In repeater mode remote AP may request channel switch to a new channel.
Check if DFS is required for the new channel before proceeding with
normal AP operations. Start CAC procedure if radar detection is required
and channel is not yet marked as available.
hostapd: Add support for DFS channels in CHAN_SWITCH
Enable support for DFS channels in the CHAN_SWITCH command. Perform CAC
instead of CSA if DFS channel is selected. Then restart normal AP
operations.
Note that the current implementation provides a simplified approach. It
does not check if the selected DFS channel block is already in the
HOSTAPD_CHAN_DFS_AVAILABLE state. CAC procedure is restarted anyway.
Add a new hostapd_is_dfs_overlap() helper function to DFS module. This
function tells whether the selected frequency range overlaps with DFS
channels in the current hostapd configuration. Selected frequency reange
is specified by its center frequency and bandwidth.
DFS: Rename and export hostapd_config_dfs_chan_available helper
Rename DFS helper hostapd_config_dfs_chan_available() to
hostapd_is_dfs_chan_available(). Enable access to this helper function
from other hostapd components.
hostapd: Basic channel check for CHAN_SWITCH parameters
Implement channel sanity check for the CHAN_SWITCH command. Verify
provided values for bandwidth, frequencies, and secondary channel
offset. Reject requested channel switch operation if basic constraints
on frequencies and bandwidth are not fulfilled.
Thomas Pedersen [Fri, 27 Mar 2020 22:51:44 +0000 (15:51 -0700)]
tests: Convert kernel-config to defconfig
Make the included kernel-config a little more minimal by checking in the
defconfig instead.
Generate the defconfig by checking out a linux at tag wt-2020-03-17,
copy kernel-config to .config, run
'yes "" | make oldconfig && make savedefconfig',
and copy resulting defconfig to kernel-config.
Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
Jouni Malinen [Sat, 28 Mar 2020 18:39:19 +0000 (20:39 +0200)]
Add a hostapd testing option for skipping association pruning
The new skip_prune_assoc=1 parameter can be used to configure hostapd
not to prune associations from other BSSs operated by the same process
when a station associates with another BSS. This can be helpful in
testing roaming cases where association and authorization state is
maintained in an AP when the stations returns.
Jouni Malinen [Sat, 28 Mar 2020 18:38:11 +0000 (20:38 +0200)]
nl80211: Allow full AP client state capability to be disabled
The new driver param full_ap_client_state=0 can be used to test
functionality with the driver capability for full AP client state being
forced to be disabled.
nl80211: Configure PMKSA lifetime and reauth threshold timer to driver
Drivers that trigger roaming need to know the lifetime and reauth
threshold time of configured PMKSA so that they can trigger full
authentication to avoid unnecessary disconnection. To support this, send
dot11RSNAConfigPMKLifetime and dot11RSNAConfigPMKReauthThreshold values
configured in wpa_supplicant to the driver while configuring a PMKSA.
Jouni Malinen [Sat, 28 Mar 2020 13:06:15 +0000 (15:06 +0200)]
DPP2: Allow station to require or not allow PFS
The new wpa_supplicant network profile parameter dpp_pfs can be used to
specify how PFS is applied to associations. The default behavior
(dpp_pfs=0) remains same as it was previously, i.e., try to use PFS if
the AP supports it. PFS use can now be required (dpp_pfs=1) or disabled
(dpp_pfs=2).
This is also working around an interoperability issue of DPP R2 STA with
certain hostapd builds that included both OWE and DPP functionality.
That issue was introduced by commit 09368515d130 ("OWE: Process
Diffie-Hellman Parameter element in AP mode") and removed by commit 16a4e931f03e ("OWE: Allow Diffie-Hellman Parameter element to be
included with DPP"). hostapd builds between those two commits would
reject DPP association attempt with PFS. The new wpa_supplicant default
(dpp_pfs=0) behavior is to automatically try to connect again with PFS
disabled if that happens.
