Commit Graph

15694 Commits

Author SHA1 Message Date
Jouni Malinen
1325655397 SAE H2E: RSNXE override for testing purposes
"SET rsnxe_override_{assoc,eapol} <hexdump>" can now be used to override
RSNXE in (Re)Association Request frames and EAPOL-Key msg 2/4 for
testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 12:54:54 +02:00
Jouni Malinen
dedd8f336e tests: sigma_dut controlled SAE H2E misbehavior with rejected groups
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 00:51:40 +02:00
Jouni Malinen
90d84bc511 tests: SAE H2E and rejected groups indication (unexpected group)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 00:45:10 +02:00
Jouni Malinen
a889e9a70c SAE: Reject invalid rejected group report in SAE commit explicitly (AP)
Previously, this case was ignored silently in AP mode. While that could
be a reasonable approach for an unexpected condition, it would be fine
to reject this case explicitly as well. This makes it somewhat easier to
test unexpected SAE H2E vs. looping behavior.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 00:39:46 +02:00
Jouni Malinen
c88e01e1b6 SAE H2E: Fix validation of rejected groups list
check_sae_rejected_groups() returns 1, not -1, in case an enabled group
is rejected. The previous check for < 0 could not have ever triggered.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 00:28:13 +02:00
Jouni Malinen
b834e97003 SAE H2E: Testing option to report extra rejected groups
"SET extra_sae_rejected_groups <groups>" can now be used to enable test
mode in which wpa_supplicant will report additional groups (configured
as space separated integers) when using SAE H2E.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 00:26:13 +02:00
Jouni Malinen
4d16d7cc8d tests: sigma_dut controlled SAE H2E misbehavior with looping forced
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 17:39:46 +02:00
Jouni Malinen
b1905c7d8e tests: SAE PWE derivation with H2E-only AP and STA forcing loop
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 17:28:52 +02:00
Jouni Malinen
918df2227e SAE: Reject unexpected Status Code in SAE commit explicitly (AP)
Previously, this case was ignored silently in AP mode. While that could
be a reasonable approach for an unexpected condition, it would be fine
to reject this case explicitly as well. This makes it somewhat easier to
test unexpected SAE H2E vs. looping behavior.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 17:26:57 +02:00
Jouni Malinen
405946d76a SAE: Testing option to ignore H2E requirement mismatch
"SET ignore_sae_h2e_only 1" can now be used to configurate
wpa_supplicant to a test mode where it ignores AP's H2E-required
advertisement and try to connect with hunt-and-pecking loop instead.
This is used only for testing AP behavior with unexpected STA behavior.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 17:13:59 +02:00
Ankita Bajaj
23acdd9f33 Fix memory leak in ACS offload operation
freq_list is built in allocated heap memory and it needs to be freed
before returning from this function.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 18:02:46 +02:00
Ankita Bajaj
e86ba912aa ACS: Remove redundant ch_list parameters from do_acs interface
Clean up do_acs interface to not pass ch_list to drivers as the same
information is available in freq_list. The channel numbers are
duplicated between 2.4 GHz and 5 GHz bands and the 6 GHz band. So, use
the QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST to populate only 2.4 GHz and 5 GHz
channels to ensure backwards compatibility with old drivers which do not
have support to decode the newer QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST
attribute.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 18:02:34 +02:00
Ankita Bajaj
3cf360b8e2 DFS: Don't handle DFS ops for 6 GHz channels
Skip DFS checks and CAC operation for 6 GHz channels. AFC checks
will be added for 6 GHz channels later.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 17:12:27 +02:00
Ankita Bajaj
ee0030e814 6 GHz: Do not check for HT capability on 6 GHz channels
HT capability check is not required when starting AP on 6 GHz band as
only HE operation mode is allowed in the 6 GHz band.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 17:12:27 +02:00
Jouni Malinen
4a667b01e6 tests: DPP bootstrapping via NFC URI record
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 12:37:51 +02:00
Jouni Malinen
e780b4bf20 DPP: Bootstrapping via NFC URI Record
This extends hostapd and wpa_supplicant DPP implementation to allow the
bootstrapping URI to be generated for and parsed from an NFC Tag with an
NFC URI Record. This is similar to the way the bootstrapping URI is used
with QR Code for unidirectional authentication.

