Commit graph

14731 commits

Author SHA1 Message Date
Jouni Malinen
c4193b9aa5 WPS: Fix a typo in a comment (use full WPA2-Personal name)
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-26 20:01:34 +03:00
Masashi Honma
6749c67564 tests: Fix ap_vht_use_sta_nsts false negative by using common finalizer
ap_vht_use_sta_nsts fails with this message.

---------------
wlan0: Country code not reset back to 00: is FI
wlan0: Country code cleared back to 00
---------------

This patch fixes the issue.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2019-06-23 18:03:51 +03:00
Masashi Honma
f3df00545e tests: Fix ap_vht_capab_not_supported false negative by using common finalizer
ap_vht_capab_not_supported fails with this message.

---------------
wlan0: Country code not reset back to 00: is FI
wlan0: Country code cleared back to 00
---------------

This patch fixes the issue.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2019-06-23 18:03:51 +03:00
Masashi Honma
3074cb1fd6 tests: Fix ap_vht80c/d false negative by using common finalizer
ap_vht80c/d fails with this message.

---------------
wlan0: Country code not reset back to 00: is FI
wlan0: Country code cleared back to 00
---------------

This patch fixes the issue.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2019-06-23 18:03:51 +03:00
Masashi Honma
8baf285c9f tests: Fix dfs_radar2 false negative by using common finalizer
dfs_radar2 fails with this message.

---------------
wlan0: Country code not reset back to 00: is FI
wlan0: Country code cleared back to 00
---------------

This patch fixes the issue.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2019-06-23 18:03:51 +03:00
Sven Eckelmann
3459c54ac7 mesh: Add support for HE mode
Mesh points can partially support HE features (when requiring no
controlling STA/AP) as long as hardware supports it. The kernel just
requires support for HE mesh and wpa_supplicant can forward the peer
capabilities to the kernel for further processing.

Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-23 18:03:51 +03:00
Sven Eckelmann
29d8bd1dec nl80211: Add driver multi iftype HE capability parsing
The HE capabilities are no longer per PHY but per iftype on this
specific PHY. It is therefore no longer enough to just parse the AP
capabilities.

The he_capabilities are now duplicated to store all information for
IEEE80211_MODE_* which hostap cares about. The nl80211 driver fills in
this information when the iftype supports HE. The rest of the code still
only uses the IEEE80211_HE_AP portion but can be extended later to also
use other HE capabilities.

Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-23 18:03:51 +03:00
Sven Eckelmann
f74618cb92 wpa_supplicant: Fix type for ssid->mode comparisons
The ssid->mode is from type enum wpas_mode and all its constants start
with WPAS_MODE_*. Still some of the code sections used the
IEEE80211_MODE_* defines instead of WPAS_MODE_*.

This should have no impact on the actual code because the constants for
INFRA, IBSS, AP and MESH had the same values.

Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-23 18:03:51 +03:00
Andrei Otcheretianski
a00ace9fd7 AP: Simplify "i" definition in hostapd_config_free_bss()
Declare the variable only once and reuse it instead of openning
unneeded scopes.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2019-06-23 18:03:51 +03:00
Amit Khatri
30bbff142d DPP: Fix documentation to include operating class for URI
As per code dpp_parse_uri_chan_list() function checks "/" as separator
for operating class and operating channel. Update readme accordingly.

Signed-off-by: Amit Khatri <amit7861234@gmail.com>
2019-06-22 20:39:39 +03:00
Sven Eckelmann
29f8556189 HE: Fix HE capability check for PPE threshold present
The the mask for PPE threshold present in the HE phy capability byte 6 is
0x80 and not 0x6. This incorrect mask breaks the length calculation and as
result the acceptance of the HE capabilities for STAs which either:

* don't have the PPE threshold present bit set AND the Codebook Size={7,5}
  MU Feedback or the Triggered SU Beamforming feedback bit set

* do have the PPE threshold present set AND neither the Codebook Size={7,5}
  MU Feedback nor the Triggered SU Beamforming feedback bit set

