WPA/WPA2-Personal passphrase is not allowed to include control
characters. Reject a Credential received from a WPS Registrar both as
STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or
WPA2PSK authentication type and includes an invalid passphrase.
This fixes an issue where hostapd or wpa_supplicant could have updated
the configuration file PSK/passphrase parameter with arbitrary data from
an external device (Registrar) that may not be fully trusted. Should
such data include a newline character, the resulting configuration file
could become invalid and fail to be parsed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
One of supported code paths already allows this scenario. It is used if
driver doesn't report NL80211_ATTR_DEVICE_AP_SME and doesn't support
monitor interface. In such situation:
1) We don't quit if subscribing for WLAN_FC_STYPE_PROBE_REQ fails
2) We don't try subscribing for WLAN_FC_STYPE_ACTION
3) We fallback to AP SME mode after failing to create monitor interface
4) We don't quit if subscribing for WLAN_FC_STYPE_PROBE_REQ fails
Above scenario is used, e.g., with brcmfmac. As you can see - thanks to
events provided by cfg80211 - it's not really required to receive Probe
Request or action frames.
However, the previous implementation did not allow using hostapd with
drivers that:
1) Report NL80211_ATTR_DEVICE_AP_SME
2) Don't support subscribing for PROBE_REQ and/or ACTION frames
In case of using such a driver hostapd will cancel setup after failing
to subscribe for WLAN_FC_STYPE_ACTION. I noticed it after setting flag
WIPHY_FLAG_HAVE_AP_SME in brcmfmac driver for my experiments.
This patch allows working with such drivers with just a small warning
printed as debug message.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
This reduces duration that private keying material might remain in the
process memory by clearing wpabuf data used in WPS operations when there
is possibility of the buffer including keys or related material.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
When a dedicated P2P Device interface is used, its configuration should
be cloned to the group interface. Add a test that covers this both when
a separate group interface is used and not.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
When the P2P Device interface is used and an existing interface is used
for P2P GO/Client, the P2P Device configuration was not cloned to the
configuration of the existing interface. Thus, configuration parameters
such as idle_group_time, etc., were not propagated to the P2P GO/Client
interface.
Handle this by copying all configuration parameters of the P2P device
interface to the reused interface, with the following exceptions:
1. Copy the NFC key data only if it was not set in the configuration
file.
2. The WPS string fields are set only if they were not previously set
in the configuration of the destination interface (based on the
assumption that these fields should be identical among all
interfaces).
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Use the p2pdev pointer instead of the parent pointer to comply with the
flows when a dedicated P2P Device interface is used and
p2p_no_group_iface == 1 (in which case the parent of the reused
interface isn't necessary the same as p2pdev).
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Use the global control interface to remove P2P network blocks, to
support cases when a dedicated P2P Device interface is used.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Some environments define default system wide HTTP proxy. Using default
system configuration may result in a failure to open some HTTP URLs. Fix
this by ensuring that no proxies are used.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
In p2p_channel_vht80_autogo and p2p_channel_vht80p80_autogo, parse the
P2P-GROUP-STARTED event prior to calling the group_request() method, as
otherwise the group ifname is not set.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Support configurations that use a dedicated P2P Device interface by
using the global control interface and specifying the interface name for
the GET commands fetching the ip_addr_go parameter.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Modify the persistent_group_profile_add test to support configurations
that use a dedicated P2P Device interface by sending the ADD_NETWORK and
SET_NETWORK commands on the global control interface and specifying the
P2P Device interface name.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Add an attribute to class WpaSupplicant with the name of the
P2P Device interface. If a separate interface is not used for
P2P Device, this attribute will hold the name of the only used
interface (with functions also as the P2P Device management
interface).
This attribute will be used to direct P2P related commands to the
P2P Device interface, which is needed for configurations that use
a separate interface for the P2P Device.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Waiting for the P2P-DEVICE-FOUND event should be done on the global
control interface to support configurations that use a dedicated P2P
Device interface.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Support configurations that use a dedicated P2P Device interface by
sending the P2P_CONNECT command on the global control interface.
In addition, when a dedicated P2P Device interface is used, there is no
need to manually respond to the Provision Discovery Request since the
request is processed by the P2P Device interface and this interface was
not set for external RX management frames handling.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
This fixes commit 2f0f69a9ec ('tests: Use
p2ps_provision() and p2ps_connect_pd() in p2ps_connect_p2ps_method()').
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
1. Fail roaming to an AP which exceeded its number of allowed stations.
2. Fail roaming due to passphrase mismatch.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
It is better to use a list of command line arguments for the local
execution case and convert that to a space-separated string for the
remote case.
Signed-off-by: Jouni Malinen <j@w1.fi>
This makes the DFS test cases that use start_dfs_ap() more usable for
testing with remote hosts.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Pass apdev to instead of HostapdGlobal() to invalid_ap() to make the
dynamic AP test cases more useful for testing with remove hosts.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Use hostapd.add_ap() and hostapd.remove_bss() to avoid direct
HostapdGlobal() use in some of the dynamic AP test cases to make them
more usable for testing with remote hosts.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Pass apdev param to hostapd.add_bss(). Kill hardcoded phy param and get
phy base on apdev. These are needed to support operation with a remote
test host.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
We need this for remote host support. From apdev we can get
apdev['hostname'] and apdev['port'].
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
On receiving a WNM BSS Transition Management Request frame with a
candidate list, fetch the latest scan results from the kernel to see if
there are any recent scan results for the candidates and initiate a
connection if found. This helps to avoid triggering a new scan in cases
where a scan initiated by something else (e.g., an internal beacon
measurement report functionality in a driver) has processed Beacon or
Probe Response frames without wpa_supplicant having received a
notification of such an update yet.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
wpabuf_parse_bin() can be used to take care of parsing a hexstring to a
wpabuf and a shared helper function can take care of clearing the
previous value when empty string is used.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This new parameter allows hostapd to add Vendor Specific elements into
(Re)Association Response frames similarly to the way vendor_elements
parameter can be used for Beacon and Probe Response frames.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The OpenSSL 1.1.0 Beta 2 release made DH opaque and that broke
compilation of crypto_openssl.c. Fix this by using the new accessor
functions when building against OpenSSL 1.1.0 or newer.
Signed-off-by: Jouni Malinen <j@w1.fi>
Commit 66d464067d ('FT: Register RRB
l2_packet only if FT-over-DS is enabled') disabled RRB l2_packet socket
if ft_over_ds is disabled, but this socket is required for FT
over-the-air, too (FT key distribution). Enable the socket regardless of
ft_over_ds setting if FT is enabled.
Signed-off-by: Günther Kelleter <guenther.kelleter@devolo.de>
systemd service files were supplied with old D-Bus bus name. After
service activation systemd was waiting for appearance of specified bus
name to consider it started successfully. However, if wpa_supplicant was
compiled only with the new D-Bus interface name, systemd didn't notice
configured (old) D-Bus bus name appearance. In the end, service was
considered malfunctioning and it was deactivated.
Update systemd service BusName property according to supported D-Bus
interface version.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