The DPP_BOOTSTRAP_GEN command uses "type=nfc-uri" to request the URI to
be assigned for NFC URI Record. In practice, the URI is generated
identically to the QR Code case, but the internal entry maintains the
NFC-URI type.

A new command "DPP_NFC_URI <uri>" can now be used to parse the URI read
from an NFC Tag with the NFC URI Record. This is similar to the
DPP_QR_CODE command.

Other commands (mainly, DPP_LISTEN and DPP_AUTH_INIT) are used for NFC
URI in the same way as they are used for QR Code.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-05 12:37:51 +02:00
Jouni Malinen
3c0d6eb8a9 Sync with mac80211-next.git include/uapi/linux/nl80211.h
This brings in nl80211 definitions as of 2019-11-08.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-12-05 12:36:09 +02:00
Jouni Malinen
2e58926ef3 tests: hostapd global control interface and per-interface events
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-02 16:35:03 +02:00
Hu Wang
38203148e9 Extend hostapd to support setband to driver via QCA vendor command
Commit 844dfeb804 ("QCA vendor command support to set band to driver")
added a vendor command to pass 'SET setband' command information to the
driver in wpa_supplicant. Add similar changes to hostapd control
interface.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-02 15:55:43 +02:00
Veerendranath Jakkam
3c13af5573 hostapd: Register wpa_msg callback even if only global ctrl_iface is used
Previously, wpa_msg_register_cb() was called only from successful
completion of per-interface control interface initialization. This would
leave the callback unregistered in case only the global control
interface is used which would result in not delivering control interface
events on the global interface. Fix this by registering the callback
handler also from successful initialization of the global control
interface.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2019-12-02 15:46:32 +02:00
Veerendranath Jakkam
e920805685 hostapd: Extend global control interface notifications
Previously, hostapd sent only WPA_MSG_ONLY_GLOBAL type notifications to
the global control interface and all other notifications to
per-interface control interface. Extend this by making it similar to
wpa_supplicant global control interface notifications handling. With
this hostapd now sends all notifications except WPA_MSG_NO_GLOBAL to the
global control interface. In addition, WPA_MSG_PER_INTERFACE type
messages will be prefixed with "IFNAME=<interface name> " while sending
to the global control interface to indicate that the message is
interface specific.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2019-12-02 15:44:52 +02:00
Jouni Malinen
dd8eb44eef tests: sae_pwe parameter in PSK-only-AP
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-29 00:13:08 +02:00
Jouni Malinen
9f50538e13 SAE H2E: Do not use sae_h2e param in AP mode if SAE is disabled
Previously, nonzero sae_h2e parameter values were used to perform SAE
H2E specific operations (deriving PT, adding RSNXE, adding H2E-only BSS
membership selector) in AP mode even if SAE was not enabled for the
network. This could result in unexpected behavior if sae_pwe=1 or
sae_pwe=2 were set in the configuration. Fix this by making the SAE
operations conditional on SAE being actually enabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-29 00:07:57 +02:00
Jouni Malinen
ee27567198 tests: Clear sae_pwe at the end of sigma_dut test cases
sigma_dut does not clear sae_pwe value when the command line argument
"-2" is used, so we need to explicitly clear this from wpa_supplicant at
the end of the test case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-29 00:06:50 +02:00
Jouni Malinen
e0cd7172c2 tests: Advertise UTF-8 SSID in DPP-provisioned AP
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
ca6a2ac705 tests: DPP ssid_charset/ssid64
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
181bf93363 DPP2: Report received ssid_charset as DPP-CONFOBJ-SSID-CHARSET event
This provides the SSID character set, if specified, to upper layers on
station Enrollee.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
71e2848eab DPP2: ssid64/ssid_charset in Configurator
This allows Configurator to be configured to use the ssid64 option in
the discovery object for a station Enrollee.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
57a63b1318 DPP2: Add parsing of ssid64/ssid_charset in Config Object
The discovery object is now allowed to use either the UTF-8 encoded
string ssid or base64url encoded ssid64.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
590bc64d65 DPP: Use JSON token builder helpers
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
e75ab53222 JSON: Add helper functions for building tokens
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
8e5e36a184 Clean up base64_{encode,decode} pointer types
Allow any pointer to be used as source for encoding and use char * as
the return value from encoding and input value for decoding to reduce
number of type casts needed in the callers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-28 16:39:09 +02:00
Jouni Malinen
b22608423b Clean up base64_url_{encode,decode} pointer types
Allow any pointer to be used as source for encoding and use char * as
the return value from encoding and input value for decoding to reduce
number of type casts needed in the callers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-27 16:09:35 +02:00
Jouni Malinen
a4255a207b Simplify base64_url_encode() prototype
There is no use case for adding padding into the base64url encoded
strings, so remove the unneeded add_pad argument that was hardcoded to 0
in all callers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-27 15:35:19 +02:00
Jouni Malinen
c54227c26a DPP2: Replace connectionStatus object ssid with ssid64
The UTF-8 encoded ssid string was replaced with base64url encoded ssid64
string, so update the implementation to match.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-27 15:34:38 +02:00
Jouni Malinen
5632b07158 tests: sigma_dut control of SAE PWE
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-24 16:58:18 +02:00
Jouni Malinen
31b6eb417b tests: Update SAE H2E test case to match SSWU parameter z change
Update the test vector based on
11-19-1817-02-000m-hash-to-curve-changes.docx

