Jouni Malinen [Mon, 24 Jan 2011 13:25:59 +0000 (15:25 +0200)]
wlantest: Fix TDLS setup failure counting
Need to be able to handle TDLS Setup Response frame with LinkId IE
when non-zero status code is used. In addition, allow finding of a
TDLS entry based on real BSSID instead of the one used in the LinkId
to allow negative testing of different BSS.
Jouni Malinen [Mon, 24 Jan 2011 12:26:35 +0000 (14:26 +0200)]
wlantest: Maintain only a single entry for an active direct link
The TDLS link itself is bidirectional, but there is explicit
initiator/responder roles. Remove the other direction of the link if it
exists when processing TDLS Setup Confirm to make sure that the link
counters are stored for the current TDLS entery.
This is also changing the control interface search for TDLS counters
to require initiator/responder addresses in the correct order instead
of matching entries regardless of the role.
Jouni Malinen [Mon, 17 Jan 2011 10:21:29 +0000 (12:21 +0200)]
AP: Validate management frame length
Make sure that received management frames are long enough before
processing them. This avoids a potential segmentation fault if a
driver delivers an invalid frame all the way to hostapd.
Dan Harkins [Sun, 16 Jan 2011 11:12:07 +0000 (13:12 +0200)]
EAP-pwd: Fix some interoperability issues
The changes are:
1. the word "and" in the hunting-and-pecking string passed to the KDF
should be capitalized.
2. the primebitlen used in the KDF should be a short not an int.
3. the computation of MK in hostap is based on an older version of the
draft and is not the way it's specified in the RFC.
4. the group being passed into computation of the Commit was not in
network order.
Jouni Malinen [Sat, 15 Jan 2011 14:55:15 +0000 (16:55 +0200)]
IBSS RSN: Do not start multiple Auth/Supp for same peer
This avoids an issue when a received EAPOL-Key frame from a peer
is initiating IBSS RSN Authenticator and Supplicant for the peer
and the following new-STA-in-IBSS event from the driver is adding
yet another instance of Authenticator/Supplicant. The EAPOL-Key
RX case was already checking whether an instance had been started;
the driver new-STA event needs to do same.
Jouni Malinen [Sat, 15 Jan 2011 12:07:02 +0000 (14:07 +0200)]
IBSS RSN: Delay setting of the initial TX GTK
The driver may get confused if we set the initial TX GTK before having
fully configured and connected to an IBSS, so better delay this
operation until the connection (join/start IBSS) has been completed.
Chao-Wen Yang [Thu, 13 Jan 2011 16:04:33 +0000 (18:04 +0200)]
WPS: Indicate WPS-FAIL event on EAPOL timeout-based failure callback
If the EAPOL processing times out (e.g., if the AP stops replying
to messages for some reason) during WPS negotiation, we need to
indicate WPS-FAIL event from eapol_cb since no other WPS failure is
reported for this particular case.
Chao-Wen Yang [Thu, 13 Jan 2011 15:50:59 +0000 (17:50 +0200)]
WPS: Add mechanism for indicating non-standard WPS errors
Previously, only the Configuration Error values were indicated in
WPS-FAIL events. Since those values are defined in the specification
it is not feasible to extend them for indicating other errors. Add
a new error indication value that is internal to wpa_supplicant and
hostapd to allow other errors to be indicated.
Use the new mechanism to indicate if negotiation fails because of
WEP or TKIP-only configurations being disallows by WPS 2.0.
Jouni Malinen [Wed, 12 Jan 2011 11:48:55 +0000 (13:48 +0200)]
P2P: Check GO Neg Req retransmit limit in p2p_listen_end
This needs to be done both in the more normal location in
p2p_timeout_connect_listen() (internal timeout after driver event) and
in p2p_listen_end() as a workaround for the case where the driver event
is delayed to happen after the internal timeout.
