Commit graph

4266 commits

Author SHA1 Message Date
Jouni Malinen
be87d3c345 wlantest: Allow GHASH update calls to avoid extra allocation
There is no need to allocate a temporary buffer and build GHASH input
data into it. Instead, ghash() is trivial to split into update part that
can be called separately for each segment.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 23:40:06 +03:00
Jouni Malinen
b4a5fcb286 wlantest: Remove CCMP specific AAD handling from GCMP
GCMP encodes length of AAD differently, so remove the unnecessary
code that got copied from the CCMP implementation.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 22:10:05 +03:00
Jouni Malinen
37c8fe2e3b wlantest: Move GCM-AE and GCM-AD into separate functions
This splits the more generic GCM operations from GCMP specific
implementation.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 22:08:00 +03:00
Jouni Malinen
455bcc0f5c wlantest: Add GCMP implementation and test vectors from P802.11ad/D9.0
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 20:00:54 +03:00
Jouni Malinen
5a652e71b0 wlantest: Check TKIP/CCMP decryption routines for test vectors
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 17:08:53 +03:00
Jouni Malinen
7d68241d3e wlantest: Add IEEE Std 802.11-2012, M.9.1 BIP test vector
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 17:08:53 +03:00
Jouni Malinen
a9eae7efe3 wlantest: Move BIP function into a separate function and file
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 17:08:53 +03:00
Jouni Malinen
6522984086 wlantest: Add IEEE Std 802.11-2012, M.9.2 CCMP (mgmt) test vector
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 16:44:37 +03:00
Jouni Malinen
3ae8968679 wlantest: Add program for generating IEEE 802.11 test vectors
This version can generate CCMP and TKIP test vectors that match with
the IEEE Std 802.11-2012, Annex M.6.3 and M.6.4.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 16:44:37 +03:00
Jouni Malinen
729f02e149 wlantest: Implement tkip_encrypt()
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-08 14:03:10 +03:00
Arik Nemtsov
4425645113 AP: Configure basic rates from iface and not conf
The conf doesn't contain any basic rates in some cases. Most notably,
when starting a P2P GO in 5 GHz. Use the iface rates which are
initialized in hostapd_prepare_rates() to the conf rates or set to
default values if no conf values exist. This fixes a bug introduced in
commit e5693c4775.

Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-09-07 00:22:40 +03:00
Jouni Malinen
f0898e9519 Make copies basic_rates list more useful
Commit e5693c4775 added a copy of the
determined basic rate set into struct hostapd_iface, but did not
actually copy the terminating -1 value. This could be problematic if
something were to actually try to use this list since would be no way to
know what is the last entry in the list. Fix this by copying the
terminating value.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-07 00:15:53 +03:00
Baruch Siach
ac947e2a83 atheros: Fix RSN capabilities debug print
Signed-hostap: Baruch Siach <baruch@tkos.co.il>
2012-09-05 19:01:11 +03:00
Jouni Malinen
d732463c47 nl80211: Register read_sta_data() handler for station only builds
This driver_op can now be used in station mode, too, to fetch
information about the connection with the AP, so allow this to be used
even if wpa_supplicant is built without AP mode support.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-05 17:07:03 +03:00
Yuhao Zheng
dc7785f845 wpa_supplicant: Add PKTCNT_POLL command to get TX/RX packet counters
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2012-09-05 17:02:02 +03:00
Jouni Malinen
a05126d620 WFD: Properly match group for WFD element in Invitation Response
The group matching should be done by comparing the P2P Interface Address
(which the group_bssid here is) to the group's BSSID and not the group
ID (which uses P2P Device Address and would have also needed the SSID).
Though, it should be noted that this case cannot really happen since a
GO in an active group would never be invited to join another group in
its GO role (i.e., if it receives an Invitation Request, it will reply
in P2P Device role). As such, this fix does not really change any
observable behavior, but anyway, it is good to keep the implementation
here consistent with the Invitation Request case.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-05 16:39:19 +03:00
Jouni Malinen
0e9c66c22d WFD: Properly match group for WFD element in Invitation Request
When building the Invitation Request for WFD use cases, match the BSSID,
i.e., P2P Interface Address, of the group on the GO to avoid using
information from another group should the device be operating multiple
concurrent groups as GO.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-05 16:29:44 +03:00
Jouni Malinen
53c9fc1df6 Interworking: Share ANQP data within homogenous ESS
If two BSS entries have the same HESSID and SSID, share the fetched ANQP
information between these BSS entries to save memory and GAS/ANQP
operations.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-04 17:22:42 +03:00
Jouni Malinen
c739d7e968 Interworking: Store HESSID in BSS entry
This makes it more convenient to match BSS entries that belong to the
same homogenous ESS.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-04 17:08:58 +03:00
Jouni Malinen
7e414b21c2 Interworking: Allow EAP-SIM/AKA/AKA' override in cred block
The eap parameter in the cred block can now be used to override
automatic EAP-SIM/AKA/AKA' selection.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-04 16:50:52 +03:00
Jouni Malinen
476aed355a Interworking: Move BSS ANQP information into separate struct
This is an initial step in allowing the ANQP responses to be shared
among multiple BSSes if the BSSes are determined to be operating under
identical configuration.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-09-04 16:22:35 +03:00
Deepthi Gowri
59ff6653aa Fix REMOVE_NETWORK to not run operations with invalid current_ssid
If the REMOVE_NETWORK command is used to delete the currently connected
network, some operations were run between removing the network and
clearing of wpa_s->current_ssid. This left wpa_s->current_ssid pointing
to freed memory and should any operation end up using it before the
pointer gets cleared, freed memory could be references. Avoid this by
removing the network only after having completed the operations that
clear wpa_s->current_ssid.

