]> git.ipfire.org Git - thirdparty/hostap.git/log
thirdparty/hostap.git
10 years agowpa_supplicant: Allow external management frame processing for testing
Jouni Malinen [Sat, 8 Mar 2014 18:21:21 +0000 (20:21 +0200)] 
wpa_supplicant: Allow external management frame processing for testing

This enables more convenient protocol testing of AP and P2P
functionality in various error cases and unexpected sequences without
having to implement each test scenario within wpa_supplicant.
ext_mgmt_frame_handle parameter can be set to 1 to move all management
frame processing into an external program through control interface
events (MGMT-RX and MGMT-TX-STATUS) and command (MGMT_TX). This is
similar to the test interface that was added to hostapd previously, but
allows more control on offchannel operations and more direct integration
with the internal P2P module.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: HS 2.0 subscription remediation notification
Jouni Malinen [Sat, 8 Mar 2014 09:49:23 +0000 (11:49 +0200)] 
tests: HS 2.0 subscription remediation notification

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: VLAN tests using RADIUS tunnel attributes
Jouni Malinen [Sat, 8 Mar 2014 09:29:35 +0000 (11:29 +0200)] 
tests: VLAN tests using RADIUS tunnel attributes

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Add test cases for AP VLAN
Jouni Malinen [Tue, 29 Oct 2013 22:16:36 +0000 (00:16 +0200)] 
tests: Add test cases for AP VLAN

These verify dynamic AP VLAN interface addition with open and WPA2-PSK
network.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoEnable RADIUS message dumps with excessive debug verbosity
Jouni Malinen [Sat, 8 Mar 2014 09:21:58 +0000 (11:21 +0200)] 
Enable RADIUS message dumps with excessive debug verbosity

Previously, this was enabled only at msgdump verbosity level, but any
level that is more verbose than it should also be included.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRevert "bridge: Track inter-BSS usage"
Jouni Malinen [Sat, 8 Mar 2014 08:54:26 +0000 (10:54 +0200)] 
Revert "bridge: Track inter-BSS usage"

This reverts commit 4345fe963e7bc6461b7547766d47fd4722d72130. That
introduced number of memory leaks and since the rest of the VLAN changes
did not yet go in, it is easier to revert this for now and bring back
the changes after fixes if there is sufficient interest for them in the
future.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Verify HS 2.0 deauth request from RADIUS Access-Accept
Jouni Malinen [Fri, 7 Mar 2014 21:21:17 +0000 (23:21 +0200)] 
tests: Verify HS 2.0 deauth request from RADIUS Access-Accept

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoAllow arbitrary RADIUS attributes to be added into Access-Accept
Jouni Malinen [Fri, 7 Mar 2014 21:19:52 +0000 (23:19 +0200)] 
Allow arbitrary RADIUS attributes to be added into Access-Accept

This extends the design already available for Access-Request packets to
the RADIUS server and Access-Accept messages. Each user entry can be
configured to add arbitrary RADIUS attributes.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoFix PMF protect disconnection on session timeout
Jouni Malinen [Fri, 7 Mar 2014 21:23:41 +0000 (23:23 +0200)] 
Fix PMF protect disconnection on session timeout

Request the driver to send a Deauthentication frame before doing
any other disconnection steps on the session timeout path. This is
needed when PMF is negotiated for the association since the driver
will need to find the STA entry and the PTK for it to be able to
protect the robust Deauthentication frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoFix hostapd error path regression
Jouni Malinen [Fri, 7 Mar 2014 20:37:03 +0000 (22:37 +0200)] 
Fix hostapd error path regression

Commit 354c903f8e47ae0fb41fb54ecc018e61d9573506 added setting of
driver_ap_teardown on the hostapd exit path without taking into account
that this may also be called on an error path where the interface has
not been initialized. Fix the resulting NULL pointer dereference to
allow hostapd to exit cleanly in error case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agowpa_supplicant: Add a configuration file for the P2P_DEVICE parameters
Ilan Peer [Mon, 2 Sep 2013 12:41:00 +0000 (15:41 +0300)] 
wpa_supplicant: Add a configuration file for the P2P_DEVICE parameters

Add an option to specify a configuration file that can be used to hold
the P2P_DEVICE configuration parameters. If this option is not used, the
P2P_DEVICE configuration parameters will be read from interface
configuration file.

Note that it is advised to use this option in some cases such as:

If a P2P_DEVICE is supported by the driver, the wpa_supplicant creates a
dedicated P2P Device interface, where the configuration file used for
the main interface is used. As a consequence, if the configuration file
includes network definition etc., the wpa_supplicant will try to perform
station specific flows on the P2P Device interface which will fail.

