Commit graph

13347 commits

Author SHA1 Message Date
Dan Harkins
d52ead3db7 EAP-pwd server: Add support for salted password databases
These changes add support for salted password databases to EAP-pwd per
RFC 8146. This commits introduces the framework for enabling this and
the salting mechanisms based on SHA-1, SHA256, and SHA512 hash
algorithms.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 22:08:51 +03:00
Dan Harkins
a8712ce5b3 EAP-pwd: Pre-processing method definitions from RFC 8146
Add new password pre-processing method definitions in preparation for
salted passwords with EAP-pwd.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 17:15:07 +03:00
Dan Harkins
2a5c291881 EAP-pwd: Move EC group initialization to earlier step
This is needed for adding support for salted passwords.

Signed-off-by: Dan Harkins <dharkins@lounge.org>
2018-05-28 17:15:07 +03:00
Sachin Ahuja
b829e4b694 Add a QCA vendor command attribute to enable/disable GTX
This commit adds a new vendor command attribute
QCA_WLAN_VENDOR_ATTR_CONFIG_GTX in
QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION to enable/disable green
Tx power saving feature.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-24 18:47:48 +03:00
Jouni Malinen
62566bc23d tests: WPA2-EAP-FT AP changing from 802.1X-only to FT-only
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-21 22:24:36 +03:00
Jouni Malinen
833bb2ab15 FT: Disable PMKSA caching with FT
PMKSA caching with FT is not fully functional, so disable the case for
now, so that wpa_supplicant does not end up trying to connect with a
PMKSA cache entry from another AKM. FT-EAP was already modified long
time ago to not add PMKSA cache entries itself.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-21 22:18:50 +03:00
Lior David
91db940ff0 fst: Fix compile error in fst_ctrl_aux.h with C++ compilers
Move enum fst_reason to be a top level type, since it is used as
argument in the function fst_reason_name() and having it as nested
type caused a compile error when fst_ctrl_aux.h was included from
a C++ source file.

Signed-off-by: Lior David <liord@codeaurora.org>
2018-05-21 17:47:03 +03:00
Jouni Malinen
9a0ae89d62 tests: SAE with Password Identifier
This verifies SAE Password Identifier functionality in both the
infrastructure and mesh BSS cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:30:29 +03:00
Jouni Malinen
9be19d0b9c SAE: Add support for using the optional Password Identifier
This extends the SAE implementation in both infrastructure and mesh BSS
cases to allow an optional Password Identifier to be used. This uses the
mechanism added in P802.11REVmd/D1.0. The Password Identifier is
configured in a wpa_supplicant network profile as a new string parameter
sae_password_id. In hostapd configuration, the existing sae_password
parameter has been extended to allow the password identifier (and also a
peer MAC address) to be set. In addition, multiple sae_password entries
can now be provided to hostapd to allow multiple per-peer and
per-identifier passwords to be set.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:30:29 +03:00
Jouni Malinen
d6a65a83fb mesh: Register msg_ctx for hostapd/AP code
The use of hostapd code for a mesh interface did not register
hapd->msg_ctx. This needs to be done similarly to the existing cases in
wpa_supplicant AP and IBSS mode uses so that wpa_msg() calls from the
hostapd/AP code get delivered properly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:22:48 +03:00
Naveen Rawat
4e47eec5a9 Add QCA NAN vendor attributes to provide IPv6 information
Add NAN attributes to communicate IPv6 address, port, and protocol
between wifihal and host driver.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:10:15 +03:00
Jouni Malinen
6bf7a54754 tests: Brainpool curves in ap_wpa2_eap_pwd_groups with OpenSSL 1.1.x
The OpenSSL version check should not have been limited to 1.0.2 only.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:03:25 +03:00
Jouni Malinen
9973129646 wolfSSL: Fix crypto_bignum_rshift() wrapper
The n argument to this function is number of bits, not bytes, to shift.
As such, need to use mp_rshb() instead of mp_rshd(). This fixes EAP-pwd
with P-521 curve.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-17 22:02:02 +03:00
Sean Parkinson
4b2e03c42a wolfSSL: DH initialization to call TEST_FAIL() for error tests
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-17 20:08:22 +03:00
Sean Parkinson
2b01270c8a wolfSSL: Fix ECDH set peer to use the index when importing point
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-17 20:08:15 +03:00
Jouni Malinen
ffff7f7095 OWE: Mark connection failed in the unlikely no-bss-entry case
If no BSS entry can be found when processing association rejected event
from the driver for the special OWE case of unsupported
finite-cyclic-group, process the event as a connection failure instead
of just skipping the the OWE retry with another DH group.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 19:01:23 +03:00
Jouni Malinen
0cc41ee635 Move wpa_supplicant_event() EVENT_ASSOC_REJECT handling into a function
This cleans up the implementation a bit by making this functionality
easier to understand.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 18:52:17 +03:00
Jouni Malinen
27fa11615b tests: Additional VHT channel switch testing
Enable/disable VHT with CHAN_SWITCH.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Sathishkumar Muruganandam
bda9c08596 hostapd: Fix CHAN_SWITCH command for VHT20 and VHT40
Previously, hostapd CHAN_SWITCH command did not effect VHT configuration
for the following:

When VHT is currently disabled (ieee80211ac=0),

1. hostapd_cli -p /var/run/hostapd chan_switch 10 5180 \
                sec_channel_offset=1 center_freq1=5190 bandwidth=40 ht

====> Comes up in HT40

2. hostapd_cli -p /var/run/hostapd chan_switch 10 5765 \
                sec_channel_offset=-1 center_freq1=5775 bandwidth=40 vht

====> Comes up in HT40

3. hostapd_cli -p /var/run/hostapd chan_switch 10 5200 center_freq1=5200 \
                                                  bandwidth=20 vht

====> Comes up in HT20

When VHT is currently enabled (ieee80211ac=1),

1. hostapd_cli -p /var/run/hostapd chan_switch 10 5180 \
                sec_channel_offset=1 center_freq1=5190 bandwidth=40 ht

====> Comes up in VHT40

2. hostapd_cli -p /var/run/hostapd chan_switch 10 5200 center_freq1=5200 \
                                                  bandwidth=20 ht

====> Comes up in VHT20

This is since VHT config from chan_switch is processed only for
bandwidths 80 and above (80P80, 160) and for VHT20, VHT40 cases, only
NLA chan type and chan width are updated.

There is no NL attribute for determining if it is HT or VHT for
bandwidths 20 & 40 and currently they are updated as HT20, HT40 (+ or -
depending on offset). Same is notified back via
NL80211_CMD_CH_SWITCH_NOTIFY.

Instead of adding new NL attribute for tracking HT/VHT enabled config,
we are adding new hostapd VHT config parameter to save the chan_switch
config and use only for chan_switch case of VHT20 and VHT40.

Tested with all combinations of chan_switch (noHT->20->40->80->) HT/VHT
and confirmed to be working.

Signed-off-by: Sathishkumar Muruganandam <murugana@codeaurora.org>
2018-05-16 01:16:54 +03:00
Srinivas Dasari
16d5c9637c OWE: Get the bss from bssid of assoc_reject to try for next group
On an assoc_reject from the BSS with the status=77, a connection attempt
with the next supported group happens. The BSS considered here is from
current_bss which may be NULL at this point of time with SME-in-driver
case. Address this by getting the BSS from the bssid obtained in
association reject indication and skip the step if no BSS entry can be
found.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Karthikeyan Periyasamy
c4dd3afa3c ACS: Avoid invalid interference factor when survey channel time is zero
When the channel time is zero the interference factor calculation falls
under divide by zero operation which results in invalid (NaN =
not-a-number) interference factor value. This leads to wrong ideal
channel selection in ACS during the scenario described below.