Jouni Malinen [Sat, 28 Mar 2020 10:33:48 +0000 (12:33 +0200)]
DPP2: Allow AP to require or reject PFS
The new hostapd configuration parameter dpp_pfs can be used to specify
how PFS is applied to associations. The default behavior (dpp_pfs=0)
remains same as it was previously, i.e., allow the station to decide
whether to use PFS. PFS use can now be required (dpp_pfs=1) or rejected
(dpp_pfs=2).
Jouni Malinen [Fri, 27 Mar 2020 19:05:44 +0000 (21:05 +0200)]
tests: Skip background scans in beacon loss tests
bgscan_learn_beacon_loss was failing quite frequently and it looks like
the background scans were related to those failures. Since those scans
are not really relevant to testing beacon loss, get rid of them in these
test cases to avoid incorrect failures.
Jouni Malinen [Fri, 27 Mar 2020 17:29:44 +0000 (19:29 +0200)]
DPP2: Presence Announcement processing in Controller
Process the received Presence Announcement frames in Controller. If a
matching bootstrapping entry for the peer is found, initiate DPP
authentication to complete provisioning of the Enrollee.
Jouni Malinen [Fri, 27 Mar 2020 17:16:42 +0000 (19:16 +0200)]
DPP2: Presence Announcement processing in AP/Relay
Process the received Presence Announcement frames in AP/Relay. If a
matching bootstrapping entry for the peer is found in a local
Configurator, that Configurator is used. Otherwise, the frame is relayed
to the first configured Controller (if available).
Jouni Malinen [Fri, 27 Mar 2020 12:03:04 +0000 (14:03 +0200)]
DPP2: Configurator Connectivity indication
Add a new hostapd configuration parameter
dpp_configurator_connectivity=1 to request Configurator connectivity to
be advertised for chirping Enrollees.
Jouni Malinen [Fri, 27 Mar 2020 10:42:00 +0000 (12:42 +0200)]
DPP2: Chirping in wpa_supplicant Enrollee
Add a new wpa_supplicant control interface command "DPP_CHIRP own=<BI
ID> iter=<count>" to request chirping, i.e., sending of Presence
Announcement frames, to be started.
Jouni Malinen [Fri, 27 Mar 2020 15:28:59 +0000 (17:28 +0200)]
DPP: Add DPP_BOOTSTRAP_SET command
"DPP_BOOTSTRAP_SET <ID> <configurator parameters..>" can now be used to
set peer specific configurator parameters which will override any global
parameters from dpp_configurator_params.
Jouni Malinen [Fri, 27 Mar 2020 15:14:06 +0000 (17:14 +0200)]
DPP: Allow per-peer configurator parameters to be set
This is a more convenient way of addressing cases where a
Configurator/Controller may store a large number of peer bootstrapping
information instances and may need to manage different configuration
parameters for each peer while operating as the Responder.
Jouni Malinen [Wed, 18 Mar 2020 10:41:46 +0000 (12:41 +0200)]
Update STA flags to the driver immediately on disconnection
hostapd (and wpa_supplicant in AP mode) was internally updating the STA
flags on disconnection cases to remove authorization and association.
However, some cases did not result in immediate update of the driver STA
entry. Update all such cases to send out the update to the driver as
well to reduce risk of race conditions where new frames might be
accepted for TX or RX after the port authorization or association has
been lost and configured keys are removed.
Jouni Malinen [Wed, 18 Mar 2020 21:15:18 +0000 (23:15 +0200)]
tests: Use frame injection in monitor_iface_unknown_sta
The previously used normal data TX depends on undefined driver behavior
after all keys have been removed. That may not be available, so do this
more properly with frame injection through a monitor interface.
Jouni Malinen [Wed, 25 Mar 2020 22:10:16 +0000 (00:10 +0200)]
Process Transition Disable KDE in station mode
Check whether the Transition Disable KDE is received from an
authenticated AP and if so, whether it contains valid indication for
disabling a transition mode. If that is the case, update the local
network profile by removing the less secure options.
Jouni Malinen [Wed, 25 Mar 2020 22:08:26 +0000 (00:08 +0200)]
Allow hostapd AP to advertise Transition Disable KDE
The new hostapd configuration parameter transition_disable can now be
used to configure the AP to advertise that use of a transition mode is
disabled. This allows stations to automatically disable transition mode
by disabling less secure network profile parameters.
