex scans not swapping PRI/SEC
channels. It was possible for a test case to fail, e.g., in the
following sequence: ap_ht40_5ghz_match ap_vht80b.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-21 19:04:12 +02:00
Avraham Stern
2c51c0bd83 P2P: Clear send action work without waiting on find/stop/listen
When clearing pending TX action to start a new P2P operation like
P2P_FIND or P2P_LISTEN, wpas_p2p_action_tx_clear() was used to clear
the send action work. However, in cases where the action work has wait
time, it is not cleared immediately but only after the wait time ends.
This may cause delay in starting the P2P operation.

Fix that by always clearing the send action work immediately on these
P2P commands that result in immediate P2P state change and practically
stopping a previous operation, if one was pending.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-21 18:53:22 +02:00
Alexander Bondar
6bdc43c4db AP: Avoid 20/40 MHz co-ex scan if PRI/SEC switch is not allowed
When an AP is started on the 5.2 GHz band with 40 MHz bandwidth, a
scan is issued in order to handle 20/40 MHz coexistence. However,
the scan is issued even if iface->conf->no_pri_sec_switch is set,
which is redundant.

Fix this by checking iface->conf->no_pri_sec_switch before starting
the scan.

Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
2015-11-21 18:42:53 +02:00
Ayala Beker
757785dab2 nl80211: Clear ignore_next_local_deauth flag
The de-authentication flow in wpa_driver_nl80211_deauthenticate() can
result in a locally generated de-authentication event. To avoid getting
this extra event ignore_next_local_deauth flag is set, and should be
cleared when the next local deauth event is received. However, it is not
cleared when the event shows up after the wpa_supplicant has started a
connection with a new AP, and as a result it might ignore future
deauth event from the driver.

Fix this by clearing the flag if the event is locally generated.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-11-21 18:00:33 +02:00
Sara Sharon
cb2a926df8 nl80211: Clear ignore_next_local_deauth and ignore_deauth_event
The authentication flow in wpa_driver_nl80211_authenticate() can
result  in a locally generated de-authentication, in which both
next_local_deauth and ignore_next_local_deauth are set.

However, in mlme_event_deauth_disassoc(), when ignore_deauth_event is
set, the flag is cleared, but the flow immediately returns leaving
ignore_next_local_deauth set, which can result in ignoring future deauth
event from the driver, leaving the wpa_supplicant in an inconsistent
state.

Fix this by clearing both flags in case that next_local_deauth is set.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
2015-11-21 18:00:33 +02:00
Jouni Malinen
fe5aa8cb9c tests: EAP-pwd local error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-21 18:00:33 +02:00
Jouni Malinen
d5482411cf tests: EAP-MD5 local error cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-21 18:00:33 +02:00
Ravi Joshi
f32227ed9e Add QCA vendor attribute and event to indicate subnet change status
This allows offloaded roaming to inform user space of the change in IP
subnet post roaming. The device may have roamed to a network which is in
a different subnet which will result in IP connectivity loss. Indicating
the change in subnet enables the user space to refresh the IP address or
to perform IP subnet validation if unknown status is indicated.

The driver indication is reported with a new event from wpa_supplicant
in the following format:
CTRL-EVENT-SUBNET-STATUS-UPDATE status=<0/1/2>
where
0 = unknown
1 = IP subnet unchanged (can continue to use the old IP address)
2 = IP subnet changed (need to get a new IP address)

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-20 11:03:06 +02:00
Jouni Malinen
6fb8b4bf84 tests: AP with open mode and select network twice
This verifies that the second SELECT_NETWORK for the same network starts
a new scan immediately if the previous connection attempt is waiting for
the next scan iteration to start.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-20 00:48:25 +02:00
Jouni Malinen
d38c7be0f0 Skip SELECT_NETWORK steps only if already connected or connecting
Commit 2a6f78fbbe ('Do not re-associate on
SELECT_NETWORK to current network') started skipping all SELECT_NETWORK
connection steps if the selected network had already been selected
previously. This happened regardless of whether the connection was
already established. This is not necessarily desirable for all cases
where there is no immediate action to even try to connect (e.g., long
wait for the next scan).

