P2P: Maintain list of per-client PSKs for persistent groups
Record all generated per-client PSKs in the persistent group network
block and configure these for the GO Authenticator whenever re-starting
the persistent group. This completes per-client PSK support for
persistent groups.
P2P: Select PSK based on Device Address instead of Interface Address
When using per-device PSKs, select the PSK based on the P2P Device
Address of the connecting client if that client is a P2P Device. This
allows the P2P Interface Address to be changed between P2P group
connections which may happen especially when using persistent groups.
P2P: Store P2P Device Address in per-device PSK records
This makes the P2P Device Address of the Enrollee available with the PSK
records to allow P2P Device Address instead of P2P Interface Address to
be used for finding the correct PSK.
"wpa_cli p2p_set per_sta_psk <0/1>" can now be used to disable/enable
use of per-device PSKs in P2P groups. This is disabled by default.
When enabled, a default passphrase is still generated by the GO for
legacy stations, but all P2P and non-P2P devices using WPS will get
a unique PSK.
This gives more protection for the P2P group by preventing clients from
being able to derive the unicast keys used by other clients. This is
also a step towards allowing specific clients to be removed from a group
reliably without having to tear down the full group to do so.
P2P: Stop listen state when listen-only duration is over
Even after listen duration is over, P2P module remained in
P2P_LISTEN_ONLY state, which is blocking station mode scans. Fix this by
stopping P2P listen explicitly to update p2p_state to IDLE when listen
duration expires.
Jouni Malinen [Sat, 31 Aug 2013 14:59:16 +0000 (17:59 +0300)]
tests: Make test_autogo validate group removal event on client
Use test_autogo to verify that P2P client is able to notice explicit
group session termination message from the GO. This would have caught
the regression in processing P2P deauthentication notifications.
Jouni Malinen [Sat, 31 Aug 2013 14:27:20 +0000 (17:27 +0300)]
wpa_cli: Allow first DISCONNECTED event to be reported
wpa_cli filters out extra DISCONNECTED events from action scripts. This
ended up filtering out the first real DISCONNECT event in case wpa_cli
was started when wpa_supplicant was in connected state. Change wpa_cli
to allow the first disconnection event to be reported to the action
script in such case.
Jouni Malinen [Sat, 31 Aug 2013 14:18:45 +0000 (17:18 +0300)]
Disallow WEP configuration in WPA network
Some drivers fail to work if WEP keys are configured in a WPA network.
To avoid potentially confusing error cases, reject hostapd configuration
that enables WPA and includes parameters that would imply that WEP keys
would be set.
Jouni Malinen [Sat, 31 Aug 2013 13:44:42 +0000 (16:44 +0300)]
D-Bus: Do not send network notification for all P2P groups
Previously, network added event was skipping during group formation.
However, this did not necessarily catch all cases of temporary P2P
network blocks. Check ssid->p2p_group to make this behavior more
consistent by avoiding all P2P groups.
Sreenath Sharma [Sat, 31 Aug 2013 08:59:05 +0000 (11:59 +0300)]
P2P: Allow P2P functionality to be disabled per interface
By default, P2P is initialized for all driver interfaces and this makes
P2P getting initialized for non-P2P station interface if the supplicant
is started first on this interface. If an interface is dedicated for
non-P2P station mode, it is now possible to disable P2P initialization
by adding 'p2p_disabled=1' in the configuration file of non-P2P station
interface, irrespective of the order in which supplicant is started.
Jouni Malinen [Sat, 31 Aug 2013 08:54:23 +0000 (11:54 +0300)]
tests: Use longer timeout in test_ap_wps_er_add_enrollee
This is another one of the test cases that can time out frequently
under valgrind during WPS exchange. Increase the timeout to make
false error reports less likely to occur.
Sreenath Sharma [Sat, 31 Aug 2013 08:11:41 +0000 (11:11 +0300)]
P2P: Immediate group removal in GC in case of deauthentication
Right now in case of deauthentication from GO, immediate group removal will
happen in GC only if the deauthentication packet has a valid IE. However,
the IE in deauthentication packet is mandated only for managed P2P group.
So in normal P2P group the group removal is delayed and will happen later
only in group idle timeout.
