Commit graph

3941 commits

Author SHA1 Message Date
Dmitry Shmidt
f89c32e63f Android: Fix max number of sched scan SSIDs based on driver capability
This adds use of the driver capability (instead of hardcoded
WPAS_MAX_SCAN_SSIDS) in wpas_start_pno() similarly to what was already
done in wpa_supplicant_req_sched_scan().

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-04-02 17:35:28 +03:00
Roshan Pius
f1a5a34d8e binder: Implement interface add/remove methods
This commit implements the methods defined in Supplicant service:
1. CreateInterface
2. RemoveInterface
3. GetInterface

The binder service returns the corresponding iface binder object
references which can be used by clients to control a specific
interface.

Signed-off-by: Roshan Pius <rpius@google.com>
2016-04-02 17:35:28 +03:00
Roshan Pius
7b4bbb9f94 binder: Add binder skeletal code for Android
Create the skeletal binder interface for wpa_supplicant. The interface
hierarchy is based off the existing dbus
interface(https://w1.fi/wpa_supplicant/devel/dbus.html).

Since we use libbinder, the binder interface codebase needs to be
written in C++ and can only be compiled on Android platform for now.

The aidl files define binder RPC interfaces. The Android build system
generates the corresponding C++ interface classes which needs to be
implemented by the server process.

The clients can obtain a reference to the binder service (root object)
using:
android::String16 service_name("fi.w1.wpa_supplicant");
android::sp<android::IBinder> binder =
  android::defaultServiceManager()->getService(service_name);

Once a reference to the root object is retrieved, the clients can
obtain references to other RPC objects using that root object methods.

Signed-off-by: Roshan Pius <rpius@google.com>
2016-04-02 17:35:26 +03:00
Jouni Malinen
c01120a05f wpa_supplicant: Do not use struct ieee80211_mgmt::u.probe_req
This struct in the union is empty, but the design of using a zero-length
u8 array here is not fully compatible with C++ and can result in
undesired compiler warnings. Since there are no non-IE fields in the
Probe Request frames, get the location of the variable length IEs simply
by using the pointer to the frame header and the known header length.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-04-02 16:55:02 +03:00
Bala Krishna Bhamidipati
5cd317d381 Do not clear PMKSA entry or EAP session cache if config does not change
This avoids unnecessary flushing of the PMKSA cache entry and EAP
session data when processing SET_NETWORK commands that set a network
profile parameter to the same value that the parameter already has.

Introduce a new wpa_config_set() and wpa_config_set_quoted() return
value (==1) signifying that the new value being set for the
corresponding field equals to the already configured one so that the
caller can determine that nothing changed in the profile.

For now, this does not cover all the network profile parameters, but
number of the most commonly used parameters are included to cover the
Android use cases where the framework may have issued SET_NETWORK
commands that would have unnecessarily prevented use of PMKSA caching or
EAP fast reauthentication.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-31 17:18:51 +03:00
Jouni Malinen
a6fbff2049 Fix CONFIG_CTRL_IFACE=udp6/udp6-remote builds
wpa_supplicant_global_ctrl_iface_receive() did not handle the from
address properly for the IPv6 case. This was broken by commit
d60886cdaf ('wpa_supplicant: Add monitor
support for global UDP ctrl_iface').

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-28 00:16:52 +03:00
Jouni Malinen
31afdd2274 Use TIOCOUTQ instead of SIOCOUTQ to avoid need for linux/sockios.h
All that the kernel header was doing here is defining SIOCOUTQ to be
TIOCOUTQ. Instead of pulling in the header, we might as well use
TIOCOUTQ directly.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-26 11:40:35 +02:00
Lior David
f347429cf1 P2P: Fix persistent group for 60 GHz networks
Fix two problems with storage of 60 GHz P2P persistent groups:
1. pbss flag was not stored in the network block.
2. When recreating the persistent group from storage,
in addition to the missing pbss flag, the pairwise_cipher and
group_cipher were initialized to CCMP which does not work
in 60 GHz since the default in 60 GHz should be GCMP.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-03-25 18:40:56 +02:00
Jouni Malinen
954e10e483 Make it a bit easier to roam from 2.4 GHz to 5 GHz within ESS
The initial connection to an ESS was already explicitly increasing the
likelihood of picking a 5 GHz BSS. While the throughput estimation is
likely to do same for the roaming decision, it might be possible that
that does not cover all cases. Add couple of dB extra preference for 5
GHz in case the roaming decision falls back to comparing signal levels.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-25 12:12:48 +02:00
Jouni Malinen
585141bb30 Fix a typo in a comment
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-25 12:12:48 +02:00
Jouni Malinen
6a5ee810a3 Include previous BSSID in connection request to indicate reassociation
This allows the SME-in-the-driver case to get similar information about
reassociation that was already available for the SME-in-wpa_supplicant
case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-24 22:35:10 +02:00
Jouni Malinen
cbc3d6fe65 WNM: Verify BSS TM target match against the current network profile
Reject a BSS transition management candidate if it does not match the
current network profile, e.g., due to incompatible security parameters.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-24 12:11:55 +02:00
Roy Marples
2e997eece5 Add interface matching support with -M, guarded by CONFIG_MATCH_IFACE
The new wpa_supplicant command line argument -M can be used to describe
matching rules with a wildcard interface name (e.g., "wlan*").

This is very useful for systems without udev (Linux) or devd (FreeBSD).

Signed-off-by: Roy Marples <roy@marples.name>
2016-03-22 17:41:37 +02:00
Roy Marples
45e3fc72c6 Find correct driver for interface additions/removals
Interface additions/removals are not guaranteed to be for the driver
listening to the kernel events. As such, send the events to
wpa_supplicant_event_global() which can then pick the correct interface
registered with wpa_supplicant to send the event to.

Signed-off-by: Roy Marples <roy@marples.name>
2016-03-22 17:41:37 +02:00
Jouni Malinen
90377029c6 wpa_supplicant: Fix CONFIG_IBSS_RSN=y build without CONFIG_AP=y
Commit 1889af2e0f ('VLAN: Separate station
grouping and uplink configuration') added an ap_sta_set_vlan() function
that gets called from pmksa_cache_auth.c. This broke CONFIG_IBSS_RSN=y
build if src/ap/sta_info.c did not get included in the build, i.e., if
CONFIG_AP=y was not set.

Fix this by making the ap_sta_set_vlan() call conditional on
CONFIG_NO_VLAN being undefined and define this for CONFIG_IBSS_RSN=y
builds. This is fine for wpa_supplicant since CONFIG_AP=y case was
already defining this. For hostapd, this function call is not needed for
CONFIG_NO_VLAN case either.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-21 21:12:20 +02:00
Janusz Dziedzic
5ae65de0b7 wpa_supplicant: Fix p2p_group_add when UDP-based ctrl_iface is used
While p2p_group_add ctrl_interface name could be derived from the main
interface (simple p2p_group_add command), we failed to bind the same UDP
port. Fix this problem and also update the correct ctrl_interface name
(port decrement).

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-20 21:41:40 +02:00
Jouni Malinen
e567c582a7 Fix nfc_pw_token build with CONFIG_FST=y
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-20 20:18:55 +02:00
Masashi Honma
d774c46aae mesh: Use appropriate BLOCKED state duration
Previously, BLOCKED state duration slightly increased up to 3600. Though
the BLOCKED state could be canceled by ap_handle_timer(). Because the
timer timeouts in ap_max_inactivity(default=300sec) and remove STA
objects (the object retains BLOCKED state).

This patch re-designs my commit bf51f4f82b
('mesh: Fix remaining BLOCKED state after SAE auth failure') to replace
mesh_auth_block_duration by ap_max_inactivity and remove incremental
duration.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 18:24:29 +02:00
Masashi Honma
9f2cf23e2e mesh: Add support for PMKSA caching
This patch add functionality of mesh SAE PMKSA caching. If the local STA
already has peer's PMKSA entry in the cache, skip SAE authentication and
start AMPE with the cached value.

If the peer does not support PMKSA caching or does not have the local
STA's PMKSA entry in the cache, AMPE will fail and the PMKSA cache entry
of the peer will be removed. Then STA retries with ordinary SAE
authentication.

If the peer does not support PMKSA caching and the local STA uses
no_auto_peer=1, the local STA can not retry SAE authentication because
NEW_PEER_CANDIDATE event cannot start SAE authentication when
no_auto_peer=1. So this patch extends MESH_PEER_ADD command to use
duration(sec). Throughout the duration, the local STA can start SAE
authentication triggered by NEW_PEER_CANDIDATE even though
no_auto_peer=1.

This commit requires commit 70c93963ed
('SAE: Fix PMKID calculation for PMKSA cache'). Without that commit,
chosen PMK comparison will fail.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 17:56:38 +02:00
Masashi Honma
4c522c7798 PMKSA: Flush AP/mesh PMKSA cache by PMKSA_FLUSH command
This extends the wpa_supplicant PMKSA_FLUSH control interface command to
allow the PMKSA list from the authenticator side to be flushed for AP
and mesh mode. In addition, this adds a hostapd PMKSA_FLUSH control
interface command to flush the PMKSA entries.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 17:37:53 +02:00
Masashi Honma
b8daac18a4 PMKSA: Show AP/mesh PMKSA list in PMKSA command
This extends the wpa_supplicant PMKSA control interface command to allow
the PMKSA list from the authenticator side to be listed for AP and mesh
mode. In addition, this adds a hostapd PMKSA control interface command
to show the same list for the AP case.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 17:37:53 +02:00
Masashi Honma
2604edbfbd mesh: Add MESH_PEER_ADD command
This allows a mesh peer connection to be initiated manually in
no_auto_peer mesh networks.