Noam Shaked [Tue, 24 Mar 2020 00:19:36 +0000 (17:19 -0700)]
Add ACS support for 60 GHz channel bonding
hostapd will trigger EDMG auto channel selection by setting
QCA_WLAN_VENDOR_ATTR_ACS_EDMG_ENABLED. The 60 GHz driver will be
called to start an auto channel selection and will return the
primary channel and the EDMG channel.
Noam Shaked [Tue, 10 Mar 2020 01:16:02 +0000 (18:16 -0700)]
nl80211: Fix offloaded ACS regression for the 60 GHz band
Addition of chan_2ghz_or_5ghz_to_freq() broke 60 GHz ACS, because it
assumes reported ACS channel is on either 2.4 or 5 GHz band. Fix this
by converting chan_2ghz_or_5ghz_to_freq() to a more generic
chan_to_freq(). The new function uses hw_mode to support 60 GHz.
Fixes: 41cac481a889 ("ACS: Use frequency params in ACS (offload) completed event interface") Signed-off-by: Noam Shaked <nshaked@codeaurora.org>
Wu Gao [Sun, 28 Aug 2016 02:56:33 +0000 (10:56 +0800)]
Extend vendor attributes to support enhanced CFR capture
Enhanced channel frequency response supports capturing of channel status
information based on RX. Define previous CFR as version 1 and enhanced
CFR as version 2. If target supports both versions, two versions can't
be enabled at same time. Extend attributes for enhanced CFR capture in
enum qca_wlan_vendor_peer_cfr_capture_attr.
Alexander Wetzel [Fri, 20 Mar 2020 19:04:32 +0000 (20:04 +0100)]
STA: Support Extended Key ID
Support Extended Key ID in wpa_supplicant according to
IEEE Std 802.11-2016 for infrastructure (AP) associations.
Extended Key ID allows to rekey pairwise keys without the otherwise
unavoidable MPDU losses on a busy link. The standard is fully backward
compatible, allowing STAs to also connect to APs not supporting it.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Alexander Wetzel [Fri, 20 Mar 2020 19:04:31 +0000 (20:04 +0100)]
AP: Support Extended Key ID
Support Extended Key ID in hostapd according to IEEE Std 802.11-2016.
Extended Key ID allows to rekey pairwise keys without the otherwise
unavoidable MPDU losses on a busy link. The standard is fully backward
compatible, allowing an AP to serve STAs with and without Extended Key
ID support in the same BSS.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Jouni Malinen [Sun, 22 Mar 2020 17:52:38 +0000 (19:52 +0200)]
tests: Fix bgscan_learn_beacon_loss with REPORTS_TX_ACK_STATUS
Stopping the AP from beaconing will also stop it from acknowledging
frames and that resulted in bgscan_learn_beacon_loss failing when
mac80211_hwsim is registering REPORTS_TX_ACK_STATUS. Work around this by
moving to using PMF so that the station ignores the unprotected
deauthentiation frames from the AP and also disabling SA Query. This
allows the AP to be stopped and restarted with large enough Beacon
interval to allow the station to detect beacon loss.
This is identical to the earlier design change for
bgscan_simple_beacon_loss (somehow this bgscan_learn_beacon_loss test
case managed to pass at that time).
Jouni Malinen [Sun, 22 Mar 2020 16:51:41 +0000 (18:51 +0200)]
Limit scan frequency list to 100 entries
There is no real use case for the scan to be requested on more than 100
channels individually. To avoid excessively long lists with invalid
configuration, use 100 entry limit for the list before dropping to the
fallback scan-all-channels option.
Jouni Malinen [Sun, 22 Mar 2020 16:35:45 +0000 (18:35 +0200)]
loop: Use size_t for eloop.count
This is more consistent with the other eloop registrations and avoids a
theoretical integer overflow with 16-bit int should more than 32767
sockets/signals/events be registered.
Jouni Malinen [Sun, 22 Mar 2020 16:26:10 +0000 (18:26 +0200)]
eloop: Use size_t for socket table->count
This is more consistent with the other eloop registrations and avoids a
theoretical integer overflow with 16-bit int should more than 32767
sockets be registered (which is not really going to happen in practice).