This fixes a regression from commit d7df0fa727a2a79d7b22df6c68961220349ab2e3 that changed the previous check
for data->deauth_info != NULL to data->deauth_info->ie != NULL.
Swisscom SIM cards do not include MNC length within EF_AD, and end up
using incorrect MNC length based on the 3-digit default. Hardcode MNC
length of 2 for Switzerland, in the same manner as it was done for
Finland.
Signed-hostap: Andrejs Cainikovs <andrejs.cainikovs@sonymobile.com>
Jouni Malinen [Sat, 31 Aug 2013 07:45:03 +0000 (10:45 +0300)]
tests: Increase WPS timeout to 30 seconds
Number of crypto operations seem to take very long time in the valgrind
tests (about five seconds for public key generation for M1 and M2 on a
virtual server) and this is enough to push the test runs to hit the
timeout frequently even when there is no real error. Make this less
frequent by increasing WPS test case timeout from 15 to 30 seconds to
avoid issues based on the test scripts.
Jouni Malinen [Sat, 31 Aug 2013 07:33:44 +0000 (10:33 +0300)]
tests: Increase P2P group formation timeout to 20 seconds
Number of crypto operations seem to take very long time in the valgrind
tests (about five seconds for passphrase to PSK mapping and for public
key generation for M1 and M2 on a virtual server) and this is enough to
push the test runs to hit the timeout frequently even when there is no
real error. Make this less frequent by increasing group formation
timeout from 15 to 20 seconds to avoid issues based on the test scripts
(15 + config time seconds timeout in the protocol may still kick in,
though).
Jouni Malinen [Tue, 27 Aug 2013 13:26:33 +0000 (16:26 +0300)]
IBSS RSN: Add a timeout for Authentication frame exchange
It is possible for the peer device not to support Authentication frame
exchange even though this would be required functionality in the
standard. Furthermore, either Authentication frame may be lost. To
recover from cases where Authentication frame sequence 2 is not
received, start EAPOL Authenticator from one second timeout.
Jouni Malinen [Tue, 27 Aug 2013 13:01:04 +0000 (16:01 +0300)]
tests: Wait for hostapd/wpa_supplicant to reply at start (concurrent)
Instead of waiting for a fixed duration, poll hostapd/wpa_supplicant
through the control interface until they are ready to reply in order to
avoid starting test case execution too early. This is like commit b76579e0c09a1a763b70d63613377b407cbc405f but for the concurrent P2P test
cases that were forgotten from that commit.
Jouni Malinen [Tue, 27 Aug 2013 09:23:10 +0000 (12:23 +0300)]
P2P: Postpone concurrent scans when waiting for first client as GO
Previously, concurrent station mode scans were postponed during an
ongoing P2P group formation up to the point of completed WPS
provisioning step. This would allow a scan to be started before the P2P
client has completed association for the data connection if a scan
request were timed to hit the window between the provisioning step and
the following association. Avoid this by extending P2P-in-progress state
to continue until the first data connection has been completed as part
of group formation. Use a ten second timeout for this to avoid leaving
scans disabled indefinitely if the client fails to connect completely.
Jouni Malinen [Tue, 27 Aug 2013 00:11:02 +0000 (03:11 +0300)]
tests: Detect BSSID mismatch in test_ibss_rsn
It looks like mac80211 does not always manage to join the same IBSS and
this can result in test_ibss_rsn failures. Detect this case and try to
get the IBSSes to merge by running a scan prior to continuing with the
test case.
Jouni Malinen [Mon, 26 Aug 2013 23:54:35 +0000 (02:54 +0300)]
IBSS RSN: Work around Data RX vs. Authentication RX race condition
It is possible for the driver to report EAPOL frame RX before
Authentication frame RX even if the frames arrived in the opposite
order. This can result in issues in cases where both IBSS peers initiate
Authentication frame exchange at about the same time and one of the
EAPOL sessions is started before processing Authentication frame seq=1
RX. Work around this by not re-initializing EAPOL state on
Authentication (SEQ=1) RX if own Authentication frame was transmitted
within last 500 ms.
Jouni Malinen [Mon, 26 Aug 2013 23:00:39 +0000 (02:00 +0300)]
tests: Wait for all 4-way handshake pairs in test_ibss_rsn
The handshake between STA2 and STA1 was not tracked previously. For
completeness, include that in the list of handshakes that are explicitly
waited for to complete prior to starting the connectivity tests. Since
all key setup should be done at this point, remove the extra wait before
the last connectivity test between STA1 and STA2.
