]> git.ipfire.org Git - thirdparty/hostap.git/log
thirdparty/hostap.git
4 years agoAllow testing override for GTK/IGTK RSC from AP to STA
Jouni Malinen [Sat, 4 Jan 2020 11:05:26 +0000 (13:05 +0200)] 
Allow testing override for GTK/IGTK RSC from AP to STA

The new hostapd gtk_rsc_override and igtk_rsc_override configuration
parameters can be used to set an override value for the RSC that the AP
advertises for STAs for GTK/IGTK. The contents of those parameters is a
hexdump of the RSC in little endian byte order.

This functionality is available only in CONFIG_TESTING_OPTIONS=y builds.
This can be used to verify that stations implement initial RSC
configuration correctly for GTK/ and IGTK.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: ROAM command failure cases
Jouni Malinen [Fri, 3 Jan 2020 16:09:57 +0000 (18:09 +0200)] 
tests: ROAM command failure cases

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoSME: Postpone current BSSID clearing until IEs are prepared
Jouni Malinen [Fri, 3 Jan 2020 16:06:01 +0000 (18:06 +0200)] 
SME: Postpone current BSSID clearing until IEs are prepared

sme_send_authentication() could fail before actually requesting the
driver to authenticate with a new AP. This could happen after
wpa_s->bssid got cleared even though in such a case, the old association
is maintained and still valid. This can result in unexpected behavior
since wpa_s->bssid would not match the current BSSID anymore.

Fix this by postponing clearing of wpa_s->bssid until the IE preparation
has been completed successfully.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: DFS with RRM
Jouni Malinen [Fri, 3 Jan 2020 13:53:03 +0000 (15:53 +0200)] 
tests: DFS with RRM

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Don't set offchan-OK flag if doing on-channel frame in AP mode
Ben Greear [Tue, 19 Mar 2019 21:34:24 +0000 (14:34 -0700)] 
nl80211: Don't set offchan-OK flag if doing on-channel frame in AP mode

I saw a case where the kernel's cfg80211 rejected hostapd's attempt to
send a neighbor report response because nl80211 flagged the frame as
offchannel-OK, but kernel rejects because channel was 100 (DFS) and so
kernel failed thinking it was constrained by DFS/CAC requirements that
do not allow the operating channel to be left (at least in FCC).

Don't set the packet as off-channel OK if we are transmitting on the
current operating channel of an AP to avoid such issues with
transmission of Action frames.

Signed-off-by: Ben Greear <greearb@candelatech.com>
4 years agotests: Remove allow_failure from DFS test cases
Jouni Malinen [Fri, 3 Jan 2020 13:41:54 +0000 (15:41 +0200)] 
tests: Remove allow_failure from DFS test cases

This functionality has been available in mac80211_hwsim for years, so
there is no need to maintain this old workaround.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Use current command for NL80211_CMD_REGISTER_ACTION
Jouni Malinen [Fri, 3 Jan 2020 13:26:31 +0000 (15:26 +0200)] 
nl80211: Use current command for NL80211_CMD_REGISTER_ACTION

This was renamed to NL80211_CMD_REGISTER_FRAME long time ago.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Rename send_action_cookie to send_frame_cookie
Jouni Malinen [Fri, 3 Jan 2020 13:23:49 +0000 (15:23 +0200)] 
nl80211: Rename send_action_cookie to send_frame_cookie

This is to match the NL80211_CMD_ACTION renaming to NL80211_CMD_FRAME
that happened long time ago. This command can be used with any IEEE
802.11 frame and it should not be implied to be limited to Action
frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Clean up nl80211_send_frame_cmd() callers
Jouni Malinen [Fri, 3 Jan 2020 13:18:46 +0000 (15:18 +0200)] 
nl80211: Clean up nl80211_send_frame_cmd() callers

Replace a separate cookie_out pointer argument with save_cookie boolean
since drv->send_action_cookie is the only longer term storage place for
the cookies. Merge all nl80211_send_frame_cmd() callers within
wpa_driver_nl80211_send_mlme() to use a single shared call to simplify
the function.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Get rid of separate wpa_driver_nl80211_send_frame()
Jouni Malinen [Fri, 3 Jan 2020 12:53:37 +0000 (14:53 +0200)] 
nl80211: Get rid of separate wpa_driver_nl80211_send_frame()

Merge this function into wpa_driver_nl80211_send_mlme() that is now the
only caller for the previously shared helper function. This is a step
towards cleaning up the overly complex code path for sending Management
frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agodriver: Remove unused send_frame() driver op
Jouni Malinen [Fri, 3 Jan 2020 11:56:12 +0000 (13:56 +0200)] 
driver: Remove unused send_frame() driver op

All the previous users have now been converted to using send_mlme() so
this unused send_frame() callback can be removed.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoConvert the only remaining send_frame() users to send_mlme()
Jouni Malinen [Fri, 3 Jan 2020 11:50:35 +0000 (13:50 +0200)] 
Convert the only remaining send_frame() users to send_mlme()

Since send_mlme() now has support for the no_encrypt argument it is
possible to get rid of the remaining send_frame() uses.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Support no_encrypt=1 with send_mlme()
Jouni Malinen [Fri, 3 Jan 2020 11:49:10 +0000 (13:49 +0200)] 
nl80211: Support no_encrypt=1 with send_mlme()

This allows send_mlme() to be used to replace send_frame() for the test
cases where unencrypted Deauthentication/Disassociation frames need to
be sent out even when using PMF for the association. This is currently
supported only when monitor interface is used for AP mode management
frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agodriver: Add no_encrypt argument to send_mlme()
Jouni Malinen [Fri, 3 Jan 2020 11:48:33 +0000 (13:48 +0200)] 
driver: Add no_encrypt argument to send_mlme()

