Commit graph

16389 commits

Author SHA1 Message Date
Jouni Malinen
e4adbacafd GAS: Fix memory leak on some DPP error paths
One of the code paths left behind a response buffer. Free this properly
on this missed code path as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 23:47:44 +03:00
Jouni Malinen
29ff74aef0 tests: Additional coverage for OWE PMKSA caching
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 14:03:30 +03:00
Jouni Malinen
8aa91282a1 Fix EAPOL-Key msg 1/4 processing in a corner case
If reassoc_same_bss_optim=1 is used to optimize reassociation back to
the same BSS, it was possible for sm->pmk_len to be 0 due to a
disconnection event getting processed after sending out the
reassociation request. This resulted in wpa_sm_rx_eapol() calling
wpa_mic_len() with incorrect PMK length when PMKSA caching was being
attempted. That resulted in incorrect mic_len getting determined and not
finding the correct Key Data Length field value. This could result in
failing to complete 4-way handshake successfully.

Fix this by updating the current PMK length based on the selected PMKSA
cache entry if sm->pmk_len is not set when processing EAPOL-Key msg 1/4.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 14:00:34 +03:00
Chittur Subramanian Raman
96e63008fb OWE: Do not add DH Params element in AssocResp with PMKSA caching
As per RFC 8110 (Opportunistic Wireless Encryption), if the AP has the
PMK identified by the PMKID and wishes to perform PMK caching, it will
include the PMKID in the Association Response frame RSNE but does not
include the Diffie-Hellman Parameter element.

This was already addressed for most cases with owe_process_assoc_req()
not setting sta->owe_ecdh in case PMKSA caching is used. However, it was
possible to an old STA entry to maintain the initial sta->owe_ecdh value
if reassociation back to the same AP was used to initiate the PMKSA
caching attempt. Cover that case by adding an explicit check for the
time when the Association Response frame is being generated.

Signed-off-by: Chittur Subramanian Raman <craman@maxlinear.com>
2020-08-22 13:33:10 +03:00
Yegor Yefremov
27ac632ae3 gitignore: Ignore ctags tags file
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2020-08-22 13:02:23 +03:00
Jouni Malinen
9bc8811538 DPP2: Fix build without IEEE8021X_EAPOL
The local network profile parameters for EAP are not available without
IEEE8021X_EAPOL, so do not try to set these in builds that do not
include any EAP support.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 12:49:05 +03:00
Brian Norris
22c06de911 wlantest: Avoid heap-overflow on unexpected data
We're doing a sort of bounds check, based on the previous loop, but only
after we've already tried to read off the end.

This squashes some ASAN errors I'm seeing when running the ap_ft hwsim
test module.

Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-08-22 12:45:09 +03:00
Jouni Malinen
2caff11d7a LibreSSL: Fix build with LibreSSL versions older than 2.9.1
SSL_add0_chain_cert() was not available in LibreSSL before version
2.9.1.

Fixes: 4b834df5e0 ("OpenSSL: Support PEM encoded chain from client_cert blob")
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 11:32:01 +03:00
Jouni Malinen
5dedbd582a tests: Fix wnm fuzzer build regression
Addition of MSCS support broke the test tool build due to references to
a functions from a new file. Fix this by bringing in that file to the
fuzzer build as well.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 11:12:17 +03:00
Jouni Malinen
55a366d7a8 dpp-nfc: Fix recv_octets() regression
The updated socket.poll() loop did not terminate properly in cases where
no response is available. Fix that to check for both False and None.

Fixes: 1733e356e4 ("dpp-nfc: Fix handover client wait for receiving handover select")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-15 00:26:21 +03:00
Veerendranath Jakkam
90e05626f0 Add test configuration to ignore SA Query timeout
Add a new QCA vendor attribute to configure the driver/firmware to
ignore SA Query timeout. If this configuration is enabled the
driver/firmware shall not send Deauthentication frame when SA Query
times out. This is required to support STA testbed role.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-14 23:10:37 +03:00
Veerendranath Jakkam
a2d35b49e7 Fix documentation for the test configuration attributes of FT-SAE/OCV
These vendor attributes for FT/OCV/SAE testing can be configured only
when the STA is in connected state. Update the documentation of the
attributes to reflect the same.