Signed-off-by: Natsuki Itaya <Natsuki.Itaya@jp.sony.com>
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 17:37:53 +02:00
Masashi Honma
e174ef341b mesh: Add MESH_PEER_REMOVE command
This command allows the specified mesh peer to be disconnected.

Signed-off-by: Natsuki Itaya <Natsuki.Itaya@jp.sony.com>
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-03-20 17:37:53 +02:00
Jouni Malinen
f7648c8679 P2P: Advertise IP Address Allocation only if it is enabled on GO
This group capability bit was previously added unconditionally which
could result in the P2P Client assuming the functionality is available
even though the GO would always reject the request (not reply to it with
an assigned IP address) during the 4-way handshake.

Fix this by advertising the capability only if the GO configuration
allow IP address assignment to be completed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-20 17:37:53 +02:00
Daisuke Niwa
192964ddc3 Handle OSEN IE in Assoc Request info if req_ies exists
The 4-way handshake fails with the error "WPA: No wpa_ie set - cannot
generate msg 2/4" while connecting to OSEN network with drivers that
indicate used Association Request frame elements because OSEN IE is not
handled in wpa_supplicant_event_associnfo() if data->assoc_info.req_ies
is not NULL.

Signed-off-by: Daichi Ueura <daichi.ueura@sonymobile.com>
2016-03-20 11:17:39 +02:00
Jouni Malinen
c3dc68e844 Do not invalidate EAP session cache on all network block parameter changes
The bssid and priority parameters in a network block do not have any
effect on the validity of an EAP session entry, so avoid flushing the
cached session when only these parameters are changed. This is mainly to
allow forced roaming or network selection changes without causing fast
reauthentication to be disabled if the changes are done during RSN
association that used EAP.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-16 19:44:32 +02:00
Jouni Malinen
c6c29be1bd Interworking: Add credential realm to EAP-TLS identity
If the configured credential includes a username without '@' (i.e., no
realm) in it and a realm, combine these to form the EAP-Request/Identity
value as "<username>@<realm>" for EAP-TLS. This was already done for
EAP-TTLS as part of the anonymous NAI conversion, but EAP-TLS could have
ended up using a username without any realm information which would be
unlikely to work properly with roaming cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-11 21:06:15 +02:00
Lior David
dfe0745c9a P2P: Add optional op_class argument to P2P_SET listen_channel
The existing implementation in p2p_ctrl_set used a hard-coded operating
class 81 which is only suitable for the social channels in the 2.4 GHz
band, and will not work for the social channel in the 60 GHz band.
Extend this by adding an optional op_class argument to P2P_SET
listen_channel. If not specified, use the default value of 81 to match
existing behavior.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-03-07 13:51:01 +02:00
Naveen Singh
c7fb678f31 D-Bus: Add association response status code property for failure cases
(Re)Association Response frame with status code other than 0 is now
notified over DBUS as a part of PropertiesChanged signal. This can be
used by application in case AP is denying association with status code
17 (band steering) so that it does not interfere in the BSSID selection
logic of wpa_supplicant.

Signed-off-by: Naveen Singh <nasingh@google.com>
2016-03-06 20:44:51 +02:00
Janusz Dziedzic
56e2fc2c31 wpa_supplicant: Add ctrl parameter to INTERFACES command
"INTERFACES ctrl" can now be used to fetch a list of network interfaces
and their control interfaces, e.g., to fetch the UDP port information
for the control interface.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 17:44:49 +02:00
Janusz Dziedzic
acf57fae76 ctrl_iface_common: Use sockaddr_storage instead of sockaddr_un
This is a step towards allowing UDP sockets to be used with the common
implementation.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 17:15:05 +02:00
Janusz Dziedzic
1a2124c650 wpa_supplicant: Use common functions for ctrl_iface
Use the common functions, structures when UNIX socket ctrl_iface used.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 17:15:05 +02:00
Janusz Dziedzic
d60886cdaf wpa_supplicant: Add monitor support for global UDP ctrl_iface
Add monitor support (ATTACH/DETACH) for the global ctrl_iface when using
the UDP backend.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 10:46:13 +02:00
Janusz Dziedzic
f0e5d3b5c6 wpa_supplicant: Share attach/detach/send UDP ctrl_iface functions
Extend the previously per-interface UDP ctrl_iface functions
(attach/detach/send) to support operations on the global interface as
well.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 10:21:18 +02:00
Janusz Dziedzic
db7fb435f3 wpa_supplicant: Allow UDP ctrl_iface configuration to set the UDP port
This allows the UDP port to be set for the per-interface and global
control interfaces. The format is: udp:<port_no>

For example:
wpa_supplicant -Dnl80211 -ddt -g udp:9888

And in the configuration file:
ctrl_interface=udp:9877

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-03-05 10:15:57 +02:00
Eliad Peller
c69ef1d2da P2P: Respect p2p_ignore_shared_freq on p2p_group_add
Make sure wpas_p2p_init_go_params() respects the p2p_ignore_shared_freq
configuration option. Choose currently used frequencies only if this
option is not set, or if there are no unused channels left.

Signed-off-by: Eliad Peller <eliad@wizery.com>
2016-03-04 21:17:32 +02:00
Eliad Peller
4115b0524b P2P: Fix shared freq print in wpas_p2p_init_go_params()
"freq" contains the forced frequency, not the selected one. Print the
correct freq instead.

Signed-off-by: Eliad Peller <eliad@wizery.com>
2016-03-04 21:16:00 +02:00
Ben Rosenfeld
a805731086 P2P: Abort ongoing scan when p2p_find is stopped
When p2p_find is stopped, send request to the driver
in order to cancel an ongoing scan if there is one.

Signed-off-by: Ben Rosenfeld <ben.rosenfeld@intel.com>
2016-03-03 17:10:26 +02:00
Ilan Peer
1446afc865 wpa_supplicant: Handle EVENT_SCAN_RESULTS when an interface is disabled
An interface can be disabled while it has an ongoing scan request.
In such a case, when the scan results notification is received,
it was being ignored (as the interface is already disabled) so the
scan state was not cleared. This can cause undetermined behavior
for the next scan request.

To handle this, clear the scan state when EVENT_SCAN_RESULTS is
received and the interface is disabled.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-03-03 17:10:26 +02:00
Avraham Stern
d14e63a2aa WNM: Do not scan based on malformed BSS Transition Management Request
Verify that when the Candidate List Included bit is set in a BSS
Transition Management Request frame, the candidate list actually
includes at least one candidate. If no candidates are included, reject
the request without scanning.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-03-03 17:10:25 +02:00
Avraham Stern
f420577f3c WNM: Fix candidates count in BSS Transition Management Request
In BSS Transition Management Request frame, it is possible that vendor
specific IEs are included after the candidate list. In this case the
candidates count was incremented for each IE although the candidate list
is already over which could result in adding all zeros candidates into
the neighbor list.

Fix that by incrementing the candidates count only for neighbor report
elements.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-03-03 17:09:26 +02:00
Ilan Peer
3c58df7ae7 wpa_cli: Support running action script on global control interface
In case wpa_cli is started with an option to execute an action script,
but no interface is specified, wpa_cli might crash in wpa_cli_exec() if
arg1 == NULL. Fix this be setting arg1 = "global".

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2016-03-03 16:30:28 +02:00
Adam Langley
8f38eed628 Android: Remove superfluous OpenSSL include paths
The libcrypto and libssl modules (and their respective static and host
versions) use LOCAL_EXPORT_C_INCLUDE_DIRS thus just including the module
is sufficient.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-03-03 16:27:10 +02:00
Daichi Ueura
cbf8d181c3 HS 2.0R2: Clear fetch_anqp_in_progress if fopen fails
Clear wpa_s->fetch_anqp_in_progress when osu-providers.txt can't be
opened. An issue happens, for instance, when wpa_supplicant doesn't
have correct access permission to the directory specified by osu_dir.
If hs20_osu_fetch_done method returns without clearing the flag,
'FETCH_OSU' command will never work correctly.

Signed-off-by: Daichi Ueura <daichi.ueura@sonymobile.com>
2016-03-03 16:25:49 +02:00
Jouni Malinen
2bf9a53a8b Add EAP-AKA' and EAP-pwd to wpa_supplicant README
The EAP methods were missing from the lists.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-03 16:19:55 +02:00
Jouni Malinen
4196c08e8b Update notes about OpenSSL versions
Obsolete OpenSSL versions 0.9.* are not supported anymore.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-03 16:17:34 +02:00
Jouni Malinen
5d7b1a3c82 Fix some typos in wpa_supplicant README files
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-03 16:15:46 +02:00
Nishant Chaprana
4194fee565 README-P2P: Fix a typo
Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2016-03-03 16:00:34 +02:00
Lior David
c58eed6dc7 P2P: Add Dev Info attribute to Probe Request frames in 60 GHz
When building P2P IE for Probe Request frames in P2P scan, add the
device information attribute if the 60 GHz band is included in the scan,
since this is required by the P2P specification.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-03-03 15:13:56 +02:00
Lior David
2b6e9f91df wpa_supplicant: Expose wpas_get_bands() and related API
Expose the functions wpas_get_bands() and wpas_freq_to_band() and the
enum wpa_radio_work_band, since they will be needed outside
wpa_supplicant.c.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-03-03 15:10:50 +02:00
Lior David
94ad3c3389 P2P: Change order of P2P IE and frequencies set up
When setting up parameters for P2P scan, calculate the frequencies
for the scan before calculating the scan IE. This is because
the scan IE calculation may need information about the scan
frequencies in use.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-03-03 15:03:46 +02:00
Jouni Malinen
bef5e9a862 Fix scan rescheduling from wpas_stop_pno to check postponed case
Commit 02e122a995 ('Reschedule scan from
wpas_stop_pno if it was postponed') uses wpa_s->scanning as the only
condition for automatically starting a postponed scan request from
EVENT_SCHED_SCAN_STOPPED event handler. However, wpa_s->scanning may be
set for sched_scan and as such, this can result in unexpected extra
scans without there having been any real postponed request.