It looks like there may not be enough time to complete this test case in
15 seconds under valgrind on a virtual host every time, so increase the
timeout to 30 seconds to get more consistent test results.
Jouni Malinen [Mon, 26 Aug 2013 13:47:15 +0000 (16:47 +0300)]
tests: Wait for hostapd/wpa_supplicant to reply at start
Instead of waiting for a fixed duration, poll hostapd/wpa_supplicant
through the control interface until they are ready to reply in order to
avoid starting test case execution too early.
Jouni Malinen [Mon, 26 Aug 2013 13:38:13 +0000 (16:38 +0300)]
tests: Kill hostapd/wpa_supplicant more forcefully if needed
Try to make sure new testing can be started by forcing
hostapd/wpa_supplicant to be killed with SIGKILL if needed. In addition,
wait a bit longer when killing the processes to avoid issues with the
next test run starting before the old one has been fully terminated.
Jouni Malinen [Mon, 26 Aug 2013 11:16:31 +0000 (14:16 +0300)]
P2P: Update peer operating channel from GO Negotiation Confirm
If the device that sends the GO Negotiation Confirm becomes the GO, it
may change its operating channel preference between GO Negotiation
Request and Confirm messages based on the channel list received from us.
Previously, the peer operating channel preference was not updated in
such a case and this could result in the initial scans after GO
Negotiation using incorrect operating channel and as such, extra delay
in the connection process. Fix this by updating the operating channel
information from GO Negotiation Confirm in cases where the peer becomes
the GO.
Jouni Malinen [Mon, 26 Aug 2013 11:10:23 +0000 (14:10 +0300)]
P2P: Use the first pref_chan entry as operating channel preference
If there are no higher priority preference for the operating channel,
use the first pref_chan entry as the operating channel preference over
the pre-configured channel which is not really a good indication of
preference. This changes the behavior for GO Negotiation Request frame
operating channel preference value in cases where p2p_pref_chan list is
set.
Jouni Malinen [Mon, 26 Aug 2013 10:35:44 +0000 (13:35 +0300)]
P2P: Add GO negotiation results into the P2P-GO-NEG-SUCCESS event
This provides status information about the negotiated group to
wpa_supplicant control interface monitors during group formation in a
form that is easier to use than having to fetch the information
separately.
Jouni Malinen [Mon, 26 Aug 2013 08:46:21 +0000 (11:46 +0300)]
Replace perror() with wpa_printf(strerror) in ctrl_iface calls
This replaces number of perror() calls with wpa_printf() to get the
error messages embedded within rest of the debug messages in the same
stream instead of pushing these to stderr which may get directed to
another location.
Jouni Malinen [Mon, 26 Aug 2013 08:28:32 +0000 (11:28 +0300)]
tests: Stop valgrind.bin regardless of which option is started
The previous design of having to provide valgrind parameter to
stop-wifi.sh did not work since the new test setup may no match the
previous one. Instead of trying to figure out what needs to be stopped
based on previous run, stop all wpa_supplicant/hostapd processes running
under valgrind unconditionally to avoid cases where new set of processes
cannot be started due to existing processed.
Jouni Malinen [Sun, 25 Aug 2013 20:10:37 +0000 (23:10 +0300)]
tests: Use more enforced order for the RSN IBSS steps
test_ibss_rsn has been failing pretty frequently due to various issues
in getting all connections up. Try to address this initially by avoiding
concurrent operations and explicitly waiting for 4-way handshake
completion before testing data connection. Once this test case is
workign more robustly, a more difficult case with concurrent operations
can be added as a separate test case.
Jouni Malinen [Sun, 25 Aug 2013 17:53:58 +0000 (20:53 +0300)]
Add STATUS command to global control interface
This provides global status information that is applicable to all
interfaces (e.g., P2P state). In addition, ifname/address pairs are
listed to get information of all the interfaces that are currently
managed through this wpa_supplicant instance.
Jouni Malinen [Sun, 25 Aug 2013 17:35:19 +0000 (20:35 +0300)]
Add SET command for global control interface
This allows global parameters to be set through the global control
interface without having to use IFNAME prefix. For now, this covers
only the wifi_display parameter.
