Commit graph

129 commits

Author SHA1 Message Date
Jouni Malinen
f3f7540edc Added WLAN_STA_MFP flag for driver wrappers so that they can configure the
driver to enable MFP (IEEE 802.11w) processing for the STA.
2008-06-17 11:21:11 +03:00
Jouni Malinen
94e5af7948 Added support for configuring IGTK
This needs changes in kernel code, too, but the cipher suite for IGTK is
defined in IEEE 802.11w, so this code in hostapd side can be added now.
2008-06-16 11:20:01 +03:00
Jouni Malinen
f598194e7a Removed forgotten todo entry 2008-06-10 20:57:32 +03:00
Jouni Malinen
1ef83fae63 Added support for AP mode Beacon transmission 2008-06-10 20:46:12 +03:00
Jouni Malinen
561c0c4c3e Set ACK flag properly for txstatus 2008-06-10 19:44:26 +03:00
Jouni Malinen
2b5ac52ee0 Use _irqsafe versions of ieee80211 rx and tx_status functions 2008-06-10 19:28:39 +03:00
Jouni Malinen
badba00bd4 Added start/stop handlers and do not send frames to stopped radios 2008-06-10 19:27:00 +03:00
Jouni Malinen
a218a713b8 Added a comment about hwsim# 2008-06-10 18:10:40 +03:00
Jouni Malinen
1f9afa67e3 Added global monitor interface (hwsim#)
This new netdev is created by hwsim, not mac80211, and as such, it is
available all the time (i.e., can be UP before starting mac80211 netdevs)
and it will receive all frames regardless of the channel etc.
2008-06-10 17:11:58 +03:00
Jouni Malinen
a837861751 Fixed tx() handler to use GFP_ATOMIC. 2008-06-10 15:49:06 +03:00
Jouni Malinen
de08c7248d Added mac80211_hwsim - software simulator of 802.11 radio(s) for mac80211
mac80211_hwsim is a Linux kernel module that can be used to simulate
arbitrary number of IEEE 802.11 radios for mac80211 on a single
device. It can be used to test most of the mac80211 functionality and
user space tools (e.g., hostapd and wpa_supplicant) in a way that
matches very closely with the normal case of using real WLAN
hardware. From the mac80211 view point, mac80211_hwsim is yet another
hardware driver, i.e., no changes to mac80211 are needed to use this
testing tool.
2008-06-10 13:31:25 +03:00
Jouni Malinen
3e2ad1b932 Fixed race condition between disassociation event and group key handshake
This avoids getting stuck in state where wpa_supplicant has canceled scans,
but the driver is actually in disassociated state. The previously used code
that controlled scan timeout from WPA module is not really needed anymore
(and has not been needed for past four years since authentication timeout
was separated from scan request timeout), so this can simply be removed to
resolved the race condition. As an extra bonus, this simplifies the
interface to WPA module.
[Bug 261]
2008-06-09 16:26:47 +03:00
Jouni Malinen
2eeaa5c9d0 EAP-PEAP: Moved the common peap_prfplus() function into a shared file 2008-06-09 10:32:12 +03:00
Jouni Malinen
3f5285e852 Added a preliminary nl80211/cfg80211 driver interface for wpa_supplicant
driver_nl80211.c is based on driver_wext.c and it is still using Linux
wireless extensions for many functions. Over time, the new driver interface
code should be modified to use nl80211/cfg80211 for everything.
2008-06-06 16:55:42 +03:00
Jouni Malinen
3f3339dfe7 Fixed a buffer overflow in nla_parse call
The first argument (tb) to nla_parse must have room for maxtype+1, not
maxtype, elements.
2008-06-06 16:51:17 +03:00
Pavel Roskin
f3833aee90 Fix compile warnings on 64-bit systems
Don't cast pointers to int in definitions of PRISM2_HOSTAPD_RID_HDR_LEN
and PRISM2_HOSTAPD_GENERIC_ELEMENT_HDR_LEN.  Use size_t instead.  That's
actually what the code needs.
2008-06-06 14:17:03 +03:00
Jouni Malinen
ad844747ca Updated the LibTomMath reference to use 0.41 version 2008-06-06 10:32:09 +03:00
Jouni Malinen
187bc466a3 Removed the 20% estimate on faster bignum routines
This was not accurate since this was mostly based on total runtime of an
eapol_test run. The real improvement in the bignum routines is much larger
(mayby twice as fast as before).
2008-06-06 10:30:43 +03:00
Jouni Malinen
b95394c66f Combined internal LibTomMath configuration into one option
CONFIG_INTERNAL_LIBTOMMATH_FAST=y in .config can now be used to enable all
optimized routines at a cost of about 4 kB. This is small enough increase
in size to justify simplified configuration.
2008-06-06 10:21:28 +03:00
Jouni Malinen
ec0205a87a Added an option to build internal LibTomMath with faster div routine
At the cost of about 1 kB of additional binary size, the internal
LibTomMath can be configured to include faster div routine to speed up DH
and RSA. This can be enabled with CONFIG_INTERNAL_LIBTOMMATH_FAST_DIV=y in
.config.
2008-06-06 10:11:17 +03:00
Jouni Malinen
b6ab429402 Read Michael MIC keys through TK2 union instead of offset from TK1
This gets rid of potential warnings about buffer bounds errors. The earlier
code works fine, but it is not the cleanest way of using the struct wpa_ptk
definition for TK1/TK2.
2008-06-05 21:00:56 +03:00
Jouni Malinen
7cdeb81e1f Fixed potential NULL pointer dereference if memory allocation fails 2008-06-05 20:44:30 +03:00
Jouni Malinen
815c5e1435 Fixed RADIUS client local address forcing for IPv6 (eapol_test)
Need to use the IPv6 address data in bind() call if IPv6 is selected.
2008-06-05 20:33:33 +03:00
Jouni Malinen
c5f5c91aeb Add faster, optional sqr routine for internal LibTomMath
