Commit graph

8778 commits

Author SHA1 Message Date
Jouni Malinen
f2dc06e2bd P2P: Ignore remain-on-channel callback event if not waiting for one
It was possible for the previously requested remain-on-channel for P2P
listen state to get canceled before having received driver event
indicating start of that remain-on-channel operation. In such a case,
the event was able to trigger P2P module to start processing listen
timeout even though there was not supposed to be a following listen
operation anymore. Skip the driver event if we are not waiting for a new
listen state.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-02 14:09:18 +02:00
Sreenath S
6a6569b8bd HS 2.0R2: Add password to DB in case of machine managed subscription
Add password and machine_managed flag to database in case of machine
managed subscription to fix EAP-TTLS connection failure to production
AP. In case of user managed subscription, the entered password is added
to DB from the PHP script. However in machine managed subscription,
machine generated password is added only in SOAP messages and PPS MO. So
connection to production will fail as the generated password is not
present in the database used by AAA server.

Signed-off-by: Sreenath Sharma <sreenath.mailing.lists@gmail.com>
2015-02-01 22:21:01 +02:00
Mukesh Agrawal
f0d0a5d23b Improve BSS selection with default noise floor values
When noise floor measurements are not available, compute SNR
using default values for the noise floor. This helps steer us
towards 5 GHz BSSes in high signal strength environments.

In more detail...

Existing code prefers a 5 GHz BSS when the 5 GHz BSS's signal
strength is "close" to that of the 2.4 GHz BSS, or when both SNRs
are large. However, the mwifiex driver does not provide noise
floor measurements, so we can't compute SNRs.

Because mwifiex doesn't provide NF measurements, the "large SNR"
code wasn't effective. By using default values for the noise floor,
we can again compute SNRs, and decide that the SNR is high enough
that we shouldn't worry about the exact difference in SNR.

The default noise floor values (one for 2.4 GHz, and one for 5 GHz)
were chosen by measurement in a noisy environment, so they should be
conservative.

Note that while this patch is motivated by mwifiex, it affects
ath9k as well. Although ath9k provides noise floor measurements
in general, it will sometimes fail to provide a measurement for
one or more specific channels.

As a result of this patch, we'll always compare BSSes based on SNR
(either measured or estimated), rather than sometimes comparing
based on signal strength. ("Always" assumes that the
WPA_SCAN_LEVEL_DBM flag is set. It is for mwifiex and ath9k.)

While there:
- fix a whitespace issue (spaces -> tab)
- clean up existing comments
- update dump_scan_res to indicate whether the noise floor is
  measured, or default

Signed-hostap: mukesh agrawal <quiche@chromium.org>
2015-02-01 22:01:18 +02:00
Jouni Malinen
7f7bfba919 Add an option allow canned EAP-Success for wired IEEE 802.1X
For wired IEEE 802.1X authentication, phase1="allow_canned_success=1"
can now be used to configure a mode that allows EAP-Success (and
EAP-Failure) without going through authentication step. Some switches
use such sequence when forcing the port to be authorized/unauthorized or
as a fallback option if the authentication server is unreachable. By
default, wpa_supplicant discards such frames to protect against
potential attacks by rogue devices, but this option can be used to
disable that protection for cases where the server/authenticator does
not need to be authenticated.

When enabled, this mode allows EAP-Success/EAP-Failure as an immediate
response to EAPOL-Start (or even without EAPOL-Start) and EAP-Success is
also allowed immediately after EAP-Identity exchange (fallback case for
authenticator not being able to connect to authentication server).

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-02-01 19:22:54 +02:00
Jouni Malinen
49fcc32e91 EAP-MSCHAPv2 peer: Add option to disable password retry query
wpa_supplicant used to request user to re-enter username/password if the
server indicated that EAP-MSCHAPv2 (e.g., in PEAP Phase 2)
authentication failed (E=691), but retry is allowed (R=1). This is a
reasonable default behavior, but there may be cases where it is more
convenient to close the authentication session immediately rather than
wait for user to do something.

Add a new "mschapv2_retry=0" option to the phase2 field to allow the
retry behavior to be disabled. This will make wpa_supplicant abort
authentication attempt on E=691 regardless of whether the server allows
retry.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-02-01 17:45:19 +02:00
Jouni Malinen
f4cd0f6454 tests: EAP-PEAP/MSCHAPv2 password failure
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-02-01 17:37:35 +02:00
Helmut Schaa
66bc6830d5 hostapd: Simplify vlan_add_dynamic error paths
Preparation for upcoming changes.
No functional changes.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
2015-02-01 11:06:24 +02:00
Ben Greear
99805a0ea1 Interworking: Convert wpa_printf() to wpa_msg()
Also adds a few messages that helped me track down why things
were not working as expected.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-02-01 01:32:25 +02:00
Roger Zanoni
b42f539ed2 Add a variable to handle extra CFLAGS values
Some packages don't install its headers in the default directory
(e.g.: In Arch Linux libiberty and libn13 includes are installed)
in their own subdirectory under /usr/include) and the build fails
trying to find the headers.