Jouni Malinen [Sun, 25 Aug 2013 16:46:57 +0000 (19:46 +0300)]
Clear EAPOL supplicant configuration info on current_ssid changes
There were some code paths that allowed obsolete configuration data
pointer to be maintained within EAPOL supplicant in case a network was
removed while not connection to it (i.e., wpa_s->current_ssid not
pointing to the network that was removed). This could result in use of
freed memory, e.g., from eap_sm_notify_ctrl_attached() when a new
control interface connected prior to the EAPOL supplicant configuration
pointer got updated.
Michal Kazior [Thu, 18 Jul 2013 07:17:06 +0000 (09:17 +0200)]
hostapd: Split up channel checking into helpers
This splits up the channel checking upon initialization into a few
helpers. This should make this a bit easier to follow. This also paves
the way for some initial ACS entry code.
Signed-hostap: Michal Kazior <michal.kazior@tieto.com>
Rui Paulo [Sun, 25 Aug 2013 08:40:19 +0000 (11:40 +0300)]
wired: Wait for the link to become active before sending packets
Interfaces that take one or two seconds to reconfigure the link after we
set IFF_ALLMULTI or after we bring the interface up were dropping the
initial TX EAPOL packet which caused excessive delays in authentication.
This change applies to FreeBSD/DragonFly only.
Ilan Peer [Sun, 25 Aug 2013 08:28:56 +0000 (11:28 +0300)]
P2P: Validate the freq in p2p_group_add
Add additional input verification for the frequency parameter in
p2p_group_add (and other P2P operations for that matter). Without this
verification invalid freq could be set and not handled properly.
Avraham Stern [Sun, 25 Aug 2013 08:24:29 +0000 (11:24 +0300)]
wpa_supplicant: Fix AP mode frequency initialization
In AP mode the frequency was initialized only after trying to set up the
AP which caused failure. Move AP frequency initialization to the right
place. This allows an AP mode network block without the frequency
parameter to be used with the default channel 11 being selected in that
case.
Ilan Peer [Sun, 25 Aug 2013 08:17:14 +0000 (11:17 +0300)]
P2P: Skip non-P2P interface in p2p_group_remove *
When 'p2p_group_remove *' is called while the station interface
is connected, the flow also disconnects the station interface.
Fix this by skipping non-P2P interfaces in the iteration.
David Spinadel [Sun, 25 Aug 2013 07:55:53 +0000 (10:55 +0300)]
WPS: Set currently used RF band in RF Bands attribute
According to WSC specification (Ver 2.0.2, section 8.3), RF Bands
attribute should be set to the specific RF band used for the current
message. Add an option to set wanted band in wps_build_rf_bands() and
add a callback to get the current band from wpa_supplicant and hostapd.
Signed-hostap: David Spinadel <david.spinadel@intel.com>
Ilan Peer [Sun, 25 Aug 2013 07:20:54 +0000 (10:20 +0300)]
nl80211: Do not change type to station on P2P interfaces
It is possible that when trying to remove a dynamically added interface,
changing its type to station mode is not possible (since the kernel does
not support so in its interface combinations).
Since P2P interfaces are always dynamically added, avoid changing their
type to station in the deinit_ap() and deinit_p2p_client() nl80211
callbacks, assuming that the interface is about to be removed.
Ilan Peer [Sun, 25 Aug 2013 06:48:27 +0000 (09:48 +0300)]
wpa_supplicant: Reduce wait time for control interfaces
Reduce the wait time for the monitor control interfaces to get
messages on wpa_supplicant de-init etc., as this significantly delays
the shutdown of the wpa_supplicant.
Jouni Malinen [Sat, 24 Aug 2013 21:35:10 +0000 (00:35 +0300)]
FT RRB: Clear pad field to avoid sending out uninitialized data
The pad field in the RRB messages is unused, but it should be
initialized to avoid sending out arbitrary data from stack. This was
also generating number of valgrind complaints about uninitialized memory
accesses in local FT tests.
Jouni Malinen [Sat, 24 Aug 2013 20:47:40 +0000 (23:47 +0300)]
tests: Sleep even longer before starting valgrind tests
It looks like some virtual host setups are too slow to get
wpa_supplicant initialized under valgrind and this was triggering test
failures. Work around this by using even a longer wait before test case
execution.
