Commit graph

15890 commits

Author SHA1 Message Date
Jouni Malinen
9dd5373122 tests: FT+PMF roaming with skip_prune
Verify hostapd behavior during FT protocol processing when a STA entry
is still present in the AP and that association has PMF negotiated.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 23:32:12 +03:00
Jouni Malinen
d867e11811 FT: Remove and re-add STA entry after FT protocol success with PMF
Allow STA entry to be removed and re-added to the driver with PMF is
used with FT. Previously, this case resulted in cfg80211 rejecting STA
entry update after successful FT protocol use if the association had not
been dropped and it could not be dropped for the PMF case in
handle_auth().

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 21:53:10 +03:00
Jouni Malinen
af23f3a849 tests: New style fuzzing tool for DPP URI parsing
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 20:09:30 +03:00
Jouni Malinen
41a1032449 tests: New style fuzzing tool for SAE commit parsing
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 19:51:46 +03:00
Jouni Malinen
97beccc838 SAE: Fix build without DPP/OWE/ERP
SAE needs sha256-kdf.c to be included in the build.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 18:11:11 +03:00
Thomas Pedersen
fe4c0ea723 tests: Enable MACsec testing by default in the VM kernel
Include support for MACsec testing in the (vm) kernel by default.

Don't include support in the example hostapd or wpa_supplicant configs
yet since that would potentially break the build on older distributions
like Ubuntu 16.04, which is supported until April 2021.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-04-04 17:25:30 +03:00
Jouni Malinen
116bbf7953 wlantest: Add frame number fo replay detected messages
This makes it easier to find the relevant frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 00:06:59 +03:00
Jouni Malinen
c8a3565947 wlantest: Remove duplicate PN/RSC prints from replay cases
The PN and RSC are already printed in the "replay detected" debug
message so there is no point in having separate hexdumps of the same
values immediately after that.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 00:04:32 +03:00
Jouni Malinen
3e537313e8 wlantest: Add debug print with frame number for decryption failures
This makes it more convenient to find the frames that could not be
decrypted.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-04 00:00:17 +03:00
Jouni Malinen
866c3acb8c wlantest: Do not report decryption failures for WEP keys if no keys
If no WEP keys are available, there is not going to be an attempt to
decrypt the frame, so don't claim decryption failed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-03 23:56:10 +03:00
Jouni Malinen
ca70f36c20 tests: Make ap_vht_csa_vht40_disable more robust
Wait for disconnection and reconnection after CSA since mac80211 does
not support clean CSA to disable VHT.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-04-03 21:19:18 +03:00
Vamsi Krishna
c7a9a5745b P2P: Start group with user configured params after accepting invitation
Use global configuration parameters while invoking a persistent P2P
group after accepting P2P Invitation Request from a peer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 20:32:37 +03:00
Jouni Malinen
169cf46534 tests: sigma_dut and DPP with NFC
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 16:27:57 +03:00
Jouni Malinen
512b6c02e0 DPP: Mandate mutual auth with NFC negotiated connection handover
Mark own bootstrap information as having been used in NFC negotiated
connection handover and do not accept non-mutual authentication when
processing Authentication Response from the peer when such bootstrapping
information is used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 16:27:52 +03:00
Jouni Malinen
4b9a1ba0ad tests: Use a helper function for starting DPP AP in sigma_dut tests
Remove unnecessary code duplication.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 12:59:47 +03:00
Jouni Malinen
f964a54ec2 tests: Remove duplicate definitions of csign/connector in sigma_dut
There is no need to duplicate the definitions of the exact same values
within each test function.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 12:54:44 +03:00
Jouni Malinen
62d5616155 tests: DPP netAccessKey for reconfig
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 12:45:03 +03:00
Jouni Malinen
872299f4b3 DPP2: Store netAccessKey in psk/sae credentials for reconfig
Connector alone is not sufficient for authentication during
reconfiguration, so store the netAccessKey as well.

