Commit Graph

6944 Commits

Author SHA1 Message Date
Jouni Malinen
c1151e47d5 Force OFDM/HT/VHT to be disabled on channel 14
The regulatory rules in Japan do not allow OFDM to be used on channel
14. While this was to some extend assumed to be enforced by drivers
(many of which apparently don't), it is safer to make hostapd enforce
this by disabling any OFDM-related functionality. This tries to avoid
backwards compatibility issues by downgrading the mode rather than
rejecting the invalid configuration.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-25 13:55:10 +02:00
Jouni Malinen
bfb79dde63 nl80211: Show regulatory rule flags in debug output
These can be useful in understanding why some channels are disabled.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-25 13:55:07 +02:00
Chaitanya T K
3d7ad2f681 hostapd: Configure spectrum management capability
Add configuration of Spectrum Management subfield in the Capability
Information of Beacon, Probe Response, and Association Response frames.
Spectrum Management bit is set when directly requested by new
configuration option spectrum_mgmt_required=1 or when AP is running on
DFS channels. In the future, also TPC shall require this bit to be set.

Signed-hostap: Srinivasan <srinivasanb@posedge.com>
Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com>
Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-25 00:54:59 +02:00
Srinivasan B
e0392f825d hostapd: Add Power Constraint element
Add Power Constraint information element to Beacon and Probe Response
frames when hostapd is configured on 5 GHz band and Country information
element is also added. According to IEEE Std 802.11-2012 a STA shall
determine a local maximum transmit power for the current channel based
on information derived from Country and Power Constraint elements.

In order to add Power Constraint element ieee80211d option need to be
enabled and new local_pwr_constraint config option need to be set to
unsigned value in units of decibels. For now this value is statically
configured but the future goal is to implement dynamic TPC algorithm
to control local power constraint.

Signed-hostap: Srinivasan <srinivasanb@posedge.com>
Signed-hostap: Chaitanya T K <chaitanyatk@posedge.com>
Signed-hostap: Marek Puzyniak <marek.puzyniak@tieto.com>
2014-02-24 23:51:23 +02:00
Stefan Lippers-Hollmann
891330fda9 Fix spelling s/algorith/algorithm/
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
2014-02-24 23:40:01 +02:00
Jouni Malinen
56d3b4d668 tests: Enable CCMP fragmentation check
This was triggering failures due to a mac80211 bug that has now been
fixed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 17:15:16 +02:00
Jouni Malinen
f0e30c8410 Do not start another connect work while one is pending
It was possible for the connect or sme-connect radio work to get
re-scheduled while an earlier request was still pending, e.g.,
select_network is issued at the moment a scan radio work is in progress
and the old scan results are recent enough for starting the connection.
This could result in unexpected attempt to re-associate immediately
after completing the first connection.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 15:22:35 +02:00
Jouni Malinen
47c549fd8e tests: WPS UPnP operations
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-24 13:56:43 +02:00
Jouni Malinen
44ff0400b4 tests: WPS UPnP SSDP testing
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-24 13:56:42 +02:00
Jouni Malinen
b2210bd289 tests: Stop WPS ER on station reset
This seems to be needed in some cases to avoid issues in test cases that
assume there are no other ERs running.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 13:56:42 +02:00
Jouni Malinen
329039869a WPS: Fix UNSUBSCRIBE error returns if NT or CALLBACK header is used
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-22 18:58:33 +02:00
Jouni Malinen
f34df28e93 WPS: Fix UNSUBSCRIBE to return 412 if no SID match found
UPnP-arch-DeviceArchitecture describe ErrorCode 412 to be used for the
case where no un-epxired subscription matches. This used to return 200
which is not strictly speaking correct even though it is unlikely to
cause any problems.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-22 18:58:33 +02:00
Jouni Malinen
80f256a568 WPS: Remove unnecessary filename NULL check
The caller of the GET parser is checking this already and the GET case
was the only one that ended up doing the duplicated validation step.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-22 14:07:23 +02:00
Jouni Malinen
29513e461a tests: Remove forgotten tcpdump references
tcpdump has not been used in the test scripts for a while, so no need
to stop it from stop.sh.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-22 10:47:49 +02:00
Jouni Malinen
8107d33361 tests: Fix the file comment to describe what this script does
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-21 20:25:25 +02:00
Roger Zanoni
040dc68e8c tests: Change the python interpreter directive
This makes the script check the environment for the current python
interpreter in use instead of assuming that the python executable points
to a python 2 interpreter.

Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
2014-02-21 20:23:56 +02:00
Jouni Malinen
5be9dcbb86 tests: Remove unnecessary interpreter line from most python files
Only run-tests.py is actually executed, so there is no need to specify
the interpreter in all the helper files and test script files.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-21 20:21:53 +02:00
Rahul Jain
aef5047acc P2P: Fix missing eloop_cancel_timeout in invitation trigger
When a Probe Request frame from an invitation peer is received, a timer
is schedule to start invitation. However, this could have been scheduled
multiple times (once per Probe Request frame) which is undesirable since
only a single invitation should be initiated.