Jouni Malinen [Sun, 22 Mar 2020 16:15:43 +0000 (18:15 +0200)]
eloop: Use size_t for signal_count
This is more consistent with the other eloop registrations and avoids a
theoretical integer overflow with 16-bit int (not that there would ever
be more that 32767 signal handlers getting registered).
Jouni Malinen [Sun, 22 Mar 2020 16:07:06 +0000 (18:07 +0200)]
Limit maximum number of pending SA Queries
There is no point in starting a huge number of pending SA Queries, so
limit the number of pending queries to 1000 to have an explicit limit
for how large sa_query_count can grow.
Jouni Malinen [Sun, 22 Mar 2020 15:46:45 +0000 (17:46 +0200)]
Use size_t instead of int or unsigned int for configuration items
While int and unsigned int are not going overflow in practice as 32-bit
values, these could at least in theory hit an integer overflow with
16-bit int. Use size_t to avoid such potential issue cases.
Jouni Malinen [Sun, 22 Mar 2020 15:30:23 +0000 (17:30 +0200)]
Use size_t instead of unsigned_int for last_scan_res
This avoids a theoretical unsigned integer overflow case with 32-bit
integers, but something that could potentially be hit with 16-bit int
(though, even that part looks pretty theoretical in this particular case
of number of BSSs in scan results).
Jouni Malinen [Sat, 21 Mar 2020 21:56:19 +0000 (23:56 +0200)]
tests: Wait longer for connection in radius_macacl_unreachable
It looks ike the authentication timeouts may continue a bit longer after
some kernel changes and that could result in temporarily disabling the
network profile. Give this test case more time to complete the
connection to avoid reporting failures unnecessarily.
Matthew Wang [Mon, 16 Mar 2020 21:11:06 +0000 (14:11 -0700)]
Interpolate rate calculation functions
Make max_*_rate() functions and rate calculation at the beginning of
wpas_get_est_tpt() more continuous. In wpa_supplicant_need_to_roam(), we
compare these values to make a roaming decision. However, at certain
SNRs, we see unrealistically large jumps in estimated throughput
according to these functions, leading us to make incorrect roaming
decisions. Perform linear interpolation where applicable to more
accurately reflect actual throughput.
Example:
wlan0: Current BSS: 88:3d:24:b4:95:d2 freq=2412 level=-69 snr=20 est_throughput=54000
wlan0: Selected BSS: 88:3d:24:b4:89:9e freq=2417 level=-67 snr=22 est_throughput=63500
wlan0: Using signal poll values for the current BSS: level=-69 snr=20 est_throughput=54000
wlan0: Allow reassociation - selected BSS has better estimated throughput
2 dB increase in RSSI likely isn't responsible for a 17% increase in
throughput.
Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
Matthew Wang [Mon, 16 Mar 2020 21:11:05 +0000 (14:11 -0700)]
Adjust max bitrate SNR floors
These values were defined in commit a1b790eb9d75 ("Select AP based on
estimated maximum throughput") with no justification. Other sources
[0,1,2] give a different (consistent) set of SNR floors per MCS index.
Adjust the values accordingly.
Jouni Malinen [Sat, 21 Mar 2020 16:13:28 +0000 (18:13 +0200)]
tests: Fix bgscan_simple_beacon_loss with REPORTS_TX_ACK_STATUS
Stopping the AP from beaconing will also stop it from acknowledging
frames and that resulted in bgscan_simple_beacon_loss failing when
mac80211_hwsim is registering REPORTS_TX_ACK_STATUS. Work around this by
moving to using PMF so that the station ignores the unprotected
deauthentiation frames from the AP and also disabling SA Query. This
allows the AP to be stopped and restarted with large enough Beacon
interval to allow the station to detect beacon loss.
Jouni Malinen [Sat, 21 Mar 2020 16:12:02 +0000 (18:12 +0200)]
Allow SA Query to be disabled for testing purposes
The new wpa_supplicant control interface SET parameter disable_sa_query
can now be used to disable SA Query on receiving unprotected
disconnection event.