Fixes: 18f3f99ac4 ("Add vendor attributes to configure testing functionality for FT/OCV/SAE")
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-14 23:08:39 +03:00
Veerendranath Jakkam
5d2218e618 Add get_sta_info vendor attrs to get BIP failure counters for STA mode
Add support to get number of MIC errors, missing MME incidents, and
packet replay incidents observed while using IGTK/BIGTK keys when PMF
and/or beacon protection features are enabled.

These counters are applicable only for STA mode and can be fetched
through the QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO vendor command.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-14 23:06:03 +03:00
Jouni Malinen
f6ddda443d tests: sigma_dut DPP AP as TCP Enrollee/initiator
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 17:31:57 +03:00
Jouni Malinen
c6a760b9c4 DPP: Add process_conf_obj into TCP connection data struct
This is needed to avoid issues with hostapd not having set this function
pointer in dpp_global.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 17:31:51 +03:00
Jouni Malinen
7f366fcbdc DPP: Add msg_ctx into TCP connection data struct
This is needed to avoid issues with hostapd not having set msg_ctx in
dpp_global.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 17:26:32 +03:00
Jouni Malinen
6aa7aa8089 DPP2: hostapd/AP as Enrollee/Initiator over TCP
Extend DPP support in hostapd to allow AP Enrollee role when initiating
the exchange using TCP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 16:44:38 +03:00
Vinita S. Maloo
d21dde9dac MSCS: Send MSCS change/remove frames only if MSCS setup exists
Allow MSCS change/remove request to be sent only after an initial setup,
i.e., after an add request has been accepted.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
af8ab3208d MSCS: Parse result of MSCS setup in (Re)Association Response frames
Add support to parse the (Re)Association Response frames to check if the
AP has accepted/declined the MSCS request in response to the
corresponding (Re)Association Request frame. AP indicates the result by
setting it in the optional MSCS Status subelement of MSCS Descriptor
element in (Re)Association Response frame.

This MSCS Status subelement is defined in the process of being added
into P802.11-REVmd/D4.0 (11-20-0516-17-000m-cr-mscs-and-cid4158).

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
c504ff5398 MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq
Include the MSCS Descriptor IE in the (Re)Association Request frames to
setup MSCS between the AP and the STA during association.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
bbd3178af4 MSCS: Add support to process MSCS Response frames
Add support to receive and process MSCS Response frames from the AP and
indicate the status to upper layers.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
a118047245 MSCS: Add support to send MSCS Request frames
Add support to send MSCS add/change/remove types of Action frames
to the connected AP.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:35 +03:00
Jouni Malinen
1733e356e4 dpp-nfc: Fix handover client wait for receiving handover select
This was supposed to wait for up to 3.0 seconds for the handover select,
but the incorrect loop terminated ended up limiting this to a single
iteration of 0.1 second wait. This was too fast for some cases like the
AP mode operation where it may take significant time to enable the radio
for listening to DPP authentication messages.

Fix the loop to allow that full three second wait for the response to be
used. In addition, report the amount of time it takes to receive the
response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 00:11:44 +03:00
Veerendranath Jakkam
596d99567a SME: Process channel switch event in SME only when supplicant's SME is used
Do not process channel switch event in wpa_supplicant's SME when SME is
offloaded to the driver/firmware to avoid SA Query initiation from both
wpa_supplicant and the driver/firmware for the OCV case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 21:39:49 +03:00
Rohan
0fa274d2bf Derive seg0_idx and seg1_idx for 6 GHz when processing channel switch
The function hostapd_event_ch_switch() derived the seg0_idx and seg1_idx
values only for the 5 GHz and 2.4 GHz bands and the 6 GHz case ended up
using incorrect calculation based on the 5 GHz channel definitions.

Fix this by adding support for 6 GHz frequencies.

