Commit graph

11762 commits

Author SHA1 Message Date
Sabrina Dubroca
0abc8d10cc drivers: Move common definitions for wired drivers out
Refactor the common parts of wired drivers code into a shared file, so
that they can be reused by other drivers. The macsec_qca driver already
contains a lot of code duplication from the wired driver, and the
macsec_linux driver would do the same. A structure to hold data common
to all wired drivers is added and used in all these drivers.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-30 19:33:43 +02:00
Sunil Dutt
bf88401d23 Add support to abort vendor scan
This commit enhances the existing implementation of abort scan to also
abort concurrent active vendor scans. This is achieved by passing the
the scan_cookie to the driver interface with the intention to abort
the specific scan request. This scan_cookie is returned from the driver
interface when the scan request is scheduled.

This scan_cookie is 0 if the scan is triggered through the upstream
cfg80211 interface. Thus, the scan_cookie is used to determine whether
to abort the cfg80211 or vendor scan request.

Also, the previous implementation of relying on scan_work/p2p_scan_work
for the active work to trigger the abort scan is enhanced to check for
the started state of either of these work operations. This should also
help to abort the concurrent active scan/p2p-scan operations.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-30 19:33:43 +02:00
Sunil Dutt
eeb34a432e nl80211: Enhance abort scan to also abort the vendor scan
This commit enhances the abort scan implementation to also abort the
vendor scan, if one was used to trigger the scan.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-30 19:33:39 +02:00
Sunil Dutt
1a793f5c2b Define a QCA vendor command to abort vendor scan
The new QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN command can be used to
abort an ongoing scan that was started with
QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-30 17:11:01 +02:00
Jouni Malinen
86f938ddea tests: PMF and Authentication frame injection
Verify that AP does not break PMF-enabled connection due to injected
Authentication frame. This is a regression test for
NL80211_FEATURE_FULL_AP_CLIENT_STATE changes resulting in dropping the
key in such a case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-29 16:26:00 +02:00
Jouni Malinen
47d74bf010 Add MGMT_RX_PROCESS test command for hostapd
This makes it easier to write hwsim test cases to verify management
frame processing sequences with dropped or modified frames. When
ext_mgmt_frame_handling is used, this new command can be used to request
hostapd to process a received a management frame, e.g., based on
information reported in the MGMT-RX events.

This is more or less identical to the earlier wpa_supplicant commit
4de70e2330 ('Add MGMT_RX_PROCESS test
command for wpa_supplicant'), but for hostapd.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-29 16:26:00 +02:00
Jouni Malinen
2ab09656ae AP: Do not drop STA entry if PMF is used with full AP client state
This fixes a regression from commit
bb598c3bdd ('AP: Add support for full
station state'). That commit added code to remove and re-add the kernel
STA entry when processing Authentication frames with a driver that
advertises support for full AP client state. That resulted in bypassing
PMF protections for unprotected Authentication frames with such drivers
since the TK was lost in this operation.

It is simplest to skip the STA entry clearing in this type of case
completely to leave the TK in place and to process the new
authentication exchange otherwise normally. This matches the behavior
used with the drivers that do not implement full AP client state.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-29 16:26:00 +02:00
Jouni Malinen
c85fcff2b1 tests: WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-26 11:39:44 +02:00
Will Glynn
209dad066e FT: Explicitly check for MDE not present in non-FT association
IEEE Std 802.11-2012, 12.4.2 states that if an MDE is present in an
(Re)Association Request frame but the RSNE uses a non-FT AKM suite, the
AP shall reject the association using status code 43 ("Invalid AKMP").

wpa_validate_wpa_ie() now explicitly checks for this condition to meet
this requirement instead of simply ignoring the MDE based on non-FT AKM.

Signed-off-by: Will Glynn <will@willglynn.com>
2016-11-26 11:39:44 +02:00
Jouni Malinen
bacbb62294 tests: Beacon frame TX rate configuration
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-26 00:36:50 +02:00
Purushottam Kushwaha
d4f3003c56 nl80211: Configure Beacon frame TX rate if driver advertises support
If the driver advertises support for setting Beacon frame data rate,
allow the user to configure this rate as part of starting the AP. Only
one Beacon frame TX rate is allowed.