Signed-hostap: Deepthi Gowri <deepthi@codeaurora.org>
intended-for: hostap-1
2012-09-03 11:55:38 +03:00
Jouni Malinen
7ff833674b Interworking: Fetch only the needed ANQP information
Use configured credentials to figure out which ANQP information needs to
be fetched and only fetch those when using Interworking network
selection. The fetch_anqp command is still fetching all ANQP
information.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 21:05:54 +03:00
Jouni Malinen
a594e2a9ab Interworking: Skip extra scan after network auto-select
If the scan results from before ANQP fetch are fresh (less than five
seconds old), do not run a new scan when selecting the BSS after having
used Interworking network selection.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 20:18:48 +03:00
Jouni Malinen
620c783753 Use BSS entries instead of scan results for BSS selection
This allows the BSS selection functions to be called without having the
scan result data structure. This can be used to skip extra scans in
cases where previous results can be considered fresh.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 19:56:57 +03:00
Jouni Malinen
cf8baca6a5 BSS: Add wpa_bss_get_vendor_ie_multi_beacon()
This can be used to fetch vendor IEs from Beacon frames.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 19:54:42 +03:00
Jouni Malinen
a297201df1 Maintain list of BSS entries in last scan result order
This allows last results to be used even after they have been freed
since the information is copied to the BSS entries anyway and this new
array provides the order in which scan results were processed.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 19:53:15 +03:00
Jouni Malinen
20ed5e40ba Use BSS table instead of scan results in need-to-roam determination
The same information is available in the BSS table, so we can reduce the
need for using the raw scan results in wpa_supplicant_need_to_roam().

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 17:39:35 +03:00
Jouni Malinen
e026159a8e EAP-SIM/AKA: Store pseudonym identity in configuration
Use the anonymous_identity field to store EAP-SIM/AKA pseudonym identity
so that this can be maintained between EAP sessions (e.g., after
wpa_supplicant restart) even if fast re-authentication data was cleared.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 13:04:18 +03:00
Jouni Malinen
50a7755735 EAP-SIM DB: Remove unnecessary username prefix checks
The EAP-SIM/AKA code is already validating the prefix and the following
lookup would not find matches if the prefix is incorrect, so there is no
need for the extra checks here.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 12:03:57 +03:00
Jouni Malinen
68a41bbb44 EAP-AKA server: Skip AKA/Identity exchange if EAP identity recognized
If EAP-Response/Identity includes a known pseudonym or re-auth username,
skip the AKA/Identity exchange since we already know the permanent
username of the peer.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 11:27:39 +03:00
Jouni Malinen
4309ca51b4 hlr_auc_gw: Fix unknown-IMSI determination with SQLite
Need to explicitly check that the SQL query returns a match before
returning values.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 11:24:59 +03:00
Jouni Malinen
f585c6a6d6 EAP-SIM server: Move subtype validation from check into process
This is needed to be able to use SIM-Notification round to indicate
failure per RFC 4186, chapter 6.3.3.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 01:42:05 +03:00
Jouni Malinen
c95c8b1859 EAP-SIM server: Use Notification before EAP-Failure
RFC 4186, chapter 6.3.3 mandates that EAP-Failure is used only after
Client-Error and Notification messages. Convert the direct jumps to the
FAILURE state with a notification round before sending out EAP-Failure.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 01:20:29 +03:00
Jouni Malinen
9343498989 EAP-SIM/AKA peer: Note sending of Client-Error in debug log
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 00:58:03 +03:00
Jouni Malinen
5d65ca514d EAP-SIM peer: Fix AT_COUNTER_TOO_SMALL use
The AT_NONCE_S value needs to be used in AT_MAC calculation for
SIM/Re-authentication response even if re-authentication is rejected
with AT_COUNTER_TOO_SMALL.