This is in preparation of being able to remove the separate send_frame()
callback.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoMake hostapd_drv_send_mlme() more generic
Jouni Malinen [Fri, 3 Jan 2020 11:34:37 +0000 (13:34 +0200)] 
Make hostapd_drv_send_mlme() more generic

Merge hostapd_drv_send_mlme_csa() functionality into
hostapd_drv_send_mlme() to get a single driver ops handler function for
hostapd. In addition, add a new no_encrypt parameter in preparation for
functionality that is needed to get rid of the separate send_frame()
driver op.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoP2P Manager: Use send_mlme() instead of send_frame() for Deauthentication
Jouni Malinen [Fri, 3 Jan 2020 11:22:32 +0000 (13:22 +0200)] 
P2P Manager: Use send_mlme() instead of send_frame() for Deauthentication

send_frame() is documented to be used for "testing use only" and as
such, it should not have used here for a normal production
functionality. Replace this with use of send_mlme() which is already
used for sending Deauthentication frames in other cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoIBSS RSN: Use send_mlme() instead of send_frame() for Authentication frames
Jouni Malinen [Fri, 3 Jan 2020 10:21:36 +0000 (12:21 +0200)] 
IBSS RSN: Use send_mlme() instead of send_frame() for Authentication frames

send_frame() is documented to be used for "testing use only" and as
such, it should not have used here for a normal production
functionality. Replace this with use of send_mlme() which is already
used for sending Authentication frames in number of other cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Simplify hapd_send_eapol() with monitor interface
Jouni Malinen [Fri, 3 Jan 2020 10:08:58 +0000 (12:08 +0200)] 
nl80211: Simplify hapd_send_eapol() with monitor interface

Call nl80211_send_monitor() directly instead of going through
wpa_driver_nl80211_send_frame() for the case where monitor interface is
used for AP mode management purposes. drv->use_monitor has to be 1 in
this code path, so wpa_driver_nl80211_send_frame() was calling
nl80211_send_monitor() unconditionally for this code path and that extra
function call can be removed here to simplify the implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agonl80211: Don't accept interrupted dump responses
Jouni Malinen [Thu, 2 Jan 2020 21:16:22 +0000 (23:16 +0200)] 
nl80211: Don't accept interrupted dump responses

Netlink dump message may be interrupted if an internal inconsistency is
detected in the kernel code. This can happen, e.g., if a Beacon frame
from the current AP is received while NL80211_CMD_GET_SCAN is used to
fetch scan results. Previously, such cases would end up not reporting an
error and that could result in processing partial data.

Modify this by detecting this special interruption case and converting
it to an error. For the NL80211_CMD_GET_SCAN, try again up to 10 times
to get the full response. For other commands (which are not yet known to
fail in similar manner frequently), report an error to the caller.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make ap_hs20_roaming_consortiums_match more robust
Jouni Malinen [Thu, 2 Jan 2020 20:54:29 +0000 (22:54 +0200)] 
tests: Make ap_hs20_roaming_consortiums_match more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Roam between two APs based on driver signal level override
Jouni Malinen [Thu, 2 Jan 2020 18:31:30 +0000 (20:31 +0200)] 
tests: Roam between two APs based on driver signal level override

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoTest functionality to override driver reported signal levels
Jouni Malinen [Thu, 2 Jan 2020 18:29:24 +0000 (20:29 +0200)] 
Test functionality to override driver reported signal levels

"SET driver_signal_override <BSSID> [<si_signal< <si_avg_signal>
<si_avg_beacon_signal> <si_noise> <scan_level>]" command can now be used
to request wpa_supplicant to override driver reported signal levels for
signal_poll and scan results. This can be used to test roaming behavior.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoFix signal_poll based roaming skip
Jouni Malinen [Thu, 2 Jan 2020 18:33:01 +0000 (20:33 +0200)] 
Fix signal_poll based roaming skip

Fix a rebasing issue in the signal difference calculation. The older
patch was not updated to use the new cur_level local variable to get the
possibly updated signal level for the current BSS.

Fixes: a2c1bebd4301 ("Improve roaming logic")
Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoBSD: Use struct ip rather than struct iphdr
Roy Marples [Thu, 2 Jan 2020 17:12:33 +0000 (19:12 +0200)] 
BSD: Use struct ip rather than struct iphdr

As we define __FAVOR_BSD use the BSD IP header.
Compile tested on NetBSD, DragonFlyBSD, and Linux.

Signed-off-by: Roy Marples <roy@marples.name>
4 years agonl80211: Fix libnl error string fetching
Jouni Malinen [Thu, 2 Jan 2020 14:50:50 +0000 (16:50 +0200)] 
nl80211: Fix libnl error string fetching

libnl functions return a library specific error value in libnl 2.0 and
newer. errno is not necessarily valid in all error cases and strerror()
for the returned value is not valid either.

Use nl_geterror() to get the correct error string from the returned
error code.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agomac80211_linux: Fix libnl error string fetching
Jouni Malinen [Thu, 2 Jan 2020 14:50:50 +0000 (16:50 +0200)] 
mac80211_linux: Fix libnl error string fetching

libnl functions return a library specific error value. errno is not
necessarily valid in all error cases and strerror() for the returned
value is not valid either.