Jouni Malinen [Mon, 10 Jan 2011 18:41:04 +0000 (20:41 +0200)]
test-sha1: Add test vectors from RFC 6070
The test with very large iterations count is commented out since it
takes quite long to derive (it does pass, though). In addition, the
last test vector is commented out since pbkdf2_sha1() does not support
arbitrary binary passphrases (\0 inside the string).
Jouni Malinen [Sun, 9 Jan 2011 17:44:28 +0000 (19:44 +0200)]
Use set_key addr to distinguish default and multicast keys
Previously, both NULL and ff:ff:ff:ff:ff:ff addr were used in various
places to indicate default/broadcast keys. Make this more consistent
and useful by defining NULL to mean default key (i.e., used both for
unicast and broadcast) and ff:ff:ff:ff:ff:ff to indicate broadcast
key (i.e., used only with broadcast).
Jouni Malinen [Sun, 9 Jan 2011 17:18:50 +0000 (19:18 +0200)]
nl80211: Avoid infinite loop when searching a BSS
When hostapd is removing a virtual BSS interface, the loop here was
incorrectly not updating the iterator during list traversal and
ended up in an infinite loop in some cases.
Jouni Malinen [Sun, 9 Jan 2011 10:09:04 +0000 (12:09 +0200)]
Use more consistent set_key seq value when nothing is being set
Use NULL instead of (u8 *) "" as the seq value and make sure the
driver wrapper implementations can handle NULL value. This was
previously already done in number of places, but not everywhere.
Jouni Malinen [Wed, 5 Jan 2011 09:49:03 +0000 (11:49 +0200)]
WPS: Make WPS-AP-AVAILABLE* events a bit more consistent
The BSS table entries may be in more or less random order and it is
better to show the most likely WPS configuration method in a way that is
somewhat more consistent instead of just showing the method of the first
BSS entry found in the table.
Jouni Malinen [Thu, 30 Dec 2010 16:27:33 +0000 (18:27 +0200)]
Fix wpa_supplicant_ssid_bss_match() handler for non-WPA
The proto configuration may be left to non-zero when moving from one
configuration to another. To avoid misidentifying a network
configuration as enabling WPA, check key_mgmt field, too.
Yi Zhu [Thu, 9 Dec 2010 19:30:20 +0000 (11:30 -0800)]
bsd: Fix receive buffer alignment issue
wpa_supplicant seems to crash from time to time on a NetBSD 4.0 MIPS
platform. The root cause turned out to be a MIPS alignment issue.
In my wpa_supplicant crash case, in function
wpa_driver_bsd_event_receive (from driver_bsd.c), the buf[2048] address
is started from i.e. 0x7fffd546, which is not 4 bytes aligned. Later
when it is casted to (struct if_msghdr *), and rtm->rtm_flags is used.
rtm->rtm_flags is "int" type, but its address is not 4 bytes aligned.
This is because the start address of rtm is not 4 bytes aligned.
Unfortunately in NetBSD MIPS kernel (unlike Linux MIPS kernel emulates
unaligned access in its exception handler), the default behavior is to
generate a memory fault to the application that accesses unaligned
memory address. Thus comes the early mentioned wpa_supplicant crash. An
interesting note is when I'm using the wpa_supplicant version 0.4.9, I
never saw this problem. Maybe the stack layout is different. But I
didn't look into details.
I used below patch to resolve this problem. Now it runs correctly for at
least several hours. But you might have a better fix (maybe we can use
malloc/free so that it is at least cache line aligned?). I'm also not
sure if other drivers should have the same problem.
Jouni Malinen [Thu, 30 Dec 2010 10:48:55 +0000 (12:48 +0200)]
P2P: Add initial support for driver-based P2P management
This adds partial callbacks and events to allow P2P management to be
implemented in a driver/firmware. This is not yet complete and is
very much subject to change in the future.
Jouni Malinen [Wed, 22 Dec 2010 09:33:59 +0000 (11:33 +0200)]
WPS: Add option to disable open networks by default
CONFIG_WPS_REG_DISABLE_OPEN=y can be used to configure wpa_supplicant
to disable open networks by default when wps_reg command is used to
learn the current AP settings. When this is enabled, there will be a
WPS-OPEN-NETWORK ctrl_iface event and the user will need to explicitly
enable the network (e.g., with "select_network <id>") to connect to
the open network.