Jouni Malinen [Sat, 24 Aug 2013 20:45:11 +0000 (23:45 +0300)]
nl80211: Fix deinit path to unregister nl_mgmt socket
Commit 8e12685c43546d03ced5ec5dc4b56486a1204115 replaced call to
nl80211_mgmt_unsubscribe() on the deinit path with a
wpa_driver_nl80211_set_mode() call. This is not enough to unregister the
bss->nl_mgmt read socket in all cases. Fix this by unconditionally
unsubscribing from the nl80211 events after having change mode to
station.
Jouni Malinen [Sat, 24 Aug 2013 20:31:06 +0000 (23:31 +0300)]
Fix DETACH command debug prints to avoid use of freed memory
In case a control interface socket is detached because of sendmsg()
failing for the socket, function call to detach the socket uses a
pointer to the socket information in the structure to be freed. Reorder
code to print socket info before freeing the data to avoid use of freed
memory in case debug prints are enabled.
Jouni Malinen [Sat, 24 Aug 2013 18:46:44 +0000 (21:46 +0300)]
tests: Make wpa_supplicant and hostapd executable through valgrind
It looks like valgrind could not under buildbot with the default file
mode. Fix this by making wpa_supplicant and hostapd binaries readable
and executable by everyone.
Jouni Malinen [Sat, 24 Aug 2013 17:33:21 +0000 (20:33 +0300)]
tests: Add option to run test cases under valgrind/concurrent P2P
./run-all.sh can now take an optional argument to select whether to run
all test cases as before (default), to run these under valgrind
("valgrind"), to run P2P test cases with concurrent station interface
("concurrent"), or the concurrent P2P test cases under valgrind
("concurrent-valgrind").
valgrind cases report errors if a test case fails or valgrind reports an
error.
Jouni Malinen [Sat, 24 Aug 2013 17:31:04 +0000 (20:31 +0300)]
Make global UNIX socket non-blocking for ctrl_iface
This keeps wpa_supplicant from hanging forever if the other end of the
socket dies. This is similar to the earlier commit 4fdc8def8855ce9b90ffbbdc47152ce46ccdcb1e to make the global control
interface befave in the same way.
Jouni Malinen [Sat, 24 Aug 2013 16:48:04 +0000 (19:48 +0300)]
tests: Use logger.info() instead of print to get one stream
print and logger.info() were directing output to different locations
(stdout and stderr, respectively) which resulted in buildbot showing
reordered entries. Use logger consistently to avoid that.
Jouni Malinen [Sat, 24 Aug 2013 16:41:08 +0000 (19:41 +0300)]
tests: Check for exceptions during TEST-START/STOP
It looks like the NOTE commands can time out in some cases. Avoid
stopping the test run in such a case to get more coverage if this is a
temporary issue.
Jouni Malinen [Fri, 23 Aug 2013 16:27:25 +0000 (19:27 +0300)]
Change WEP network selection to reject WPA/WPA2 APs
Previously, wpa_supplicant behavior in WEP configuration was to try to
mimic a device that is not aware of WPA/WPA2 and as such, it tried to
connect to a WPA/WPA2 AP with the assumption that the AP could be
providing support for both WEP and WPA/WPA2 stations in the same BSS.
Such APs could have been used during transition from WEP to more secure
options, but that type of deployment have not been used in large number
and are not really of much use anymore taken into account that more or
less all new devices support WPA/WPA2. That combined with the preference
to deprecate WEP justifies removing this use case and making WEP
networking matching more strict by using the knowledge of AP advertising
WPA/WPA2 as an indication of WEP not being supported.
Jouni Malinen [Fri, 23 Aug 2013 14:43:01 +0000 (17:43 +0300)]
WPS: Fix failure path to allow WSC_NACK and EAP-Failure to be exchanged
Commit c7a67a77195464d667d6f482777a75325b6f3642 forced disconnection
when wpas_clear_wps() is called. Call this function from a registered
timeout when processing a failure event in order to allow the WPS
handshake to be completed with WSC_NACK and EAP-Failure.
