Commit graph

14954 commits

Author SHA1 Message Date
Jouni Malinen
528f263c4a FT: Reject over-the-DS response with MFPC=0 if PMF is required
If FT over-the-DS case is enforced through the "FT_DS <BSSID>" control
interface command, the PMF capability check during BSS selection is not
used and that could have allowed PMF to be disabled in the over-the-DS
case even if the local network profile mandated use of PMF. Check
against this explicitly to avoid unexpected cases if the APs within the
same mobility domain are not configured consistently.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 13:55:26 +03:00
Jouni Malinen
ae05b6a215 RSN: Do not allow connection to proceed without MFPC=1 if PMF required
PMF capability check is done as part of BSS selection routines, but
those are not used when going through the enforced roaming operation
("ROAM <BSSID>" control interface command). While that mechanism is
mainly for testing purposes, extend it to do the same check for PMF to
prevent cases where forced roaming could end up disabling PMF against
the local profile requirement.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 13:48:16 +03:00
Jouni Malinen
ded56f2faf FT: Fix MFPR flag in RSNE during FT protocol
Commit e820cf952f ("MFP: Add MFPR flag into station RSN IE if 802.11w
is mandatory") added indication of MFPR flag in non-FT cases, but forgot
to do so for the FT protocol cases where a different function is used to
build the RSNE. Do the same change now for that FT specific case to get
consistent behavior on indicating PMF configuration state with MFPR.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 13:23:06 +03:00
Ankita Bajaj
0028d627c8 OCE: Mandate PMF for WPA2 association with OCE AP
An OCE AP with WPA2 enabled shall require PMF negotiation when
associating with an OCE STA. An OCE STA-CFON may negotiate PMF with a
STA when it is operating as an AP. Don't select an OCE AP for connection
if PMF is not enabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-15 19:06:53 +03:00
Purushottam Kushwaha
84ebc759a0 HS 2.0: Match credentials based on required_roaming_consortium
When required_roaming_consortium is set in a credential, station
should match this against Roaming Consortium(s) for a BSS similar
to how it is matching for roaming_consortiums during Interworking
credentials availability check for roaming_consortium.

In the context of Hotspot 2.0 PPS MO, this means addressing matching
part in the same manner for HomeSP/HomeOIList/<X+>/HomeOI regardless of
how HomeSP/HomeOIList/<X+>/HomeOIRequired is set (i.e., the required
part is used as an independent check for the AP advertising the needed
information while the "credential can be used here and this is a home
network" part is shared).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-15 16:51:02 +03:00
Jouni Malinen
b6fe6e8b5a tests: SAE and PMKSA caching (PMKID in AssocReq after SAE)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 17:51:31 +03:00
Jouni Malinen
d2b2083843 SAE: Allow PMKID to be added into Association Request frame following SAE
IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but
it is not disallowed either, so it is useful to have an option to
identify the derived PMKSA in the immediately following Association
Request frames. This is disabled by default (i.e., no change to previous
behavior) and can be enabled with a global wpa_supplicant configuration
parameter sae_pmkid_in_assoc=1.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 17:49:23 +03:00
Jouni Malinen
2ca23faf1c Make wpa_insert_pmkid() more generic
This is not used only with FT, so make the comments less confusing and
include the function in all builds to make it available for
non-FT/non-FILS builds.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 17:47:58 +03:00
Sven Eckelmann
d1fcf34cb5 tests: Fix wlan.mesh.config.cap workaround for test_wpas_mesh_max_peering
The wlan.mesh.config doesn't have to be the last element of beacon. Things
like VHT or HE oper/cap are usually follow the mesh configuration element.

The workaround must first get the position of a correct reference value in
wlan.mesh.config (ps_protocol) and then calculate the correct
wlan.mesh.config.cap offset based on that.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Fixes: 2cbaf0de22 ("tests: Work around tshark bug in wpas_mesh_max_peering")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
2019-08-13 13:57:50 +03:00
John Crispin
05822609d1 HE: MCS size is always a minimum of 4 bytes
The MCS set always has a minimal size of 4 bytes. Without this change
HE20 failed to work.