At the cost of about 0.5 kB of additional binary size, the internal
LibTomMath can be configured to include faster sqr routine to speed up DH
and RSA. This can be enabled with CONFIG_INTERNAL_LIBTOMMATH_FAST_SQR=y in
.config.
2008-06-05 18:33:46 +03:00
Jouni Malinen
4fba48a5a7 Silence compiler warnings about out of array bounds indexes
struct wpa_ie_hdr had separate fields for 24-bit OUI and 8-bit oui_type
for WPA/RSN selectors. {WPA,RSN}_SELECTOR_{GET,PUT} access these four
octets through oui and the "out-of-bounds" access for the fourth octet is
actually reading/writing oui_type. This works fine, but some tools complain
about the array bounds "failure". Since oui_type is never accessed
separately, the simplest fix is to just combine these into a single 4-octet
field.
2008-06-05 17:50:53 +03:00
Dan Williams
1d3c75b3b6 Give adhoc associations a bit more time
Depending on how the driver implements IBSS searching and creation, it
may need to perform one or more scans before successfully completing the
association operation.  Therefore, increase the timeout for IBSS
association operations so that the supplicant doesn't interrupt the
driver as much.
2008-06-04 21:00:09 +03:00
Dan Williams
59c9707863 wext: handle mode switches correctly for mac80211
Since mac80211 requires that the device be !IFF_UP to change the mode
(and I think the old prism54 fullmac driver does too), do that.  This
shouldn't harm fullmac devices since they can handle mode switches on
the fly and usually don't care about up/down that much.
2008-06-04 20:55:57 +03:00
Jouni Malinen
87114163b7 Updated the comments since Montgomery reduction is now included 2008-06-04 11:59:45 +03:00
Jouni Malinen
8ccc0402b2 Internal LibTomMath: add optional support for Montgomery reduction
Add a cost of about 2.5 kB of additional cost, the internal LibTomMath can
be configured to include fast exptmod routine to speed up DH and RSA.
This can be enabled with CONFIG_INTERNAL_LIBTOMMATH_FAST_EXPTMOD=y in
.config.
2008-06-04 11:57:55 +03:00
Jouni Malinen
0527710dd3 Reduce integrated LibTomMath size by dropping negative exponent support
Current uses do not require support for negative exponent in exptmod, so we
can save about 1.5 kB in leaving out invmod.
2008-06-04 11:26:52 +03:00
Jouni Malinen
a8e16edc86 Introduced new helper function is_zero_ether_addr()
Use this inline function to replace os_memcmp(addr,
"\x00\x00\x00\x00\x00\x00", ETH_ALEN) == 0.
2008-06-03 18:08:48 +03:00
Jouni Malinen
957ed801e9 Fix USE_KERNEL_HEADERS build with compat-wireless
compat-wireless does not include linux/compiler.h to define __user, so
define it in hostapd code before including linux/wireless.h.
2008-06-03 11:57:52 +03:00
Dan Williams
7e1488494e Do not continually reschedule specific scans to help finding hidden SSIDs
In situations where the driver does background scanning and sends a
steady stream of scan results, wpa_supplicant would continually
reschedule the scan.  This resulted in specific SSID scans never
happening for a hidden AP, and the supplicant never connecting to the AP
because it never got found.  Instead, if there's an already scheduled
scan, and a request comes in to reschedule it, and there are enabled
scan_ssid=1 network blocks, let the scan happen anyway so the hidden
SSID has a chance to be found.
2008-06-03 11:37:48 +03:00
Jouni Malinen
8479707beb Include wireless_copy.h instead of linux/wireless.h to avoid conflicts
linux/wireless.h ends up including number of Linux kernel header files and
many of the definitions are conflicting with (or at least duplicating)
definitions in net/if.h.
2008-06-03 11:31:42 +03:00
Dan Williams
2e5a7b49a0 wext: don't overwrite BSS frequency
mac80211 sends _both_ channel and frequency in it's scan results, with
frequency first and channel second (it's since been fixed to send
channel first and frequency second to work around this issue).  This
results in wpa_supplicant getting the right value when the frequency
comes, but overwriting the value with '0' when the channel comes because
wpa_supplicant can't handle 5GHz channel numbers.  So if a valid
previous SIOCGIWFREQ event came in, don't try to overwrite it.
2008-06-02 20:47:09 +03:00
Jouni Malinen
d952d16df4 Internal TLS: Added support for parsing PKCS #8 formatted private keys
The internal TLS implementation can now use both PKCS #1 RSA private key
and PKCS #8 encapsulated RSA private key. PKCS #8 encrypted private key is
not yet supported.
2008-06-02 19:39:46 +03:00
Jouni Malinen
b5aebee49e Fixed dbus build without OpenSSL. 2008-06-02 18:45:45 +03:00
Jouni Malinen
ec717917e5 Fixed build without CONFIG_IEEE8021X_EAPOL, but with CONFIG_CTRL_IFACE 2008-05-30 18:43:06 +03:00
Jouni Malinen
bf206cada3 Changed TLS server to use OpenSSL SSL_accept() instead of SSL_read()
The server handshake processing was still using SSL_read() to get OpenSSL
to perform the handshake. While this works for most cases, it caused some
issues for re-authentication. This is now changed to use SSL_accept() which
is more approriate here since we know that the handshake is still going on
and there will not be any tunneled data available. This resolves some of
the re-authentication issues and makes it possible for the server to notice
if TLS processing fails (SSL_read() did not return an error in many of
these cases while SSL_accept() does).