Make this more accurate by verifying that there really is a pending
request for a scan before speeding up its start.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-03 11:04:38 +02:00
Lior David
96a26ab744 P2P: Support dedicated P2P_DEVICE without separate group interface
Add support for drivers with dedicated P2P_DEVICE interface, but without
group interface concurrency (only a single netdev is used). With such
devices, wpa_supplicant tried to use the p2p_dev interface instead of
the group interface and most P2P operations failed. Extend
wpa_supplicant to use the primary interface instead of a separate group
interface in such cases.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-02-27 19:37:19 +02:00
Lior David
ba307f8528 P2P: Add a separate pointer to the P2P Device instance
In many places in the code there was a reference to wpa_s->parent to get
from group interface to p2p_dev interface. These places can break if
P2P_DEVICE interface would need to be used with the primary interface as
the group interface, since the parent of the primary interface points to
itself and not the p2p_dev interface.

Fix this by adding a separate "p2pdev" pointer to wpa_supplicant,
it will be the same as parent pointer in most cases but whenever
the primary interface is used as a group interface, change it to
point to the correct p2p_dev interface.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-02-27 19:37:19 +02:00
Jouni Malinen
e04019737e GAS client: Make PMF check on RX more consistent
Use the SA field instead of BSSID in the received Action frame to
determine whether PMF has been negotiated with the transmitter. While
these fields are supposed to be same for Public Action frames from an
AP, it would be possible that a frame is received with different values.
The following operations in gas_query_rx() use SA, so do the same for
the PMF check.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-02-27 19:37:19 +02:00
Jouni Malinen
0645492e7c WNM: Optimize a single BSS transition management candidate scan
If the BSS Transition Management Request frame includes only a single
candidate and we need to scan for the BSS to get up-to-date information,
use a scan for the known BSSID instead of wildcard BSSID. In addition,
set the SSID in the scan if it is known based on old scan results in the
BSS table. This removes unnecessary Probe Response frames when we are
interested in results from only a single BSS.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-26 17:19:20 +02:00
Jouni Malinen
eb20cea590 nl80211: Add an option to specify the BSSID to scan for
This allows scans to be optimized when a response is needed only from a
single, known BSS.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-26 17:19:20 +02:00
Jouni Malinen
940491ce08 MBO: Mandate use of PMF for WPA2+MBO association (STA)
If WPA2 is used, MBO AP must enable PMF. Refuse to select a BSS that has
MBO and WPA2 enabled without PMF.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 19:53:05 +02:00
Jouni Malinen
6332aaf3b2 MBO: Track STA cellular data capability from association request
This makes hostapd parse the MBO attribute in (Re)Association Request
frame and track the cellular data capability (mbo_cell_capa=<val> in STA
control interface command).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-22 19:53:05 +02:00
Jouni Malinen
d010048cf7 MBO: Expire non-matching bss_tmp_disallowed entries as part of check
This makes wpa_is_bss_tmp_disallowed() expire old entries from the
bss_tmp_disallowed list even if they do not match the BSSID that is
being searched for. This allows the list to be kept at shorter length to
speed up operations and minimize memory use in cases where the
previously disabled BSS is not in radio range anymore.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-02-22 19:53:04 +02:00
Avraham Stern
016082e9e6 MBO: Send WNM-Notification when cellular capabilities change
Send a WNM-Notification to the associated AP to indicate changes in
cellular data capabilities.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
c484b19882 Move Hotspot 2.0 element in (Re)Association Request frames
According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements
must follow all other elements, so Hotspot 2.0 element which is actually
a vendor specific element must come after all other elements.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
a0c38e5dd7 Re-order elements in (Re)Association Request frames
According to IEEE Std 802.11-2012, Table 8-22, RM Enabled Capabilities
element must come before the Extended Capabilities element.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
9a493fab73 WNM: Add candidate list to BSS transition query
Add an option to configure a candidate list to BSS transition query
("list" as the second argument to WNM_BSS_QUERY). The candidate list is
built from the available scan results. If no updated scan results (< 10
sec) are available, the command fails.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
84d1c0fd5a WNM: Add candidate list to BSS transition response
Add the transition candidate list to BSS Transition Management Response
frame. The candidates preference is set using the regular wpa_supplicant
BSS selection logic. If the BSS transition request is rejected and
updated scan results are not available, the list is not added.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
c8082d2b6a MBO: Add MBO IE to BSS Transition Management Response frame
When rejecting a BSS Transition Management Request frame, add MBO IE to
the BSS Transition Management Response frame to specify the transition
rejection reason.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
dd5999084e MBO: Parse MBO IE in BSS Transition Management Request frames
Add parsing of MBO IE in BSS Transition Management Request frames. If
the MBO IE includes the association retry delay attribute, do not try to
reconnect to the current BSS until the delay time is over.

If the MBO IE includes the cellular data connection preference attribute
or the transition rejection reason attribute, send a message to upper
layers with the data.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
5e57ba2505 MBO: Add Supported Operating Classes element to Association Request
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
Avraham Stern
7d46f586de MBO: Add global operating class definitions
Add definitions for global operating classes. These definitions will be
used to construct supported operating classes information element.

The operating classes definitions used locally for P2P module will be
removed and included in the general operating classes definitions.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-22 19:53:04 +02:00
David Spinadel
cb06cf3456 MBO: Prevent association to APs that explicitly disallow this
Prevent association to MBO APs that have association disallowed
attribute in MBO IE in Beacon or Probe Response frames.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-22 19:53:04 +02:00
David Spinadel
c5d193d7b3 MBO: Add cellular capability to MBO IE
Add cellular capability attribute to MBO IE and add MBO IE with cellular
capabilities to Probe Request frames. By default, cellular capability
value is set to Not Cellular capable (3).

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-22 19:53:04 +02:00
David Spinadel
2d5b8614b7 MBO: Send MBO WNM-Notification Request frames to notify changes
Send a WNM-Notification Request frame with Non-preferred Channel Report
subelement if the non-preferred channels list changes during an
association.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-22 19:53:04 +02:00
David Spinadel
92c6e2e3a9 MBO: Implement MBO non-preferred channel report in Association Request
Add MBO IE with non-preferred channels to (Re)Association Request
frames.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-22 19:53:04 +02:00
David Spinadel
facf2c728a MBO: Add non-preferred channel configuration in wpa_supplicant
Add non-preferred channel configuration to wpa_config for MBO.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-21 17:55:16 +02:00
Avraham Stern
231b04b6cb utils: Share a single helper function to get IE by ID
Add a helper function to find a certain IE inside IEs buffer by ID and
use this function in several places that implemented similar
functionality locally.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-21 17:14:56 +02:00
Avraham Stern
ea69d9737c wpa_supplicant: Share a single get_mode() implementation
There is no need to duplicate this helper function in multiple files.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-21 17:14:51 +02:00
Nick Lowe
98a516eae8 WPS: Use only os_get_random() for PIN generation
Remove the fallback dependency on os_random() when generating a WPS pin.
This is exceptionally unlikely to ever be called as the call to
os_get_random() is unlikely to fail. The intention is to facilitate
future removal of os_random() as it uses a low quality PRNG.

Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-02-19 18:44:40 +02:00
Nick Lowe
8c676b5056 Add RADIUS Service-Type attribute with a value of Framed
This seems to be the common value used by APs and also mentioned in RFC
3580.

Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-02-19 18:44:39 +02:00
Masashi Honma
70c93963ed SAE: Fix PMKID calculation for PMKSA cache
The SAE PMKID is calculated with IEEE Std 802.11-2012 11.3.5.4, but the
PMKID was re-calculated with 11.6.1.3 and saved into PMKSA cache. Fix
this to save the PMKID calculated with 11.3.5.4 into the PMKSA cache.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2016-02-18 21:07:47 +02:00
Roy Marples
640b0b933a ctype functions require an unsigned char
Ensure that characters are represented as unsigned char when using
isblank() and isspace(). These function take in a "int c" argument, but
it needs to be unsigned for the cases where EOF is not indicated.

Signed-off-by: Roy Marples <roy@marples.name>
2016-02-18 17:39:00 +02:00
Roy Marples
634e2e29d6 Add CONFIG_ELOOP_KQUEUE to defconfig
Signed-off-by: Roy Marples <roy@marples.name>
2016-02-18 17:02:13 +02:00
Michael Braun
ba91e92023 wpa_supplicant: Parse ifname argument from DATA_TEST_CONFIG
This is required to test tagged VLANs.

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-02-17 11:46:13 +02:00
Jouni Malinen
ddd0032e03 wpa_cli: Clean up logical operation
While '!func() == 0' here resulted in correct behavior, it is not clear
and clang is starting to warn about this (-Wlogical-not-parentheses).
Use 'func()' instead as the condition to clear this.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-16 15:52:08 +02:00
Lior David
b907491281 wpa_supplicant: Basic support for PBSS/PCP
PBSS (Personal Basic Service Set) is a new BSS type for DMG
networks. It is similar to infrastructure BSS, having an AP-like
entity called PCP (PBSS Control Point), but it has few differences.
PBSS support is mandatory for IEEE 802.11ad devices.

Add a new "pbss" argument to network block. The argument is used
in the following scenarios:
1. When network has mode=2 (AP), when pbss flag is set will start
as a PCP instead of an AP.
2. When network has mode=0 (station), when pbss flag is set will
connect to PCP instead of AP.