If a P2P_DEVICE is supported by the driver and update_config is used,
the P2P Device configuration data will override the main interface
configuration data.

Signed-hostap: Ilan Peer <ilan.peer@intel.com>

10 years agoDisable interface if ACS fails
Pawel Kulakowski [Thu, 6 Mar 2014 09:40:54 +0000 (10:40 +0100)] 
Disable interface if ACS fails

In case of Automatic Channel Selection (ACS) failure, we do not have a
real fallback path. Interface still remains in ACS state. To reflect we
did not succeed with ACS, simply disable the interface and indicate this
to user/upper layer entity so that a suitable recovery or error
notification can be performed.

Signed-off-by: Pawel Kulakowski <pawel.kulakowski@tieto.com>
10 years agotests: Verify open mode IBSS and beacon_int configuration
Jouni Malinen [Thu, 6 Mar 2014 21:10:48 +0000 (23:10 +0200)] 
tests: Verify open mode IBSS and beacon_int configuration

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoConfigure beacon interval for IBSS command
Jouni Malinen [Thu, 6 Mar 2014 21:09:20 +0000 (23:09 +0200)] 
Configure beacon interval for IBSS command

wpa_supplicant already allowed beacon interval to be configured for AP
mode operations, but this was not passed to the driver for IBSS even
though the same parameter can used for that case. Add this for the
nl80211 driver interface to allow beacon interval to be controlled for
IBSS as well.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify open mode AP functionality
Jouni Malinen [Thu, 6 Mar 2014 20:59:38 +0000 (22:59 +0200)] 
tests: Verify open mode AP functionality

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoHS 2.0R2: Check for OSEN when determining whether to authorize STA
Jouni Malinen [Thu, 6 Mar 2014 20:48:37 +0000 (22:48 +0200)] 
HS 2.0R2: Check for OSEN when determining whether to authorize STA

handle_assoc_cb() got this addition, but the check in
hostapd_new_assoc_sta() was not modified to be aware of the OSEN special
case for EAPOL state machines to be used for marking a STA authorized.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoSet the station to authorized on assoc event for open authentication
Sunil Dutt Undekari [Tue, 25 Feb 2014 17:02:02 +0000 (22:32 +0530)] 
Set the station to authorized on assoc event for open authentication

This was done in handle_assoc_cb() in ieee802_11.c for drivers that use
hostapd SME/MLME. However, drivers that include SME/MLME implementation
do not use that function and the STA flag needs to be set when
processing the association notification. This is needed to get the STA
entry into showing the proper authorized state and to get the
AP-STA-CONNECTED/DISCONNECTED events on the control interface.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agohostapd: Fix vht_capab 'Maximum A-MPDU Length Exponent' handling
Bartosz Markowski [Wed, 26 Feb 2014 09:39:47 +0000 (10:39 +0100)] 
hostapd: Fix vht_capab 'Maximum A-MPDU Length Exponent' handling

As per IEEE Std 802.11ac-2013, 'Maximum A-MPDU Length Exponent' field
value is in the range of 0 to 7. Previous implementation assumed EXP0 to
be the maximum length (bits 23, 24 and 25 set) what is incorrect.

This patch adds options to set it up within the 0 to 7 range.

Signed-off-by: Bartosz Markowski <bartosz.markowski@tieto.com>
10 years agotests: Fix current log dir symbolic link
Eduardo Abinader [Thu, 27 Feb 2014 15:18:36 +0000 (11:18 -0400)] 
tests: Fix current log dir symbolic link

Fix updating of the current symbolic link when LOGDIR is already set.
The current symbolic link was only set, if LOGDIR has not been
previously defined. If the user had chosen to cancel the running test
iteration and run it again by running start.sh again, the current
symbolic link was not updated.

Signed-off-by: Eduardo Abinader <eduardo.abinader@openbossa.org>
10 years agoACS: Fix VHT80 segment picking
Michal Kazior [Wed, 5 Mar 2014 08:12:11 +0000 (09:12 +0100)] 
ACS: Fix VHT80 segment picking

For example, the previous implementation considered [44, 48, 52, 56] to
be a valid VHT80 channel -- which it is not. This resulted in, e.g.,
failure to start CAC when channels on overlapped segments included DFS
channels.

Add a check similar to the HT40 one to prevent that. The check is
performed this way as the ACS implementation assumes the primary channel
to be the first channel in a given segment.

Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
10 years agoDFS: Print error in case CAC fails
Janusz Dziedzic [Wed, 5 Mar 2014 08:21:20 +0000 (09:21 +0100)] 
DFS: Print error in case CAC fails

Previously, we printed this message as a debug one, which was confusing
in case verbose debug messages were disabled. User could think CAC
started but never ended. Add more parameterss to DFS_EVENT_CAC_START, so
external programs can more easily check what was wrong in case of
errors.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
10 years agoAP/GO interface teardown optimization
Moshe Benji [Wed, 5 Mar 2014 12:55:29 +0000 (14:55 +0200)] 
AP/GO interface teardown optimization

This commit adds an option to optimize AP teardown by leaving the
deletion of keys (including group keys) and stations to the driver.

This optimization option should be used if the driver supports stations
and keys removal when stopping an AP.

For example, the optimization option will always be used for cfg80211
drivers since cfg80211 shall always remove stations and keys when
stopping an AP (in order to support cases where the AP is disabled
without the knowledge of wpa_supplicant/hostapd).

Signed-off-by: Moshe Benji <moshe.benji@intel.com>
10 years agoUse P2P_IE_VENDOR_TYPE more consistently
Rahul Jain [Wed, 26 Feb 2014 06:18:07 +0000 (11:48 +0530)] 
Use P2P_IE_VENDOR_TYPE more consistently

Previously, both this and combination of OUI_WFA and P2P_OUI_TYPE were
used. Using the full 32-bit value as a single operation saves a bit in
code size, so start moving towards using it more consistently when
writing or finding the P2P vendor specific element.

Signed-off-by: Rahul Jain <rahul.jain@samsung.com>
10 years agoWPS: Parse Registrar Configuration Methods
Rahul Jain [Wed, 26 Feb 2014 12:09:49 +0000 (17:39 +0530)] 
WPS: Parse Registrar Configuration Methods

This new subelement was added into the WFA Vendor Extension.

Signed-off-by: Rahul Jain <rahul.jain@samsung.com>
10 years agotests: Group formation and two peers at the same time
Jouni Malinen [Wed, 5 Mar 2014 20:37:50 +0000 (22:37 +0200)] 
tests: Group formation and two peers at the same time

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Persistent group formation with reverse roles
Jouni Malinen [Wed, 5 Mar 2014 20:23:01 +0000 (22:23 +0200)] 
tests: Persistent group formation with reverse roles

This increase test coverage a bit for the Persistent group flag in GO
Negotiation Response.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Extended listen timing in GO Negotiation messages
Jouni Malinen [Wed, 5 Mar 2014 20:14:15 +0000 (22:14 +0200)] 
tests: Extended listen timing in GO Negotiation messages

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: P2P GO Negotiation with PBC vs. PIN
Jouni Malinen [Wed, 5 Mar 2014 20:04:44 +0000 (22:04 +0200)] 
tests: P2P GO Negotiation with PBC vs. PIN

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agonl80211: Extend the new vendor command for testing nl80211
Jouni Malinen [Wed, 5 Mar 2014 15:19:58 +0000 (17:19 +0200)] 
nl80211: Extend the new vendor command for testing nl80211

CONFIG_TESTING_OPTIONS=y build of wpa_supplicant now allows arbitrary
cfg80211 commands to be performed through the new VENDOR ctrl_iface
command by using a special vendor_id ffffffff. The command identifier
(NL80211_CMD_*) is encoded as the subcmd and the attributes in the
hexformatted data area. Response attributes are returned as a hexdump.

For example, this shows a NL80211_CMD_FRAME and a response (cookie
attribute) on a little endian host:

wpa_cli -i wlan0 vendor ffffffff 59 080003004d0000000800260085090000....
0c00580000d7868c0388ffff

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: More thorough P2P GO Negotiation Request protocol checks
Jouni Malinen [Tue, 4 Mar 2014 22:26:16 +0000 (00:26 +0200)] 
tests: More thorough P2P GO Negotiation Request protocol checks

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: WPS 2.0 rejection of WEP credential
Jouni Malinen [Wed, 5 Mar 2014 10:36:20 +0000 (12:36 +0200)] 
tests: WPS 2.0 rejection of WEP credential

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: PD-before-GO-Neg workaround
Jouni Malinen [Tue, 4 Mar 2014 22:36:37 +0000 (00:36 +0200)] 
tests: PD-before-GO-Neg workaround

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoP2P: Do not start scan for P2P Device interfaces at driver init
Eliad Peller [Mon, 3 Mar 2014 12:53:23 +0000 (14:53 +0200)] 
P2P: Do not start scan for P2P Device interfaces at driver init

wpa_supplicant started delayed sched scan also on P2P Device interfaces,
resulting in erroneous scans and connection attempts. Skip that on
driver init when the interface is dedicated only for P2P management
purposes.

Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
10 years agoP2P: Do not initialize bgscan on P2P interfaces
David Spinadel [Mon, 3 Mar 2014 12:53:20 +0000 (14:53 +0200)] 
P2P: Do not initialize bgscan on P2P interfaces

As a P2P group has a unique SSID and one security domain, it does
not make sense to enable background scanning for roaming purposes.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
10 years agonl80211: Fix RTM event handling for dynamic interfaces
Andrei Otcheretianski [Mon, 3 Mar 2014 12:53:19 +0000 (14:53 +0200)] 
nl80211: Fix RTM event handling for dynamic interfaces

When an interface is disabled through rtm event, wpa_supplicant's
EVENT_INTERFACE_DISABLED is generated, which in turn, may
completely destroy wpa_driver_nl80211_data struct (drv). This
scenario happens now when P2P GO interface is disabled. Since this
struct may be used later in this function it causes segmentation fault.

Fix it by trying to find drv again in the interface list after
wpa_supplicant's event handling.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
10 years agoconfig: Add bgscan option when saving global configuration
Alexander Bondar [Mon, 3 Mar 2014 12:53:18 +0000 (14:53 +0200)] 
config: Add bgscan option when saving global configuration

Signed-off-by: Alexander Bondar <alexander.bondar@intel.com>
10 years agobgscan: Do not initialize bgscan if disabled by user
David Spinadel [Mon, 3 Mar 2014 12:53:17 +0000 (14:53 +0200)] 
bgscan: Do not initialize bgscan if disabled by user

Do not initialize bgscan if the user explicitly set bgscan to an empty
string. Without this patch wpa_supplicant tries to initialize bgscan to
the first option if the string is empty.

Signed-off-by: David Spinadel <david.spinadel@intel.com>
10 years agonl80211: Add vendor command support
Beni Lev [Mon, 3 Mar 2014 11:09:50 +0000 (13:09 +0200)] 
nl80211: Add vendor command support

Add a callback to the driver interface that allows vendor specific
commands to be sent. In addition, a control interface command is added
to expose this new interface outside wpa_supplicant:

Vendor command's format:
VENDOR <vendor id> <sub command id> [<hex formatted data>]

The 3rd argument will be converted to binary data and then passed as
argument to the sub command.

This interface is driver independent, but for now, this is only
implemented for the nl80211 driver interface using the cfg80211 vendor
commands.

Signed-off-by: Beni Lev <beni.lev@intel.com>
10 years agonl80211: Fix tearing down WDS STA interfaces
Felix Fietkau [Fri, 28 Feb 2014 14:41:49 +0000 (15:41 +0100)] 
nl80211: Fix tearing down WDS STA interfaces

wpa_driver_nl80211_if_remove() checks bss->if_added before deleting an
interface, which is 0 for the first BSS. The only part of
wpa_driver_nl80211_if_remove() that should get called for WDS STA
interfaces is the call to nl80211_remove_iface(), which can be pulled in
here directly.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
10 years agotests: Add protocol tests for P2P message processing
Jouni Malinen [Sun, 2 Mar 2014 11:18:18 +0000 (13:18 +0200)] 
tests: Add protocol tests for P2P message processing

This commit includes number of test frames for attribute parsing.
Invitation Request and Provision Discovery processing is also covered.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: P2P PD retries and timeout
Jouni Malinen [Sun, 2 Mar 2014 20:22:29 +0000 (22:22 +0200)] 
tests: P2P PD retries and timeout

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: P2P Device management with connect command
Jouni Malinen [Sun, 2 Mar 2014 18:44:05 +0000 (20:44 +0200)] 
tests: P2P Device management with connect command

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRedirect more frames with ext_mgmt_frame_handling=1
Jouni Malinen [Sun, 2 Mar 2014 09:51:38 +0000 (11:51 +0200)] 
Redirect more frames with ext_mgmt_frame_handling=1

This allows Action frames from not-associated stations to be processed
by external test tools.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRADIUS server: Copy IPv4 address only when IPv6 is not used
Jouni Malinen [Sun, 2 Mar 2014 15:01:32 +0000 (17:01 +0200)] 
RADIUS server: Copy IPv4 address only when IPv6 is not used