Use nl_geterror() to get the correct error string from the returned
error code.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoDrop support for libnl 1.1
Jouni Malinen [Thu, 2 Jan 2020 15:27:02 +0000 (17:27 +0200)] 
Drop support for libnl 1.1

This simplifies code by not having to maintain and come up with new
backwards compatibility wrappers for a library release from 12 years
ago.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoDrop debug print level for informative debug messages
Jouni Malinen [Thu, 2 Jan 2020 13:52:01 +0000 (15:52 +0200)] 
Drop debug print level for informative debug messages

These are certainly not error conditions, but normal cases for starting
up. Drop the message from ERROR to DEBUG.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make scan_bss_limit more robust
Jouni Malinen [Thu, 2 Jan 2020 11:02:56 +0000 (13:02 +0200)] 
tests: Make scan_bss_limit more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: External MAC address change for connection
Jouni Malinen [Thu, 2 Jan 2020 10:09:33 +0000 (12:09 +0200)] 
tests: External MAC address change for connection

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoMaintain BSS entries for 5 seconds after interface is disabled
Jouni Malinen [Thu, 2 Jan 2020 09:51:04 +0000 (11:51 +0200)] 
Maintain BSS entries for 5 seconds after interface is disabled

This is targeting the case of MAC address change for an association
which may require the interface to be set down for a short moment.
Previously, this ended up flushing the BSS table that wpa_supplicant
maintained and that resulted in having to scan again if the MAC address
was changed between the previous scan and the connection attempt. This
is unnecessary extra latency, so maintain the BSS entries for 5 seconds
(i.e., the same time that the old scan results are consider valid for a
new connection attempt) after an interface goes down.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoIndicated if the selected BSS is the current BSS
Jouni Malinen [Wed, 1 Jan 2020 15:55:00 +0000 (17:55 +0200)] 
Indicated if the selected BSS is the current BSS

This makes scan result processing a bit more readable in debug log.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoMake min_diff determination from cur_level more readable
Jouni Malinen [Wed, 1 Jan 2020 15:46:03 +0000 (17:46 +0200)] 
Make min_diff determination from cur_level more readable

This handles both the dBm and unspecified unit cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoUse sel_est consistently with cur_sel in wpa_supplicant_need_to_roam()
Jouni Malinen [Wed, 1 Jan 2020 15:37:58 +0000 (17:37 +0200)] 
Use sel_est consistently with cur_sel in wpa_supplicant_need_to_roam()

This makes the code a bit easier to read.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoImprove roaming logic
Matthew Wang [Tue, 17 Jul 2018 17:56:21 +0000 (10:56 -0700)] 
Improve roaming logic

Currently, wpa_supplicant may roam too aggressively; the need_to_roam()
function will return early with a roaming decision if the difference in
signal level or throughput between the current and selected APs is
"sufficiently large." In particular, if the selected AP's estimated
throughput is more than 5k greater than the current AP's estimated
throughput, wpa_supplicant will decide to roam. Otherwise, if the
selected AP's signal level is less than the current AP's signal level,
or the selected AP's estimated throughput is at least 5k less than the
current AP's estimated throughput, wpa_supplicant will skip the roam.
These decisions are based only on one factor and can lead to poor
roaming choices (e.g., a roam should not happen if the selected AP's
estimated throughput meets the threshold but the current signal and
throughput are already good, whereas a roam should happen if the signal
is slightly worse but the estimated throughput is significantly better).

This change standardizes the roaming heuristic for signal strength
difference requirements and will hopefully improve user experience. The
change can be summarized as follows: based on the current signal level,
a certain roaming difficulty is assigned. Based on the selected AP's
estimated throughput relative to the current AP's estimated throughput,
the difficulty is adjusted up or down. If the difference in signal level
meets the threshold, a roam happens.

The hard-coded values were selected purely based on the previous version
of this function. They may eventually need to be fine-tuned for optimal
performance.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
4 years agoAllow roam to lower signal level if throughput benefit is significant
Jouni Malinen [Wed, 1 Jan 2020 15:09:18 +0000 (17:09 +0200)] 
Allow roam to lower signal level if throughput benefit is significant

Do not prevent roam to a different BSS based only on the signal level
with the current BSS being higher than with the selected BSS. If the
estimated throughput is significantly higher (> 20%), allow roaming if
the following conditions are met.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoSkip roaming based on signal level difference if current SNR is good
Jouni Malinen [Wed, 1 Jan 2020 14:56:40 +0000 (16:56 +0200)] 
Skip roaming based on signal level difference if current SNR is good

If the current SNR with the associated BSS is sufficiently good (better
than GREAT_SNR = 25), there is limited benefit from moving to another
BSS even if that BSS were to have a higher signal level. As such, skip
roaming based on the signal level difference between the selected BSS
from scan results and the current BSS for such cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make ap_wps_conf_pin_* more robust
Jouni Malinen [Wed, 1 Jan 2020 14:41:33 +0000 (16:41 +0200)] 
tests: Make ap_wps_conf_pin_* more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoUse signal_poll noise information for roaming, if available
Jouni Malinen [Wed, 1 Jan 2020 11:38:11 +0000 (13:38 +0200)] 
Use signal_poll noise information for roaming, if available

Using average signal strength from the driver and hardcoded noise floor
does not look like an ideal design since there can be significant
differences in the driver-reported noise floor values. Furthermore, even
though the current noise floor is a snapshot from the driver, it is
common for drivers to use a noise floor value from a longer calibration
step and that should not prevent the driver provided value from being
used. This makes the comparisons of the signal strengths between the
current AP (signal_poll) and other APs (scan) more accurate.