Signed-off-by: John Crispin <john@phrozen.org>
2019-08-11 18:04:26 +03:00
Sven Eckelmann
df4f959988 nl80211: Don't force VHT channel definition with HE
HE (802.11ax) is also supported on 2.4 GHz. And the 2.4 GHz band isn't
supposed to use VHT operations. Some codepaths in wpa_supplicant will
therefore not initialize the freq->bandwidth or the freq->center_freq1/2
members. As a result, the nl80211_put_freq_params() will directly return
an error (-1) or the kernel will return an error due to the invalid
channel definition.

Instead, the channel definitions should be created based on the actual
HT/VHT/none information on 2.4 GHz.

Fixes: ad9a1bfe78 ("nl80211: Share VHT channel configuration for HE")
Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-08-11 18:04:26 +03:00
Matthew Wang
dd0153fced Check for LEAP before doing FT
According to https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html
Cisco does not support EAP-LEAP with Fast Transition. Here,
we check for LEAP before selecting FT 802.1X key management
suite.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2019-08-11 18:04:24 +03:00
Jouni Malinen
ba2d5f3642 tests: DPP network introduction with expired netaccesskey
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:45:43 +03:00
Jouni Malinen
ed98d4d719 tests: SAE dot11RSNASAESync
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
6126e5f970 Fix a typo in hostapd config documentation
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
4c9376ef7a tests: OCE AP
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
63a792a7c5 tests: WPS registrar configuring an AP using preconfigured AP password token
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
a14e266dff tests: HE AP parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
d23362a679 tests: OCV on 2.4 GHz with PMF getting enabled automatically
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
2d53b0c3d2 tests: acs_exclude_dfs=1
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
c6ab7b55a6 tests: FT RKH parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
5916637cf2 tests: FT PMK-R0/R1 expiration
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
6379bd6acf tests: Server checking CRL with check_crl_strict=0
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
698a0067c9 Fix check_crl_strict documentation
The OpenSSL error codes used here were for certificates, not CRLs. Fix
that to refer to CRL being expired or not yet valid.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
ce30a79a14 tests: private_key_passwd2 in hostapd configuration
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
09839cab75 tests: Additional hostapd configuration parser coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-11 16:37:48 +03:00
Jouni Malinen
aa8ea7abc9 tests: Additional dpp_controller parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 18:45:37 +03:00
Jouni Malinen
161f1d5d7c tests: Additional sae_password parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 18:37:54 +03:00
Jouni Malinen
3bfa7f798b tests: Additional tls_flags coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 17:22:32 +03:00
Jouni Malinen
8d231c5e3b tests: Additional operator_icon parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 17:06:40 +03:00
Jouni Malinen
a32f4c226d tests: Additional osu_nai2 parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 17:04:27 +03:00
Jouni Malinen
c805a7aeb7 tests: Additional venue_url parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 17:02:10 +03:00
Jouni Malinen
95b493dc40 tests: Additional eap_user_file parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 16:35:11 +03:00
Jouni Malinen
3d276ba530 tests: Additional vlan_file parsing coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-10 16:16:29 +03:00
Rajeev Kumar Sirasanagandla
485dd425ba Add QCA vendor command for avoid frequency feature
Add vendor command QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY_EXT
and attribute qca_wlan_vendor_attr_avoid_frequency_ext to send structured
avoid frequency data.

This new command is alternative to existing command
QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY since existing command is
using stream of bytes instead of structured data using vendor attributes.

Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
2019-08-09 19:52:24 +03:00
Rajeev Kumar Sirasanagandla
6ae1247bfa Update QCA vendor attributes for 6 GHz band support
As a part of P802.11ax amendment, 6 GHz band operation is added.

Since the 6 GHz channel numbers are overlapping with existing 2.4 GHz
and 5 GHz channel numbers, use frequency to identify unique channel
operation instead of channel number. Channel frequency is unique across
bands.

In the existing QCA vendor interface, wherever missing, add frequency
attributes to identify unique channel operation. In addition, add
comments to document some of the previously missed attributes/values.

Note: If both channel and frequency attributes are present in vendor
command/event and
(a) If both the driver and user-space application supports 6 GHz band
then channel related attributes are deprecated and use frequency
attributes.
(b) If either driver or user-space application or both doesn't
support 6 GHz band then use channel attributes.

Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
2019-08-09 19:52:24 +03:00
Rajeev Kumar Sirasanagandla
aa23ece3de Add QCA vendor channel attribute to restart AP
Add QCA_WLAN_VENDOR_ATTR_SAP_CONFIG_CHANNEL attribute in
enum qca_wlan_vendor_attr_sap_config to use with vendor command
QCA_NL80211_VENDOR_SUBCMD_SET_SAP_CONFIG.

This new attribute is used to restart AP on given channel.

Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
2019-08-09 19:52:23 +03:00
Rajeev Kumar Sirasanagandla
85508ecf67 Add QCA vendor command to configure ACS policy
Add a QCA vendor sub command QCA_NL80211_VENDOR_SUBCMD_ACS_POLICY
with attributes enum qca_wlan_vendor_attr_acs_config and
enum qca_acs_dfs_mode to configure ACS policy.

Signed-off-by: Rajeev Kumar Sirasanagandla <rsirasan@codeaurora.org>
2019-08-09 19:52:23 +03:00
Srinivas Dasari
2395fdb67b Add QCA vendor attributes to enhance roaming configuration
This enhances the existing vendor command QCA_NL80211_VENDOR_SUBCMD_ROAM
with the following configurations:
1. Set/get/clear roam control
2. Set/get the channels on which the roaming has to be triggered.
3. Set/get the roam scan period.
4. Configure the triggers for roaming.
5. Configure the candidate selection criteria.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-08 23:52:06 +03:00
Sunil Dutt
1425caac28 Rename qca_wlan_vendor_attr_roam_subcmd to represent subcmds
qca_wlan_vendor_attr_roam_subcmd is an enum associated with the
attribute QCA_WLAN_VENDOR_ATTR_ROAMING_SUBCMD. It represents different
sub command values and these are not the attributes. Hence, rename the
enum to qca_wlan_vendor_roaming_subcmd. Accordingly, the members of this
enum are also renamed to suite the usage.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-08 18:45:08 +03:00
Sunil Dutt
f131196319 Document the attributes used by QCA_NL80211_VENDOR_SUBCMD_ROAM
This commit documents the attributes used by
QCA_NL80211_VENDOR_SUBCMD_ROAM.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-08 18:45:04 +03:00
Jouni Malinen
b0b25c5bbc Clear external eapSuccess setting in driver-authorized cases
The conditions for the eapol_sm_notify_eap_success(FALSE) calls did not
cover the case where eapol_sm_notify_eap_success(TRUE) had been called
based on offloaded 4-way handshake and driver notification of
authorization in wpa_supplicant_event_port_authorized(). This could
result in eapSuccess and altSuccess state machine variables being left
TRUE when roaming to another BSS and that results in EAP failure if the
following roaming case does not get fully authorized through the driver
offload.

Fix this by clearing eapSuccess/altSuccess when processing a new
association (including roaming) event and also when disconnecting from
the network.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 19:24:06 +03:00
Jouni Malinen
fa1d5ec182 The master branch is now used for v2.10 development
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-07 17:51:53 +03:00
Jouni Malinen
ca8c2bd28a Preparations for v2.8 release
Update the version number for the build and also add the ChangeLog
entries for both hostapd and wpa_supplicant to describe main changes
between v2.7 and v2.8.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-08-07 16:25:25 +03:00
Jouni Malinen
d1fb06c947 tests: Check wait_event argument type
It was clearly too easy to get unexpected behavior by accidentially
passing in a string instead of a list of strings to these functions, so
enforce the correct type to notice such issues automatically.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:57:22 +03:00
Jouni Malinen
12c5c2404e tests: Fix ap_vht_csa_vht40 to use list of events with wait_event()
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:57:22 +03:00
Jouni Malinen
0e2605b948 tests: Fix concurrent_autogo_crossconnect to use list of events with wait_event()
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:57:22 +03:00
Jouni Malinen
79b44113ec tests: Fix ap_vht_csa_vht40_disable to use list of events with wait_event()
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:57:22 +03:00
Jouni Malinen
d371f0cbbf tests: Fix eap_proto_otp to use list of events with wait_event()
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:57:22 +03:00
Jouni Malinen
c4a9610e8f tests: Fix hostapd.wait_sta()
wait_event() expects a list of events instead of a single event name.
The previous implementation of wait_sta() did not really wait for
AP-STA-CONNECT; instead, it returned the next event from hostapd
regardless of what that event was.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-07 12:36:36 +03:00