Commit graph

6560 commits

Author SHA1 Message Date
Jouni Malinen
91728f2f12 Add wpa_ctrl helper functions for upper level functionality
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 01:09:21 +02:00
Jouni Malinen
b4c26ef997 Clean up hostapd_config_fill() parsers
Some of the parsing code was using a bit too complex design and could be
simplified after the earlier return-on-error cleanups.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 01:09:21 +02:00
Jouni Malinen
b2e32cde83 Fix memory leaks on wpa_config_parse_string() error paths
hostapd configuration parser did not free the temporary buffer on some
error paths.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 01:09:21 +02:00
Jouni Malinen
a0b728b7e2 Simplify hostapd_config_fill() error reporting
There is no need for trying to count the number of errors in this
function since this is not a loop anymore and the return value will be
either 0 or 1.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 01:09:21 +02:00
Jouni Malinen
599f40db7d Remove extra indentation level from hostapd_config_fill()
The configuration file parsing routines were moved to a separate
function a while back, but left at the old indentation level to avoid
showing large diffs in the commit and to avoid conflicts with parallel
development in other branches. There is never a perfect time for this
type of changes, but we might as well finally get rid of that extra
indentation now with Hotspot 2.0 Rel 2 changes pulled in.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-12 01:09:15 +02:00
Jouni Malinen
99cd77a8c5 tests: Verify reassociate-to-same-BSS commands
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 20:08:18 +02:00
Jouni Malinen
e8d70a739b nl80211: Hide deauth event due to forced deauth-during-auth
If NL80211_CMD_AUTHENTICATE fails due to exiting authentication, forced
deauthentication is used to clear cfg80211 start and a new
authentication command is retried. This resulted in an extra
disconnection event getting delivered to the core wpa_supplicant code
and that could end up confusing state there, e.g., by clearing
connection parameters like wpa_s->key_mgmt and preventing the following
association from reaching proper COMPLETED state with open networks.

Fix this by hiding the unnecessary disconnection event when using the
deauth-for-auth workaround.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 20:02:23 +02:00
Peter Qiu
0f44ec8eba Add a reattach command for fast reassociate-back-to-same-BSS
Add "reattach" command to perform single-channel single-ssid scan
instead of full scan when trying to reconnect to the currently
"connected" network (assuming old scan results are not current enough to
skip the scan completely). This allows the scan result to come back in
much faster time. In ath9k, the scan took around 12 seconds with full
background scan, and only 0.1 second with the single-channel single-ssid
scan. Thus, take much less time for the client to re-establish
connection with the currently "connected" network.

Signed-hostap: Peter Qiu <zqiu@chromium.org>
2014-03-11 19:38:01 +02:00
Ben Greear
cfc393a645 hostapd: Document interworking realm EAP Method types
Add link to the EAP type definitions document.

Signed-hostap: Ben Greear <greearb@candelatech.com>
2014-03-11 19:27:55 +02:00
Ben Greear
7450c1287d DFS: Add extra debugging messages
This might help someone realize why their hostapd config isn't working
properly.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2014-03-11 19:26:48 +02:00
Ben Greear
5d0d72a3e5 wpa_supplicant: Put upper bound on initial scan time delay
This makes stations associate much faster when using lots of stations.
In addition, this avoids delaying the initial scan continuously for
dynamic interface removal/addition cases.

Signed-hostap: Ben Greear <greearb@candelatech.com>
2014-03-11 19:23:17 +02:00
Moshe Benji
8c06db703d nl80211: Fix P2P Device handling when starting with RF-kill blocked
On RF-kill, we should not request the kernel to start a P2P device. In
addition, we should call i802_set_iface_flags() both for a P2P Device
interface and any other interface instead of calling a dedicated
function for each.

Signed-off-by: Moshe Benji <Moshe.Benji@intel.com>
2014-03-11 19:22:03 +02:00
Alexander Bondar
5e3ddf4d23 PNO: Change sched_scan_stopped event to handle pending PNO properly
When a sched_scan_stopped event is received and there is a pending PNO,
it used regular scheduled scan parameters instead of PNO specific
parameters. Change it by calling wpas_start_pno().

Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-03-11 19:15:48 +02:00
Alexander Bondar
737e7a08b0 PNO: Move and rename pno_start()/pno_stop()
Move pno_start() and pno_stop() to scan.c as a more relevant location
and rename them to wpas_start_pno()/wpas_stop_pno().

Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-03-11 19:12:57 +02:00
Eduardo Abinader
b5008c2c2d tests: Fix trace parameter invocation
If trace-cmd command does not exist, run-tests.py could end up hanging
in a loop waiting for input. Fix this simply by checking whether the
trace-cmd command can be executed sucessfully and exiting the script if
not.