As an example, test runs in home environment showed 5 dB difference
between the driver reported noise floor and the hardcoded value and this
could result in significant differences in estimated throughput
calculation.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoClear SME auth_alg on FLUSH
Jouni Malinen [Wed, 1 Jan 2020 10:33:57 +0000 (12:33 +0200)] 
Clear SME auth_alg on FLUSH

This avoids a testing failure in the following test case sequence:
ap_ft_r1_key_expiration ap_open_external_assoc

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoRSN: Do not add PMKSA candidates unnecessarily
Jouni Malinen [Wed, 1 Jan 2020 09:26:52 +0000 (11:26 +0200)] 
RSN: Do not add PMKSA candidates unnecessarily

Add PMKSA candidates from scan results only if they advertise an AKMP
that is used with RSN pre-authentication. Previously, candidates were
added but then ignored later if the AKMP was not suitable.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoClear last Michael MIC error timer on FLUSH
Jouni Malinen [Wed, 1 Jan 2020 10:03:42 +0000 (12:03 +0200)] 
Clear last Michael MIC error timer on FLUSH

TKIP countermeasures were already terminated on FLUSH, but the timer for
detecting two Michael MIC errors within 60 seconds was left behind. This
resulted in test case failures with following test sequence:
ap_cipher_tkip_countermeasures_sta ap_cipher_tkip_countermeasures_sta2

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Fix a missing parentheses in an error message
Jouni Malinen [Wed, 1 Jan 2020 09:29:47 +0000 (11:29 +0200)] 
tests: Fix a missing parentheses in an error message

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make rrm_beacon_req_table_request more robust
Jouni Malinen [Tue, 31 Dec 2019 09:51:25 +0000 (11:51 +0200)] 
tests: Make rrm_beacon_req_table_request more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agowpa_supplicant: Fall back to avg_signal in roaming decision
Matthew Wang [Fri, 6 Dec 2019 22:27:48 +0000 (14:27 -0800)] 
wpa_supplicant: Fall back to avg_signal in roaming decision

Some drivers (e.g. Marvell WiFi) don't report avg_beacon_signal, but
it's still useful to poll for the signal again when a roaming decision
needs to be made. Use si.avg_signal when si.avg_beacon_signal is not
available.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
4 years agoUpdate throughput estimate for the current BSS based on signal poll
Emmanuel Grumbach [Fri, 6 Dec 2019 22:27:47 +0000 (14:27 -0800)] 
Update throughput estimate for the current BSS based on signal poll

We saw that on certain platforms in certain places we keep switching
between two APs and eventually get the same RSSI. Debugging showed that
we have a very big difference between the two antennas.

Ant A can hear AP A very well (-60) but AP B very bad (-80)
Ant B can hear AP B very well (-60) but AP A very bad (-80)

When the device associates to AP A, it'll learn to use Ant A. If the
device uses one single antenna to receive the scan results, it may hear
the AP it is currently associated to on the second antenna and get bad
results. Because of that, the wpa_supplicant will roam to the other AP
and the same scenario will repeat itself:

Association to AP A (Ant A reports -60).
Scan on Ant A: AP A: -60, AP B: -80
Scan on Ant B: AP A: -80, AP A: -60 ==> ROAM.

Association to AP B (Ant B reports -60)
Scan on Ant A: AP A: -60, AP B: -80 ==> ROAM

Etc...

Improve this by querying the signal level of the current AP using
drv_signal_poll() instead of relying on the signal level that we get
from the scan results. Also update the throughput estimate based on the
likely more accurate values for the current association.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
4 years agoMove throughput estimation into a helper function
Emmanuel Grumbach [Fri, 6 Dec 2019 22:27:47 +0000 (14:27 -0800)] 
Move throughput estimation into a helper function

This is a step towards allowing this functionality to update the scan
result -based values with the values from a signal poll for the current
BSS.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
4 years agoMove scan/roaming related defines to a header file
Emmanuel Grumbach [Fri, 6 Dec 2019 22:27:47 +0000 (14:27 -0800)] 
Move scan/roaming related defines to a header file

This is a step towards allowing these values to be used in both scan.c
and events.c.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
4 years agoUse local variables for current BSS signal strength in roaming
Emmanuel Grumbach [Fri, 6 Dec 2019 22:27:47 +0000 (14:27 -0800)] 
Use local variables for current BSS signal strength in roaming

This is a step towards allowing these values to be determined based on
signal poll instead of scan results.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
4 years agotests: Make ap_hs20_eap_tls more robust
Jouni Malinen [Mon, 30 Dec 2019 20:07:27 +0000 (22:07 +0200)] 
tests: Make ap_hs20_eap_tls more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Fix sigma_dut_sae_h2e_rsnxe_mismatch to clear sae_pwe
Jouni Malinen [Mon, 30 Dec 2019 17:32:28 +0000 (19:32 +0200)] 
tests: Fix sigma_dut_sae_h2e_rsnxe_mismatch to clear sae_pwe

sae_pwe=1 could be left configured when exiting this test case since
sigma_dut does not guarantee the default value to be restored. This
could result in test case failures, e.g., in the following sequence:
sigma_dut_sae_h2e_rsnxe_mismatch sae_pwe_h2e_only_ap_sta_forcing_loop

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoRADIUS client: fix extra retry before failover
Ethan Everett [Tue, 12 Feb 2019 22:20:04 +0000 (22:20 +0000)] 
RADIUS client: fix extra retry before failover

This commit changes the failover behavior of RADIUS client. Commit
27ebadccfb2 ("RADIUS client: Cease endless retry for message for
multiple servers") changed the retry logic, causing RADIUS client to
wait RADIUS_CLIENT_NUM_FAILOVER + 1 timeouts before failing over the
first time. Prior to that commit, RADIUS client would wait
RADIUS_CLIENT_NUM_FAILOVER timeouts before each failover. This was
caused by moving the entry->attempts > RADIUS_CLIENT_NUM_FAILOVER
comparison to before the retry attempt, where entry->attempts is
incremented.