Signed-hostap: Jouni Malinen <j@w1.fi>
intended-for: hostap-1
2012-09-02 00:39:48 +03:00
Jouni Malinen
31a3de8af3 EAP-SIM server: Add support for AT_COUNTER_TOO_SMALL
If the peer rejects re-authentication with AT_COUNTER_TOO_SMALL, fall
back to full authentication to allow the authentication session to be
completed.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-02 00:38:39 +03:00
Jouni Malinen
f24630d26a EAP-SIM DB: Use pointer to struct eap_sim_db_data instead of void*
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:48:48 +03:00
Jouni Malinen
2c22668c8f EAP-SIM DB: Add debug print for AKA reauth identity addition
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:41:23 +03:00
Jouni Malinen
60123b6430 EAP-AKA server: Remove unnecessary protocol version check
This validation is done automatically as part of the prefix value
use in the username.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:38:25 +03:00
Jouni Malinen
3e43a8ec4f EAP-SIM DB: Get rid of unnecessary wrapper functions
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:37:17 +03:00
Jouni Malinen
e95ffe0465 EAP-SIM DB: Return pseudonym username instead of structure with it
This cleans up the implemenation a bit.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:32:22 +03:00
Jouni Malinen
741596a817 EAP-SIM DB: Remove unneeded SQLite value copying
These fields are used only as the search key, so the value is already
known and does not need to be copied from the database.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:26:26 +03:00
Jouni Malinen
6d49d9ecb8 EAP-SIM DB: Store permanent username as string in SQLite DB
Store permanent username (i.e., including prefix character) instead of
IMSI in the SQLite DB. Convert the string to a string since the EAP-AKA
prefix can start with zero. This cleans up the field names since the
value was already with the prefix included instead of just IMSI. In
addition, this explicitly removes some theoretical cases where the
different identity types could have been mixed.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:22:15 +03:00
Jouni Malinen
3961dffc13 EAP-SIM DB: Rename valid_pseudonym_string to valid_db_string
This will be used with other strings, too, so use a more generic
function name.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:17:48 +03:00
Jouni Malinen
61e181db86 EAP-SIM DB: Use char* strings instead of u8* pointer and length
Since the EAP-SIM/AKA identities are ASCII strings, there is no need to
use more complex way for storing and passing them. In addition, be more
strict about enforcing username (i.e., no realm part) to be used in the
EAP-SIM DB API. Similarly, require specific username type instead of any
of the types to be used as the key in the pseudonym and reauth
operations. This allows simpler lookup operations to be used.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 21:10:19 +03:00
Jouni Malinen
4e9015a225 EAP-SIM DB: Remove unused eap_sim_db_identity_known()
This function is not used anymore, so remove it.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 20:12:40 +03:00
Jouni Malinen
8a9f58f2cc EAP-AKA server: Store permanent username in session data
This allows identity use to be cleaned up in various operations.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 20:09:07 +03:00
Jouni Malinen
ccea4fb107 EAP-AKA server: Split fullauth setup into a separate function
This is an initial cleanup step for AKA/Identity processing.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 19:37:49 +03:00
Jouni Malinen
02a0ce13bc EAP-AKA server: Require AKA/Identity response to include identity
Since we always request an identity in the request, the response
has to include AT_IDENTITY. This allows the AKA/Identity response
processing to be simplified a bit.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-01 19:23:14 +03:00