Sunil Dutt [Fri, 23 Aug 2013 12:41:05 +0000 (15:41 +0300)]
nl80211: Update the assoc_freq during connect
drv->assoc_freq was not updated during the connect command (neither
during the command's invocation nor after getting the event) unlike with
auth/assoc case where assoc_freq is updated. This resulted in
nl80211_get_link_noise() (and any other function for that matter) using
the improper drv->assoc_freq value with drivers that use the connect
API. Fix this by updating drv->assoc_freq on connect command and when
fetching the frequency from the driver.
Stop AP command can be used by the driver as an event to indicate that
AP mode has stopped operation. WLAN driver may have encountered errors
that has forced the driver to report this event or concurrent operations
on virtual interfaces may have forced AP operation to be stopped. When
in P2P GO mode, wpa_supplicant uses this event to remove P2P group to
keep in sync with the driver state.
It turned out that this breaks lots of use cases where p2p_find is
issued while already in p2p_listen state. As such, we cannot reject
p2p_find this easily without checking for more specific cases.
Deepthi Gowri [Thu, 1 Aug 2013 12:39:47 +0000 (15:39 +0300)]
P2P: Reject p2p_find while P2P connection is in progress
Though p2p_find is not expected during ongoing P2P connection, it is
possible that any third party application issues a p2p_find resulting in
connection failure. Address this by rejecting any p2p_find command while
connection is in progress.
Sunil Dutt [Thu, 1 Aug 2013 07:47:23 +0000 (10:47 +0300)]
TDLS: Handle transmission failures of TPK Handshake messages
A transmission failure of the TDLS Setup Request frame (TPK Handshake
M1) results in no further retries and the peer entry being left in state
where all TDLS Setup Request frames from the peer with higher address
would be rejected, thus always resulting in a failure to establish a
TDLS link. Handle the failures in transmission by disabling the link
immediately to ensure the traffic to the peer goes through the AP. This
commit also handles similar transmision failures for TPK Handshake M2
and M3 frames (TDLS Setup Response and Confirm).
Wei-Jen Lin [Wed, 31 Jul 2013 20:22:04 +0000 (23:22 +0300)]
P2P: Fix invalid remain-on-channel duration for frame TX
cfg80211 does not allow the zero duration of remain-on-channel. Instead,
use 20 ms as default waiting time when remain-on-channel is used to
schedule offchannel transmission that does not expect a response.
Sean Lin [Wed, 31 Jul 2013 20:09:34 +0000 (23:09 +0300)]
P2P: Do not delay retries on failure during group formation
4-way handshake may fail under extremely noisy environment and if this
happens during P2P group formation, the 10 second extra delay added in
wpas_auth_failed() can result in running over the 15 second timeout.
Avoid this by skipping the delay mechanism in wpas_auth_failed() for the
P2P group formation case. The P2P formation timeout will take care of
stopping the attempts if the failure condition does not get resolved.
nl80211: Fix TDLS key configuration to not set TX key index
The nl80211 command for setting the TX index does not distinguish TDLS
vs. AP key and as such, the driver would not know what this set TX key
index operation is doing in the TDLS case. This could result in the TX
key index for AP being changed instead if static WEP is used in the AP
connection. Fix the issue by not setting TX key index when configuring a
TDLS key.
This is not used anymore after the previous commits that changed the
driver interface to use number of supported concurrent channels instead
of this flag.
Signed-hostap: Ilan Peer <ilan.peer@intel.com>
Signed-hostap: David Spinadel <david.spinadel@intel.com>
Use wpa_drv_shared_freq() if get_radio_name() is not supported
Some driver interfaces may not support the get_radio_name() design and
get_shared_radio_freqs() needs to be aware of such possibility when
determining shared radio frequencies.
Ilan Peer [Sun, 21 Jul 2013 17:03:53 +0000 (20:03 +0300)]
Change share_vif_oper_freq() to handle multiple freqs
There are devices that can operate several channels concurrently.
Change shared_vif_oper_freq() to get_shared_radio_freqs() that can
return an array of frequencies currently used by all the virtual
interfaces that share the same radio.
In addition, move it to wpa_supplicant.c, so it can be used by other
modules.
Signed-hostap: Ilan Peer <ilan.peer@intel.com>
Signed-hostap: David Spinadel <david.spinadel@intel.com>
projects / thirdparty / hostap.git / log