Signed-off-by: Eduardo Abinader <eduardo.abinader@openbossa.org>
2014-03-11 19:09:40 +02:00
Simon Wunderlich
1d91f504e4 hostapd: Process management frames only once per BSS
At least in nl80211, broadcast management frames like Probe Request
frames, may be processed multiple times per BSS if multi-BSS is active
and NL80211_CMD_FRAME event is used to deliver them. In the case of
Probe Request frames, hostapd will create multiple redundant Probe
Response frames which are problematic when many BSS are on one channel.

This problem is caused by driver_nl80211 generating an event for
wpa_supplicant_event() for each BSS, and hostapd_mgmt_rx() calls
ieee802_11_mgmt() for each BSS, too.

Fix this by processing broadcast events only for the BSS the driver
intended to. The behavior is not changed for drivers not setting a BSS.

Signed-hostap: Simon Wunderlich <simon@open-mesh.com>
2014-03-11 19:07:25 +02:00
Simon Wunderlich
e070051207 hostapd: Allow to switch to usable DFS channels
If channels are "available", change to "usable" DFS channels as a
fallback, too. This requires CAC, but it is still better to do that
instead of stopping service completely.

Signed-hostap: Simon Wunderlich <sw@simonwunderlich.de>
2014-03-11 19:04:15 +02:00
Simon Wunderlich
01b99998bd hostapd: Allow to switch to DFS channels if available
If DFS channels are marked as "available", an AP can switch to them
immediately without performing CAC. Therefore, the channel selection
function should consider these channels even though these are radar
channels.

Signed-hostap: Simon Wunderlich <sw@simonwunderlich.de>
2014-03-11 19:01:44 +02:00
Simon Wunderlich
70ee1be248 hostapd: Add config option chanlist for DFS channels
Different channels allow different transmission power, at least in ETSI
countries. Also, ETSI requires a "channel plan" for DFS operation, and
channels should be randomly choosen from these channels.

Add a channel list configuration option for users to add channels
hostapd may pick from.

Signed-hostap: Simon Wunderlich <sw@simonwunderlich.de>
2014-03-11 18:59:40 +02:00
Jouni Malinen
2ca47da4f7 tests: Fix trace-cmd output for host case
Both the output file path and the current working directory included the
log directory and this failed if log directory was not absolute (e.g.,
when using the default logs/current in the case a VM is not used).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 17:04:33 +02:00
Jouni Malinen
09eef142ea Use internal FIPS 186-2 PRF if needed
Previously, EAP-SIM/AKA/AKA' did not work with number of crypto
libraries (GnuTLS, CryptoAPI, NSS) since the required FIPS 186-2 PRF
function was not implemented. This resulted in somewhat confusing error
messages since the placeholder functions were silently returning an
error. Fix this by using the internal implementation of FIP 186-2 PRF
(including internal SHA-1 implementation) with crypto libraries that do
not implement this in case EAP-SIM/AKA/AKA' is included in the build.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 16:44:22 +02:00
Jouni Malinen
9b3e2ad3a7 tests: Fix reporting of skipped cipher suite tests
The return value was lost and GCMP, CCMP-256, and GCMP-256 test cases
were reporting PASS instead of SKIP.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 15:03:38 +02:00
Jouni Malinen
3b9c5176d1 Fix PTK derivation for CCMP-256 and GCMP-256
Incorrect PTK length was used in PMK-to-PTK derivation and the Michael
MIC TX/RX key swapping code was incorrectly executed for these ciphers
on supplicant side.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 15:00:09 +02:00
Jouni Malinen
e6ef73f188 nl80211: Add debug print of KEY_DATA and KEY_SEQ
While these were already available from elsewhere in the debug log, it
is convenient to have the values also available at the location where
the actual nl80211 command is issued.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-11 14:59:15 +02:00
Jouni Malinen
8fc1f204df tests: HS 2.0 session information URL
Verify that session information is stored from Access-Accept and sent to
the station at the requested timeout. Verify that station processes this
notification.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 11:34:31 +02:00
Jouni Malinen
4056b0c747 tests: RADIUS Class attribute
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 11:16:29 +02:00
Jouni Malinen
18b92c6cfe tests: RADIUS attributes in Access-Request and Accounting-Request
This verifies that hostapd can add extra RADIUS attributes using
radius_auth_req_attr and radius_acct_req_attr.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 11:05:48 +02:00
Jouni Malinen
fe23f3816e tests: hostapd as P2P Device manager
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:58:01 +02:00
Jouni Malinen
f6e1eb07ee tests: Set country code and use 5 GHz band
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:49:49 +02:00
Jouni Malinen
52ec1aebe5 tests: hostapd adding vendor elements to Beacon/Probe Response frames
This verifies that the configuration parameter vendor_elements works
correctly.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:42:41 +02:00
Jouni Malinen
5c3b96eea6 tests: hostapd control interface - STATUS commands
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:39:23 +02:00
Jouni Malinen
b465f5d3a1 Remove unused hostapd_wep_key_cmp()
The only user was removed five years ago in commit
fb6d357532.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:27:58 +02:00
Jouni Malinen
76a30196ad tests: PMKSA cache and Chargeable-User-Identity
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-10 00:51:14 +02:00
Jouni Malinen
4fb363c62b Fix error path handling on radius_accept_attr
This error path must not try to free the user entry since that entry was
already added to the BSS list and will be freed when BSS is freed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-10 00:44:26 +02:00
Jouni Malinen
8b56743ef7 tests: Displayable message in EAP Request-Identity
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-10 00:27:15 +02:00
Jouni Malinen
7c50093f37 tests: Authenticator-initiated EAP reauthentication
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-10 00:18:49 +02:00
Jouni Malinen
390b92913a TLS testing: Allow hostapd to be used as a TLS testing tool
The internal TLS server implementation and RADIUS server implementation
in hostapd can be configured to allow EAP clients to be tested to
perform TLS validation steps correctly. This functionality is not
included in the default build; CONFIG_TESTING_OPTIONS=y in
hostapd/.config can be used to enable this.