The function wpa_scan_res_match() was modified to match BSS according to
the pbss flag in the network block (wpa_ssid structure). When pbss flag
is set it will match only PCPs, and when it is clear it will match only
APs.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-02-08 22:23:56 +02:00
Roy Marples
f9982b3212 Implement kqueue(2) support via CONFIG_ELOOP_KQUEUE
NOTE: kqueue has to be closed and re-build after forking. epoll *should*
do the same, but it seems that wpa_supplicant doesn't need it at least.

I have re-worked a little bit of the epoll code (moved into a similar
kqueue function) so it's trivial to requeue epoll if needed in the
future.

Signed-off-by: Roy Marples <roy@marples.name>
2016-02-07 18:09:19 +02:00
Roy Marples
2e69bdd16a eloop: Add eloop_sock_requeue()
This function can be used to re-build eloop socket tables after forking
for eloop implementations that need this.

Signed-off-by: Roy Marples <roy@marples.name>
2016-02-07 12:38:04 +02:00
Lubomir Rintel
df9e2c2a55 D-Bus: Don't do <deny send_interface="..." /> in dbus service file
It does more than intended; apart from denying messages to that
particular interface it also denies all messages non-qualified with an
interface globally. This blocks messages completely unrelated to
wpa_supplicant, such as NetworkManager communication with the VPN
plugins.

From the dbus-daemon manual:

  Be careful with send_interface/receive_interface, because the
  interface field in messages is optional. In particular, do NOT
  specify <deny send_interface="org.foo.Bar"/>! This will cause
  no-interface messages to be blocked for all services, which is almost
  certainly not what you intended. Always use rules of the form: <deny
  send_interface="org.foo.Bar" send_destination="org.foo.Service"/>

We can just safely remove those rules, since we're sufficiently
protected by the send_destination matches and method calls are
disallowed by default anyway.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
2016-02-07 11:55:09 +02:00
Srinivasa Duvvuri
9684c7567e mesh: Fix peer link counting when a mesh peer reconnects
When a mesh point reconnects by starting from Authentication frame
sequence, the plink count was not decremented from its last connection.
This resulted in leaking peer link count and causing wpa_supplicant to
reject the connection after max_peer_links (default: 99) reconnects.

This was reproduced by pre-configuring 2 mesh points with mesh
credentials. Boot both mesh points and make sure they connect to each
other. Then in a loop reboot one of the mesh points after it
successfully connects while leaving the other mesh point up and running.
After 99 iterations the supplicant on mesh point that is not rebooting
will reject the connection request from the other mesh point.

Fix this by decrementing num_plinks when freeing a STA entry that is
still in PLINK_ESTAB state.

Signed-off-by: Srinivasa Duvvuri <sduvvuri@chromium.org>
2016-02-06 21:22:29 +02:00
Avraham Stern
83fe38b011 P2P: Fall back to no VHT when starting AP/P2P GO
In cases where the bandwidth is not set when starting an AP/P2P GO,
the code tries to use 160 MHz or 80 MHz channels. As a result, the
AP/P2P GO configuration is set to use these channel widths even if
they are not available, which may results in failing to start the
AP/P2P GO.

Fix this by changing the AP/P2P GO configuration not to use VHT channels
when they are not available. In this case the AP/P2P GO will use a 40
MHz channel, if available, or a 20 MHz channel, if this is the maximum
available width.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-06 18:23:33 +02:00
Nick Lowe
2cbc6ffb3a RADIUS: Redesign Request Authenticator generation
Simplify and make properly random the generation of the Request
Authenticator.

Signed-off-by: Nick Lowe <nick.lowe@lugatech.com>
2016-02-06 17:19:35 +02:00
Roy Marples
a3cc64f3d2 Remove -w support from wpa_supplicant README
wpa_supplicant dropped the -w option long long time ago..

Signed-off-by: Roy Marples <roy@marples.name>
2016-02-06 00:31:26 +02:00
John Ernberg
f91e11f465 D-Bus: Fix p2p interface capability message
If the config file for the interface says "p2p_disabled=1", don't report
p2p capabilities on this interface. This helps programs like Connman to
not enable p2p when it's been disabled in wpa_supplicant.

Signed-off-by: John Ernberg <john.ernberg@actia.se>
2016-02-05 18:09:38 +02:00
Jouni Malinen
80ce804e88 WNM: Workaround for broken AP operating class behavior
Some APs do not advertise operating classes correctly for BSS Transition
Management. Try to determine the most likely operating frequency based
on the channel number (1..14 --> 2.4 GHz; 36..169 --> 5 GHz) if invalid
op_class == 0 is received in a BSS Transition Management Request. This
speeds up the following operating by avoiding a full scan due to an
unknown channel.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-02-05 17:06:06 +02:00
Purushottam Kushwaha
17d32eb3d3 Allow re-write of ip_addr* configurations to conf file.
This patch keeps ip_addr* configuration in conf file while
 updating supplicant conf file either internally by supplicant or
 due to save_config command.

Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Avichal Agarwal <avichal.a@samsung.com>
2016-01-15 20:23:25 +02:00
Purushottam Kushwaha
bcce934755 dbus: Restrict DeviceName size to 32 characters in setter
The maximum WPS Device Name length is 32 characters and that limit was
already enforced for the control interface and configuration files.

Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
2016-01-15 20:16:13 +02:00
Roy Marples
7c70fe2c6e Sort options and reduce printf calls in wpa_supplicant usage text
Signed-off-by: Roy Marples <roy@marples.name>
2016-01-15 20:11:54 +02:00
Jouni Malinen
1d20c66e45 P2P: Clear groups first on FLUSH command
This is needed to get proper P2P group removal processing for some test
cases. discovery_group_client followed by nfc_p2p_client was able to hit
a case where the P2P group idle timeout survived to the next group
instance because of the FLUSH command not clearing the group and this
timeout properly.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 18:49:15 +02:00
Jouni Malinen
27446e471c mesh: Do not force another peering exchange on driver event
If the local driver indicated a peer candidate event when the peer had
already initiated peering exchange in open mesh case, we used to force a
new exchange to be started instead of allowing the previously started
exchange to complete. This is not desirable, so make this initiation of
the new exchange conditional on there not being an already started (or
successfully completed) exchange.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 17:50:15 +02:00
Jouni Malinen
cc64fe7b9e mesh: Do not clear link state on driver event if exchange was started
If the local driver event for a new peer candidate arrived only after
the peer had already initiated the peering exchange, we used to clear
the link state. This resulted in the already completed (or in progress)
exchange getting abandoned and a new exchange initiated. This is not
desirable since the already started (or even completed) exchange can be
used. Clear the link state only when adding the new STA entry for the
first time, i.e., use the same !sta->my_lid condition in handling the
driver event similarly to how the peer initiated cases were already
handled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 17:50:15 +02:00
Jouni Malinen
b5f5c32412 mesh: Add some more details to MPM debug messages
This makes it easier to follow the debug log when trying to figure out
issues with mesh peering exchange.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 17:50:15 +02:00
Jouni Malinen
6174de663c mesh: Connection and group started/removed events into debug log
The messages were sent out with wpa_msg_ctrl() so they were not visible
in the debug log. However, these would be quite helpful strings to
search for in the debug log, so change these messages to use wpa_msg().

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-06 13:13:13 +02:00
Jouni Malinen
e9ccfc38fd Clear wpa_supplicant state to DISCONNECTED on FLUSH command
It was possible for the FLUSH command to trigger auto connect mechanism
to schedule a new scan in 100 ms. This is not desired since all the
network profiles will be removed immediately and the scan or an attempt
to reconnect would not be of any benefit here. Such a scan in 100 ms can
cause issues for cases where multiple test sequences are run back to
back, so prevent this by clearing wpa_supplicant state to DISCONNECTED
(which avoids scheduling of the 100 ms scan trigger on disconnection) if
the state was AUTHENTICATING or higher when the FLUSH command was
issued.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-04 23:37:43 +02:00
Jouni Malinen
aeb408fff1 HS 2.0: Add some documentation for OSEN and network block use
This adds notes on how wpa_supplicant can be configured for OSEN for a
link-layer protected online signup connection and how network profiles
can be set for a Hotspot 2.0 data connection when using external
Interworking network selection.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-04 21:34:39 +02:00
Jouni Malinen
15c5606758 Update copyright notices for the new year 2016
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-01 13:42:04 +02:00
Jouni Malinen
6e379c6c16 WPS: Testing mechanism to force auth/encr type flags
The new wps_force_{auth,encr}_types parameters can be used in test build
(CONFIG_WPS_TESTING) to force wpa_supplicant to use the specified value
in the Authentication/Encryption Type flags attribute. This can be used
to test AP behavior on various error cases for which there are
workarounds to cover deployed device behavior.

Signed-off-by: Jouni Malinen <j@w1.fi>
2016-01-01 13:42:04 +02:00
Jouni Malinen
944f693591 P2P: Stop offchannel TX wait on P2P_STOP_FIND/P2P_LISTEN
Previously it was possible for the pending Action frame TX to be
cleared, but the offchannel TX operation being left in wait state in the
kernel. This would delay start of the next operation (e.g., that listen
operation requested by P2P_LISTEN) until the wait time for the
previously pending Action frame had expired.