Scenario:

In VHT80 mode, the channel 36 (first channel) gets the channel time as
zero which causes the interfactor factor to be an invalid number (NaN).
Any operations (like addition, mulitplication, divide, etc.) with NaN
value results in a NaN value, so that average factor for the primary
channel 36 got the invalid value (NaN). Since channel 36 is the first
channel, ideal factor is assigned as NaN in the first iteration. The
following iteration condition check (factor < ideal_factor) with a NaN
value fail for all other primary channels. This results in channel 36
being chosen as the ideal channel in ACS which holds a NaN value.

Logs:

ACS: Survey analysis for channel 36 (5180 MHz)
ACS: 1: min_nf=-103 interference_factor=nan nf=0 time=0 busy=0 rx=0
ACS: 2: min_nf=-103 interference_factor=0.615385 nf=-102 time=13 busy=8 rx=0
ACS: 3: min_nf=-103 interference_factor=2.45455 nf=0 time=22 busy=16 rx=0
ACS: 4: min_nf=-103 interference_factor=0.785714 nf=-103 time=42 busy=33 rx=0
ACS: 5: min_nf=-103 interference_factor=nan nf=0 time=0 busy=0 rx=0
ACS:  * interference factor average: nan
...
ACS:  * channel 36: total interference = nan
..
ACS:  * channel 149: total interference = 5.93174e-21
..
ACS: Ideal channel is 36 (5180 MHz) with total interference factor of nan

Signed-off-by: Karthikeyan Periyasamy <periyasa@codeaurora.org>
2018-05-16 01:16:54 +03:00
Jeff Johnson
6965705bf5 Fix style issues in qca-vendor.h
Over time a number of style issues have crept into qca-vendor.h,
so fix most of them. There are some identifiers and comments which
exceed 80 columns, but these are left as-is for readability.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Kiran Kumar Lokere
7d66e7c408 Define new QCA feature flag for self managed regulatory support
This can be used to determine which mechanism to use for configuring
country code from trusted sources.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Kiran Kumar Lokere
38f60142d2 Define test config vendor attribute for Tx beamformee configuration
Add a new wifi test config QCA vendor attribute to configure Tx
beamformee in the driver. This is used for testbed configuration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Srinivas Dasari
d109aa6cac SAE: Flush PMKSA if an assoc reject without timeout is received
Flush the PMKSA upon receiving association reject event without timeout
in the event data in SME-in-driver case to avoid trying to use the old
PMKSA entry in subsequent connection attempts. Do not flush PMKSA if
association reject is received with timeout as it is generated
internally from the driver without reaching the AP. This is similar to
the SME-in-wpa_supplicant case that was already addressed within
sme_event_assoc_reject().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Jouni Malinen
46053a4c93 wext: Avoid gcc warnings on restricted pointer aliasing
The first two parameters to readlink() are marked restricted and at
least gcc 8.2 warns about used the same pointer for then, so avoid this
by using separate buffers for the pathname and response buffer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:54 +03:00
Jouni Malinen
ce2a9644bd Silence a gcc warning on switch statement fallthrough
Add an explicit comment noting a previously undocumented fallthrough to
not trigger an implicit-fallthrough warning.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-16 01:16:35 +03:00
Jouni Malinen
d267bdf9bd Silence new gcc warnings on switch statement fallthroughs
Reword the comments to make gcc 8.1 recognize these as designed cases
and not trigger implicit-fallthrough warnings.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-15 20:55:17 +03:00
Jouni Malinen
79467d74fd tests: Fix dbus_tdls_channel_switch with missing kernel support
Check driver capabilities in the D-Bus TDLS case similarly to the
non-D-Bus cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-15 00:38:13 +03:00
Jouni Malinen
23c024b9c1 tests: Do not fail if driver supports power saving
Couple of "invalid value" tests started to fail now that mac80211_hwsim
actually accepts power save configuration. Fix these by running the same
command for more code coverage, but in a way that ignores the result of
the operation (succeeds with older kernel versions and fails with
newer).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-04 23:56:32 +03:00
Ahmad Masri
60a5737e8f FT: Clear SME FT data on disassoc
SME ft_used flag is sometimes not cleared on disassoc. For example,
after initial FT connection, ft_used is set while ft_ies stays NULL.
Later on, upon disassoc, sme_update_ft_ies() is not invoked and ft_used
is not cleared. Fix this by invoking sme_update_ft_ies() also in case
ft_used is set.