The commit in question set entry->attempts in radius_change_server to 1
instead of 0, so RADIUS client would still only wait
RADIUS_CLIENT_NUM_FAILOVER timeouts for subsequent failovers, the same
as the original behavior.

This commit changes the comparison so the initial failover now happens
after waiting RADIUS_CLIENT_NUM_FAILOVER timeouts, as it did originally.
It also changes the RADIUS_CLIENT_MAX_FAILOVER comparison to prevent an
additional attempt to the primary server after the final failover.

Signed-off-by: Ethan Everett <ethan.everett@meraki.net>
4 years agotests: radius_acct_unreachable2 to detect retransmissions earlier
Jouni Malinen [Mon, 30 Dec 2019 17:12:33 +0000 (19:12 +0200)] 
tests: radius_acct_unreachable2 to detect retransmissions earlier

It looks like this test case can start showing failures with a change in
the retransmission limit behavior for a server change. Check for
retransmissions every second instead of only at the end of the four
second wait to avoid this.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Extend the timeout for some SAE error case tests
Ilan Peer [Wed, 22 Aug 2018 16:49:05 +0000 (19:49 +0300)] 
tests: Extend the timeout for some SAE error case tests

Commit 407879b690ba ("mac80211: Adjust SAE authentication timeout") in
the kernel tree increased the SAE authentication timeout. This caused
some error case tests to fail. To fix this, extend the timeout for some
error case tests.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
4 years agowpa_supplicant: Do not disconnect on deinit if WoWLAN is enabled
Alfonso Sánchez-Beato [Thu, 14 Jun 2018 09:00:43 +0000 (11:00 +0200)] 
wpa_supplicant: Do not disconnect on deinit if WoWLAN is enabled

Do not disconnect on interface deinit when WoWLAN is enabled, so we can
boot the system with WoWLAN after S5 (poweroff).

Signed-off-by: Alfonso Sanchez-Beato <alfonso.sanchez-beato@canonical.com>
4 years agonl80211: Add a driver ops function to check WoWLAN status
Matteo Croce [Thu, 14 Jun 2018 09:00:42 +0000 (11:00 +0200)] 
nl80211: Add a driver ops function to check WoWLAN status

Add function that returns whether WoWLAN has been enabled for the device
or not.

Signed-off-by: Alfonso Sanchez-Beato <alfonso.sanchez-beato@canonical.com>
4 years agowpa_cli: WPS-PIN-ACTIVE and WPS-CANCEL events for action scripts
Bilal Hatipoglu [Mon, 30 Dec 2019 10:22:01 +0000 (13:22 +0300)] 
wpa_cli: WPS-PIN-ACTIVE and WPS-CANCEL events for action scripts

These events were added in commit b1b62a13648e ("WPS: Add WPS-PIN-ACTIVE
and WPS-CANCEL events").

Signed-off-by: Bekir Celik <bekir.celik@airties.com>
Signed-off-by: Bilal Hatipoglu <bilal.hatipoglu@airties.com>
4 years agotests: Make wps_reg() test cases more robust
Jouni Malinen [Sun, 29 Dec 2019 22:22:23 +0000 (00:22 +0200)] 
tests: Make wps_reg() test cases more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoCall hostapd_allowed_address() directly from handle_probe_req()
Jouni Malinen [Sun, 29 Dec 2019 21:24:10 +0000 (23:24 +0200)] 
Call hostapd_allowed_address() directly from handle_probe_req()

ieee802_11_allowed_address() did not really do anything useful for the
call from handle_probe_req(), so replace that with a direct call to
hostapd_allowed_address() and make ieee802_11_allowed_address() a static
function.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoFix possible memory leak of RADIUS data in handle_auth()
Michael Braun [Sun, 28 Apr 2019 11:14:57 +0000 (13:14 +0200)] 
Fix possible memory leak of RADIUS data in handle_auth()

When returning from handle_auth() after ieee802_11_allowed_address()
returned HOSTAPD_ACL_ACCEPT, but before ieee802_11_set_radius_info() has
been called, identity, radius_cui, and psk might not have been consumed.

Fix this by avoiding the need to free these variables at all.

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
4 years agoMake hostapd_copy_psk_list() non-static
Michael Braun [Sun, 28 Apr 2019 11:14:57 +0000 (13:14 +0200)] 
Make hostapd_copy_psk_list() non-static

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
4 years agoMove the RADIUS cached attributes into a struct
Michael Braun [Sun, 28 Apr 2019 11:14:57 +0000 (13:14 +0200)] 
Move the RADIUS cached attributes into a struct

This makes it easier to pass these around and to add new attributes.

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
4 years agoFT: Do not deliver RRB messages locally without matching FT/SSID
Jouni Malinen [Sun, 29 Dec 2019 18:38:40 +0000 (20:38 +0200)] 
FT: Do not deliver RRB messages locally without matching FT/SSID

For FT protocol to work, the BSSs need to be operating an FT AKM with
the same SSID and mobility domain. The previous commit covered the
mobility domain, this covers the other prerequisites. This reduces
unnecessary load from having to allocate queued messages for interfaces
that cannot have valid data.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoFT: Check mobility domain when sending RRB message to local managed BSS
Jinglin Wang [Fri, 13 Dec 2019 08:30:28 +0000 (16:30 +0800)] 
FT: Check mobility domain when sending RRB message to local managed BSS

Fast BSS Transition requires related APs operating in the same mobility
domain. Therefore, we can check whether the local managed BSS is
operating the same mobility domain before sending multicast/unicast
messages to it. This reduces unnecessary load from having to allocate
queued messages for interfaces that cannot have valid data.

