Commit Graph

9419 Commits

Author SHA1 Message Date
Jouni Malinen
ac5953db66 Fixed EAP-AKA build in case EAP-AKA' is disabled 2008-12-16 18:57:49 +02:00
Jouni Malinen
22a299ee9d Improve EAPOL-Key handshake stability with retransmitted frames
Accept response to any pending request, not just the last one. This
gives the Supplicant more time to reply since hostapd will now allow up
to three seconds for the reply to the first EAPOL-Key frame transmission
(and two seconds for the first retry and one second for the last) while
the previous version invalidated any old request immediately when
sending a retransmitted frame.

If the Supplicant replies to more than one request, only the first reply
to arrive at the Authenticator will be processed. As far as the
Supplicant is concerned, this behavior does not differ from the previous
one except for being less likely to cause unneeded retransmissions of
EAPOL-Key frames.

This can help in cases where power saving is used when the group key is
rekeyed or when there is excessive traffic on the channel that can delay
(or drop) EAPOL-Key frames.
2008-12-16 14:17:33 +02:00
Jouni Malinen
3d799c0b2c WPS: Added WPS support into wpa_gui-qt4
Currently, only Enrollee operations (both PBC and PIN) are supported.
2008-12-15 22:36:42 +02:00
Jouni Malinen
ff8a53a8d7 Use a fixed wps_msg prefix with WPS creds notification 2008-12-15 22:32:45 +02:00
Jouni Malinen
a524f05eb3 WPS: Added control interface notification for available WPS APs
Whenever new scan results include WPS AP(s) and the client is not
associated, send a notification message to control interface monitors.
This makes it easier for GUIs to notify the user about possible WPS
availability without having to go through the scan results.
2008-12-15 20:09:57 +02:00
Jouni Malinen
484957ae6c Fixed memory leak in WPS PBC overlap detection 2008-12-15 19:50:53 +02:00
Jouni Malinen
f4f2774a96 Fixed interoperability issue with PEAPv0 cryptobinding and NPS
Windows Server 2008 NPS gets very confused if the TLS Message Length is
not included in the Phase 1 messages even if fragmentation is not used.
If the TLS Message Length field is not included in ClientHello message,
NPS seems to decide to use the ClientHello data (excluding first six
octets, i.e., EAP header, type, Flags) as the OuterTLVs data in
Cryptobinding Compound_MAC calculation (per PEAPv2; not MS-PEAP)..

Lets add the TLS Message Length to PEAPv0 Phase 1 messages to get rid of
this issue. This seems to fix Cryptobinding issues with NPS and PEAPv0
is now using optional Cryptobinding by default (again) since there are
no known interop issues with it anymore.
2008-12-15 00:15:54 +02:00
Jouni Malinen
000a1de72b Cleaned up EAP-MSCHAPv2 key derivation
Changed peer to derive the full key (both MS-MPPE-Recv-Key and
MS-MPPE-Send-Key for total of 32 octets) to match with server
implementation.

Swapped the order of MPPE keys in MSK derivation since server
MS-MPPE-Recv-Key | MS-MPPE-Send-Key matches with the order specified for
EAP-TLS MSK derivation. This means that PEAPv0 cryptobinding is now
using EAP-MSCHAPv2 MSK as-is for ISK while EAP-FAST will need to swap
the order of the MPPE keys to get ISK in a way that interoperates with
Cisco EAP-FAST implementation.
2008-12-14 13:12:20 +02:00
Jouni Malinen
6e783c6da9 Added INT_RANGE parser for global configuration variables 2008-12-13 18:21:16 +02:00
Jouni Malinen
32896a0dd1 Use shared string parser for global configuration fields 2008-12-13 18:17:27 +02:00
Jouni Malinen
d7afb15a10 Share the same global config parser function for integer values 2008-12-13 18:04:43 +02:00
Jouni Malinen
55655636d8 First step in cleaning up global config parser: use parse_data array 2008-12-13 17:57:17 +02:00
Jouni Malinen
3c0b7aa4fe Added configuration of WPS device parameters for wpa_supplicant 2008-12-13 17:20:46 +02:00
Jouni Malinen
75fc67e97b driver_test: Handle WPS IE in non-MLME test 2008-12-12 22:52:56 +02:00
Jouni Malinen
329a55b314 Ported driver_test to Windows (only UDP socket available) 2008-12-12 22:41:18 +02:00
Jouni Malinen
e33bbd8f4d driver_test: Optional support for using UDP socket
driver_test can now be used either over UNIX domain socket or UDP
socket. This makes it possible to run the test over network and makes it
easier to port driver_test to Windows.