This patch will allow passing extra CFLAGS values without discarding
the assignments made in the Makefile. The CFLAGS values in the Makefile
are ignored, if defined directly in the make command line.

Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
2015-02-01 00:26:17 +02:00
Jouni Malinen
54f2cae2e6 tests: Make *_key_lifetime_in_memory more robust
It was possible for the GTK-found-in-memory case to be triggered due to
a retransmission of EAPOL-Key msg 3/4 especially when running test cases
under heavy load (i.e., timeout on hostapd due to not receiving the 4/4
response quickly enough). Make this false failure report less likely by
waiting a bit longer after the connection has been completed before
fetching the process memory.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 18:06:06 +02:00
Jouni Malinen
a1512a0cc7 tests: wpa_supplicant and station interface in a bridge
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 17:28:08 +02:00
Jouni Malinen
e6dd8196e5 Work around Linux packet socket regression
Linux kernel commit 576eb62598f10c8c7fd75703fe89010cdcfff596 ('bridge:
respect RFC2863 operational state') from 2012 introduced a regression
for using wpa_supplicant with EAPOL frames and a station interface in a
bridge. Since it does not look like this regression is going to get
fixed any time soon (it is already two years from that commit and over
1.5 from a discussion pointing out the regression), add a workaround in
wpa_supplicant to avoid this issue.

The wpa_supplicant workaround uses a secondary packet socket to capture
all frames (ETH_P_ALL) from the netdev that is in a bridge. This is
needed to avoid the kernel regression. However, this comes at the price
of more CPU load. Some of this is avoided with use of Linux socket
filter, but still, this is less efficient than a packet socket bound to
the specific EAPOL ethertype. The workaround gets disabled
automatically, if the main packet socket interface on the bridge
interface turns out to be working for RX (e.g., due to an old kernel
version being used or a new kernel version having a fix for the
regression). In addition, this workaround is only taken into use for the
special case of running wpa_supplicant with an interface in a bridge.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 17:21:58 +02:00
Jouni Malinen
db5f6b2ca3 tests: RSN pre-authentication OOM in wpa_supplicant
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 13:45:52 +02:00
Jouni Malinen
7650f9e7d8 Fix resource leaks on rsn_preauth_init() error paths
The l2_packet instances were not freed on some of the rsn_preauth_init()
error paths.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 13:44:48 +02:00
Jouni Malinen
7afa678033 tests: RSN pre-authentication timeout
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 13:35:31 +02:00
Jouni Malinen
d2432b8b7e tests: PMKSA cache size limit in wpa_supplicant
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 13:26:46 +02:00
Jouni Malinen
19879b4572 tests: Invalid NFC NDEF record handling
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 02:00:02 +02:00
Jouni Malinen
55c430b63c tests: Add capture file validation for IPv6 in proxyarp_open
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 21:55:46 +02:00
Jouni Malinen
efd0a6fbf1 tests: Add capture file validation for IPv4 in proxyarp_open
Verify that the expected frames were seend and unexpected frames
weren't.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
210a4f6a13 tests: Add another bridge port to proxyarp_open
Use another AP instance as a separate bridge port in the proxyarp_open
test cases to increase testing coverage for kernel proxyarp
functionality.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
87f0ede914 tests: Add brctl showmacs output to proxyarp_open test cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
9934ee1967 tests: Run the proxyarp_open test case both with and without ebtables
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
2076846cc4 tests: Fix tshark refactoring
Commit 2e1d7386e2 ('tests: Refactor tshark
running') added a helper function for running tshark. However, it did
not use the filter argument correctly, added an extra -Tfields on the
command line, and failed to use global variable. In practice, this ended
up disabling all the tshark sniffer checks. Fix that by using the filter
argument from the caller and marking the _tshark_filter_arg global.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
a565e03086 dhcp_snoop: Make IPv4 addresses human readable in debug log
Use standard numbers-and-dots format for IPv4 in debug logs instead
of hexdump in two different byte orders.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 18:55:22 +02:00
Jouni Malinen
3a4bace428 tests: RADIUS server changing VLAN ID assignment
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 01:11:56 +02:00
Jouni Malinen
2dd4f3aede Fix STA re-bind to another VLAN on reauthentication
Previously, the old VLAN ID could have been deleted before the STA was
bound to the new VLAN in case the RADIUS server changed the VLAN ID
during an association. This did not exactly work well with mac80211, so
reorder the operations in a way that first binds the STA to the new VLAN
ID and only after that, removes the old VLAN interface if no STAs remain
in it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 01:09:51 +02:00
Jouni Malinen
4437f8fc77 Free old eap_user_file data on configuration change
This fixes a memory leak if hostapd eap_user_file parameter is modified.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 00:54:40 +02:00
Jouni Malinen
3b86e9d52c tests: PMKSA caching OOM error cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-30 00:14:57 +02:00
Jouni Malinen
915135e055 tests: hostapd OOM loop tests for WPA2-PSK and WPA2-EAP connection
These verify number of previously uncovered error paths.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:33:25 +02:00
Jouni Malinen
1180dd66a9 WPA auth: Disconnect STA if MSK cannot be fetched
Previously, it was possible for some corner cases to leave the WPA
authenticator state machine running if PMK could not be derived. Change
this to forcefully disconnect the STA to get more consistent behavior
and faster notification of the error.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:31:41 +02:00
Jouni Malinen
40aaa64f9f WPA auth: Clear temporary MSK storage from stack explicitly
This reduces the duration of time a key may remain unnecessarily in
memory.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 22:24:27 +02:00
Jouni Malinen
01b481aff3 Convert couple of remaining printf to wpa_printf in ap_list
This type of error reporting cases should use wpa_printf() to get
consistent debug logging behavior.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 21:12:51 +02:00
Jouni Malinen
cdebd24db6 tests: OLBC AP table error cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 21:11:41 +02:00
Jouni Malinen
496a7a6ff9 tests: hostapd OOM loop targeting RADIUS accounting
The hostapd_oom_wpa2_eap test case did not always catch these code
paths, so add a variant of that test case explicitly targeting RADIUS
functions.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 20:52:30 +02:00
Jouni Malinen
2c528e9690 tests: cfg80211 DEL_STATION issued externally to hostapd
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 16:26:31 +02:00
Jouni Malinen
4a4cd04cad tests: RADIUS MAC ACL and accounting enabled
This ends up using the special User-Name = STA MAC address case for
Accounting-Request. In addition, add Chargeable-User-Identity for one of
the STAs.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 15:55:48 +02:00
Jouni Malinen
ef318402f6 tests: EAP-MSCHAPv2 server out-of-memory cases
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 16:17:25 +02:00
Jouni Malinen
bfaefd5174 EAP-PEAP server: Fix Phase 2 TLV length in error case
The payload length in a Phase 2 TLV message reporting error was not set
correctly. Fix this to not include the TLVs that are included only in
success case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 16:15:58 +02:00
Jouni Malinen
95a15d793e tests: EAP-GTC server error cases
In addition, no-password-configured coverage extended to EAP-MD5 and
EAP-MSCHAPv2 as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 15:59:36 +02:00
Bob Copeland
745d93695b mesh: Create new station entry on popen frames
Currently, there is a race in open mesh networks where mesh STA A
receives a beacon from B and sends a peering open frame to initiate
peering. STA B, having not yet received a beacon from A and thus
created the corresponding station entry, will ignore all such open
frames. If the beacon interval is sufficiently long then peering
will not succeed as a result.