This is needed to fix an issue with drivers that use nl80211 Connect API
with FT and expect to the NL80211_AUTHTYPE_OPEN specified in the Connect
command for the initial mobility domain association.

Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
2018-05-04 20:56:52 +03:00
Edayilliam Jayadev
98b806b03d Add QCA vendor attribute for spectral hardware generation
Add spectral hardware generation attribute to
QCA_NL80211_VENDOR_SUBCMD_SPECTRAL_SCAN_GET_CAP_INFO vendor command.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-04 20:44:05 +03:00
Bhagavathi Perumal S
d57e06170b wpa_supplicant: Make channel switch event available for non-AP builds
This allows user to get channel switch indication in station mode even
if wpa_supplicant is built without CONFIG_AP=y.

Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org>
2018-05-04 20:31:23 +03:00
Jouni Malinen
f98fdc4e4b tests: wpa_supplicant STATUS output and ieee80211ac=1
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-04 20:19:17 +03:00
Bhagavathi Perumal S
d7f038ded2 wpa_supplicant: Add ieee80211ac information in STATUS
This allows user to get current operating mode of station.

Signed-off-by: Bhagavathi Perumal S <bperumal@codeaurora.org>
2018-05-04 20:18:55 +03:00
Jouni Malinen
585e728a5c tests: Skip OCSP tests with wolfSSL
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-02 13:32:51 +03:00
Sean Parkinson
ab35793ec1 wolfSSL: Fix EAP-FAST key derivation
Implement tls_connection_get_eap_fast_key() using cryptographic
primitives as wolfSSL implements different spec.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
71faf06cb6 wolfSSL: Do not free cert store after setting it
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
b7f5b0ec65 wolfSSL: Fix OCSP ifdefs
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
ca620a3642 wolfSSL: Fix altSubjectName handling
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
7be462084e wolfSSL: Use defines from wolfssl/options.h
Depend on proper wolfSSL configuration instead of trying to define these
build configuration values externally.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
3122121746 wolfSSL: Remove aes-omac1.o from hostapd build
Avoid duplicated omac1_*() functions when building hostapd with wolfSSL.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
385dd7189a wolfSSL: Use wolfSSL memory allocation in dh5_init()
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
6590d84664 wolfSSL: Load certificates using 'chain' APIs
This allows the full chain to be loaded.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
fc5e88e3ea wolfSSL: Changes for memory allocation failure testing
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
06657d3166 wolfSSL: Fix crypto_hash_init() memory clearing
Explicitly clear the allocated memory to avoid uninitialized data in
struct crypto_hash.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
d396057109 wolfSSL: Fix crypto_ec_point_y_sqr()
Use the correct intermediate result from mp_sqrmod() in the following
mp_mulmod() call (t is not initialized here; it is used only after this
step).

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
e3501ac18f wolfSSL: Fix crypto_ec_point_solve_y_coord()
Provide full uncompressed DER data length to wc_ecc_import_point_der()
even though a compressed form is used here. In addition, use
ECC_POINT_COMP_* defined values to make this more readable.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:51 +03:00
Sean Parkinson
187ad3a303 wolfSSL: Add crypto_ecdh_*()
Implement the wrapper functions for ECDH operations.

Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 13:32:49 +03:00
Sean Parkinson
3d2f638d61 wolfSSL: Use new digest namespace
Signed-off-by: Sean Parkinson <sean@wolfssl.com>
2018-05-02 12:04:46 +03:00