Commit Graph

16944 Commits

Author SHA1 Message Date
Veerendranath Jakkam
43106e122b GAS: Update source MAC address on preassoc_mac_addr randomization
The GAS query source MAC address was not getting updated correctly when
preassoc_mac_addr is enabled. Fix this by copying the current MAC
address to the GAS query source address.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:34:43 +03:00
Veerendranath Jakkam
1289ecf4cc GAS: Ignore preassoc_mac_addr when gas_rand_mac_addr enabled
Skip unnecessary random MAC generation due to preassoc_mac_addr
parameter when gas_rand_mac_addr parameter is enabled.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:33:27 +03:00
Veerendranath Jakkam
dbe485a35a SAE-PK: Check psk param also to look for SAE-PK acceptable BSS
SAE-PK password can be set using psk parameter also in case of mixed
SAE+PSK networks, so look for acceptable SAE-PK BSS when SAE password
not set and psk parameter meets SAE-PK password criteria.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:31:38 +03:00
Vamsi Krishna
f5388b34eb Add channel TX/RX times to QCA vendor interface of LL stats
Currently the driver/firmware indicates CCA busy time which includes own
TX and RX time and as such, does not allow the CCA busy time due to
other nodes to be computed. Add separate statistics to indicate own
radio TX time and own radio RX time to facilitate userspace applications
to compute CCA busy time because of traffic unintended to this device.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:28:24 +03:00
Vamsi Krishna
9f9c110484 Fix QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO interface documentation
All QCA_WLAN_VENDOR_ATTR_LL_STATS_CHANNEL_* attributes are also nested
within QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO, not only
QCA_WLAN_VENDOR_ATTR_LL_STATS_CHANNEL_INFO* attributes in the current
implementation. Fix QCA_WLAN_VENDOR_ATTR_LL_STATS_CH_INFO documentation
accordingly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:28:00 +03:00
Sunil Dutt
096456c0c2 Enhancements to the TWT attributes/parameters (vendor command)
This commit does the following enhancements to the TWT interface:

Corrects the documentation for QCA_WLAN_TWT_SUSPEND and
QCA_WLAN_TWT_TERMINATE. Specifies that these operations carry the
parameters obtained through QCA_WLAN_VENDOR_ATTR_CONFIG_TWT_PARAMS. This
interface is very recently introduced and missed to document the same.
There are no user space or driver components using this interface yet.
Hence, enhancing/modifying the interface.

Corrects the documentation for
QCA_WLAN_VENDOR_ATTR_TWT_SETUP_WAKE_DURATION. Mentions that the units it
represent is a multiple of 256 microseconds rather than a TU. The host
driver always interpreted this as an unit in 256 microseconds and there
are no user space implementations that are impacted with this change in
the unit. Hence, modifying the documentation.

Introduces QCA_WLAN_VENDOR_ATTR_TWT_RESUME_NEXT2_TWT_SIZE, which is
similar to that of QCA_WLAN_VENDOR_ATTR_TWT_RESUME_NEXT_TWT, but carries
an offset/data of u32 size.