Fixes: e4eb009d98 ("DPP2: Add Connector and C-sign-key in psk/sae credentials for reconfig")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 12:43:48 +03:00
Jouni Malinen
bf9f49396b OWE: Remove check for unexpected DH Parameter IE use with other AKMs
While the Diffie-Hellman Parameter element is defined in RFC 8110
explicitly for use witht he OWE AKM, it has now been proposed to be used
with another AKM (DPP). Should any other AKM be extended in similar
manner in the future, the check against unexpected use could result in
additional interoperability issues. Remove that and instead, ignore the
unexpected Diffie-Hellman Parameter element if it is included in
(Re)Association Request frame when any other AKM is negotiated.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-03 12:18:11 +03:00
Jouni Malinen
a34fb79788 tests: DPP reconfiguration connector
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-02 21:34:49 +03:00
Jouni Malinen
e4eb009d98 DPP2: Add Connector and C-sign-key in psk/sae credentials for reconfig
If the Enrollee indicates support for DPP R2 or newer, add Connector and
C-sign-key in psk/sae credentials (i.e., cases where DPP AKM is not
enabled) for reconfiguration. Extend processing of such credentials in
wpa_supplicant network profile addition to handle this new case
correctly by not setting key_mgmt=DPP based on Connector being present,
but by looking at the actual akm value in the config object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-02 21:34:49 +03:00
Jouni Malinen
08ac6f807d wlantest: Update PTK after rekeying even if EAPOL-Key msg 4/4 is missing
Update TPTK to PTK if a valid EAPOL-Key msg 2/4 and 3/4 are available,
but 4/4 is missing. This avoids certain cases where the new TK could be
derived, but it was not being used to try to decrypt following encrypted
frames.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 18:46:14 +03:00
Jouni Malinen
0dc58cfa95 wlantest: Do not report decryption keys when checking only zero TK
All the "Failed to decrypt frame" debug prints were confusing since
those were not supposed to be shown unless there were one or more real
TKs available. The recently added check for zero TK added these notes
for that case which is not really correct, so get rid of them.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 18:30:33 +03:00
Jouni Malinen
1dcfbab254 DPP2: Clear requirement for QR Code mutual authentication for chirping
The chirping cases are not really targeting interactive operations, so
clear the requirement for mutual authentication when DPP_CHIRP command
is used. This avoids testing isues where an earlier DPP_LISTEN command
has used qr=mutual parameter and that seting not getting cleared before
the next DPP_CHIRP command is used.

This fixes a test case failure in the following test sequence:
dpp_auth_resp_status_failure dpp_controller_relay_chirp

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 17:19:10 +03:00
Jouni Malinen
a371164f88 Process received WNM Notification Request for beacon protection failures
Report received notifications for beacon protection failures in syslog
and control interface.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 16:30:12 +03:00
Jouni Malinen
0e794989e5 Beacon frame protection event for incorrect protection
Define a driver interface event for Beacon frame protection failures.
Report such events over the control interface and send a
WNM-Notification Request frame to the AP as well.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-01 16:22:48 +03:00
P Praneesh
7c8f540ee0 wpa_supplicant: Add HE override support
Add HE override support under the build parameter CONFIG_HE_OVERRIDES=y.
The disable_he=1 network profile parameter can be used to disable HE.
This requires a fallback to VHT on the 5 GHz band and to HT on the 2.4
GHz band.

There is no nl80211 support for configuring the driver to disable HE, so
for now, this applies only to IBSS and mesh cases.

Signed-off-by: P Praneesh <ppranees@codeaurora.org>
2020-03-30 12:55:01 +03:00
Sriram R
e149051ced hostapd: Validate the country_code parameter value
cfg80211/regulatory supports only ISO 3166-1 alpha2 country code and
that's what this parameter is supposed to use, so validate the country
code input before accepting the value. Only characters A..Z are
accepted.

Signed-off-by: Sriram R <srirrama@codeaurora.org>
2020-03-30 12:37:54 +03:00
Jouni Malinen
d4f5d1f0c7 DPP: Add some more details on how to use DPP
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 23:24:45 +03:00
Jouni Malinen
66e20bb1a7 Fix the dpp_configurator_sign example command
The mandatory ssid parameter was forgotten from this command when it was
added to the dpp_auth_init examples.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 23:07:42 +03:00
Jouni Malinen
4e9cfc3eb8 tests: DFS channel switch
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
91498a1225 hostapd: DFS for channel switch in repeater mode
In repeater mode remote AP may request channel switch to a new channel.
Check if DFS is required for the new channel before proceeding with
normal AP operations. Start CAC procedure if radar detection is required
and channel is not yet marked as available.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
c60717f839 hostapd: Add support for DFS channels in CHAN_SWITCH
Enable support for DFS channels in the CHAN_SWITCH command. Perform CAC
instead of CSA if DFS channel is selected. Then restart normal AP
operations.