The local addr variable is valid only when !ipv6, so there is no point
in copying it for the IPv6 case.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agodbus: Clean up error reporting for TDLS peer address parsing
Jouni Malinen [Sun, 2 Mar 2014 14:44:18 +0000 (16:44 +0200)] 
dbus: Clean up error reporting for TDLS peer address parsing

Passing a pointer to an error reply message is not very robust since
memory allocation could fail even for that error message. Instead, use a
separate error value as the return value from get_peer_hwaddr_helper()
and return a pointer to the error message through a pointer-to-pointer
so that the error case will always be clear.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoWPS: Remove duplicate variable setting
Jouni Malinen [Sun, 2 Mar 2014 14:23:28 +0000 (16:23 +0200)] 
WPS: Remove duplicate variable setting

There is no need to use a for loop here since the h variable is
set identically at the beginning of the body anyway.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRemove unnecessary variable initialization
Jouni Malinen [Sun, 2 Mar 2014 14:19:41 +0000 (16:19 +0200)] 
Remove unnecessary variable initialization

The following if statements set the new_op_mode value in all cases,
so there is no need to initialize this to 0 first. This removes a
static analyzer warning.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agodbus: Remove duplicated variable assignment
Jouni Malinen [Sun, 2 Mar 2014 14:18:38 +0000 (16:18 +0200)] 
dbus: Remove duplicated variable assignment

This gets rid of a static analyzer warning.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRemove a static analyzer warning about unused variable write
Jouni Malinen [Sun, 2 Mar 2014 14:16:48 +0000 (16:16 +0200)] 
Remove a static analyzer warning about unused variable write

The pos variable was not used between its first and second assignment.
Clean this up by using the pos variables instead of the buf (start of
the buffer).

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoDo not use a separate variable for tracking first entry in a list
Jouni Malinen [Sun, 2 Mar 2014 14:14:09 +0000 (16:14 +0200)] 
Do not use a separate variable for tracking first entry in a list

The pos pointer can be compared to the start of the buffer pointer to
determine whether the entry is the first one in the list. This gets rid
of some static analyzer warnings about unused variable writes.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoWPA: Clean up cipher suite counting in write routines
Jouni Malinen [Sun, 2 Mar 2014 14:03:22 +0000 (16:03 +0200)] 
WPA: Clean up cipher suite counting in write routines

There is no need to maintain a separate counter for this in addition to
the pointer to the current location. In addition, this gets rid of
warnings about unused variable write.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRemove unused gid_str pointer update
Jouni Malinen [Sun, 2 Mar 2014 13:52:10 +0000 (15:52 +0200)] 
Remove unused gid_str pointer update

The group name is not used on these paths, so just remove it from the
directory name without updating gid_str to point to the unused group
name.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoDebug print trailing WPA/RSN IE bytes, if any
Jouni Malinen [Sun, 2 Mar 2014 13:35:11 +0000 (15:35 +0200)] 
Debug print trailing WPA/RSN IE bytes, if any

This silences a never-used analyzer warning in addition to making the
debug log entry somewhat more useful.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoOpenSSL: Avoid never-used analyzer warning
Jouni Malinen [Sun, 2 Mar 2014 13:32:27 +0000 (15:32 +0200)] 
OpenSSL: Avoid never-used analyzer warning

Use #ifdef blocks more cleanly to avoid unnecessary never-used
assignment of a variable.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoClean up hostapd add_iface error path operations
Jouni Malinen [Sun, 2 Mar 2014 13:29:26 +0000 (15:29 +0200)] 
Clean up hostapd add_iface error path operations

If hapd_iface->bss[i] == NULL, this could have resulted in NULL pointer
dereference in the debug print. Avoid this by skipping the message in
case of NULL pointer. In addition, clear iface->bss[i] to NULL for
additional robustness even though this array gets freed immediately.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoWNM: Check wpa_s->current_bss more consistently
Jouni Malinen [Sun, 2 Mar 2014 13:21:59 +0000 (15:21 +0200)] 
WNM: Check wpa_s->current_bss more consistently

The scan result comparison routine would not make much sense without
current BSS level known, so return from the function without going
through the iteration that could have dereferenced the pointer if
wpa_s->current_bss == NULL.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoEAP-FAST: Use clear eap_get_config() result validation
Jouni Malinen [Sun, 2 Mar 2014 13:16:45 +0000 (15:16 +0200)] 
EAP-FAST: Use clear eap_get_config() result validation