Drivers advertising such support should set corresponding flag via the
NL80211_ATTR_EXT_FEATURES attribute.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-26 00:36:27 +02:00
Purushottam Kushwaha
29483a5678 Add support for user configurable Beacon frame data rate for AP mode
Allow configuration of Beacon frame TX rate from hostapd.conf with
"beacon_rate=xx" option. The following format is used to set
legacy/HT/VHT beacon rates:

Legacy (CCK/OFDM rates):
	beacon_rate=<legacy rate in 100 kbps>
HT:
	beacon_rate=ht:<HT MCS>
VHT:
	beacon_rate=vht:<VHT MCS>

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-25 23:12:30 +02:00
Jouni Malinen
dff690b859 tests: Random MAC address in scans while connected
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-25 22:52:39 +02:00
Srinivas Dasari
346b333d9a Use random MAC address for scanning only in non-connected state
cfg80211 rejects the scans issued with random MAC address if the STA is
in connected state. This resulted in failures when using MAC_RAND_SCAN
while connected (CTRL-EVENT-SCAN-FAILED ret=-95). Enable random MAC
address functionality only if the STA is not in connected state to avoid
this. The real MAC address of the STA is already revealed in the
association, so this is an acceptable fallback mechanism for now.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-25 22:52:39 +02:00
Jouni Malinen
afe280539b tests: D-Bus P2P and IP address parameters
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-21 14:45:13 +02:00
Nishant Chaprana
18f1611797 D-Bus: Send P2P IP address assignment info with GroupStarted event
This commit adds IP address information into GroupStarted event on the
P2P client side like it is sent over the control interface.

Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2016-11-21 14:45:13 +02:00
Nishant Chaprana
046fa6fd11 D-Bus: Add getter and setter for P2P IP address config parameters
This patch adds setter and getter for P2P IP address config parameters:
1. ip_addr_go
2. ip_addr_mask
3. ip_addr_start
4. ip_addr_end

Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2016-11-20 12:41:39 +02:00
Jouni Malinen
d503eeead1 FT: Complete CONFIG_IEEE80211R_AP renaming for hostapd
Commit 4ec1fd8e42 ('FT: Differentiate
between FT for station and for AP in build') renamed all
CONFIG_IEEE80211R instances within src/ap/* to CONFIG_IEEE80211R_AP, but
it did not change hostapd/* files to match. While this does not cause
much harm for normal use cases, this broke some test builds where
wpa_supplicant build is used to build in hostapd/*.c files for analysis.
Fix this by completing CONFIG_IEEE80211R_AP renaming.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-20 00:35:35 +02:00
Sabrina Dubroca
e0d9fd344d wpa_supplicant: Allow configuring the MACsec port for MKA
Previously, wpa_supplicant only supported hardcoded port == 1 in the
SCI, but users may want to choose a different port.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:31 +02:00
Sabrina Dubroca
1d3d0666a6 mka: Add enable_encrypt op and call it from CP state machine
This allows MKA to turn encryption on/off down to the driver.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:23 +02:00
Sabrina Dubroca
7b4d546e3d wpa_supplicant: Add macsec_integ_only setting for MKA
So that the user can turn encryption on (MACsec provides
confidentiality+integrity) or off (MACsec provides integrity only). This
commit adds the configuration parameter while the actual behavior change
to disable encryption in the driver is handled in the following commit.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:16 +02:00
Sabrina Dubroca
008e224dbb mka: Disable peer detection timeout for PSK mode
The first peer may take a long time to come up. In PSK mode we are
basically in a p2p system, and we cannot know when a peer will join the
key exchange. Wait indefinitely, and let the administrator decide if
they want to abort.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:11 +02:00
Sabrina Dubroca
ad51731abf wpa_supplicant: Allow pre-shared (CAK,CKN) pair for MKA
This enables configuring key_mgmt=NONE + mka_ckn + mka_cak.
This allows wpa_supplicant to work in a peer-to-peer mode, where peers
are authenticated by the pre-shared (CAK,CKN) pair. In this mode, peers
can act as key server to distribute keys for the MACsec instances.

This is what some MACsec switches support, and even without HW
support, it's a convenient way to setup a network.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-20 00:35:08 +02:00
Jouni Malinen
5acbf22bb0 Fix hostapd usage entry style for -T
Remove the extra equals sign from the line since hostapd usage text does
not have it for other entries either (while wpa_supplicant does and this
was likely copy-pasted from there).