Fixes: 8f5fc369e2 ("HE: Fix HE Capabilities element variable length encoding")
Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-22 20:35:26 +03:00
Jouni Malinen
e1e203c800 libtommath: Make sure fast_s_mp_mul_digs initializes the W[] array
Some compilers have started to warn about this and the use of two loops
with ix 0..pa-1 and 0..pa loop a bit suspicious, so better make sure the
array is initialized with zeros before extracting the terms from it.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-22 18:56:44 +03:00
Jouni Malinen
702cc6da1a TLS: Move ASN.1 DER BOOLEAN validation into generic ASN.1 parsing
This does not need to be specific to X.509, so move the BOOLEAN DER
encoding validation into asn1_get_next() to make it apply for all cases
instead of having to have the caller handle this separately.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-22 18:56:44 +03:00
Jouni Malinen
34c1b75c82 TLS: Only allow 0xff value as TRUE for ASN.1 DER encoded BOOLEAN
While BER encoding allows any nonzero value to be used for TRUE, DER is
explicitly allowing only the value 0xff. Enforce this constraint in
X.509 parsing to be more strict with what is acceptable.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-22 18:27:36 +03:00
Jouni Malinen
5e6ab36df8 tests: Add X.509v3 parsing example with invalid BasicConstraints
This is a regression test based on an input data from OSS-Fuzz.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-22 18:15:22 +03:00
Jouni Malinen
ce11c281ad TLS: Fix X.509v3 BasicConstraints parsing
Handling of the optional pathLenConstraint after cA was not done
properly. The position after cA needs to be compared to the end of the
SEQUENCE, not the end of the available buffer, to determine whether the
optional pathLenConstraint is present. In addition, when parsing
pathLenConstraint, the length of the remaining buffer was calculated
incorrectly by not subtracting the length of the header fields needed
for cA. This could result in reading couple of octets beyond the end of
the buffer before rejecting the ASN.1 data as invalid.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15408
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-06-22 18:11:24 +03:00
Jouni Malinen
df5dc87873 tests: sigma_dut and UOSC when CA is not trusted
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-20 23:46:46 +03:00
Jouni Malinen
84db90e484 OpenSSL: Send cert event for the peer even on CA cert failure
This adds a CTRL-EVENT-EAP-PEER-CERT even for depth=0 even if a depth >
0 certificate results in peer certificate validation error. Previously,
this case resulted in the upper layers not getting any information about
the used peer certificate. Now that information is available, e.g., to
allow server certificate -based overriding of the trust to be done.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-20 23:44:51 +03:00
Purushottam Kushwaha
e17ef1e9cb wpadebug: Allow WebView to parse and load clear text (HTTP)
Recent Android version doesn't allow cleartext parsing by WebView by
default:

Error message: ERR_CLEARTEXT_NOT_PERMITTED.

To resolve this wpadebug need to have following updated under
application definition of AndroidManifest.xml
 - android:usesCleartextTraffic="true"

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-20 00:33:43 +03:00
Jouni Malinen
09448d94a7 Avoid use of a shadowed local variable
The same len variable can be used for both needs within
ieee802_1x_get_keys() to avoid compiler warning about use of shadowed
variable.

Fixes: 0ee6885dae ("macsec: Store EAP-Key-Name as eapSessionId")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-19 01:17:54 +03:00
Liangwei Dong
ef60f0121f hostapd: Process OWE IE and update DH IE to the driver if needed
This implements the required functionality in hostapd to facilitate OWE
connection with the AP SME-in-driver cases. Stations can either send DH
IE or PMKID (in RSNE) (or both) in Association Request frame during the
OWE handshake. The drivers that use this offload mechanism do not
interpret this information and instead, pass the same to hostapd for
further processing. hostapd will either validate the PMKID obtained from
the STA or generate DH IE and further indicate the same to the driver.
The driver further sends this information in the Association Response
frame.

Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
Signed-off-by: Liangwei Dong <liangwei@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Liangwei Dong
d1836e2308 nl80211: Introduce the interface to update new DH IE
This command/event interface can be used by SME based host drivers that
rely on user space (hostapd/wpa_supplicant) for DH IE
processing/generation. This interface facilitates the OWE connection
with host drivers by offloading DH IE processing to the user space
(hostapd/wpa_supplicant).

Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
Signed-off-by: Liangwei Dong <liangwei@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Purushottam Kushwaha
dcc31e7957 HS 2.0: Skip credential without EAP method for roaming consortium match
EAP method is required for a credential that matches configured
roaming_consortium with an Interworking AP. Hence skip credentials which
do not have EAP method specified for this match. This fixes an issue
where a credential that cannot work without EAP method from NAI Realms
information is selected first based on roaming consortium.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Jouni Malinen
4fc5c00c78 tests: Specify EAP type in ap_hs20_set_profile_failures
Matching with roaming_consortium requires EAP type to be specified to
work for the connection. This test case was not really testing the
connection part, so this has not been much of an issue in the past, but
in preparation for the matching rules to start filtering out invalid
credential configurations from selection, the EAP type needs to be
explicitly set here.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Jouni Malinen
20eba39b51 tests: WNM BSS Transition Management disabled
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Ankita Bajaj
ef59f98729 WNM: Provide option to disable/enable BTM support in STA
Add support to disable/enable BTM support using configuration and
wpa_cli command. This is useful mainly for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:51 +03:00
Jouni Malinen
4068d683f5 tests: sigma_dut server certificate validation with UOSC/TOD
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:50 +03:00
Jouni Malinen
3539738cf5 OpenSSL: Report peer certificate before stopping due to validation issue
This is needed to allow upper layer software to learn the hash of the
server certificate for allowing user to override trust root
configuration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:50 +03:00
Jouni Malinen
1363fdb283 tests: EAP-TLS server certificate validation and TOD
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:50 +03:00
Jouni Malinen
21f1a1e66c Report TOD policy in peer certificate events
Add tod=1 to CTRL-EVENT-EAP-PEER-CERT events if the peer certificate
includes the TOD policy in the X.509v3 Certificate Policies extension.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:50 +03:00
Jouni Malinen
bc0634da4a Pass full struct to peer certificate callbacks
This makes it easier to add new information to the callbacks without
having to modify each callback function type in EAPOL and EAP code every
time.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-14 23:10:50 +03:00
Jouni Malinen
82b9de98c3 tests: Add a server certificate with TOD policy
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-12 22:29:09 +03:00
Jouni Malinen
8a3368d7f4 tests: sigma_dut and DPPConfIndex,8
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-12 22:29:09 +03:00
Jouni Malinen
b3c43c3c24 wlantest: Allow duplicate frame processing after decryption failure
If a sniffer capture does not include FCS for each frame, but may
included frames with invalid FCS, it would be possible for wlantest to
try to decrypt the first received frame and fail (e.g., due to CCMP MIC
mismatch) because that particular frame was corrupted and then ignore
the following retry of that frame as a duplicate even if that retry has
different payload (e.g., if its reception did not show corruption).