Johannes Berg [Wed, 29 Dec 2010 12:05:34 +0000 (14:05 +0200)]
nl80211: Use driver-based off-channel TX if available
If the underlying driver supports off-channel TX, it will now be used by
the nl80211 driver wrapper, setting WPA_DRIVER_FLAGS_OFFCHANNEL_TX
accordingly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Wed, 29 Dec 2010 11:59:17 +0000 (13:59 +0200)]
P2P: Add option for offloading off-channel TX to the driver
With the new kernel functionality coming to Linux to allow off-channel
TX, we can take advantage of that in the P2P code that currently uses
remain-on-channel. If a driver advertises support for it, it will be
asked to handle off-channel TX by itself.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Tue, 28 Dec 2010 15:15:01 +0000 (17:15 +0200)]
Allow AP mode to disconnect STAs based on low ACK condition
The nl80211 driver can report low ACK condition (in fact it reports
complete loss right now only). Use that, along with a config option, to
disconnect stations when the data connection is not working properly,
e.g., due to the STA having went outside the range of the AP. This is
disabled by default and can be enabled with disassoc_low_ack=1 in
hostapd or wpa_supplicant configuration file.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jouni Malinen [Tue, 28 Dec 2010 10:09:14 +0000 (12:09 +0200)]
Re-initialize EAP ClientTimeout on for each session
ClientTimeout changes from EAP peer methods were not supposed to
change behavior for other EAP peer methods or even other sessions
of the same method. Re-initialize ClientTimeout whenever an EAP
peer method is initialized to avoid this. This addresses problems
where WPS (EAP-WSC) reduces the timeout and consecutive EAP runs
may fail due to too small timeout.
Fabien Marotte [Tue, 28 Dec 2010 09:48:58 +0000 (11:48 +0200)]
P2P: Limit the retransmission of GO Negotiation request to 120
If the peer you want to connect to is no longer available (does not
acknowledge frames) when wpa_supplicant sends GO Negotition Request
frames, retransmission of this frame is done until the associated
p2p_device structure is removed on timeout. In that case, no signal
is emitted to inform the GO Negotiation has failed.
When sending an Invitation Request frame, the same retransmission
mechanism is in place but limit the transmission to 100 and hitting
the limit generates an event.
This patch adds the same mechanism as the one in place for Invitation
Request, but with limit of 120 to match the existing wait_count for
for GO Negotiation.
Jouni Malinen [Tue, 28 Dec 2010 06:56:23 +0000 (08:56 +0200)]
WPS: Require PBC match with wps_pbc that specifies BSSID
The WPS mode was already verified when the AP was configured for
WPA/WPA2, but this was not done with AP that was in open mode.
Fix this by allowing wpa_supplicant_ssid_bss_match() to be called
in non-WPA configuration, too. With this change, wps_pbc BSSID
command will wait until the specified target AP is in active PBC
mode before trying to connect to it.
Jouni Malinen [Sun, 19 Dec 2010 09:58:00 +0000 (11:58 +0200)]
Use SA Query procedure to recovery from AP/STA state mismatch
If a station received unprotected Deauthentication or Disassociation
frame with reason code 6 or 7 from the current AP, there may be a
mismatch in association state between the AP and STA. Verify whether
this is the case by using SA Query procedure. If not response is
received from the AP, deauthenticate.
This implementation is only for user space SME with
driver_nl80211.c.
Johannes Berg [Fri, 17 Dec 2010 13:31:05 +0000 (15:31 +0200)]
Allow setting scan_res_handler from the callback function
Some new code I'm working on will need the scan_res_handler assigned all
the time in certain circumstances, so the easiest way is to reset it
within the handler. This is currently prevented by the way the code in
the event handler works -- change that to permit such usage.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
P2P: Unauthorize pending P2P GO Neg peer on p2p_cancel
If there is a pending GO Negotiation when p2p_cancel is used,
unauthorize the peer to avoid immediate reconnection from being
accepted without a new p2p_connect command.