Signed-off-by: Rahul Jain <rahul.jain@samsung.com>
2014-02-21 13:54:09 +02:00
Jouni Malinen
3cdcb3a4b3 tests: Add module tests for WPS attribute parsing
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-21 13:41:30 +02:00
Jouni Malinen
ea449b5bfe tests: Add a module test integration to hwsim tests
CONFIG_MODULE_TESTS=y build option can now be used to build in module
tests into hostapd and wpa_supplicant binaries. These test cases will be
used to get better testing coverage for various details that are
difficult to test otherwise through the control interface control. A
single control interface command is used to executed these tests within
the hwsim test framework. This commit adds just the new mechanism, but no
module tests are yet integrated into this mechanism.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-21 13:08:08 +02:00
Jouni Malinen
da179bd0e1 WPS: Fix parsing of 0-length WFA vendor extension subelement
The previous parser would have skipped a WFA vendor extension attribute
that includes only a single zero-length subelement. No such subelement
has been defined so far, so this does not really affect any
functionality, but better make the parser address this correctly should
such an element ever be added.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-21 13:08:08 +02:00
Jouni Malinen
211d7ab3d8 P2P: Add even more debug prints for Probe Request in non-Listen state
It looks like discovery_dev_id test case can still fail and based on the
previously added debug prints, this is happening since the P2P module
believes it is not in Listen state even when a P2P_LISTEN was issued.
p2p_listen_cb() did not get called on remain-on-channel event for some
reason, so lets add more debug to find out why this can happen.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 16:59:29 +02:00
Roger Zanoni
848905b12a Avoid undefined references with CONFIG_WPA_TRACE_BFD=y
libdl, libiberty, and libzlib are dependencies for libbfd.

Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
2014-02-20 16:32:26 +02:00
Anders Kaseorg
9e38836427 wpa_debug: Remove 2048 byte message length limit
Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2014-02-20 16:32:26 +02:00
Jouni Malinen
66a6331501 tests: Increase P2P SD test coverage
Verify cases both with multiple peers (one of which not advertising any
services) and with multiple SD queries.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 16:32:26 +02:00
Jithu Jance
f667e031c9 P2P: Address few issues seen with P2P SD
Suppose we have multiple peers and we have peers advertising SD
capability, but no services registered for advertising. In this case,
even if there are multiple broadcast queries set, we might end up
sending only the lastly added broadcast query to the same device (since
SD_INFO won't get set for the first broadcast query). Add support for
multiple wildcard queries to be tracked to enable this type of use
case.

Some times it is seen that before advancing to next device in the list,
the scan results come and update SD_SCHEDULE flag. This will result in
sending the already sent query to the same device without giving chance
to other devices. This issue again is seen with peer devices advertising
SD capability without any services registered.

Signed-off-by: Jithu Jance <jithu@broadcom.com>
2014-02-20 16:32:12 +02:00
Dmitry Shmidt
e9a6f18385 TLS: Add tls_disable_tlsv1_1 and tls_disable_tlsv1_2 phase1 params
These can be used to disable TLSv1.1 and TLSv1.2 as a workaround for AAA
servers that have issues interoperating with newer TLS versions.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2014-02-20 15:28:57 +02:00
Jouni Malinen
41ff0fa64c tests: Verify NAS identification attributes in Disconnect-Request
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 13:56:27 +02:00
Jouni Malinen
cb10c7d12d RADIUS DAS: Add support for NAS identification attributes
This allows NAS-IP-Address, NAS-Identifier, and NAS-IPv6-Address to be
included in the Disconnect-Request packets.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 13:55:36 +02:00
Jouni Malinen
e58f59cb58 tests: Verify that Disconnect-Request prevents PMKSA caching
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 13:27:16 +02:00
Jouni Malinen
0d7c5e1dfc RADIUS DAS: Remove PMKSA entry on Disconnect-Request
When a station is disconnected based on Disconnect-Request, it is better
to force the station to go through full EAP authentication if it tries
to reconnect.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-20 13:26:22 +02:00
Jouni Malinen
d87a6acdf5 WPS: Fix STA state validation when processing PutWLANResponse
It is possible for an ER to send an unexpected PutWLANResponse action
when the destination STA is in disassociated, but not fully
deauthenticated state. sta->eapol_sm can be NULL in such state and as
such, it would be possible to hit a NULL pointer dereference in the
eapol_auth_eap_pending_cb() call at the end of the
hostapd_wps_probe_req_rx() when trying to proxy the WPS message to the
station. Fix this by validating that sta->eapol_sm is set before
processing the message.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-19 23:51:55 +02:00
Dmitry Shmidt
ac494fcce4 Android: Use external libnl 2.0 dynamic library
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2014-02-19 14:10:12 +02:00
Roger Zanoni
b7cac41254 Fix hostapd and wpa_supplicant build with binutils >= 2.24.x
Using binutils >= 2.24.x and setting
CONFIG_WPA_TRACE/CONFIG_WPA_TRACE_BDF causes both builds to fail with
"#error config.h must be included before this header" message.