In fact B can simply create the station entry when the popen is
received, as is done in Linux's in-kernel MPM, avoiding the issue.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-28 13:09:31 +02:00
Bob Copeland
41bff862d9 mesh: Always free the station if peering failed
Previously, we would only free the station entry if a peering close
frame was received (freeing the station entry causes the kernel to
start sending peer candidate events again when suitable beacons are
received, triggering peering or authentication to restart).

The end result is the same in any case regardless of close reason:
if we leave holding state then peering has started again, so go
ahead and remove the station in all cases.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-01-28 13:09:31 +02:00
Masashi Honma
871ff0b746 mesh: Sync plink state with kernel
The plink_state exists both wpa_supplicant and kernel. Synchronize them
with wpa_mesh_set_plink_state().

Signed-off-by: Kenzoh Nishikawa <Kenzoh.Nishikawa@jp.sony.com>
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
467775c5ac tests: Pending EAP peer processing with VENDOR-TEST
This extends the VENDOR-TEST EAP method peer implementation to allow
pending processing case to be selected at run time. The
ap_wpa2_eap_vendor_test test case is similarly extended to include this
option as the second case for full coverage.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 13:09:31 +02:00
Jouni Malinen
ba4226130e Simplify eapol_sm_notify_pmkid_attempt()
Drop the unneeded 'attempt' argument. This was originally used for
indicating an aborted PMKID caching attempt, but a fix in 2006 removed
the only such user and since that time, only attempt == 1 has been used.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 13:09:31 +02:00
Jouni Malinen
a08fdb17aa tests: EAPOL supplicant invalid frame handling
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
48bb2e68c0 tests: STATUS-VERBOSE
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
993a865407 Add eap_session_id to wpa_supplicant STATUS output
This makes the current EAP Session-Id available for external programs.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
f19c907822 OpenSSL: Implement aes_wrap() and aes_unwrap()
This replaces the implementation in aes-wrap.c and aes-unwrap.c with
OpenSSL AES_wrap_key() and AES_unwrap_key() functions when building
hostapd or wpa_supplicant with OpenSSL.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
fee31f76cd OpenSSL: Remove support for versions older than 0.9.8
These have reached out-of-life status in the OpenSSL project and there
is no need to maintain support for them in hostapd/wpa_supplicant
either.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00
Jouni Malinen
8bf3030af6 OpenSSL: Use a common helper function for HMAC
There is no need to duplicate this construction for each hash algorithm.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 13:09:31 +02:00