We should cancel group formation completely on PBC overlap instead
of just partially notifying that operations were stopped. There is
no point in waiting for the group formation timeout in this case.
Jouni Malinen [Fri, 17 Dec 2010 06:06:52 +0000 (08:06 +0200)]
wlantest: Replace pcap header directory
The use of the pcap subdirectory seems to be limited to some of the
newer Linux distros only, so use the older paths to pcap.h and
pcap-bpf.h to make wlantest bit more easier to compile on older
systems.
Jouni Malinen [Thu, 16 Dec 2010 14:11:54 +0000 (16:11 +0200)]
wlantest: Add send command for injecting raw frames
This can be used by external programs (e.g., wlantest_cli) to inject
raw frames (hex dump of the frame header and body). The data can be
requested to be sent as-is or protected with the current key.
Jouni Malinen [Mon, 13 Dec 2010 19:08:53 +0000 (21:08 +0200)]
nl80211: Set cipher suites when using user space SME
Previously, pairwise and group cipher suites were configured only
when kernel SME (nl80211 connect API) was used. However, mac80211
needs this information even in the user space SME case for one
thing: to disable HT when TKIP/WEP is used. Add
NL80211_ATTR_CIPHER_SUITES_PAIRWISE to fix this special case with
user space SME. This allows mac80211 to disable HT properly when
the AP is configured with configuration that is not allowed.
Jouni Malinen [Sun, 5 Dec 2010 04:31:22 +0000 (20:31 -0800)]
RSN IBSS: RX GTK configuration with nl80211
This add preliminary code for setting the per-STA RX GTK for
RSN IBSS when nl80211 drivers. For some reason, this does not
seem to fully work, but at least driver_nl80211.c is now aware of
what kind of key is being set and the whatever is missing from
making this key configuration go through should be specific to
nl80211/cfg80211.
Jouni Malinen [Sun, 5 Dec 2010 01:40:36 +0000 (17:40 -0800)]
Do not send Deauth/Disassoc to unknown STA if SA is invalid
The frame needs to be sent from an individual (non-group) address,
so drop invalid frames before sending Deauth/Disassoc frames to
not associated STAs.
Jouni Malinen [Sat, 4 Dec 2010 19:37:41 +0000 (11:37 -0800)]
Fix EAP-FAST PAC file writer to avoid crash with multiple PACs
One of the pointers to the PAC buffer was not updated after realloc
and if the realloc ended up returning new pointer, the *pos pointer
was still pointing at the old location (i.e., freed memory at
this point).
Ben Greear [Fri, 26 Nov 2010 19:46:30 +0000 (21:46 +0200)]
Enable sharing of scan result events among virtual interfaces
When controlling multiple virtual interfaces on the same physical
radio, share the scan results events with sibling interfaces. This
decreases the time it takes to connect many virtual interfaces.
This is currently only supported on Linux with cfg80211-based
drivers when using nl80211 or wext driver interface.
Signed-off-by: Ben Greear <greearb@candelatech.com>
Jouni Malinen [Fri, 26 Nov 2010 15:41:21 +0000 (17:41 +0200)]
Allow driver wrappers to indicate whether result codes are sane
Some drivers are not providing exactly reliable error codes (e.g.,
with WEXT), but others may actually indicate reliable information.
Allow driver wrappers to indicate if that is the case and use
optimizations if so. For now, this improves nl80211 with
NL80211_CMD_CONNECT for a case where connection request fails.
Jouni Malinen [Fri, 26 Nov 2010 15:37:22 +0000 (17:37 +0200)]
SME: Optimize recovery from assocication command failures
mac80211 can indicate this mainly because of channel selection
conflicts with other vifs. If there is another BSS on another
channel, we should try to connect to it instead.