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-19 22:20:14 +02:00
Sergei Sinyak
611d67a16e Add doxygen ref to eap_method structure
doc/eap.doxygen was mentioning eap_method structure, but there was no
reference as in doc/eap_server.doxygen on a similar paragraph

Signed-off-by: Sergei Sinyak <serega.belarus@gmail.com>
2016-11-19 17:46:19 +02:00
Kenny Root
88f93c30ec Android: Remove BoringSSL guard
BoringSSL is the only supported version of SSL, so remove this guard so
we can continue to compile when the flavor.mk is removed.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-11-19 17:43:03 +02:00
Joel Cunningham
7824bf77d6 nl80211: Fix get_inact_sec() returning -1 on failure
This commit fixes the nl80211 driver call get_inact_sec() to return -1
when STA inactivity time retrieval fails in i802_read_sta_data().

This was intended to be handled by initalizing the inactive_msec member
to -1 but i802_read_sta_data() assumes the data parameter is
uninitialized and memsets the entire structure, neutralizing the attempt
to distinguish between no value (-1) and a time value of 0.

This is fixed by now requiring i802_read_sta_data() callers to
initialize the data structure first (allowing get_inact_sec() to use
-1). This is a safe change because it does not change any driver API
behavior and only affects one other static function in driver_nl80211.c

Signed-off-by: Joel Cunningham <joel.cunningham@me.com>
2016-11-19 17:39:23 +02:00
Sabrina Dubroca
088d53dd15 mka: Fix getting capabilities from the driver
In commit a25e4efc9e ('mka: Add driver op
to get macsec capabilities') I added some code to check the driver's
capabilities. This commit has two problems:
 - wrong enum type set in kay->macsec_confidentiality
 - ignores that drivers could report MACSEC_CAP_NOT_IMPLEMENTED, in
   which case the MKA would claim that MACsec is supported.

Fix this by interpreting MACSEC_CAP_NOT_IMPLEMENTED in the same way as a
DO_NOT_SECURE policy, and set the correct value in
kay->macsec_confidentiality.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-11-19 17:29:54 +02:00
Jouni Malinen
242fc738a0 tests: GAS/ANQP and Capability List ANQP-element
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-17 16:00:59 +02:00
Peng Xu
5e785a6792 Reserve QCA vendor specific nl80211 command 144
This is reserved for QCA use.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-17 16:00:59 +02:00
Jouni Malinen
8e5c2c208e tests: GAS/ANQP and Venue URL
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-17 16:00:59 +02:00
Jouni Malinen
4051dd8667 GAS: Add Capability List ANQP-element support for Info ID 270, 280..299
This extends the anqp_elem configuration parameter support for new Info
IDs (270 (TDLS Capability) was previously missed from the list of
defined values, 280 has already been assigned in REVmc/D8.0; 281..299
are yet to be assigned). No additional source code changes are needed to
allow hostapd to advertise support for these if the ANQP-element value
is set with the anqp_elem parameter.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-17 16:00:25 +02:00
Jouni Malinen
7d3f18d72c tests: Allow multiple management frames to be used with ap-mgmt-fuzzer
The optional "-m <multi.dat>" command line option can now be used to
specify a data file that can include multiple management frames with
each one prefixed with a 16-bit big endian length field. This allows a
single fuzzer run to be used to go through multi-frame exchanges. The
multi.dat file shows an example of this with Probe Request frame,
Authentication frame, Association Request frame, and an Action frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-16 18:17:08 +02:00
Jouni Malinen
d50f518e95 Fix libap.a build
Add the new defines and files to allow src/ap/libap.a to be build with
all the needed functions.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-11-16 13:26:23 +02:00
Jouni Malinen
e65a87b399 Debug print scan results matching the currently selected network
This provides more details on BSS selection process in the debug log.
Previously, the BSSs that were not either the current or the selected
one were not necessarily printed at all. Now all BSSs that match the
currently selected network are listed with their frequency and signal
strength details.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-13 18:22:38 +02:00
Jouni Malinen
8d1e693186 Use estimated throughput to avoid signal based roaming decision
Previously, the estimated throughput was used to enable roaming to a
better AP. However, this information was not used when considering a
roam to an AP that has better signal strength, but smaller estimated
throughput. This could result in allowing roaming from 5 GHz band to 2.4
GHz band in cases where 2.4 GHz band has significantly higher signal
strength, but still a lower throughput estimate.