Signed-off-by: Jinglin Wang <bryanwang@synology.com>
Signed-off-by: MinHong Wang <minhongw@synology.com>
4 years agotests: RRB wildcard R0KH/R1KH pull with multiple BSSs
Jouni Malinen [Sun, 29 Dec 2019 17:37:04 +0000 (19:37 +0200)] 
tests: RRB wildcard R0KH/R1KH pull with multiple BSSs

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoRRB: More debug prints for local delivery
Jouni Malinen [Sun, 29 Dec 2019 17:30:33 +0000 (19:30 +0200)] 
RRB: More debug prints for local delivery

This makes it easier to figure out how frames are delivered directly
between BSSs operated within a single hostapd process.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoRRB: Do not reorder locally delivered messages
Jouni Malinen [Sun, 29 Dec 2019 17:32:29 +0000 (19:32 +0200)] 
RRB: Do not reorder locally delivered messages

Add new messages to the end of the l2_oui_queue instead of inserting
them at the beginning so that the dl_list_for_each_safe() iteration in
hostapd_oui_deliver_later() goes through the messages in the same order
they were originally queued.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoFT: Fix hostapd_wpa_auth_oui_iter() iteration for multicast packets
Jinglin Wang [Fri, 13 Dec 2019 08:30:27 +0000 (16:30 +0800)] 
FT: Fix hostapd_wpa_auth_oui_iter() iteration for multicast packets

When using FT wildcard feature, the inter-AP protocol will send
broadcast messages to discover related APs.

For example,
12/6 16:24:43 FT: Send PMK-R1 pull request to remote R0KH address
    ff:ff:ff:ff:ff:ff
12/6 16:24:43 FT: Send out sequence number request to
    ff:ff:ff:ff:ff:ff

If you have multiple interfaces/BSSs in a single hostapd process,
hostapd_wpa_auth_oui_iter() returned 1 after the first interface was
processed. Iteration in for_each_interface() will be stopped since it
gets a non-zero return value from hostapd_wpa_auth_oui_iter().

Even worse, the packet will not be sent to ethernet because
for_each_interface() returns non-zero value. hostapd_wpa_auth_send_oui()
will then return data_len immediately.

To prevent this, hostapd_wpa_auth_oui_iter() should not return 1 after
any successful transmission to other interfaces, if the dst_addr of
packet is a multicast address.

Signed-off-by: Jinglin Wang <bryanwang@synology.com>
Signed-off-by: MinHong Wang <minhongw@synology.com>
4 years agoOpenSSL: Add support for TPM2-wrapped keys
Daniel Kobras [Tue, 2 Jul 2019 14:19:38 +0000 (16:19 +0200)] 
OpenSSL: Add support for TPM2-wrapped keys

If the header of a PEM-formatted certificate or key in private_key file
indicates that it is wrapped with a TPM2 key, try to autoload the
appropriate OpenSSL engine that can transparently unwrap the key. This
enables systems to use TPM2-wrapped keys as drop-in replacements to
ordinary SSL keys.

This functionality needs
https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl_tpm2_engine.git
to be installed as an OpenSSL engine.

Signed-off-by: Daniel Kobras <kobras@puzzle-itc.de>
4 years agotests: Make ap_hs20_gas_while_associated_with_pmf more robust
Jouni Malinen [Sat, 28 Dec 2019 21:38:36 +0000 (23:38 +0200)] 
tests: Make ap_hs20_gas_while_associated_with_pmf more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: ignore_broadcast_ssid and SSID List or Short SSID List mismatch
Jouni Malinen [Sat, 28 Dec 2019 21:21:14 +0000 (23:21 +0200)] 
tests: ignore_broadcast_ssid and SSID List or Short SSID List mismatch

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoFix ignore_broadcast_ssid behavior with SSID List and Short SSID List
Jouni Malinen [Sat, 28 Dec 2019 21:19:44 +0000 (23:19 +0200)] 
Fix ignore_broadcast_ssid behavior with SSID List and Short SSID List

ignore_broadcast_ssid=1 (or 2) were practically ignored if the Probe
Request frame included the SSID List or Short SSID List elements. Fix
this by requiring exact SSID match whenever ignore_broadcast_ssid is in
use regardless how SSID parameters are set in the Probe Request frame.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Scan using SSID List and Short SSID List elements
Jouni Malinen [Sat, 28 Dec 2019 21:14:47 +0000 (23:14 +0200)] 
tests: Scan using SSID List and Short SSID List elements

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoAP: Support Short SSID List element in Probe Request frames
Andrei Otcheretianski [Wed, 19 Jun 2019 12:49:16 +0000 (15:49 +0300)] 
AP: Support Short SSID List element in Probe Request frames

According to IEEE P802.11ax/D6.0, 11.1.4.3.4 (Criteria for sending a
response), AP should answer Probe Request frames if either SSID or Short
SSID matches. Implement this part of the Short SSID use for the BSS (the
collocated 6 GHz BSS case is not covered in this commit).