Optimize this by explicitly stopping any pending offchannel Action frame
TX when clearing the internal offchannel TX state in
wpas_p2p_clear_pending_action_tx().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-31 00:03:21 +02:00
Jouni Malinen
8edd9f1058 P2P: Add an option to specify group SSID in P2P_CONNECT join case
The new optional ssid=<hexdump> argument to P2P_CONNECT can be used to
make P2P Client operations during join-an-existing-group more robust by
filtering out scan results based on the SSID in addition to the P2P
Device/Interface Address. This can help if the same MAC address has been
used in multiple groups recently and the cached scan results may still
include an older BSS.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:12:38 +02:00
Jouni Malinen
70e0cb33f2 P2P: Provide group SSID, if specified, to P2P Client join step
At least one of the wpas_p2p_connect() callers (NFC join case) already
had access to the Group SSID. Pass that information through
wpas_p2p_connect() to wpas_p2p_join() so that the join operation can
filter out incorrect groups more easily.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:08:51 +02:00
Jouni Malinen
438be60153 P2P: Do not accept any GO BSS entry if SSID is specified for join
Accept only a BSS entry matching the SSID when trying to find the
operating channel of a GO during join operation for which the SSID was
already specified. Previously, it could have been possible to pick an
incorrect BSS entry if the new GO was not found in the latest scan and
there was an older cached scan entry for the same BSSID.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:06:19 +02:00
Jouni Malinen
35510d530a P2P: Use join SSID in the skip-PD cases
It was already possible to limit join operation to accept only a
specific SSID. However, this constraint was not used when starting a P2P
Client interface as a WPS Enrollee without going through a Provision
Discovery exchange.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:04:43 +02:00
Jouni Malinen
8b8d4f4eb4 P2P: Do not accept any BSS entry for join if SSID is already known
Use wpa_bss_get() with the specific Group SSID instead of
wpa_bss_get_bssid_latest() if the SSID is already known. This makes the
P2P join operations more robust in case the frequency of the group was
not yet known and the same P2P Interface Address may have been used in
multiple group instances with an older group entry still present in the
cached scan results.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:02:33 +02:00
Jouni Malinen
b875276c4d P2P: Use group SSID, if known, for join operation even if no BSS entry
This allows the cases where a specific group SSID is known to filter out
groups on the P2P Client even if the specific BSS entry for the target
group is not yet available.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 19:00:56 +02:00
Jouni Malinen
aa256cb399 P2PS: Add group SSID, if known, to the P2PS-PROV-DONE event
The new optional group_ssid=<hexdump> argument in the P2PS-PROV-DONE
event can be used to help in identifying the exact group if there have
been multiple groups with the same P2P Interface Address in short period
of time.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-30 18:59:03 +02:00
Jouni Malinen
c2ed779748 mesh: Document Mesh Peering Management element structure in more detail
Provide details on the pointers to the subfields and rename "pmk" to
"chosen_pmk" and use SAE_PMKID_LEN macro with it to make the code more
readable.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Bob Copeland
b2817cd5c2 mesh: Check PMKID in AMPE Action frames
From IEEE Std 802.11-2012 13.3.5:

   If the incoming Mesh Peering Management frame is for AMPE and the
   Chosen PMK from the received frame contains a PMKID that does not
   identify a valid mesh PMKSA, the frame shall be silently discarded.

We were not checking the PMKID previously, and we also weren't parsing
it correctly, so fix both.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-28 17:21:08 +02:00
Bob Copeland
6c33eed3ee mesh: Fix PMKID to match the standard
IEEE Std 802.11-2012 11.3.5.4 specifies the PMKID for SAE-derived keys
as:

   L((commit-scalar + peer-commit-scalar) mod r, 0, 128)

This is already calculated in the SAE code when the PMK is derived, but
not saved anywhere. Later, when generating the PMKID for plink action
frames, the definition for PMKID from 11.6.1.3 is incorrectly used.
Correct this by saving the PMKID when the key is generated and use it
subsequently.

Signed-off-by: Bob Copeland <me@bobcopeland.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
ede7770180 wpa_supplicant: Do not wait for monitor on P2P Device interface
External programs are not aware of the creation of a
dedicated P2P Device interface, so it does not make sense
to wait for a monitor to connect on such an interface.

Fix this by not waiting on a dedicated P2P Device interface
for monitor to attach.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Ilan Peer
1c94570f1b Do not wait for monitor to attach if no control interface
In case an interface has started without a control interface
initialized, skip waiting for monitor to attach at the start of
wpa_supplicant (-W).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
f98674aa37 Clone default LIBS value to LIBS_* for other tools
If LIBS is set with some global build system defaults, clone those for
LIBS_c, LIBS_h, LIBS_n, and LIBS_p to cover wpa_cli, wpa_passphrase,
hostapd_cli, hlr_auc_gw, and nt_password_hash as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-28 17:21:08 +02:00
Jouni Malinen
7d2f67433d Add "GET_CAPABILITY acs" to allow ACS build option to be detected
This allows upper layer software to check whether wpa_supplicant can use
ACS for AP mode.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
d99097177a wpa_supplicant: Enable Automatic Channel Selection support for AP mode
Since hostapd supports ACS now, let's enable its support in
wpa_supplicant as well when starting AP mode.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
[u.oelmann@pengutronix.de: adjusted added text in defconfig]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 22:24:05 +02:00
Tomasz Bursztyka
96bc508684 Handle survey event properly in wpa_supplicant
Let's reuse hostapd code for such handling. This will be useful to get
ACS support into wpa_supplicant where this one needs to handle the
survey event so it fills in the result ACS subsystem will require.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
[u.oelmann@pengutronix.de: rebased series from hostap_2_1~944 to master]
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
2015-12-24 21:35:54 +02:00
Jouni Malinen
662512e027 P2PS: Remove dead code
Commit f8a80e39b3 ('P2PS: Change
connection capability handling') added the identical P2PS_SETUP_CLIENT
check into two places within p2ps_group_capability(). However, only the
first one of these can be reached. In the second case, role can only
have values 0 or P2PS_SETUP_NEW and as such, the P2PS_SETUP_CLIENT case
is not possible. It looks like the first part of the commit is
sufficient, so remove the dead code added by the second part.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-24 19:16:15 +02:00
Jouni Malinen
d6b536f7e5 Add ocsp=3 configuration parameter for multi-OCSP
ocsp=3 extends ocsp=2 by require all not-trusted certificates in the
server certificate chain to receive a good OCSP status. This requires
support for ocsp_multi (RFC 6961). This commit is only adding the
configuration value, but all the currently included TLS library wrappers
are rejecting this as unsupported for now.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-24 00:54:30 +02:00
Jouni Malinen
0ab0de88e8 Document previously missing key_mgmt values
Number of key_mgmt options were missing from the documentation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-21 17:45:57 +02:00
Jouni Malinen
c24f8e8e75 GAS: Do not cancel initial offchannel wait with comeback delay 1
The minimum comeback delay 1 is used to indicate that fragmentation is
needed instead of indicating that the response is going to be available
only after some time. Do not cancel offchannel wait for this case
between the initial and comeback exchanges to avoid delaying the full
operation unnecessarily.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Jouni Malinen
364282c8c9 GAS: Retry full GAS query if comeback response is not received
It is possible for a comeback response to get lost especially when going
through a large GAS exchange fragmented to multiple frames in an
environment with interference or other traffic. Make this less likely to
fail the full exchange by trying full GAS query again and using longer
wait time on the GAS comeback exchanges.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 21:07:33 +02:00
Matti Gottlieb
8fb718a748 GAS: Shorten the duration of the wait for GAS comeback response
When exchanging GAS frames with the AP, the initial response from the AP
may take a while to come, since the AP may need to fetch the info from a
server. The next fragments/comeback response frames should take much
less time since the AP already has all of the info, so the wait time
for these frames can be reduced.

In addition, some drivers, e.g., mac80211, try to combine ROC based flows,
to improve medium utilization. For example, if the requested ROC fits
entirely in a previous requested ROC they can be combined. Thus, reducing
the wait time for the next frames can improve medium utilization.

Shorten the duration of GAS comeback to improve medium utilization and
overall GAS exchange times.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2015-12-20 19:42:12 +02:00
Jouni Malinen
c012567df6 GAS: Clear offchannel_tx_started when ending remain-on-channel
Commit 2c0d0ae370 ('GAS: End
remain-on-channel due to delayed GAS comeback request') started ending
the remain-on-channel operation between the initial request and the
following comeback request. However, it did not check or update the
offchannel_tx_started variable. While this alone would not necessarily
be problematic, this makes it more difficult to optimize wait time for
offchannel TX operations, so make sure the internal tracking variable
gets updated.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 19:40:01 +02:00
Jouni Malinen
e7160bd8fe Drop any pending EAPOL RX frame when starting a new connection
Such a pending frame cannot be valid anymore, so drop it instead of
risking of using an unexpected EAPOL frame after association if a
previous association received one at the end and the new association can
happen within 100 ms.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-20 17:25:41 +02:00
Jouni Malinen
61f25f80b4 HS 2.0: Remove duplicate icon entries
Only one of the icon entries with a matching BSSID and file name can be
fetched from wpa_supplicant and as such, there is no need to maintain
the old data if it was not explicitly deleted before running a new fetch
for the same BSSID and icon. Remove older duplicated entries whenever
completing a pending icon fetch to optimize memory use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-19 18:53:27 +02:00
Jouni Malinen
ca9968a012 HS 2.0: Convert icon storage to use dl_list
This simplifies the list operations quite a bit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-19 18:49:57 +02:00
Jan Nordqvist
8dd5c1b4e9 HS 2.0: Add a command to retrieve icon with in-memory storage
This adds a new command based Hotspot 2.0 icon retrieval option.

In short, here is the new command sequence:
1. REQ_HS20_ICON <bssid> <file-name>
2. event: RX-HS20-ICON <bssid> <file-name> <size>
3. GET_HS20_ICON <bssid> <file-name> <offset> <size>
   (if needed, repeat with larger offset values until full icon is
   fetched)
5. DEL_HS20_ICON <bssid> <file-name>

REQ_HS20_ICON is a new command that is analogous to HS20_ICON_REQUEST
with the slight difference that an entry to store the icon in memory is
prepared. The RX-HS20-ICON event has been augmented with BSSID,
file-name and size, and GET_HS20_ICON is used to retrieve a chunk of up
to <size> bytes of icon data at offset <offset>. Each chunk is returned
as a base64 encoded fragment, preceded by "HS20-ICON-DATA", BSSID, and
file-name as well as the starting offset of the data.