hostapd configuration: test_socket=UDP:<listen port>
wpa_supplicant configuration: driver_param=test_udp=<dst IP addr>:<port>
2008-12-12 21:35:22 +02:00
Jouni Malinen
2ff0f83b9e Comment out dynamic CertEnumCertificatesInStore loading by default
This is now available in MinGW header files, so the loading code is
triggering conflicts.
2008-12-11 00:57:15 +02:00
Jouni Malinen
9e72e1d356 Workaround number of compiler warnings with newer MinGW version 2008-12-11 00:56:37 +02:00
Jouni Malinen
702c349e5e Resolved number of signed/unsigned mismatches and ntddndis.h location 2008-12-11 00:55:33 +02:00
Jouni Malinen
47ce4bfc38 Rename MSG to MESG to avoid conflicts with Windows header files 2008-12-11 00:54:49 +02:00
Jouni Malinen
3ee81d489a Don't include unused calls to SHA256 functions if EAP-AKA' is not enabled 2008-12-11 00:49:39 +02:00
Jouni Malinen
1edb9533f1 SHA256 is needed for EAP-AKA' and WPS 2008-12-11 00:48:13 +02:00
Jouni Malinen
9a6cec7bc6 Added CONFIG_IEEE80211N into defconfig (commented out) 2008-12-10 00:46:55 +02:00
Jouni Malinen
cfb7e8a086 Fixed build without CONFIG_IEEE80211N 2008-12-10 00:45:57 +02:00
Jouni Malinen
fecc01663b Updated the comment about libnl to state that version 1.1 is new enough 2008-12-09 22:41:01 +02:00
Jouni Malinen
315ce40a00 Renamed the 'alpha2' variable to 'country' to match with config string 2008-12-09 22:15:47 +02:00
Jouni Malinen
814e925dc4 Added documentation for the new 'country' configuration option 2008-12-09 22:13:35 +02:00
Luis R. Rodriguez
6d1584905c wpa_supplicant: Add support for setting of a regulatory domain
This adds support for setting of a regulatory domain to wpa_supplicant
drivers. It also adds regulatory domain setting for the nl80211 driver.
We expect an ISO / IEC 3166 alpha2 in the wpa configuration file as a
global.
2008-12-09 22:11:14 +02:00
Helmut Schaa
556f5a2a28 wpa_supplicant: print password field only if -K is given
Print the password field only if -K is given by using wpa_hexdump_ascii_key
instead of wpa_hexdump_ascii. Additionally mark the password field as key.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
2008-12-09 21:56:47 +02:00
Jouni Malinen
205a372b2d Added libnl 2.0 compatibility code (CONFIG_LIBNL20=y in .config needed)
Unfortunately, at least the current libnl git snapshot changes the API
in backwards incompatible way and in a way that makes it difficult to
to allow building against the latest libnl code.
2008-12-08 22:40:58 +02:00
Jouni Malinen
13d9817dd0 Fixed a typo in wpa_supplicant manpage 2008-12-08 22:16:15 +02:00
Jouni Malinen
d9f2b1c382 driver_test: Added support for testing WPS without use_mlme 2008-12-08 21:42:01 +02:00
Jouni Malinen
eef7d7a138 WPS: Added [WPS], [WPS-PIN], [WPS-PBC] flags for scan results 2008-12-08 20:57:59 +02:00
Jouni Malinen
7e45830ab7 nl80211: Include copy of linux/nl80211.h with hostapd/wpa_supplicant
This makes it easier to build the packages and allows all new features
to be built into the binary regardless of which kernel is currently
used.
2008-12-08 11:04:13 +02:00
Jouni Malinen
9478eaef53 Added option to force SoH version 1 (tnc=soh1)
The default version with tnc=soh remains to be 2 which is the currently
recommended version in SoH specification.
2008-12-07 21:00:42 +02:00
Jouni Malinen
9c9f869a05 Added EAP-FAST interop test results with Radiator 4.3.1 2008-12-07 20:27:43 +02:00
Jouni Malinen
a9d1364c5f Merged EAP-AKA' into eap_aka.c and added it to defconfig/ChangeLog 2008-12-07 19:24:56 +02:00
Jouni Malinen
01b0569437 Added protection against EAP-AKA' -> EAP-AKA bidding down attacks
AT_BIDDING attribute is included in EAP-AKA/Challenge to allow peer to
know whether the server would have preferred EAP-AKA'.
2008-12-05 22:25:47 +02:00
Jouni Malinen
8de5048e26 Fixed a typo in a comment 2008-12-04 22:15:51 +02:00
Jouni Malinen
a478ef0d12 EAP-AKA': Added CK',IK' derivation
This is based on a change request 3GPP TS 33.402 CR 0033 for version
8.1.1. The hardcoded ANID is now 'WLAN' since that is used in
3GPP TS 24.302.
2008-12-04 21:50:56 +02:00
Jouni Malinen
a49c428a1b EAP-AKA': Comment out EAP-AKA' server KDF negotiation
Since only one KDF is currently supported, the negotiation is not
allowed and peer must be rejected if it tries to send KDF selection in a
Challenge message. The negotiation code is left in the file and just
commented out since it was tested to work and can be used in the future
if another KDF is added.
2008-12-04 20:32:56 +02:00
Jouni Malinen
6ec4021c03 EAP-AKA': Added processing of AT_KDF and AT_KDF_INPUT attributes
Network Name is not yet generated and validated based on 3GPP.33.402
(i.e., a hardcoded string is used in server and anything is accepted in
peer).
2008-12-04 20:29:46 +02:00
Jouni Malinen
b8ab624984 Fixed EAP-SIM and EAP-AKA AT_IDENTITY parsing (server only)
The attribute uses 'Actual Identity Length' field to indicate the exact
(pre-padding) length of the Identity. This actual length should be used
as the length, not the remaining attribute length.