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-23 17:46:15 +02:00
Jouni Malinen
0432237a4d SAE H2E: Update SSWU curve-specific parameter z values
Update the values based on
11-19-1817-02-000m-hash-to-curve-changes.docx

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-23 17:46:15 +02:00
Jouni Malinen
5b50265e13 WMM: Do not modify input TSPEC buffer during processing
The WMM TSPEC processor used the input buffer for processing the request
and building the response. This was fine for the FT case, but for the
WMM Action frame case, the input buffer is marked const, so it should
not really be modified. This modification could not really cause any
noticeable harm, but it can result in error reports from fuzzing and
potentially even from some static analyzers.

Fix this by marking the input arguments const more consistently (the
parsed IE was able to drop the const) and copy the const input data to a
temporary buffer for processing and modification instead of allowing the
input data to be modified.

Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19050
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-11-23 17:39:55 +02:00
Jouni Malinen
e8ccbef251 tests: Remove a multi-line test description
The previous description of wmediumd_scan_only_one used multiple lines
and that resulted in parallel-vm.py miscounting total number of test
cases. Fix that by getting rid of the newlines from the description.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-11-23 17:19:49 +02:00
Jouni Malinen
9dc07a1d55 tests: Fix 'unexpected exit' detection in parallel-vm.py
Now that parallel-vm.py is actually stopping VMs as soon as they are not
needed for retries, it is not really an unexpected exit to see a VM exit
while test cases remain in the queue as long as at least that many VMs
remain running. Get rid of confusing 'unexpected exit' status from the
UI in such cases.

Fixes: 4aaddecdd8 ("tests: Handle test retries through the same queue")
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-11-23 17:09:56 +02:00
Jouni Malinen
81121319a9 tests: ap_hs20_cred_and_no_roaming_consortium to match implementation
Now that wpa_supplicant was modified to use NAI realm query even if
roaming_consortium is set, this test case is actually able to find a
match. Update it to avoid cause incorrect test failures.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-17 21:04:42 +02:00
Purushottam Kushwaha
783a99b73d HS2.0: Skip check for roaming_consortium for NAI realm query
Previously ANQP fetch considered NAI realm query only when cred block
did not specify roaming_consortium to optimize ANQP operations (NAI
realm list can have a very long value). In certain cases, both NAI realm
and roaming_consortium are configured in credential block and this
resulted in ANQP fetch for NAI realm not being initiated. That could
result in not being able to select the highest priority available
credential/network.