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
4 years agoAP: Determine Short SSID value for the BSS
Andrei Otcheretianski [Wed, 19 Jun 2019 12:49:15 +0000 (15:49 +0300)] 
AP: Determine Short SSID value for the BSS

This can be used in the future to implement support for RNR and scanning
extensions using a shorter field for the SSID.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
4 years agomesh: Fix race condition in mesh mpm new peer handling
Felix Fietkau [Sun, 17 Feb 2019 15:02:56 +0000 (16:02 +0100)] 
mesh: Fix race condition in mesh mpm new peer handling

When wpa_supplicant receives another new peer event before the first one
has been processed, it tries to add a station to the driver a second
time (which fails) and then tears down the station entry until another
event comes in.

Fix this by only adding a station to the driver if it didn't exist
already.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
4 years agoEnsure authenticator session timer is applied with wired driver
Zefir Kurtisi [Mon, 29 Apr 2019 09:00:02 +0000 (11:00 +0200)] 
Ensure authenticator session timer is applied with wired driver

We use the wired driver for wired port authentication with a slight
extension to add the port into a bridge upon successful authentication
and to remove it from the bridge when the session terminates.

Our expectation was that the Session-Timeout configuration at the RADIUS
server is respected, i.e. the session is terminated and would need
re-authentication - like it is working for WLAN sessions over the
nl80211 driver. Alas, it turned out the session is not terminated with
the wired driver.

It turned out that when ap_handle_session_timer() is executed, the
sta->flags of the wired port has only the WLAN_STA_AUTHORIZED bit set.
The WLAN_STA_AUTH bit, which is used to check whether the STA needs to
be de-authenticated, is missing.

Extend the check for any of the WLAN_STA_(AUTH | ASSOC | AUTHORIZED)
bits to solve this issue with the wired driver. That should not have any
side-effect for the WLAN cases since WLAN_STA_AUTH is expected to always
be set for those when there is an ongoing session and separate checks
for ASSOC and AUTHORIZED don't change this.

Signed-off-by: Zefir Kurtisi <zefir.kurtisi@neratec.com>
4 years agotests: Fix he_supported() check with python3
Jouni Malinen [Sat, 28 Dec 2019 17:52:17 +0000 (19:52 +0200)] 
tests: Fix he_supported() check with python3

This was making error paths on HE test cases fail with:
TypeError: a bytes-like object is required, not 'str'

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make ap_hs20_roaming_consortium more robust
Jouni Malinen [Sat, 28 Dec 2019 17:05:50 +0000 (19:05 +0200)] 
tests: Make ap_hs20_roaming_consortium more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make ap_cipher_mixed_wpa_wpa2 more robust
Jouni Malinen [Sat, 28 Dec 2019 17:03:22 +0000 (19:03 +0200)] 
tests: Make ap_cipher_mixed_wpa_wpa2 more robust

Explicitly clear cfg80211 scan cache to avoid issues with old BSS
entries from previous test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agodefconfig: Enable MACsec
Lubomir Rintel [Tue, 19 Feb 2019 13:44:13 +0000 (14:44 +0100)] 
defconfig: Enable MACsec

Debian and Fedora enable it, NetworkManager uses it.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
4 years agoAllow debug log to be written to both syslog and file
Jouni Malinen [Sat, 28 Dec 2019 16:17:44 +0000 (18:17 +0200)] 
Allow debug log to be written to both syslog and file

If hostapd or wpa_supplicant is started with both -s and -f command line
arguments, debug log ended up being written only into syslog and the log
file was left empty. Change this so that the log entries will be written
to both places. Either -s or -f (or both) results in debug log to stdout
being disabled which was already the case.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Ignore fe80::ff:fe00:300 NS from AP for now in proxyarp tests
Jouni Malinen [Sat, 28 Dec 2019 15:17:05 +0000 (17:17 +0200)] 
tests: Ignore fe80::ff:fe00:300 NS from AP for now in proxyarp tests

This NS seems to go out from the AP interface every now and then and it
makes proxyarp_open_ebtables_ipv6 fails inconveniently often. That frame
should not really be there, but it's not clear what exactly is needed to
stop it going through. It does not come from the test operations
themselves, so ignore it for now to keep test results cleaner.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make ap_hs20_nai_realms more robust
Jouni Malinen [Fri, 27 Dec 2019 22:34:25 +0000 (00:34 +0200)] 
tests: Make ap_hs20_nai_realms more robust

Explicitly clear cfg80211 scan cache to avoid issues from scan results
from previous test cases interfering with INTERWORKING_CONNECT
operation.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agowpa_gui: Silence a compiler warning
Jouni Malinen [Fri, 27 Dec 2019 22:17:55 +0000 (00:17 +0200)] 
wpa_gui: Silence a compiler warning

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agowpa_gui: Show entire list of networks
Victor Ananyev [Wed, 18 Sep 2019 22:12:23 +0000 (00:12 +0200)] 
wpa_gui: Show entire list of networks

Use LAST_ID of LIST_NETWORKS to load all the network entries iteratively
if there is large enough number of networks to not fit in a single
response.

Signed-off-by: Victor Ananyev <vindex10@gmail.com>
4 years agowpa_cli: Let LAST_ID argument to be used for LIST_NETWORKS
Victor Ananyev [Tue, 17 Sep 2019 19:38:52 +0000 (21:38 +0200)] 
wpa_cli: Let LAST_ID argument to be used for LIST_NETWORKS

This allows starting point of the network list to be specified so that
the potentially long response can be fragmented into multiple fetch
operations.