This was previously worked around by stripping null termination away
from the end of the identity string at EAP-SIM and EAP-AKA server code.
However, it is likely that that workaround is not really needed and the
real problem was in AT_IDENTITY parsing. Anyway, the workaround is left
in just in case it was really needed with some implementations.
2008-12-04 18:51:42 +02:00
Jouni Malinen
bb9f45e0bb nl80211: Remove the debug print from data frame processing
This is currently happening way too frequently (mac80211 monitor
interface sends TX info for every frame) and the end result makes it
difficult to read hostapd debug log if there is large amount of data
traffic.
2008-12-04 14:20:33 +02:00
Jouni Malinen
15828ba820 Made 802.11 management frame IE parser aware of vendor HT Capab IE
This IE is not (at least yet) actually used for anything, but parsing it
cleans up verbose debug log a bit since thie previously unknown, but
commonly used, vendor IE was being reported as unknown.
2008-12-04 13:42:33 +02:00
Jouni Malinen
4a7b9f885f Fixed WEP authentication (both Open System and Shared Key) with mac80211
Only one of the authentication frame types is encrypted. In order for
static WEP encryption to work properly (i.e., to not encrypt the frame),
we need to tell mac80211 about the frames that must not be encrypted.
2008-12-04 13:21:35 +02:00
Jouni Malinen
73d48dc4b4 EAP-AKA': Allow both AKA AKA' to be registed from eap_aka_prime.c
This allows the same source code file to be shared for both methods. For
now, this is only in eap_aka_prime.c, but eventually, changes in
eap_aka_prime.c are likely to be merged into eap_aka.c at which point
the separate eap_aka_prime.c can be removed.
2008-12-03 19:59:52 +02:00
Jouni Malinen
a17322c345 Removed mac_addr from eapol_ctx to fix the eapol_test build 2008-12-03 19:53:31 +02:00
Jouni Malinen
9881795e2c EAP-AKA': Derive keys using the new KDF (PRF') 2008-12-03 19:22:20 +02:00
Jouni Malinen
f07688e37d nl80211: Generate 802.11b mode based on 802.11g information
If the phy info from nl80211 does not include 802.11b mode, generate
that mode based on 802.11g information. This allows hw_mode=b to be used
with drivers that support 2.4 GHz band.
2008-12-03 12:42:21 +02:00