Signed-off-by: Rohan <drohan@codeaurora.org>
2020-08-13 21:37:49 +03:00
Pooventhiran G
5644b23de1 QCA vendor command to update SSID
Add a QCA vendor subcommand QCA_NL80211_VENDOR_SUBCMD_UPDATE_SSID
to update the new SSID in hostapd. NL80211_ATTR_SSID is used to encapsulate
the new SSID.

Signed-off-by: Pooventhiran G <pooventh@codeaurora.org>
2020-08-13 21:34:19 +03:00
Min Liu
cd708e8ff9 Add a vendor command for medium assessment
Introduce a vendor command for medium assessment through
QCA_NL80211_VENDOR_SUBCMD_MEDIUM_ASSESS.

Signed-off-by: Min Liu <minliu@codeaurora.org>
2020-08-13 21:34:17 +03:00
Harshal Udas
cc9fe46b3a Add AllPlay type to the QCA vendor element
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 21:24:37 +03:00
Jouni Malinen
97e6ead423 tests: GAS/ANQP query without scan
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:51:12 +03:00
Veerendranath Jakkam
170775232d ANQP: Add support to specify frequency in ANQP_GET command
Previously, wpa_supplicant fetched BSS channel info from scan results to
send ANQP Query frames. If the scan results for the specified BSS are
not available, the ANQP_GET command request was getting rejected.

Add support to send ANQP Query frame on the specified frequency without
requiring the scan results to be available.

The control interface command format:
- ANQP_GET <dst_addr> [freq=<freq in MHz>] <Query ID1>[,<Query ID2>,..]

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:51:00 +03:00
Veerendranath Jakkam
43106e122b GAS: Update source MAC address on preassoc_mac_addr randomization
The GAS query source MAC address was not getting updated correctly when
preassoc_mac_addr is enabled. Fix this by copying the current MAC
address to the GAS query source address.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:34:43 +03:00
Veerendranath Jakkam
1289ecf4cc GAS: Ignore preassoc_mac_addr when gas_rand_mac_addr enabled
Skip unnecessary random MAC generation due to preassoc_mac_addr
parameter when gas_rand_mac_addr parameter is enabled.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:33:27 +03:00
Veerendranath Jakkam
dbe485a35a SAE-PK: Check psk param also to look for SAE-PK acceptable BSS
SAE-PK password can be set using psk parameter also in case of mixed
SAE+PSK networks, so look for acceptable SAE-PK BSS when SAE password
not set and psk parameter meets SAE-PK password criteria.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:31:38 +03:00
Vamsi Krishna
f5388b34eb Add channel TX/RX times to QCA vendor interface of LL stats
Currently the driver/firmware indicates CCA busy time which includes own
TX and RX time and as such, does not allow the CCA busy time due to
other nodes to be computed. Add separate statistics to indicate own
radio TX time and own radio RX time to facilitate userspace applications
to compute CCA busy time because of traffic unintended to this device.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:28:24 +03:00
Vamsi Krishna
9f9c110484 Fix QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO interface documentation
All QCA_WLAN_VENDOR_ATTR_LL_STATS_CHANNEL_* attributes are also nested
within QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO, not only
QCA_WLAN_VENDOR_ATTR_LL_STATS_CHANNEL_INFO* attributes in the current
implementation. Fix QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO documentation
accordingly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:28:00 +03:00
Sunil Dutt
096456c0c2 Enhancements to the TWT attributes/parameters (vendor command)
This commit does the following enhancements to the TWT interface:

Corrects the documentation for QCA_WLAN_TWT_SUSPEND and
QCA_WLAN_TWT_TERMINATE. Specifies that these operations carry the
parameters obtained through QCA_WLAN_VENDOR_ATTR_CONFIG_TWT_PARAMS. This
interface is very recently introduced and missed to document the same.
There are no user space or driver components using this interface yet.
Hence, enhancing/modifying the interface.

Corrects the documentation for
QCA_WLAN_VENDOR_ATTR_TWT_SETUP_WAKE_DURATION. Mentions that the units it
represent is a multiple of 256 microseconds rather than a TU. The host
driver always interpreted this as an unit in 256 microseconds and there
are no user space implementations that are impacted with this change in
the unit. Hence, modifying the documentation.