Signed-off-by: Victor Ananyev <vindex10@gmail.com>
4 years agotests: Replace tcpdump with wlantest
Jouni Malinen [Fri, 27 Dec 2019 21:17:43 +0000 (23:17 +0200)] 
tests: Replace tcpdump with wlantest

This removes dependency on tcpdump by using an already included test
tool for capturing frames with Ethernet headers. There were some issues
in getting tcpdump working on Ubuntu 19.10, so this seems to be a clean
way of addressing that.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agowlantest: Ethernet interface capture
Jouni Malinen [Fri, 27 Dec 2019 21:15:14 +0000 (23:15 +0200)] 
wlantest: Ethernet interface capture

Allow option (command line argument -e) to capture Ethernet headers
instead of IEEE 802.11 so that wlantest can be used as a replacement for
tcpdump/dumpcap for capturing.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make rrm_reassociation more robust
Jouni Malinen [Fri, 27 Dec 2019 20:41:36 +0000 (22:41 +0200)] 
tests: Make rrm_reassociation more robust

Flush cfg80211 scan cache explicitly when running this test case to
avoid issues with the ROAM command not working due to a scan result from
an earlier test case. This was causing failures in the following test
case sequence:
rrm_beacon_req_active_ap_channels rrm_reassociation

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agoSTA OBSS: Update secondary channel info after CSA
Sergey Matyukevich [Fri, 27 Dec 2019 12:22:24 +0000 (15:22 +0300)] 
STA OBSS: Update secondary channel info after CSA

Field wpa_s->sme.ht_sec_chan keeps secondary channel for the 40 MHz
band. This field is used to prepare a list of channels for the STA OBSS
scan. Initially, the secondary channel is set to HT_SEC_CHAN_UNKNOWN.
Later on, in function wpa_obss_scan_freq_list() it is obtained from the
current BSS HT operation IE. However, the secondary channel information
is not updated after channel switch, which may lead to an incorrect list
of channels prepared for the STA OBSS scan.

Update ht_sec_chan according to the channel switch event data to fix
this.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
4 years agotests: Allow more VMs to be started in parallel
Jouni Malinen [Fri, 27 Dec 2019 18:31:33 +0000 (20:31 +0200)] 
tests: Allow more VMs to be started in parallel

Check the number of CPUs to determine how many VMs can be started in
parallel.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Move ocsp-resp-*-signed*.der generation into test case
Jouni Malinen [Fri, 27 Dec 2019 18:01:38 +0000 (20:01 +0200)] 
tests: Move ocsp-resp-*-signed*.der generation into test case

There is no need to generate these OCSP responses for every single test
session. Generate these more dynamically if a test case that uses these
files is executed.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Move ocsp-server-cache-{revoked,unknown}.der generation into test case
Jouni Malinen [Fri, 27 Dec 2019 17:44:35 +0000 (19:44 +0200)] 
tests: Move ocsp-server-cache-{revoked,unknown}.der generation into test case

There is no need to generate these OCSP responses for every single test
session. Generate these more dynamically if a test case that uses these
files is executed.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Use the run_openssl() helper for running openssl
Jouni Malinen [Fri, 27 Dec 2019 17:38:44 +0000 (19:38 +0200)] 
tests: Use the run_openssl() helper for running openssl

This avoids unnecessary duplication of the same functionality to run
openssl and check result.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Move ocsp-server-cache-key-id.der generation into test case
Jouni Malinen [Fri, 27 Dec 2019 17:37:06 +0000 (19:37 +0200)] 
tests: Move ocsp-server-cache-key-id.der generation into test case

There is no need to generate this OCSP response for every single test
session. Generate this more dynamically if the test case that uses the
particular file is executed.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Remove unnecessary copying of ocsp-multi-server-cache.der
Jouni Malinen [Fri, 27 Dec 2019 17:10:20 +0000 (19:10 +0200)] 
tests: Remove unnecessary copying of ocsp-multi-server-cache.der

This file is not being modified, so the original one from the auth_serv
directory can be used directly.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Fix thread handling in P2P GO Negotiation test cases
Jouni Malinen [Fri, 27 Dec 2019 16:14:09 +0000 (18:14 +0200)] 
tests: Fix thread handling in P2P GO Negotiation test cases

Some of the error paths in go_neg_pbc() and go_neg_pin() did not wait
for the helper thread to complete processing. This could result in
unexpected behavior when the test case could have exited while the
thread was still performing tasks for the GO Negotiation. This could
result in getting stuck in one of the following test cases with
"go_neg_init_pbc thread caught an exception from p2p_go_neg_init: Group
formation timed out" showing up in the log.

This was hit, e.g., with the following test sequence:
no_go_freq p2p_channel_drv_pref_autogo

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Use python selector in the parallel-vm.py main loop
Jouni Malinen [Fri, 27 Dec 2019 15:12:34 +0000 (17:12 +0200)] 
tests: Use python selector in the parallel-vm.py main loop

This gets rid of the loop that was polling for things to do every 0.25
seconds and instead, reacts to any data from VMs as soon as it becomes
available. This avoids unnecessary operations when no new data is
available and avoids unnecessary waits when new data becomes available
more quickly.

Signed-off-by: Jouni Malinen <j@w1.fi>
4 years agotests: Make pmksa_cache_expiration more robust
Jouni Malinen [Fri, 27 Dec 2019 13:58:32 +0000 (15:58 +0200)] 
tests: Make pmksa_cache_expiration more robust

Wait for hostapd to enter the PTKINITDONE state before checking
connectivity. This is needed to avoid a race condition with UML
time-travel.

Signed-off-by: Jouni Malinen <j@w1.fi>