Introduces MAC_ADDR attribute to represent the peer for the TWT setup
and resume operations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:26:03 +03:00
Jouni Malinen
3adc1c623e DPP2: Disconnect before starting reconfiguration
The offchannel operations (scan, Public Action frame TX/RX) have
significantly more latency when performed while connected, so disconnect
when requested to initiate DPP reconfiguration to avoid this. The old
network profile (i.e., likely the current connection) is going to be
replaced in practice and as such, there is no need to try continue that
association any further.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:05:49 +03:00
Jouni Malinen
2afc46a0a9 tests: sigma_dut and second DPP reconfiguration
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:01:32 +03:00
Jouni Malinen
574a8fa6c8 DPP: Do not interpret unknown channel as missing channel list for NFC
While the listed unknown operating class/channel number pairs need to be
ignored, that should be done in a manner than prevents the parsed
bootstrapping info from being used as if it had no channel list (i.e.,
allowing any channel) if there are no known operating class/channel
number pairs.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 18:06:28 +03:00
Jouni Malinen
ab676bc1fa tests: DPP over TCP (mutual)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 12:08:26 +03:00
Jouni Malinen
fc3efe0834 DPP2: Support mutual auth with QR in scan-during-auth-exchange case
Extend DPP authentication session search for the DPP_QR_CODE command to
cover the ongoing exchanges in Controller/Responder.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 12:04:25 +03:00
Jouni Malinen
2e956c37d2 DPP2: Do not close TCP socket when waiting for full Auth Resp
The case where mutual authentication with QR Code bootstrapping is used
with scanning of the QR Code during the exchange resulted in the
Controller closing the TCP socket too early. Fix this by leaving the
socket open while waiting for the full Authentication Response message.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 11:52:25 +03:00
Jouni Malinen
e4e95aabbf DPP2: Allow Controller to be configured to require QR mutual auth
Extend the DPP_CONTROLLER_START command to accept the optional qr=mutual
parameter similarly to the DPP_LISTEN case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 11:41:52 +03:00
Mathy Vanhoef
0792f321bc fragattack: reorder some code 2020-08-12 12:31:03 +04:00
Mathy Vanhoef
7eed86283b README: include license for research code 2020-08-12 11:59:08 +04:00
Mathy Vanhoef
6047eef00a fragattack: restore hostap README file 2020-08-12 11:57:39 +04:00
Vamsi Krishna
61c249c490 Add QCA vendor attribute to configure number of TX/RX chains
Add support to configure the number of TX chains and the number of RX
chains to be used during a connection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 10:25:52 +03:00
Jouni Malinen
86fd6755cb dpp-nfc: Use --altchan value in handover server
Use the alternative channel list in the handover server role when
processing an alternative proposal. This was previously done only in the
handover client role, but with the updated design, both roles act in a
similar manner for the case where the alternative channel list is
specified.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-11 23:44:48 +03:00
Mathy Vanhoef
8b48cf302c fragattacks: tweaks to README and SUMMARY 2020-08-11 16:23:54 +04:00
Mathy Vanhoef
68922c28f4 fragattacks: summary of vulnerabilities 2020-08-11 15:23:48 +04:00
Mathy Vanhoef
016606a780 fragattack: updated README 2020-08-11 11:39:02 +04:00
Mathy Vanhoef
c80fe6c682 fragattacks: disabling HW crypto is not needed 2020-08-11 11:15:40 +04:00
Mathy Vanhoef
9a0886b0e1 fragattack: remove old build.sh 2020-08-11 09:58:13 +04:00
Jouni Malinen
315422196a dpp-nfc: Update listen channel based on channel list when writing a tag
Do not use the hardcoded channel 1 (2412 MHz) with DPP_LISTEN if a
channel list is specified when writing an NFC Tag. Instead, pick the
first channel from that list as the listen channel.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 23:52:11 +03:00
Jouni Malinen
66ffe9d246 DPP2: Update Reconfig Flags attribute format
This was simplified by replacing the JSON encoded value with a single
octet.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 17:36:56 +03:00
Jouni Malinen
57e2e5ed7a tests: DPP over TCP for enterprise provisioning (Controller initiating)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 10:42:49 +03:00
Jouni Malinen
5caf4e094a DPP2: Support RA/CA functionality in Controller initiated case
Extend dpp_control_get_auth() to find the ongoing session for enterprise