Remove roaming_consortium check for NAI realm query inclusion in ANQP
request so that we will request NAI realm information whenever it can
result in matching additional networks. This makes the ANQP queries more
costly in some cases, but the additional information is needed for
correct behavior in network selection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-17 21:04:38 +02:00
Hu Wang
f3c077929f P2P: Fix listen state machine getting stuck in send_action() scheduled case
Commit 947b5a1532 ("P2P: Stop listen state if Action frame TX is
needed on another channel") added an optimization for P2P response
transmission in certain concurrent operation cases. However, it did not
take into account possibility of the driver not being in listen
state (p2p->drv_in_listen == 0) and could end up getting stuck with the
P2P state machine in a manner that made the device not listen for
following messages. This showed up in following manner in the debug log:

P2P: Starting short listen state (state=SEARCH)
P2P: Driver ended Listen state (freq=2437)
process received frame and send a response
P2P: Stop listen on 0 MHz to allow a frame to be sent immediately on 2437 MHz
P2P: Clear timeout (state=SEARCH)
--> state machine stuck

Fix this by adding drv_in_listen > 0 condition for the optimization to
stop the listen operation in send_action() resulting in scheduled TX.

Fixes: 947b5a1532 ("P2P: Stop listen state if Action frame TX is needed on another channel")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-13 23:59:37 +02:00
Lei Wang
530b8ee3c8 hostapd: Update DFS status in VHT80+80 mode
Update center frequency and center frequency2's DFS channel status in
VHT80+80 mode. Otherwise it will cause AP failed to start on a DFS
channel.

Tested: qca9984 with firmware ver 10.4-3.10-00047

Signed-off-by: Rick Wu <rwu@codeaurora.org>
Signed-off-by: Lei Wang <leiwa@codeaurora.org>
2019-11-10 22:54:19 +02:00
Jouni Malinen
93ba13bcfd Fix status code in SAE/DPP association PMKID mismatch (driver-AP-SME)
wpa_validate_wpa_ie() was already extended to cover these cases with
WPA_INVALID_PMKID return value, but hostapd_notif_assoc() did not have
code for mapping this into the appropriate status code
(STATUS_INVALID_PMKID) and ended up using the default
(WLAN_STATUS_INVALID_IE) instead. This caused AP SME-in-driver cases
returning incorrect status code when the AP did not have a matching
PMKSA cache entry. This could result in unexpected station behavior
where the station could continue trying to use a PMKSA cache entry that
the AP does not have and not being able to recover this.

Fix this by adding the previously missed mapping of validation errors to
status/reason codes.

Fixes: 567da5bbd0 ("DPP: Add new AKM")
Fixes: 458d8984de ("SAE: Reject request with mismatching PMKID (no PMKSA cache entry)")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-09 00:33:58 +02:00
Jouni Malinen
9c7ab4c5df tests: sigma_dut controlled AP and deauth commands
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-06 19:55:42 +02:00
Jouni Malinen
b90d2f7ffe Fix a typo in a comment
Spell NULL correctly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-11-06 19:44:50 +02:00
Jouni Malinen
cf28cfc12e tests: D-Bus MACAddressRandomizationMask property Get/Set
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-10-27 19:50:22 +02:00
Eric Caruso
9fde146070 Allow scans triggered by D-Bus to use MAC address randomization
wpas_dbus_handler_scan() constructs a set of 'params' each time, but it
doesn't acknowledge the existing randomization settings when doing so.
That means that any D-Bus initiated scans weren't going to follow the
configured settings.

Signed-off-by: Eric Caruso <ejcaruso@chromium.org>
2019-10-27 19:50:22 +02:00