Since version 2.24.x, the bfd header checks for PACKAGE and
PACKAGE_VERSION macros.

As suggested in http://sourceware.org/bugzilla/show_bug.cgi?id=14243
projects that use bfd and don't use autotools should define a PACKAGE
macro.

Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
2014-02-19 14:10:12 +02:00
Jouni Malinen
b62d5b5450 Revert "OpenSSL: Do not accept SSL Client certificate for server"
This reverts commit 51e3eafb68. There are
too many deployed AAA servers that include both id-kp-clientAuth and
id-kp-serverAuth EKUs for this change to be acceptable as a generic rule
for AAA authentication server validation. OpenSSL enforces the policy of
not connecting if only id-kp-clientAuth is included. If a valid EKU is
listed with it, the connection needs to be accepted.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-19 13:22:49 +02:00
Jouni Malinen
94a3df500f P2P: Enable U-APSD support on GO automatically
Since P2P specification mandates P2P GO to support WMM-PS with legacy
STAs, enable this automatically if the driver indicates support for
U-APSD in AP mode. The "P2P_SET go_apsd 0" command can still be used to
disable this if needed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-17 13:15:29 +02:00
Jouni Malinen
a5527a49e8 P2P: Add more debug prints for Probe Request processing
It can be helpful to see from the debug log why the P2P Device role did
not reply to a Probe Request frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-17 11:43:53 +02:00
Jouni Malinen
da63ee073f tests: Add more time for P2P discovery tests
It looks like some of the discovery_* test cases have been failing every
now and then on the virtual server and the one second timeout could have
been a bit too short to cover some possible timing cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-17 11:42:43 +02:00
Andrei Otcheretianski
b3253ebb73 wpa_supplicant: Complete radio works on disable event
While testing rfkill blocking of a scanning interface, it
was seen that the ongoing scan never completes. This happens
since EVENT_SCAN_RESULTS is discarded on a disabled interface.

Fix this and also other possible radio work completion issues
by removing all the radio works (including started) of the
disabled interface.

To be able to remove already started radio works, make their
callbacks be reentrant with deinit flag (when the work
is started), so each radio work should be able to handle
its own termination.

Signed-hostap: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-02-16 00:06:23 +02:00
Jouni Malinen
55497a51a8 tests: Verify CoA-Request behavior
This version verifies that hostapd NAKs a valid request since
CoA-Request is not yet supported.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 22:03:06 +02:00
Jouni Malinen
6f939e591e tests: Convert connect() to use kwargs
This makes it more convenient to add new network block parameters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 21:58:09 +02:00
Jouni Malinen
a3b2bdaf24 tests: Verify RADIUS Disconnect-Request behavior
This uses pyrad to build and send various Disconnect-Request packets to
hostapd.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 21:58:08 +02:00
Jouni Malinen
38ecb06e16 Convert RADIUS debug dumps to use wpa_printf()
This allows the debug dumps of RADIUS messages to be captured through
normal wpa_printf() mechanisms.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 21:39:31 +02:00
Jouni Malinen
a0ac572611 EAP-SIM DB: Remove client socket file on connect() error
If the connection from hostapd authentication server to hlr_auc_gw fails
due to hlr_auc_gw not running yet, the local socket file was left
behind. Delete the socket file on connect() failure path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 21:39:31 +02:00
Jouni Malinen
4fcee244b9 tests: Verify RADIUS server MIB values
Enable hostapd control interface for the RADIUS server instance and
verify that the RADIUS server MIB counters are incremented.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 21:39:31 +02:00
Jouni Malinen
4287bb76bf tests: Verify RADIUS accounting functionality
Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 17:08:38 +02:00
Jouni Malinen
1cfb58d400 tests: Build hlr_auc_gw separately for code coverage analysis
This improves accuracy of the code coverage reports with hostapd-as-AS
and hlr_auc_gw getting analyzed separately.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 17:08:38 +02:00
Jouni Malinen
a1dd890a85 RADIUS: Add minimal accounting server support
This can be used to test RADIUS Accounting in hostapd.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 16:26:48 +02:00
Jouni Malinen
eac674402f tests: Verify NtPasswordHash with different UTF-8 cases
This adds a password that uses one, two, and three octet encoding
for UTF-8 characters. The value is tested against a pre-configured
hash to verify that utf8_to_ucs2() function works correctly.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 12:08:50 +02:00
Jouni Malinen
22dd2d7a98 Fix MSCHAP UTF-8 to UCS-2 conversion for three-byte encoding
This fixes issues in using a password that includes a UTF-8 character
with three-byte encoding with EAP methods that use NtPasswordHash
(anything using MSCHAPv2 or LEAP).

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 12:06:35 +02:00