credential provisioning in cases where the Controller/Configurator
initiated the exchange. Only the other direction was supported
previously.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 10:41:20 +03:00
Mathy Vanhoef
b721339f1e fragattack: proper anchors and link in README 2020-08-08 12:59:42 +04:00
Mathy Vanhoef
567ec8b1a8 fragattack: improved default client.conf 2020-08-08 09:43:04 +04:00
Mathy Vanhoef
dd44b0103a fragattack: README fixes are tests on live Kali 2020-08-08 09:42:23 +04:00
Mathy Vanhoef
91e9efcf8f fragattack: proofread of README 2020-08-08 08:35:28 +04:00
Jouni Malinen
b58cd7aa1c tests: DPP reconfiguration retries
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-08 00:14:00 +03:00
Jouni Malinen
9304d1b3c3 DPP2: Regenerate Reconfig Announcement for each transmission
This is needed to generate a new unique A-NONCE and E'-id values.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-08 00:14:00 +03:00
Jouni Malinen
b591810f9b DPP2: Add DPP Status attribute into Reconfig Auth Confirm
Add and process DPP Status at the end of reconfig authentication.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 23:33:59 +03:00
Jouni Malinen
6d0217119e DPP2: Allow iteration count to be configured for DPP_RECONFIG
Add an optional iter=# parameter to DPP_RECONFIG similarly to the way
this was handled with DPP_CHIRP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 23:22:31 +03:00
Jouni Malinen
c6d0e5a93d DPP2: Add E-id in Reconfig Announcement
Add an encrypted Enrollee identifier into Reconfig Announcement frames
and decrypt that on the Configurator side. The actual E-id value is
currently not used for anything, but it can be used in the future to
provide better control over reconfiguration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 22:54:53 +03:00
Jouni Malinen
ad2119cbc6 tests: DPP reconfiguration connector with different groups
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 15:26:15 +03:00
Jouni Malinen
e5be6e68c8 DPP2: Add Enrollee netAccessKey group into Reconfig Announcement
This was added to the protocol design to support cases where the
C-sign-key uses a different group than the netAccessKey. The Enrollee
now indicates its netAccessKey group in Reconfig Announcement and the
Configurator builds it own reconfig Connector using that group instead
of the group used for the C-sign-key.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 15:25:10 +03:00
Mathy Vanhoef
a270eb63b7 fragattacks: draft README done 2020-08-07 10:24:41 +04:00
Mathy Vanhoef
5a072bac17 fragattack: updated README 2020-08-07 07:45:15 +04:00
Mathy Vanhoef
6379055c5b fragattack: minor output improvement 2020-08-07 07:44:50 +04:00
Jouni Malinen
1837648e71 tests: SAE-PK and PSK using invalid password combination
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 01:09:06 +03:00
Jouni Malinen
abd950be90 tests: sigma_dut controlled AP using SAE-PK(disabled) and PSK
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 00:49:00 +03:00
Jouni Malinen
5e6919fd52 tests: SAE-PK and PSK
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 00:49:00 +03:00
Jouni Malinen
2a58968d39 SAE-PK: Allow SAE-PK password to be set using the psk parameter
Only the sae_password parameter was previously accepted for SAE-PK use.
That is not sufficient for covering mixed SAE+PSK cases. Extend this by
allowing the psk parameter to be used as well just like it can be used
for SAE without SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 00:49:00 +03:00
Jouni Malinen
7ca81190a8 SAE-PK: Allow SAE-PK style wpa_passphrase if SAE-PK is enabled with same
This prevents use of a SAE-PK style password as the WPA-PSK passphrase
only if the same password is not also enabled through sae_password for
use with SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-06 23:52:07 +03:00
Rajasekaran Kalidoss
844ecc70a3 Additional TWT attributes for response path and resume
Introduce additional attributes for the TWT response parameters from the
host driver. Also, add ATTR_TWT_RESUME_FLOW_ID for TWT Resume request.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-06 16:32:33 +03:00
Jouni Malinen
0a9d7b169e SAE-PK: Update design for fingerprint encoding into password
Update the SAE-PK implementation to match the changes in the protocol
design:
- allow only Sec values 3 and 5 and encode this as a single bit field
  with multiple copies
- add a checksum character

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-05 22:05:20 +03:00
Mathy Vanhoef
f8d04e7485 fragattack: bugfix in eapfrag test 2020-08-05 12:11:32 +04:00
Mathy Vanhoef
6de61875e7 fragattack: tweak eapol-inject forward test 2020-08-05 12:05:49 +04:00