If there is no entry prepared for the icon when the ANQP result comes
back, hs20_process_icon_binary_file falls back to legacy behavior.

Finally the DEL_HS20_ICON command deletes (all) icons associated with
BSSID and file-name (there could be several if retries are used and they
have different dialog tokens).

Signed-off-by: Jan Nordqvist <jannq@google.com>
2015-12-19 18:34:01 +02:00
Dmitry Shmidt
96e8d831a5 wpa_supplicant: Add SIGNAL_MONITOR command
SIGNAL_MONITOR THRESHOLD=DD HYSTERESIS=DD command will request signal
strength monitoring events based on there having been requested amount
of drop in the signal strength. The threshold value is the RSSI
threshold in dBm for the event to be sent. 0 threshold can be used to
disable monitoring. The hysteresis value is RSSI hysteresis in dB to
specify the minimum amount of change before a consecutive event is
reported.

With nl80211 driver interface, these values map to the
NL80211_CMD_SET_CQM command with NL80211_ATTR_CQM_RSSI_THOLD and
NL80211_ATTR_CQM_RSSI_HYST attributes to the driver.

This command cannot be used when bgscan module is in use since that
depends on being able to control the connection monitoring parameters.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2015-12-18 21:02:37 +02:00
Matti Gottlieb
2c0d0ae370 GAS: End remain-on-channel due to delayed GAS comeback request
During the sequence of exchanging GAS frames with the AP, the AP can
request to come back in X amount of time and resend the GAS request.

Previously, wpa_supplicant did not terminate the remain-on-channel
session, but rather waited until the requested comeback delay had
expired, and then tried to send the GAS frame (potentially to save the
time that is required to schedule a new remain on channel flow).

This might cause unnecessary idle time (can be close to 1000 ms) in
which the device might be off-channel. Ending the current
remain-on-channel session and then rescheduling makes better usage of
the time in this case.

End remain-on-channel session due to receiving a delayed GAS comeback
request from the AP.

Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2015-12-18 20:32:53 +02:00
Eliad Peller
685ea2f60c wpa_cli: Send ALL_STA command to the correct interface
wpa_ctrl_command_sta(), called by the "ALL_STA" handler, didn't consider
ifname_prefix, resulting in various commands being sent to the global
control interface, rather than the specified interface when IFNAME=
prefix was used.

This in turn caused the unexpected "UNKNOWN COMMAND" result be
considered as valid station, resulting in infinite loop while trying to
get all stations.

Fix it by considering ifname_prefix, similarly to _wpa_ctrl_command().

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
2015-12-18 00:24:52 +02:00
Ayala Beker
0e6a2cf282 Disconnect before trying to switch to a different network
Previously, when wpa_supplicant received bgscan results with a preferred
network, it connected to that network without disconnecting from the
previous one. This might result in an inconsistent state of upper
layers.

Fix this by disconnecting from the current AP before connecting to the
new one when the network profile changes and there is an existing
connection.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-12-18 00:24:52 +02:00
Arik Nemtsov
706e11a485 Avoid network selection from scan during connection
If scan results arrive during the connection process, the network
selection function was called, interrupting the current connection.
While a regular scan is mutually exclusive with connection establishment
via the nature of radio work, there's no such protection for scheduled
scan. Prevent network selection while a connection is in progress.

Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
2015-12-18 00:24:52 +02:00
Ayala Beker
1b3dd69d93 P2P: Fix possible NULL pointer dereference
Fix wpas_p2p_invite() to call p2p_set_own_pref_freq_list() after the
NULL check, to avoid NULL pointer dereference if P2P initialization were
to have failed or P2P module getting deinitialized.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
2015-12-18 00:24:51 +02:00
Jouni Malinen
d06a35052f mesh: Fix VHT Operation information in peering messages
The full VHT channel information was not set in the hostapd data
structures which resulted in incorrect information (all zeros) being
used when building the VHT Operation element for peering messages while
the actual driver mode was set with the full details. We did not seem to
use the VHT information from peering messages, so this does not change
behavior with another wpa_supplicant-based mesh implementation. Anyway,
these elements should match the ones used in Beacon frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-17 21:20:02 +02:00
Jouni Malinen
d560288a44 TLS: Parse CertificateStatus message
This allows the internal TLS client implementation to accept
CertificateStatus message from the server when trying to use OCSP
stapling. The actual OCSPResponse is not yet processed in this commit,
but the CertificateStatus message is accepted to allow the TLS handshake
to continue.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-14 15:49:01 +02:00
Jouni Malinen
3c108b7573 EAP peer: External server certificate chain validation
This adds support for optional functionality to validate server
certificate chain in TLS-based EAP methods in an external program.
wpa_supplicant control interface is used to indicate when such
validation is needed and what the result of the external validation is.

This external validation can extend or replace the internal validation.
When ca_cert or ca_path parameter is set, the internal validation is
used. If these parameters are omitted, only the external validation is
used. It needs to be understood that leaving those parameters out will
disable most of the validation steps done with the TLS library and that
configuration is not really recommend.

By default, the external validation is not used. It can be enabled by
addingtls_ext_cert_check=1 into the network profile phase1 parameter.
When enabled, external validation is required through the CTRL-REQ/RSP
mechanism similarly to other EAP authentication parameters through the
control interface.

The request to perform external validation is indicated by the following
event:
CTRL-REQ-EXT_CERT_CHECK-<id>:External server certificate validation needed for SSID <ssid>

Before that event, the server certificate chain is provided with the
CTRL-EVENT-EAP-PEER-CERT events that include the cert=<hexdump>
parameter. depth=# indicates which certificate is in question (0 for the
server certificate, 1 for its issues, and so on).

The result of the external validation is provided with the following
command:
CTRL-RSP-EXT_CERT_CHECK-<id>:<good|bad>

It should be noted that this is currently enabled only for OpenSSL (and
BoringSSL/LibreSSL). Due to the constraints in the library API, the
validation result from external processing cannot be reported cleanly
with TLS alert. In other words, if the external validation reject the
server certificate chain, the pending TLS handshake is terminated
without sending more messages to the server.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-12 18:24:27 +02:00
Jouni Malinen
651c6a84af Add TEST_ASSOC_IE for WPA/RSN IE testing on AP side
The new wpa_supplicant control interface command "TEST_ASSOC_IE
<hexdump>" can now be used to override the WPA/RSN IE for Association
Request frame and following 4-way handshake to allow protocol testing of
AP side processing of WPA/RSN IE.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-06 19:33:16 +02:00
Jouni Malinen
58059e6c0c FST: Print debug entry on MB IE update based on EVENT_AUTH
This is more consistent with all the other callers of
wpas_fst_update_mbie().

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-06 12:53:24 +02:00
Avichal Agarwal
af041f997d dbus: Add support for vendor specific elements
The new methods are
1. VendorElemAdd "i" "ay" i=integer ay=array of bytes
2. VendorElemGet "i" i=integer (output array of bytes)
3. VendorElemRem "i" "ay" i=integer ay=array of bytes

These provide functionality similar to the control interface commands
VENDOR_ELEM_ADD, VENDOR_ELEM_GET, and VENDOR_ELEM_REMOVE.

Signed-off-by: Avichal Agarwal <avichal.a@samsung.com>
Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Kyeong-Chae Lim <kcya.lim@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
Signed-off-by: Dilshad Ahmad <dilshad.a@samsung.com>
[VendorElemGet to return array of bytes instead of string; cleanup]
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-06 12:50:13 +02:00
Jouni Malinen
bf3214b593 P2P: Fix re-invoked client interface completion on data connection
This was already working for the case where a separate group interface
is used due to the recent commit
328f49acfe ('P2P: Complete group formation
on client data connection'). However, the case of no separate group
interface was used did not clear the interface state properly on data
connection. Fix this by setting the group formation information in
wpas_start_p2p_client().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-04 23:11:10 +02:00
Jouni Malinen
63502c64e1 P2P: Fix P2P_CANCEL for p2p_in_invitation case
Commit f05cee9714 ('P2P: Clear
p2p_in_invitation on cancel') added a wpas_p2p_cancel() case to call
wpas_p2p_group_formation_failed() if wpa_s->p2p_in_invitation is set.
This is done in a loop going through wpa_s->next pointers. However, the
call here can result in removing the interface and freeing wpa_s. The
following attempt to read wpa_s->next is from freed memory and that can
result in process termination when using a separate P2P group interface
and issuing P2P_CANCEL on a group that was started through re-invocation
of a persistent group.

The recent commit 328f49acfe ('P2P:
Complete group formation on client data connection') "fixed" this by
accident since wpa_s->p2p_in_invitation gets cleared in the sequence
that could hit this issue and this results in P2P_CANCEL getting
rejected. However, the real bug here is in the loop that continues after
possible wpa_s instance deletion. Fix that by breaking out of the loop.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-04 22:49:59 +02:00
Jouni Malinen
213e158ca8 BoringSSL: Move OCSP implementation into a separate file
This makes it easier to share the OCSP implementation needed for
BoringSSL outside tls_openssl.c. For now, this is mainly for
http_curl.c.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-04 20:08:31 +02:00
Jouni Malinen
328f49acfe P2P: Complete group formation on client data connection
This was already the case in the GO role where the first client
connection is waited before marking
wpa_s->p2p_go_group_formation_completed = 1 and clearing
wpa_s->global->p2p_group_formation. However, in the P2P Client role,
that was done already at the completion of the WPS exchange. This can be
problematic since group formation timeout may still try to clear the
group and with wpa_s->global->p2p_group_formation == NULL, the correct
group interface may not be found.