This was previously checked through the eap_peer_tls_ssl_init() call
which made it difficult for static analyzers. Add an explicit check for
config == NULL into the beginnign of eap_fast_init() since this will
always result in initialization failing anyway.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoroboswitch: Verify that register read succeeds before comparing result
Jouni Malinen [Sun, 2 Mar 2014 13:12:21 +0000 (15:12 +0200)] 
roboswitch: Verify that register read succeeds before comparing result

If wpa_driver_roboswitch_read() fails before such comparison, the values
that are being compared are not initialized properly and as such, there
is not much point in comparing them either.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoDFS: Make sure center frequency is always initialized for VHT
Jouni Malinen [Sun, 2 Mar 2014 13:05:28 +0000 (15:05 +0200)] 
DFS: Make sure center frequency is always initialized for VHT

This seemed to be fine on most code paths, but the code was complex
enough to make the analysis difficult (and a bit too much for static
analyzers). There is no harm in forcing these parameters to be
initialized, so do that to make sure they cannot be left uninitialized.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotrace: Fix memory use on no-function name path
Jouni Malinen [Sun, 2 Mar 2014 11:57:11 +0000 (13:57 +0200)] 
trace: Fix memory use on no-function name path

bfd_demangle() call could be skipped if data.function == NULL. Make sure
the already freed aname pointer cannot be used again in such a case.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotest: Use more consistent NULL checking for associate ssid parameter
Jouni Malinen [Sun, 2 Mar 2014 11:41:05 +0000 (13:41 +0200)] 
test: Use more consistent NULL checking for associate ssid parameter

This was checked once against NULL, but not on the following uses.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoMake code path easier for static analyzers
Jouni Malinen [Sun, 2 Mar 2014 11:37:11 +0000 (13:37 +0200)] 
Make code path easier for static analyzers

record->type == NULL case was handled through the record->type_length
comparison. While this was correct, it is a bit difficult for static
analyzers to understand, so add an extra check for NULL to avoid false
reports on this.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Verify offchannel TX using remain-on-channel
Jouni Malinen [Sat, 1 Mar 2014 20:26:20 +0000 (22:26 +0200)] 
tests: Verify offchannel TX using remain-on-channel

This is the older design that some drivers may still use if they do not
support offloaded offchannel TX operations.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agonl80211: Allow old r-o-c offchannel TX to be tested
Jouni Malinen [Sat, 1 Mar 2014 20:24:55 +0000 (22:24 +0200)] 
nl80211: Allow old r-o-c offchannel TX to be tested

no_offchannel_tx=1 driver parameter can now be used to force the older
remain-on-channel -based offchannel TX design to be used with
mac80211_hwsim. This can be used to increase test coverage with the
hwsim test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Increase coverage for NAI Realm to EAP configuration
Jouni Malinen [Sat, 1 Mar 2014 17:06:45 +0000 (19:06 +0200)] 
tests: Increase coverage for NAI Realm to EAP configuration

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Check roaming consortium match in all different places
Jouni Malinen [Sat, 1 Mar 2014 16:46:49 +0000 (18:46 +0200)] 
tests: Check roaming consortium match in all different places

A bit different code path is used to match the first three different
locations of roaming consortium OI within Beacon frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: HS 2.0 OSU and icon fetch
Jouni Malinen [Sat, 1 Mar 2014 15:45:39 +0000 (17:45 +0200)] 
tests: HS 2.0 OSU and icon fetch

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: GAS comeback protocol testing
Jouni Malinen [Sat, 1 Mar 2014 15:05:52 +0000 (17:05 +0200)] 
tests: GAS comeback protocol testing

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Verify TEMP-DISABLED flag in HS 2.0 deauth req
Jouni Malinen [Sat, 1 Mar 2014 09:57:07 +0000 (11:57 +0200)] 
tests: Verify TEMP-DISABLED flag in HS 2.0 deauth req

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Check Interworking already-connected with all credential types
Jouni Malinen [Sat, 1 Mar 2014 09:48:09 +0000 (11:48 +0200)] 
tests: Check Interworking already-connected with all credential types

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Verify excluded_ssid with all credential types
Jouni Malinen [Sat, 1 Mar 2014 09:44:25 +0000 (11:44 +0200)] 
tests: Verify excluded_ssid with all credential types

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Speed up INTERWORKING_SELECT cases with freq parameter
Jouni Malinen [Sat, 1 Mar 2014 08:35:30 +0000 (10:35 +0200)] 
tests: Speed up INTERWORKING_SELECT cases with freq parameter

This removes unnecessary full scan from couple of test cases that missed
this optimization.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Increase req_conn_capab coverage
Jouni Malinen [Sat, 1 Mar 2014 07:19:05 +0000 (09:19 +0200)] 
tests: Increase req_conn_capab coverage