Set session id context to a unique value in order to avoid fatal errors
when client tries session resumption (SSL_set_session_id_context() must be
called for that to work), but disable session resumption with the unique
value for the time being since not all server side code is ready for it yet
(e.g., EAP-TTLS needs special Phase 2 processing when using abbreviated
handshake).

Changed EAP-TLS server not to call TLS library when processing the final
ACK (empty data) from the client in order to avoid starting a new TLS
handshake with SSL_accept().
2008-05-29 20:36:18 +03:00
Jouni Malinen
8816045743 Updated the EAP-FAST patch for the latest OpenSSL 0.9.9 snapshot 2008-05-29 11:00:33 +03:00
Jouni Malinen
2298ca6410 Added the EAP-FAST patch for OpenSSL 0.9.8h 2008-05-29 10:47:03 +03:00
Jouni Malinen
3c99fa29d3 Add eap_tls_state() to get closer to EAP-TTLS/PEAP/FAST code 2008-05-28 17:19:57 +03:00
Jouni Malinen
cda97d11bb Share EAP-TLS/PEAP/TTLS/FAST core process() functionality
Move the basic processing of received frames into eap_tls_common.c and use
callback functions to handle EAP type specific processing of the version
field and payload.
2008-05-28 17:15:17 +03:00
Jouni Malinen
3c724cc564 Do not refer to Flags::Version field as 'PEAP version'
This field is also used for EAP-TTLS and EAP-FAST, so it is clearer to use
a more generic term for it.
2008-05-28 09:59:55 +03:00
Jouni Malinen
34f564dbd5 Redesigned EAP-TLS/PEAP/TTLS/FAST fragmentation/reassembly
Fragmentation is now done as a separate step to clean up the design and to
allow the same code to be used in both Phase 1 and Phase 2. This adds
support for fragmenting EAP-PEAP/TTLS/FAST Phase 2 (tunneled) data.
2008-05-28 09:57:17 +03:00
Jouni Malinen
ab17e3f2b7 Fixed EAP-IKEv2 server fragment processing
Need to clear the state back to MSG after having processed all incoming
fragments. Without this, the server got stuck in sending the fragment ACK
even after having received the full message.
2008-05-26 16:51:40 +03:00
Jouni Malinen
ef626b4d50 Added a workaround for handling TLS compression
Even though we try to disable TLS compression, it is possible that this
cannot be done with all TLS libraries. For example, OpenSSL 0.9.8 does not
seem to have a configuration item for disabling all compression (0.9.9 has
such an option). If compression is used, Phase 2 decryption may end up
producing more data than the input buffer due to compressed data. This
shows up especially with EAP-TNC that uses very compressible data format.

As a workaround, increase the decryption buffer length to (orig_len+500)*3.
This is a hack, but at least it handles most cases. TLS compression should
really be disabled for EAP use of TLS, but since this can show up with
common setups, it is better to handle this case.
2008-05-26 12:33:04 +03:00
Jouni Malinen
e572cb6398 Do not define tls_engine_get_cert() if OpenSSL engine is disabled 2008-05-26 12:04:35 +03:00
Jouni Malinen
1b52ea47e4 Added fragmentation support for EAP-TNC 2008-05-26 12:00:18 +03:00
Jouni Malinen
d9521c7438 Example configuration for EAP-TLS authentication using PKCS#11 TPM token 2008-05-23 19:41:05 +03:00