Make this less likely to happen by increasing/reducing the minimum
required signal strength difference based on the estimated throughputs
of the current and selected AP. In addition, add more details about the
selection process to the debug log to make it easier to determine whaty
happened and why.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-13 17:52:32 +02:00
Jouni Malinen
fde3a53132 Rename a function argument to avoid shadowing a variable in global scope
Do not use optarg as a function argument since a variable with that name
is in the global scope.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-11-12 19:26:47 +02:00
Jouni Malinen
96a5b80958 tests: Make ap_interworking_scan_filtering more robust
It was possible for the first wt.clear_bss_counters(bssid) call to fail
the test if timing worked out in a way that the wlantest process had not
received any Beacon frames from the first AP. Run a directed scan for
both of the BSSs before starting the test validation steps to make sure
such a case cannot fail this test case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-10-29 22:23:53 +03:00
Ilan Peer
4ec1fd8e42 FT: Differentiate between FT for station and for AP in build
Previously, CONFIG_IEEE80211R enabled build that supports FT for both
station mode and AP mode. However, in most wpa_supplicant cases only
station mode FT is required and there is no need for AP mode FT.

Add support to differentiate between station mode FT and AP mode FT in
wpa_supplicant builds by adding CONFIG_IEEE80211R_AP that should be used
when AP mode FT support is required in addition to station mode FT. This
allows binary size to be reduced for builds that require only the
station side FT functionality.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-29 22:14:54 +03:00
Beni Lev
f0259c3f68 hostapd: Fix own wide bandwidth subelement generation (neighbor report)
The Channel Center Frequency Segment subfields use the channel index
instead of frequency in MHz.

Signed-off-by: Beni Lev <beni.lev@intel.com>
Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-10-29 22:03:43 +03:00
Ilan Peer
0a63635ed0 AP: Use valid status code in wpa_ft_send_rrb_auth_resp()
The return value from this function may be used in an outgoing message,
so use a valid status code instead of -1.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-29 22:02:14 +03:00
Avraham Stern
e4b48b7b0f Extend ieee80211_freq_to_channel_ext() to cover channels 52-64
Add frequency to channel conversion for the 5 GHz channels 52-64.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-10-29 21:51:04 +03:00
Avrahams Stern
c433c50c9c wpa_supplicant: Make CONFIG_MBO independent of CONFIG_AP
CONFIG_MBO was defined inside ifdef CONFIG_AP, so when AP support
was not compiled, MBO was not compiled either. However, CONFIG_MBO
is not related AP support, so it should not depend on CONFIG_AP.

Fix this by moving CONFIG_MBO outside of ifdef CONFIG_AP.

Signed-off-by: Avrahams Stern <avraham.stern@intel.com>
2016-10-29 19:31:38 +03:00
Eliad Peller
d044d2f7d8 wpa_supplicant: Get scan_result IE also from Beacon frames
No reason to require ie_len if only beacon_ie_len is given.

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
2016-10-29 19:28:37 +03:00
Jouni Malinen
baa8f5ba26 tests: hostapd stationary_ap=1 in neighbor DB
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-10-29 19:25:39 +03:00
David Spinadel
451a27b1ad hostapd: Add a configuration to set an AP as stationary
Add a configuration option in hostapd.conf and in neighbor report that
sets an AP as stationary. To enable this option on the current AP set
the config option stationary_ap to 1. To set a neighbor entry to be
marked as stationary add the word stat to the SET_NEIGHBOR command. This
option tells hostapd to send LCI data even if it is older than requested
by max age subelement in RRM request.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-10-29 19:16:47 +03:00
Ilan Peer
5cb59370d5 hostapd: Clear location configuration when it is reset
In case that LCI or location civic configuration is cleared,
free the buffer holding the corresponding information to avoid
cases that the information is considered as valid/useful.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-29 19:11:59 +03:00
Ilan Peer
f5ec346902 hostapd: Fix adding neighbor entry
It is possible that a LCI or location civic configuration buffer
is valid but contains no data. In such a case do not add the LCI
and location civic information to the entry in the neighbor
data base.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-10-29 19:10:17 +03:00
Sabrina Dubroca
99b82bf537 mka: Implement reference counting on data_key
struct data_key already had a 'user' field for reference counting, but
it was basically unused.

Add an ieee802_1x_kay_use_data_key() function to take a reference on a
key, and use ieee802_1x_kay_deinit_data_key() to release the reference.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-29 11:38:57 +03:00
Sabrina Dubroca
23c3528a84 mka: Add support for removing SAs
So that the core can notify drivers that need to perform some operations
when an SA is deleted.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
2016-10-29 11:35:38 +03:00