When enabled, the RADIUS server will configure special TLS test modes
based on the received User-Name attribute value in this format:
<user>@test-tls-<id>.<rest-of-realm>. For example,
anonymous@test-tls-1.example.com. When this special format is used, TLS
test modes are enabled. For other cases, the RADIUS server works
normally.

The following TLS test cases are enabled in this commit:
1 - break verify_data in the server Finished message
2 - break signed_params hash in ServerKeyExchange
3 - break Signature in ServerKeyExchange

Correctly behaving TLS client must abort connection if any of these
failures is detected and as such, shall not transmit continue the
session.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 18:47:09 +02:00
Jouni Malinen
994afe3390 RADIUS server: Allow TLS implementation add log entries
This allows the internal TLS implementation to write log entries to the
same authlog with rest of the RADIUS server and EAP server
functionality.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 18:21:13 +02:00
Jouni Malinen
01f7fe10ef RADIUS server: Allow EAP methods to log into SQLite DB
This extends RADIUS server logging capabilities to allow EAP server
methods to add log entries.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-09 18:21:13 +02:00
Jouni Malinen
8a57da7e28 RADIUS server: Add option for storing log information to SQLite DB
If eap_user_file is configured to point to an SQLite database, RADIUS
server code can use that database for log information.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-09 18:21:13 +02:00
Jouni Malinen
f3ef7a2640 TLS client: Send decrypt_error on verify_data validation error
Previously, this was silently dropped which left the connection waiting
for timeout. decrypt_error alert can be used here to avoid that.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 18:21:13 +02:00
Jouni Malinen
129b9b991a TLS: Share a helper function for verifying Signature
This same design is used in both the server and the client roles in the
internal TLS implementation. Instead of duplicated implementation, use a
helper function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 17:11:58 +02:00
Jouni Malinen
6531963584 TLS: Use a helper function for calculating ServerKeyExchange hash
Instead of separate server and client side implementations, use a common
set of helper functions for calculating the ServerParams hash for
ServerKeyExchange.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 16:26:27 +02:00
Jouni Malinen
65074a2a7c TLS: Add support for DHE-RSA cipher suites
This extends the internal TLS implementation to support DHE-RSA
cipher suites in both server and client roles.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 15:43:50 +02:00
Jouni Malinen
41ebfe97ec TLS server: Enable SHA256-based cipher suites
The SHA256-based RSA-AES-128/256 cipher suites were already implemented
and enabled for the internal TLS client, but they had not been enabled
for the server.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 11:57:05 +02:00
Jouni Malinen
daf3806d1d tests: Protocol tests for unexpected/invalid GO Neg Resp
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 01:18:42 +02:00
Jouni Malinen
9e423774d3 tests: Fix a typo in check_p2p_response error path
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 01:18:42 +02:00
Jouni Malinen
e2a9fa34bb tests: Simultaneous GO Neg initiation
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 01:18:42 +02:00
Jouni Malinen
9a19cc0807 tests: RADIUS interim accounting update
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 01:18:42 +02:00
Jouni Malinen
403548350a tests: Non-compliant reject-by-user indication in GO Neg Req
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-08 23:00:10 +02:00