Work around this by skipping duplicate frame detection immediately
following a decryption failure.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-12 22:27:34 +03:00
Jouni Malinen
a6ed414c82 TLS: Be more careful in X.509 Time parsing
sscanf() can apparently read beyond the end of the buffer even if the
maximum length of the integer is specified in the format string. Replace
this parsing mechanism with helper functions that use sscanf() with NUL
terminated string to avoid this.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15158
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-11 06:34:19 +03:00
Jouni Malinen
d438b4a3ce tests: Fix CFLAGS passing for new fuzzing tools
src/*/Makefile needs to allow additional CFLAGS values to be provided
from the calling Makefiles so that the clang command line arguments to
enable sanitizers consistently. In addition, it can be useful to be able
to provide CC, CFLAGS, and LDFLAGS from external setup while still
requesing LIBFUZZER=y build. Allow that by not overriding these
variables if they are already set.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-11 06:34:19 +03:00
Jouni Malinen
009c4d79d3 tests: Fix eapol-key-auth memory use for the callback pointer struct
This struct needs to remain valid through the lifetime of the
authenticator state machine, so move it to the context struct instead of
being a local stack variable inside the setup function that returns
before the actual test functionality is executed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-07 23:54:20 +03:00
Vamsi Krishna
9c7e4f94de Add a QCA vendor attr to disable auto resume beacon reporting
The driver automatically starts beacon reporting if it pauses the beacon
reporting for any reason other than disconnection. In specific cases,
userspace may not want the beacon reporting to be automatically resumed
after a pause. Add interface support for userspace to specify driver not
to start beacon reporting automatically after a pause.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-05 23:10:56 +03:00
Jouni Malinen
7deb0450bc Interworking: Print HESSID in debug messages
This makes it easier to understand ANQP queries needed during
Interworking network selection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-05 21:09:57 +03:00
Jouni Malinen
ea27fcff61 tests: Skip mesh_link_probe if kernel support not present
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:30:51 +03:00
Jouni Malinen
41bca92662 tests: MACsec with hostapd
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:27:44 +03:00
Jouni Malinen
abe025dd31 tests: Shorter TX/RX test frame support for hostapd
wpa_supplicant already included support for this, but hostapd
DATA_TEST_* commands did not yet have support for using a shorter test
frame. This is needed for MACsec testing.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:27:44 +03:00
Jouni Malinen
59fcb3f0b1 RADIUS server: Add EAP-Key-Name into Access-Accept
If the EAP Session-ID is available, add it into Access-Accept
(EAP-Key-Name attribute). This is needed for MACsec.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:27:44 +03:00
Jouni Malinen
b09670abfb macsec_linux: Hook QCA driver wrapper for hostapd MACsec
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:27:44 +03:00
Jouni Malinen
524dc5bf10 macsec: Do not change eapol_version for non-MACsec cases in hostapd
It is safer to maintain the old EAPOL version (2) in EAPOL frames that
are not related to MACsec and only update the version to 3 for the
MACsec specific cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-06-03 20:27:44 +03:00
leiwei
a93b369c17 macsec: Support IEEE 802.1X(EAP)/PSK MACsec Key Agreement in hostapd
Signed-off-by: leiwei <leiwei@codeaurora.org>
2019-06-03 20:27:44 +03:00
leiwei
a872bfcf31 macsec: Export eapSessionId
Signed-off-by: leiwei <leiwei@codeaurora.org>
2019-06-03 20:27:44 +03:00
leiwei
0ee6885dae macsec: Store EAP-Key-Name as eapSessionId
Signed-off-by: leiwei <leiwei@codeaurora.org>
2019-06-03 20:27:44 +03:00
leiwei
a90cc1c997 macsec: Note that MKA takes care of EAPOL-MKA processing
Signed-off-by: leiwei <leiwei@codeaurora.org>
2019-06-03 20:27:44 +03:00
leiwei
3e21a47eab macsec_qca: Hook QCA driver wrapper for hostapd MACsec
Signed-off-by: leiwei <leiwei@codeaurora.org>
2019-06-03 20:27:44 +03:00