Speed this up by allowing the SELECT_NETWORK operation to get started if
there is no connection or ongoing connection attempt with the selected
network.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-20 00:45:40 +02:00
Jouni Malinen
364418661d tests: PMKSA caching and EAPOL reauthentication
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 21:16:36 +02:00
Jouni Malinen
4013d6885b tests: Verify EAPOL reauthentication after FT protocol
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 21:16:29 +02:00
Jouni Malinen
25eb7fcbb4 Fix EAPOL reauth after FT protocol or offloaded PMKSA cache use
The EAP peer state machine moved from IDLE to FAILURE state when the
EAPOL Authenticator triggered reauthentication with an
EAP-Request/Identity in a case where the associated started with FT
protocol or offloaded PMKSA cache use (4-way handshake using a
previously acquired PMK). This happened due to the altSuccess=TRUE
setting being left behind and not cleared when processing the restart of
authentication. Fix this by clearing altAccept and eapSuccess when going
through SUPP_PAE RESTART state.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 21:16:18 +02:00
Jouni Malinen
f68d491b0a FT auth: Fix EAPOL reauthentication after FT protocol run
The EAPOL AUTH_PAE state machine was left in incomplete state at the
completion of FT protocol. Set portValid = TRUE to allow the state
machine to proceed from AUTHENTICATING to AUTHENTICATED state, so that a
new EAPOL reauthentication can be triggered.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 21:16:06 +02:00
Jouni Malinen
119562cfdf tests: Clear FST sessions at the end of fst_setup_mbie_diff
This avoids issues with following test cases failing due to unexpected
starting state. This issue showed up with the following hwsim test case
sequence:
fst_setup_mbie_diff fst_dynamic_iface_attach

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 17:33:34 +02:00
Peter Oh
a65efbfb24 Add VHT support for Mesh
Mesh Points themselves have capability to support VHT as long as
hardware supports it. However, supporting VHT in mesh mode was disabled
because no one had clearly tested and confirmed its functionality. Since
VHT80 has now been verified to work with ath10k QCA988X driver and
mac80211_hwsim, enable VHT support in mesh mode.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2015-11-19 11:37:41 +02:00
Peter Oh
a73c984261 Set WMM flag to Mesh STA by default
Set WLAN_STA_WMM flag to Mesh STA by default since Mesh STAs are QoS
STAs. Mesh STA's HT capabilities won't be parsed properly without the
flag.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2015-11-19 11:37:17 +02:00
Peng Xu
9a8d9f7c62 Assign QCA vendor command and attribute for Tx power reduction in dB
Assign nl80211 vendor command
QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_DECR_DB and corresponding
attributes.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-19 11:34:31 +02:00
Jouni Malinen
4f524e99d2 tests: Clear scan cache at the end of ap_wps_per_station_psk
It was possible for the WPS PBC state to get cached through to the
following test cases and that would trigger false failures. Fix this by
explicitly clearing the scan cache at the end of ap_wps_per_station_psk.
This issue was triggered with the following test case sequence:
ap_wps_per_station_psk autogo_pbc

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-18 18:03:22 +02:00
Jouni Malinen
747ba1067d nl80211: Do not return incomplete hw capability info
If a memory allocation fails while parsing driver capabilities, drop all
mode/channel/rate information instead of returning possibly partial
information.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-17 19:50:34 +02:00
Jouni Malinen
89a79ca2b9 tests: Force hw capability re-fetch at the end of dbus_connect_oom
This is needed since the forced OOM may have forced the cached
information to be invalid or dropped. This issue was hit with the
following hwsim test case sequence:
ap_interworking_scan_filtering fst_sta_config_llt_large dbus_connect_oom
wpas_ctrl_enable_disable_network

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-17 19:50:34 +02:00
Sunil Dutt
5e238cc682 WPS: Reconnect for a failed data connection when STA_AUTOCONNECT is 0
If "STA_AUTOCONNECT 0" has been used to disable automatic connection on
disconnection event and the driver indicates a failure for the data
connection after successful WPS handshake, it is possible to hit a case
where wpa_s->disconnected is set to 1 and further attempts to connect
shall stop.

While "STA_AUTOCONNECT 0" is used to disable automatic reconnection
attempts in general, this specific WPS case can benefit from trying
again even with that configuration for a short period of time. Extend
the wpa_supplicant re-enable-networks-after-WPS 10 second timeout to
apply for ignoring disabled STA_AUTOCONNECT immediately after a WPS
provisioning step.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-17 19:50:34 +02:00
Jouni Malinen
1992af115a tests: D-Bus P2P and InvitationReceived
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-17 19:50:34 +02:00
MAYANK HAARIT
442cc8cc41 dbus: Fix memory leak in sending InvitationReceived signal
Free the message after message send in
wpas_dbus_signal_p2p_invitation_received() to avoid leaking memory.

Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
Signed-off-by: Avichal Agarwal <avichal.a@samsung.com>
2015-11-17 17:20:03 +02:00
Anton Nayshtut
0603bcb7fe hostapd: Process MAC ACLs on a station association event (SME in driver)
Now hostapd will use station MAC-based permissions according to the
macaddr_acl policy also for drivers which use AP SME offload, but do not
support NL80211_CMD_SET_MAC_ACL for offloading MAC ACL processing. It
should be noted that in this type of case the association goes through
and the station gets disconnected immediately after that.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-17 12:38:32 +02:00
Amarnath Hullur Subramanyam
89a11ad38f RSN: Remove check for proactive_key_caching while setting PMK offload
wpa_sm_key_mgmt_set_pmk() was checking for proactive_key_caching to be
enabled before setting the PMK to the driver. This check is not required
and would mandate configuration setting of okc or proactive_key_caching
for cases which were not necessary.

Signed-off-by: Amarnath Hullur Subramanyam <amarnath@qca.qualcomm.com>
2015-11-16 19:05:01 +02:00
Ravi Joshi
d381963385 Extend QCA roam event with subnet change indication
The new attribute can be used with
QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH to indicate whether the IP
subnet was detected to have changed when processing offloaded roam/key
management.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-16 19:00:35 +02:00
Samuel Tan
07e3653922 dbus: Do not use pointer arithmetic with a void pointer
This failed to compile on x86 gcc due to pointer arithmetic on a void
pointer.

Signed-off-by: Samuel Tan <samueltan@google.com>
2015-11-15 19:34:51 +02:00
Samuel Tan
3b49719130 Android: Use libdbus rather than dbus-1
The upstream wpa_supplicant uses the dbus-1 library when it is compiled
with D-Bus support. In Android, we imported the D-Bus shared libraries
under the name "libdbus", so use this shared library instead of dbus-1
when compiling wpa_supplicant with D-Bus support.

Signed-off-by: Samuel Tan <samueltan@google.com>
2015-11-15 19:26:49 +02:00
Ben Greear
5b75ecead3 Document passive_scan option for wpa_supplicant.conf
This should save the next person to need this behavior some time.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-11-15 19:25:05 +02:00
Ben Greear
68ac584a49 nl80211: Add debug message for passive scanning
This is more obvious than looking for the lack of 'Scan SSID' messages.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-11-15 19:20:35 +02:00
Jouni Malinen
2299b54383 tests: D-Bus SaveConfig
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-15 19:08:05 +02:00
Purushottam Kushwaha
2d0fe6bc4e dbus: Add SaveConfig to update configuration file
This is similar to SAVE_CONFIG on control interface, which allow users
to update the configuration file.

Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-11-15 19:04:15 +02:00
Purushottam Kushwaha
a3dff7dc0c P2P: Fix a typo in debug message
Signed-off-by: Dilshad Ahmad <dilshad.a@samsung.com>
2015-11-15 18:55:23 +02:00
Purushottam Kushwaha
fb7e7daeff dbus: Fix a copy-paste error in debug print
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-11-15 18:53:51 +02:00
Jouni Malinen
8a848fae66 tests: EAP-pwd protocol tests
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
95577884ca EAP-pwd peer: Fix error path for unexpected Confirm message
If the Confirm message is received from the server before the Identity
exchange has been completed, the group has not yet been determined and
data->grp is NULL. The error path in eap_pwd_perform_confirm_exchange()
did not take this corner case into account and could end up
dereferencing a NULL pointer and terminating the process if invalid
message sequence is received. (CVE-2015-5316)

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
bef802ece0 EAP-pwd server: Fix last fragment length validation
All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5314)

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
8057821706 EAP-pwd peer: Fix last fragment length validation
All but the last fragment had their length checked against the remaining
room in the reassembly buffer. This allowed a suitably constructed last
fragment frame to try to add extra data that would go beyond the buffer.
The length validation code in wpabuf_put_data() prevents an actual
buffer write overflow from occurring, but this results in process
termination. (CVE-2015-5315)

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
03ed0a5239 WNM: Ignore WNM-Sleep Mode Response if WNM-Sleep Mode has not been used
The AP is not expected to send out a WNM-Sleep Mode Response frame
without the STA trying to use WNM-Sleep Mode. Drop such unexpected
responses to reduce unnecessary processing of the frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
8823178c96 tests: Start WNM-Sleep Mode in wnm_action_proto*
This is needed to avoid test case failures with additional state
validation in wpa_supplicant.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
63a19e56b0 tests: WNM Action protocol testing (PMF disabled)
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
2cb28a4c75 WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates. (CVE-2015-5310)

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00