Fix this by postponing clearing of wpa_s->global->p2p_group_formation on
the P2P Client side until the data connection has been completed and
group is declared started.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-30 21:35:16 +02:00
Jouni Malinen
bea48f7784 Allow sched_scan_plans to be updated at runtime
This allows the control interface SET command to be used to update the
sched_scan_plans parameter at runtime. In addition, an empty string can
be used to clear the previously configured plan.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-30 14:03:28 +02:00
Avraham Stern
32c02261dd Add support for configuring scheduled scan plans
Add the option to configure scheduled scan plans in the config file.
Each scan plan specifies the interval between scans and the number
of scan iterations. The last plan will run infinitely and thus
specifies only the interval between scan iterations.

usage:
sched_scan_plans=<interval:iterations> <interval2:iterations2> ... <interval>

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-30 14:03:28 +02:00
Avraham Stern
09ea4309b6 nl80211: Add support for multiple scan plans for scheduled scan
Add 'scan plans' to driver scan parameters for scheduled scan.
Each 'scan plan' specifies the number of iterations to run the scan
request and the interval between iterations. When a scan plan
finishes (i.e., it was run for the specified number of iterations),
the next scan plan is executed. The last scan plan will run
infinitely.

The maximum number of supported scan plans, the maximum number of
iterations for a single scan plan and the maximum scan interval
are advertised by the driver.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-30 14:03:28 +02:00
Jouni Malinen
dd895e9964 P2P: Make p2p_go_configured() more robust against unexpected calls
A hwsim test sequence was able to hit a SIGSEGV in
p2p_go_save_group_common_freqs() called by p2p_go_configured() callback
in a case where a non-P2P AP mode operation is started in wpa_supplicant
(wpas_ap_wep test case). This callback should not have happened for
non-P2P case and the debug logs did not make it clear how this could
happen. In addition, it is unclear how this could be reproduced.

To avoid this type of issues, clear the wpa_s->ap_configured_cb pointer
as soon as the first call to the function happens. In addition, verify
that wpa_s->go_params is available before processing the GO configured
callback.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-30 01:25:24 +02:00
Pali Rohár
6bb6a9ce29 Add SHA384 and SHA512 implementations from LibTomCrypt library
These will be used with the internal TLS implementation to extend hash
algorithm support for new certificates and TLS v1.2.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
2015-11-29 18:19:32 +02:00
Jouni Malinen
53401e919e Abort ongoing scans on FLUSH command
This may speed up some hwsim test case sequencies by avoiding a wait for
a scan at the end of a test case to complete.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-27 01:09:42 +02:00
Jouni Malinen
2ea2166d5a Add control interface command for aborting an ongoing scan
The new ABORT_SCAN command can be used to request an ongoing scan to be
aborted.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-26 19:44:14 +02:00
Kanchanapally, Vidyullatha
4ead7cfd5d Abort an ongoing scan before connect
Connect radio work is sometimes delayed for a considerable duration if
there is an ongoing scan radio work. To avoid these delays abort the
ongoing scan on that interface before queuing a connect request. Upon a
scan done indication from the driver, connect radio work will be
scheduled.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-26 19:44:14 +02:00
Kanchanapally, Vidyullatha
4f30addb38 nl80211: Add support for aborting an ongoing scan
This adds the driver interface commands for issuing a request to abort
an ongoing scan operation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-26 19:44:14 +02:00
Jouni Malinen
0530eb1086 mesh: Clear wpa_s cipher selection on starting mesh
This is needed to avoid hitting WEP/TKIP detection in
ibss_mesh_setup_freq() if the previous connection used WEP or TKIP.
Previously, that could have resulted in VHT and HT getting disabled for
the mesh connection.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-26 18:47:40 +02:00
Ahmad Kholaif
0f29bc68d1 IBSS/mesh: Add support for VHT80P80 configuration
A new network profile configuration parameter max_oper_chwidth=3 can be
used to specify preference to enable 80+80 MHz VHT channel for IBSS. If
that is set, the first 80 MHz segment is specified based on the
frequency parameter in the network profile and the second segment is
selected automatically (which will practically be limited to a single
possibility due to DFS requirements in most countries).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-26 17:47:15 +02:00
Ahmad Kholaif
c27f4c9006 P2P: Add support for VHT 80+80 MHz and 160 MHz
The new max_oper_chwidth and freq2 arguments to P2P_CONNECT, P2P_INVITE,
and P2P_GROUP_ADD control interface commands can be used to request
larger VHT operating channel bandwidth to be used than the previously
used maximum 80 MHz.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-25 19:01:20 +02:00
Ahmad Kholaif
bee5d8e067 nl80211: Add VHT 160 MHz channel flags
This extends the previous design that covered only the VHT 80 MHz cases
for VHT channel flags. New functions are introduced to allow 160 MHz
bandwidth cases to determine the center channel and check availability
of a 160 MHz channel.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-25 19:01:14 +02:00
Ahmad Kholaif
5e1da9c8fd P2P: Define operating classes for VHT 80+80 and 160
This adds definitions for the global operating classes 129 and 130 for
VHT 80+80 MHz and 160 MHz use cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-25 19:01:10 +02:00
Dedy Lansky
ea7081185e FST: Improve parsing of Multiband IEs
Previously, MB IEs were parsed only from association event. Try to get
MB IEs from other management frames like Probe Response frames. The MB
IEs from the association event may not be up-to-date and in some cases
may actually be missing and updating the information based on other
frames can improve robustness of FST exchanges.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-25 17:33:31 +02:00
Jouni Malinen
39c3c9b7dc Remove wpa_supplicant/tests
There was only a single file remaining in this directory. All the other
old test functionality has been moved under the top level tests
directory. Move the remaining file to the wpa_supplicant directory to
get rid of the subdirectory.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-24 00:00:21 +02:00
Jouni Malinen
1fff13a9cb tests: Move EAP-SIM PRF module test into the hwsim framework
The old wpa_supplicant/Makefile target test-eap_sim_common did not work
anymore and anyway, this test is better placed in the newer hwsim
framework to make sure the test case gets executed automatically.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-24 00:00:21 +02:00
Jouni Malinen
9b635d0bde Remove link_test and test_wpa
These wpa_supplicant test programs have not been maintained for years
and it would take significant effort to get these into working state.
Since there does not seem to be any real need for these based on lack of
maintenance, it is easier to just drop these tools for now.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-24 00:00:21 +02:00
Jouni Malinen
9e68742ef1 Fix CONFIG_NO_WPA=y build
Number of places were calling functions that are not included in
CONFIG_NO_WPA=y build anymore. Comment out such calls. In addition, pull
in SHA1 and MD5 for config_internal.c, if needed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-23 23:34:52 +02:00
Jouni Malinen
eb926f1257 Comment out wpas_reenabled_network_time with CONFIG_NO_SCAN_PROCESSING
This removes a compiler warning about unused function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-23 23:33:55 +02:00
Ilan Peer
ed7820b484 P2P: Add a testing option to force P2P GO CSA
Add a testing option to force a P2P GO CSA on successful
invitation to join an active P2P GO.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-11-22 21:49:19 +02:00
Ilan Peer
6cbbae2cf8 P2P: Set p2p_go_wait_client in invitation_result() cb
When an invitation to join an existing group is accepted by the
peer device, set p2p_go_wait_client to the current time so
that wpas_p2p_in_progress() would return != 0, thus preventing
P2P CSA, scanning etc., that would interfere with the peer
device connection.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2015-11-22 21:46:43 +02:00
Avraham Stern
cadffacb3f wpa_cli: Add an option to set created interface type
Add an option to set the interface type when creating
a driver interface.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:50:05 +02:00
Avraham Stern
0f039e3432 Add an option to create interface of a certain type with INTERFACE_ADD
Some drivers do not support having two station interfaces, so the fact
that wpa_supplicant always creates a new interface in station mode, even
if it will be used as another type of interface, may prevent
wpa_supplicant from creating new interfaces. Allow setting the interface
type when a new interface is created so that interfaces of supported
types can be created.

Currently supported types are station ("sta") and AP ("ap"). If the
interface type is not specified, a station interface will be created.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:46:54 +02:00
Avraham Stern
d8a3b66d7f driver: Make setting up AP optional when creating AP interface
When an AP interface it created, it is also setup and subscribes
for management frames etc. However, when the interface is added by
wpa_supplicant, setting up for AP operations is redundant because
it will be done by wpa_supplicant on wpa_drv_init() when setting
the interface mode to AP.

In addition, it may cause wpa_supplicant to fail initializing the
interface as it will try to subscribe for management frames on this
interface but the interface is already registered.

Change this, so when adding an AP interface, make setting up the AP
optional, and use it only when the interface is added by hostapd but not
when it is added by wpa_supplicant.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-22 17:42:59 +02:00
Avraham Stern
2c51c0bd83 P2P: Clear send action work without waiting on find/stop/listen
When clearing pending TX action to start a new P2P operation like
P2P_FIND or P2P_LISTEN, wpas_p2p_action_tx_clear() was used to clear
the send action work. However, in cases where the action work has wait
time, it is not cleared immediately but only after the wait time ends.
This may cause delay in starting the P2P operation.

Fix that by always clearing the send action work immediately on these
P2P commands that result in immediate P2P state change and practically
stopping a previous operation, if one was pending.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2015-11-21 18:53:22 +02:00
Ravi Joshi
f32227ed9e Add QCA vendor attribute and event to indicate subnet change status
This allows offloaded roaming to inform user space of the change in IP
subnet post roaming. The device may have roamed to a network which is in
a different subnet which will result in IP connectivity loss. Indicating
the change in subnet enables the user space to refresh the IP address or
to perform IP subnet validation if unknown status is indicated.