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: HS 2.0 minimum bandwidth policy
Jouni Malinen [Sat, 1 Mar 2014 08:10:53 +0000 (10:10 +0200)] 
tests: HS 2.0 minimum bandwidth policy

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Add more coverage for SET_NETWORK parsing
Jouni Malinen [Fri, 28 Feb 2014 23:24:37 +0000 (01:24 +0200)] 
tests: Add more coverage for SET_NETWORK parsing

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Server certificate with both client and server EKU
Jouni Malinen [Fri, 28 Feb 2014 22:44:09 +0000 (00:44 +0200)] 
tests: Server certificate with both client and server EKU

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: HS 2.0 network selection with username vs. SIM credential
Jouni Malinen [Fri, 28 Feb 2014 22:31:32 +0000 (00:31 +0200)] 
tests: HS 2.0 network selection with username vs. SIM credential

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agotests: Verify RADIUS functionality over IPv6
Jouni Malinen [Fri, 28 Feb 2014 22:14:49 +0000 (00:14 +0200)] 
tests: Verify RADIUS functionality over IPv6

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoP2P: Fix validation on Invitation Request error path
Jouni Malinen [Sun, 2 Mar 2014 00:06:06 +0000 (02:06 +0200)] 
P2P: Fix validation on Invitation Request error path

It was possible for the error path to try to use P2P Group ID attribute
even if one was not included in the message. This could result in
dereferencing a NULL pointer, so re-check the pointer before copying the
data.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoRemove unreachable return statement
Jouni Malinen [Sat, 1 Mar 2014 23:06:39 +0000 (01:06 +0200)] 
Remove unreachable return statement

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoGAS: Fix additional comeback delay with status code 95
Jouni Malinen [Sat, 1 Mar 2014 14:51:46 +0000 (16:51 +0200)] 
GAS: Fix additional comeback delay with status code 95

The special case of non-zero status code used in a GAS Comeback Response
frame to indicate that additional delay is needed before the response is
available was not working properly. This case needs to allow the status
code check to be bypassed for the comeback case prior to having received
any response data.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoInterworking: Remove unused password setting for SIM credential
Jouni Malinen [Sat, 1 Mar 2014 09:31:08 +0000 (11:31 +0200)] 
Interworking: Remove unused password setting for SIM credential

The simulated SIM/USIM case uses a separate milenage cred parameter, so
this cred password parameter was unused for this credential type.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoAdd OSEN to proto config field writer
Jouni Malinen [Sat, 1 Mar 2014 08:48:08 +0000 (10:48 +0200)] 
Add OSEN to proto config field writer

This was forgotten from the OSEN addition where it was parsed, but not
written to a network block.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoClear hostapd bss entry to NULL on add-interface-failure
Jouni Malinen [Fri, 28 Feb 2014 22:15:07 +0000 (00:15 +0200)] 
Clear hostapd bss entry to NULL on add-interface-failure

It looks like leaving behind the freed pointed at the end of the array
could end up in a crash triggered by double free in some cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
10 years agoatheros: Add support for OSEN
Kyeyoon Park [Fri, 23 Aug 2013 07:40:33 +0000 (10:40 +0300)] 
atheros: Add support for OSEN

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoHS 2.0R2: Fix temporary network disabling in Deauth Req case
Jouni Malinen [Thu, 27 Feb 2014 22:29:34 +0000 (00:29 +0200)] 
HS 2.0R2: Fix temporary network disabling in Deauth Req case

Commits 7ef6947993d4b09dea6797b96f34dbcfed57d90e and
533536d82ac63512c31ff0bae403d437392d34e0 added this temporarily
disabling case, but those commits were merged in without having been
converted to the new os_reltime design used for ssid->disabled_until.
Consequently, they ended up disabling the network for 44 years or so too
long time (depending on what values the relative timestamp had
accummulated so far). Fix this by using relative timestamps
consistently.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify that home operator is preferred over roaming operator
Jouni Malinen [Thu, 27 Feb 2014 17:34:34 +0000 (19:34 +0200)] 
tests: Verify that home operator is preferred over roaming operator

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify HS 2.0 connection status values
Jouni Malinen [Thu, 27 Feb 2014 17:26:50 +0000 (19:26 +0200)] 
tests: Verify HS 2.0 connection status values

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify HS 2.0 cred selection based on priority
Jouni Malinen [Thu, 27 Feb 2014 17:23:14 +0000 (19:23 +0200)] 
tests: Verify HS 2.0 cred selection based on priority