Note that the current implementation provides a simplified approach. It
does not check if the selected DFS channel block is already in the
HOSTAPD_CHAN_DFS_AVAILABLE state. CAC procedure is restarted anyway.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
683e7c7559 DFS: Add new hostapd_is_dfs_overlap() helper
Add a new hostapd_is_dfs_overlap() helper function to DFS module. This
function tells whether the selected frequency range overlaps with DFS
channels in the current hostapd configuration. Selected frequency reange
is specified by its center frequency and bandwidth.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
7988767393 DFS: Rename and export hostapd_config_dfs_chan_available helper
Rename DFS helper hostapd_config_dfs_chan_available() to
hostapd_is_dfs_chan_available(). Enable access to this helper function
from other hostapd components.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Sergey Matyukevich
30b6d4bb7d hostapd: Basic channel check for CHAN_SWITCH parameters
Implement channel sanity check for the CHAN_SWITCH command. Verify
provided values for bandwidth, frequencies, and secondary channel
offset. Reject requested channel switch operation if basic constraints
on frequencies and bandwidth are not fulfilled.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
af6a2b727c tests: Use complete CHAN_SWITCH parameters in ap_vht_csa_vht40_disable
Specify the secondary channel offset and correct center_freq1 value to
make the parameters complete for a 40 MHz channel.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Alexander Wetzel
3f88d2ba0d AP: Drop not needed condition to delete PTK ID 1
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
2020-03-29 21:15:16 +03:00
Thomas Pedersen
34708b4893 tests: Include UML defconfig
Include a defconfig for building kernel as UML. Also update the README
with a few notes related to UML.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-03-29 21:15:16 +03:00
Thomas Pedersen
eedf08f7a9 tests: Convert kernel-config to defconfig
Make the included kernel-config a little more minimal by checking in the
defconfig instead.

Generate the defconfig by checking out a linux at tag wt-2020-03-17,
copy kernel-config to .config, run
'yes "" | make oldconfig && make savedefconfig',
and copy resulting defconfig to kernel-config.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
80914e9eb2 DPP2: Fix build with OpenSSL 1.0.2 (EVP_PKEY_get0_EC_KEY() wrapper)
EVP_PKEY_get0_EC_KEY() was added in OpenSSL 1.1.0, so add a
compatibility wrapper for it when building with OpenSSL 1.0.2.

Fixes: c025c2eb59 ("DPP: DPPEnvelopedData generation for Configurator backup")
Fixes: 7d9e320054 ("DPP: Received Configurator backup processing")
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Johannes Berg
478bc00b5f tests: Assume --long for UML
If we use user-mode-linux, we have time-travel, and then the --long
argument doesn't really make a difference, so just assume that's the
case.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-03-29 21:15:16 +03:00
Jouni Malinen
6f291896b9 tests: FT roaming cases with authorized STA entry remaining
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-29 21:15:16 +03:00
Jouni Malinen
54e2961f80 Add a hostapd testing option for skipping association pruning
The new skip_prune_assoc=1 parameter can be used to configure hostapd
not to prune associations from other BSSs operated by the same process
when a station associates with another BSS. This can be helpful in
testing roaming cases where association and authorization state is
maintained in an AP when the stations returns.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 20:39:19 +02:00
Jouni Malinen
1a18f8df63 nl80211: Allow full AP client state capability to be disabled
The new driver param full_ap_client_state=0 can be used to test
functionality with the driver capability for full AP client state being
forced to be disabled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 20:38:11 +02:00
Jouni Malinen
7b156a3c5a wpa_auth: Use printf format %zu instead of type casts
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:54:10 +02:00
Jouni Malinen
f83d3491b9 wpa_auth: Do not split strings into multiple lines
Avoid unnecessary splitting of long string constants into multiple
lines.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:48:32 +02:00
Jouni Malinen
9385f03feb wpa_auth: Coding style cleanup for pointer is NULL comparisons
Use !ptr instead of ptr == NULL.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:36:00 +02:00
Jouni Malinen
62e12afcf1 wpa_auth: Clean up pointer dereferences
Use local variables to avoid sm->wpa_auth->conf type of dereferences
where multiple instances within a function can be cleaned up.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-28 19:29:12 +02:00
Veerendranath Jakkam
bbf94a0958 nl80211: Configure PMKSA lifetime and reauth threshold timer to driver
Drivers that trigger roaming need to know the lifetime and reauth
threshold time of configured PMKSA so that they can trigger full
authentication to avoid unnecessary disconnection. To support this, send
dot11RSNAConfigPMKLifetime and dot11RSNAConfigPMKReauthThreshold values
configured in wpa_supplicant to the driver while configuring a PMKSA.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-03-28 17:27:42 +02:00