Introduces QCA_WLAN_VENDOR_ATTR_TWT_RESUME_NEXT2_TWT_SIZE, which is
similar to that of QCA_WLAN_VENDOR_ATTR_TWT_RESUME_NEXT_TWT, but carries
an offset/data of u32 size.

Introduces MAC_ADDR attribute to represent the peer for the TWT setup
and resume operations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:26:03 +03:00
Jouni Malinen
3adc1c623e DPP2: Disconnect before starting reconfiguration
The offchannel operations (scan, Public Action frame TX/RX) have
significantly more latency when performed while connected, so disconnect
when requested to initiate DPP reconfiguration to avoid this. The old
network profile (i.e., likely the current connection) is going to be
replaced in practice and as such, there is no need to try continue that
association any further.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:05:49 +03:00
Jouni Malinen
2afc46a0a9 tests: sigma_dut and second DPP reconfiguration
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:01:32 +03:00
Jouni Malinen
574a8fa6c8 DPP: Do not interpret unknown channel as missing channel list for NFC
While the listed unknown operating class/channel number pairs need to be
ignored, that should be done in a manner than prevents the parsed
bootstrapping info from being used as if it had no channel list (i.e.,
allowing any channel) if there are no known operating class/channel
number pairs.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 18:06:28 +03:00
Jouni Malinen
ab676bc1fa tests: DPP over TCP (mutual)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 12:08:26 +03:00
Jouni Malinen
fc3efe0834 DPP2: Support mutual auth with QR in scan-during-auth-exchange case
Extend DPP authentication session search for the DPP_QR_CODE command to
cover the ongoing exchanges in Controller/Responder.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 12:04:25 +03:00
Jouni Malinen
2e956c37d2 DPP2: Do not close TCP socket when waiting for full Auth Resp
The case where mutual authentication with QR Code bootstrapping is used
with scanning of the QR Code during the exchange resulted in the
Controller closing the TCP socket too early. Fix this by leaving the
socket open while waiting for the full Authentication Response message.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 11:52:25 +03:00
Jouni Malinen
e4e95aabbf DPP2: Allow Controller to be configured to require QR mutual auth
Extend the DPP_CONTROLLER_START command to accept the optional qr=mutual
parameter similarly to the DPP_LISTEN case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 11:41:52 +03:00
Vamsi Krishna
61c249c490 Add QCA vendor attribute to configure number of TX/RX chains
Add support to configure the number of TX chains and the number of RX
chains to be used during a connection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 10:25:52 +03:00
Jouni Malinen
86fd6755cb dpp-nfc: Use --altchan value in handover server
Use the alternative channel list in the handover server role when
processing an alternative proposal. This was previously done only in the
handover client role, but with the updated design, both roles act in a
similar manner for the case where the alternative channel list is
specified.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-11 23:44:48 +03:00
Jouni Malinen
315422196a dpp-nfc: Update listen channel based on channel list when writing a tag
Do not use the hardcoded channel 1 (2412 MHz) with DPP_LISTEN if a
channel list is specified when writing an NFC Tag. Instead, pick the
first channel from that list as the listen channel.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 23:52:11 +03:00
Jouni Malinen
66ffe9d246 DPP2: Update Reconfig Flags attribute format
This was simplified by replacing the JSON encoded value with a single
octet.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 17:36:56 +03:00
Jouni Malinen
57e2e5ed7a tests: DPP over TCP for enterprise provisioning (Controller initiating)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 10:42:49 +03:00
Jouni Malinen
5caf4e094a DPP2: Support RA/CA functionality in Controller initiated case
Extend dpp_control_get_auth() to find the ongoing session for enterprise
credential provisioning in cases where the Controller/Configurator
initiated the exchange. Only the other direction was supported
previously.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 10:41:20 +03:00
Jouni Malinen
b58cd7aa1c tests: DPP reconfiguration retries
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-08 00:14:00 +03:00