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify HS 2.0 AP connection with non-HS 2.0 station
Jouni Malinen [Thu, 27 Feb 2014 17:04:56 +0000 (19:04 +0200)] 
tests: Verify HS 2.0 AP connection with non-HS 2.0 station

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Optimize ap_wps_init_through_wps_config
Jouni Malinen [Thu, 27 Feb 2014 16:01:32 +0000 (18:01 +0200)] 
tests: Optimize ap_wps_init_through_wps_config

Wait a bit between WPS_CONFIG command and the first scan. This can avoid
an extra five second wait due to having to scan again if the initial
scan operations happens to be quick enough to happen before the AP has
updated its configuration.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoP2P: Cancel offchannel TX wait on PD Response TX status
Jouni Malinen [Thu, 27 Feb 2014 14:36:03 +0000 (16:36 +0200)] 
P2P: Cancel offchannel TX wait on PD Response TX status

PD Response is sent out using a 200 ms offchannel wait, but that wait
was not cancelled on TX status report. This could result in offchannel
operation being left waiting unnecessarily long. Fix this by making the
P2P_NO_PENDING_ACTION case in Action TX callback cancel the wait if a
pending wait is marked (and mark this for PD Response).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoTDLS: Work around interop issues with supported operating class
Sunil Dutt Undekari [Tue, 25 Feb 2014 08:50:48 +0000 (14:20 +0530)] 
TDLS: Work around interop issues with supported operating class

It looks like some deployed devices may send an invalid supported
operating class element (length = 0) in TDLS Setup messages. With
cfg80211, this results in the NL80211_CMD_SET_STATION command failing
due to an invalid argument (cfg80211 mandates supported operating
classes information to have a length of 2..253 octets).

Work around this interop issue by ignoring the Supported Operating Class
element if it has invalid length.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify cred vs. network block priority selection
Jouni Malinen [Thu, 27 Feb 2014 12:17:31 +0000 (14:17 +0200)] 
tests: Verify cred vs. network block priority selection

This verifies that 'INTERWORKING_SELECT auto' is able to pick the
correct network based on priority configuration when connected to a
lower priority network.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoInterworking: Fix already-connected check to verify network priority
Jouni Malinen [Thu, 27 Feb 2014 12:06:23 +0000 (14:06 +0200)] 
Interworking: Fix already-connected check to verify network priority

Commit d28f4e44f10a8549d969e5434f7d4d16f462dfcc optimized Interworking
network selection in a case where the operation is run while already
connected to the selected network by skipping the reconnection. However,
this did not take into account that a higher priority network may have
shown up in the new scan results.

Fix this by checking whether network selection based on the latest scan
results (the ones from the interworking_select operation) would result
in a network with higher priority being selected. If so, skip the
optimization and force normal network connection (which will select this
newly found higher priority network). This fixes cases where a
non-Hotspot 2.0 network with higher priority (e.g., home network) shows
up while connected to a Hotspot 2.0 network with lower priority.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoInterworking: Fix last-network preference to not override priority
Jouni Malinen [Thu, 27 Feb 2014 11:47:23 +0000 (13:47 +0200)] 
Interworking: Fix last-network preference to not override priority

Commit 3d910ef497b11e149cf41e772670f7a7fe3a1e19 tried to make
last-network selection behave more consistently with Interworking
network selection preferences. However, it did not take into account
that other network block may have higher priority. In such cases, the
last added network from Interworking network selection should actually
not be selected for the next connection. Fix this by limiting the
last-network preference to work only within a priority class.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify req_conn_capab as cred parameter
Jouni Malinen [Wed, 26 Feb 2014 22:49:52 +0000 (00:49 +0200)] 
tests: Verify req_conn_capab as cred parameter

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agoHS 2.0R2: Fix req_conn_capab example
Jouni Malinen [Wed, 26 Feb 2014 22:43:58 +0000 (00:43 +0200)] 
HS 2.0R2: Fix req_conn_capab example

Protocol field needs to be separated properly from te port number list.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: wpa_supplicant ctrl_iface config parser
Jouni Malinen [Wed, 26 Feb 2014 16:48:12 +0000 (18:48 +0200)] 
tests: wpa_supplicant ctrl_iface config parser

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
10 years agotests: Verify invalid required_roaming_consortium values
Jouni Malinen [Wed, 26 Feb 2014 16:35:13 +0000 (18:35 +0200)] 
tests: Verify invalid required_roaming_consortium values

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>