The driver indication is reported with a new event from wpa_supplicant
in the following format:
CTRL-EVENT-SUBNET-STATUS-UPDATE status=<0/1/2>
where
0 = unknown
1 = IP subnet unchanged (can continue to use the old IP address)
2 = IP subnet changed (need to get a new IP address)

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-20 11:03:06 +02:00
Jouni Malinen
d38c7be0f0 Skip SELECT_NETWORK steps only if already connected or connecting
Commit 2a6f78fbbe ('Do not re-associate on
SELECT_NETWORK to current network') started skipping all SELECT_NETWORK
connection steps if the selected network had already been selected
previously. This happened regardless of whether the connection was
already established. This is not necessarily desirable for all cases
where there is no immediate action to even try to connect (e.g., long
wait for the next scan).

Speed this up by allowing the SELECT_NETWORK operation to get started if
there is no connection or ongoing connection attempt with the selected
network.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-20 00:45:40 +02:00
Peter Oh
a65efbfb24 Add VHT support for Mesh
Mesh Points themselves have capability to support VHT as long as
hardware supports it. However, supporting VHT in mesh mode was disabled
because no one had clearly tested and confirmed its functionality. Since
VHT80 has now been verified to work with ath10k QCA988X driver and
mac80211_hwsim, enable VHT support in mesh mode.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2015-11-19 11:37:41 +02:00
Peter Oh
a73c984261 Set WMM flag to Mesh STA by default
Set WLAN_STA_WMM flag to Mesh STA by default since Mesh STAs are QoS
STAs. Mesh STA's HT capabilities won't be parsed properly without the
flag.

Signed-off-by: Peter Oh <poh@qca.qualcomm.com>
2015-11-19 11:37:17 +02:00
Sunil Dutt
5e238cc682 WPS: Reconnect for a failed data connection when STA_AUTOCONNECT is 0
If "STA_AUTOCONNECT 0" has been used to disable automatic connection on
disconnection event and the driver indicates a failure for the data
connection after successful WPS handshake, it is possible to hit a case
where wpa_s->disconnected is set to 1 and further attempts to connect
shall stop.

While "STA_AUTOCONNECT 0" is used to disable automatic reconnection
attempts in general, this specific WPS case can benefit from trying
again even with that configuration for a short period of time. Extend
the wpa_supplicant re-enable-networks-after-WPS 10 second timeout to
apply for ignoring disabled STA_AUTOCONNECT immediately after a WPS
provisioning step.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-11-17 19:50:34 +02:00
MAYANK HAARIT
442cc8cc41 dbus: Fix memory leak in sending InvitationReceived signal
Free the message after message send in
wpas_dbus_signal_p2p_invitation_received() to avoid leaking memory.

Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
Signed-off-by: Avichal Agarwal <avichal.a@samsung.com>
2015-11-17 17:20:03 +02:00
Samuel Tan
07e3653922 dbus: Do not use pointer arithmetic with a void pointer
This failed to compile on x86 gcc due to pointer arithmetic on a void
pointer.

Signed-off-by: Samuel Tan <samueltan@google.com>
2015-11-15 19:34:51 +02:00
Samuel Tan
3b49719130 Android: Use libdbus rather than dbus-1
The upstream wpa_supplicant uses the dbus-1 library when it is compiled
with D-Bus support. In Android, we imported the D-Bus shared libraries
under the name "libdbus", so use this shared library instead of dbus-1
when compiling wpa_supplicant with D-Bus support.

Signed-off-by: Samuel Tan <samueltan@google.com>
2015-11-15 19:26:49 +02:00
Ben Greear
5b75ecead3 Document passive_scan option for wpa_supplicant.conf
This should save the next person to need this behavior some time.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2015-11-15 19:25:05 +02:00
Purushottam Kushwaha
2d0fe6bc4e dbus: Add SaveConfig to update configuration file
This is similar to SAVE_CONFIG on control interface, which allow users
to update the configuration file.

Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-11-15 19:04:15 +02:00
Purushottam Kushwaha
fb7e7daeff dbus: Fix a copy-paste error in debug print
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-11-15 18:53:51 +02:00
Jouni Malinen
03ed0a5239 WNM: Ignore WNM-Sleep Mode Response if WNM-Sleep Mode has not been used
The AP is not expected to send out a WNM-Sleep Mode Response frame
without the STA trying to use WNM-Sleep Mode. Drop such unexpected
responses to reduce unnecessary processing of the frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Jouni Malinen
2cb28a4c75 WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use
WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is
enabled. Verify that PMF is in use before using this field on station
side to avoid accepting unauthenticated key updates. (CVE-2015-5310)

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-10 18:40:54 +02:00
Max Stepanov
73ed03f333 wpa_supplicant: Add GTK RSC relaxation workaround
Some APs may send RSC octets in EAPOL-Key message 3 of 4-Way Handshake
or in EAPOL-Key message 1 of Group Key Handshake in the opposite byte
order (or by some other corrupted way). Thus, after a successful
EAPOL-Key exchange the TSC values of received multicast packets, such as
DHCP, don't match the RSC one and as a result these packets are dropped
on replay attack TSC verification. An example of such AP is Sapido
RB-1732.

Work around this by setting RSC octets to 0 on GTK installation if the
AP RSC value is identified as a potentially having the byte order issue.
This may open a short window during which older (but valid)
group-addressed frames could be replayed. However, the local receive
counter will be updated on the first received group-addressed frame and
the workaround is enabled only if the common invalid cases are detected,
so this workaround is acceptable as not decreasing security
significantly. The wpa_rsc_relaxation global configuration property
allows the GTK RSC workaround to be disabled if it's not needed.

Signed-off-by: Max Stepanov <Max.Stepanov@intel.com>
2015-11-01 21:00:22 +02:00
Jouni Malinen
ea6030c77f Restore previous wpa_state in scan-only result handler
The SCAN TYPE=ONLY results do not trigger a connection operation
automatically. As such, there was no explicit operation that would
change wpa_state after such a scan-only operation and WPA_SCANNING state
could have been left in effect until the next operation is triggered by
an external command. This is not desirable, so restore the wpa_state
that was in use when the scan was started in case WPA_SCANNING state is
still set when the scan operation completes.

This was triggered by the following mac80211_hwsim test sequence:
dbus_wps_oom scan_trigger_failure

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-01 20:26:35 +02:00
Jouni Malinen
1e74ae4de9 WNM: Clear BSS TM data if already associated with preferred candidate
Previously, wnm_deallocate_memory() was called only if we decided to
move to another BSS at the completion of an accepted BSS Transition
Management Request. This resulted in the candidate information being
left in effect for the following scan operation if we were already
associated with the preferred candidate. This could result in unexpected
behavior in the following connection attempt.

Fix this by clearing the candidate information even if we do not need to
roam to another BSS.

This was triggered with mac80211_hwsim test cases in this sequence:
wnm_bss_tm ap_track_sta_force_2ghz

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-01 20:09:11 +02:00
Jouni Malinen
a34eace204 dbus: Remove unused dict helper functions
There are no callers for these helper functions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-11-01 00:16:57 +02:00
Purushottam Kushwaha
cdcb2d0e7f wpa_cli: Add support for vendor_elem_* commands
Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Avichal Agarwal <avichal.a@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-10-31 21:56:59 +02:00
Jouni Malinen
1f1e619282 Add test programs for checking libwpa_client linking
libwpa_test1 and libwpa_test2 targets can now be used to check
libwpa_client linking for static and shared library cases respectively.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-10-31 21:56:59 +02:00
Jörg Krause
736b7cb2da wpa_supplicant/Makefile: Fix libwpa_client build
Building libwpa_client requires src/utils/common.c for bin_clear_free()
else loading the library fails with:

Error relocating /usr/lib/libwpa_client.so: bin_clear_free: symbol not found

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
2015-10-31 19:15:37 +02:00
Dan Williams
e50c50d5a0 dbus: Expose interface globals via D-Bus properties
All interface globals are now exposed as D-Bus properties of type
string, and parsed via the normal interface global parsing functions.

Signed-off-by: Dan Williams <dcbw@redhat.com>
2015-10-28 23:41:32 +02:00
Dan Williams
1aa0fb77ea dbus: Pass property description to getters/setters
We'll use it later for global interface properties.

Signed-off-by: Dan Williams <dcbw@redhat.com>
2015-10-28 23:40:49 +02:00
Jouni Malinen
8f3ea3175f tests: Fix build without CONFIG_ERP=y
hmac_sha256_kdf() got pulled in only if CONFIG_ERP=y is set. Fix
test_sha256() by making the test case conditional on the function being
present.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-10-26 00:42:14 +02:00
Lubomir Rintel
1248e58492 wpa_supplicant: Reopen debug log file upon receipt of SIGHUP signal
This is useful for logrotate to be able to rotate the file even if the
control interface is not enabled (e.g., when using DBus).

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
2015-10-25 20:45:02 +02:00
Mohammed Shafi Shajakhan
67deaa582d l2_packet: Add build option to disable Linux packet socket workaround
Linux packet socket workaround(*) has an impact in performance when the
workaround socket needs to be kept open to receive EAPOL frames. While
this is normally avoided with a kernel that has the issue addressed by
closing the workaround packet socket when detecting a frame through the
main socket, it is possible for that mechanism to not be sufficient,
e.g., when an open network connection (no EAPOL frames) is used.

Add a build option (CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y) to disable the
workaround. This build option is disabled by default and can be enabled
explicitly on distributions which have an older kernel or a fix for the
kernel regression.

Also remove the unused variable num_rx.

(*) Linux kernel commit 576eb62598f10c8c7fd75703fe89010cdcfff596
('bridge: respect RFC2863 operational state') from 2012 introduced a
regression for using wpa_supplicant with EAPOL frames and a station
interface in a bridge.

Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
2015-10-25 19:56:53 +02:00