Ouden [Wed, 18 Mar 2020 09:58:37 +0000 (17:58 +0800)]
nl80211: Fix RTM NEW/DELLINK IFLA_IFNAME copy for maximum ifname length
If the kernel rtm_newlink or rtm_dellink send the maximum length of
ifname (IFNAMSIZ), the event handlers in
wpa_driver_nl80211_event_rtm_addlink() and
wpa_driver_nl80211_event_rtm_dellink() did not copy the IFLA_IFNAME
value. Because the RTA_PAYLOAD (IFLA_IFNAME) length already includes the
NULL termination, that equals the IFNAMSIZ.
Sourav Mohapatra [Thu, 19 Mar 2020 13:51:34 +0000 (19:21 +0530)]
More details to the vendor specific driver internal failure reporting
Add more hang reason codes for the hang reason in the
QCA_NL80211_VENDOR_SUBCMD_HANG events. This also introduces the
attribute QCA_WLAN_VENDOR_ATTR_HANG_REASON_DATA to carry the required
data for the respective hang reason. This data is expected to contain
the required dump to analyze the reason for the hang.
Jouni Malinen [Sat, 21 Mar 2020 13:57:37 +0000 (15:57 +0200)]
Ignore duplicated SSID element when parsing
Some APs have managed to add two SSID elements into Beacon frames and
that used to result in picking the last one which had incorrect data in
the known examples of this misbehavior. Pick the first one to get the
correct SSID.
Jouni Malinen [Sat, 21 Mar 2020 10:57:37 +0000 (12:57 +0200)]
Check against integer overflow in int_array functions
int_array_concat() and int_array_add_unique() could potentially end up
overflowing the int type variable used to calculate their length. While
this is mostly theoretical for platforms that use 32-bit int, there
might be cases where a 16-bit int overflow could be hit. This could
result in accessing memory outside buffer bounds and potentially a
double free when realloc() ends up freeing the buffer.
All current uses of int_array_add_unique() and most uses of
int_array_concat() are currently limited by the buffer limits for the
local configuration parameter or frame length and as such, cannot hit
this overflow cases. The only case where a long enough int_array could
be generated is the combination of scan_freq values for a scan. The
memory and CPU resource needs for generating an int_array with 2^31
entries would not be realistic to hit in practice, but a device using
LP32 data model with 16-bit int could hit this case.
It is better to have more robust checks even if this could not be
reached in practice, so handle cases where more than INT_MAX entries
would be added to an int_array as memory allocation failures instead of
allowing the overflow case to proceed.
Jouni Malinen [Fri, 20 Mar 2020 22:23:01 +0000 (00:23 +0200)]
Allow RSNXE to be removed from Beacon frames for testing purposes
The new hostapd configuration parameter no_beacon_rsnxe=1 can be used to
remove RSNXE from Beacon frames. This can be used to test protection
mechanisms for downgrade attacks.
Jouni Malinen [Fri, 20 Mar 2020 19:56:44 +0000 (21:56 +0200)]
FT: Omit RSNXE from FT protocol Reassociation Response when needed
The previous design for adding RSNXE into FT was not backwards
compatible. Move to a new design based on 20/332r3 to avoid that issue
by not include RSNXE in the FT protocol Reassociation Response frame so
that a STA not supporting RSNXE can still validate the FTE MIC
correctly.
Jouni Malinen [Fri, 20 Mar 2020 19:45:22 +0000 (21:45 +0200)]
FT: Omit RSNXE from FT protocol Reassociation Request when needed
The previous design for adding RSNXE into FT was not backwards
compatible. Move to a new design based on 20/332r3 to avoid that issue
by not include RSNXE in the FT protocol Reassociation Request frame so
that an AP not supporting RSNXE can still validate the FTE MIC
correctly.
Jouni Malinen [Fri, 20 Mar 2020 19:38:22 +0000 (21:38 +0200)]
FT: Verify that RSNXE is used consistently in Reassociation Response
Verify that the AP included RSNXE in Beacon/Probe Response frames if it
indicated in FTE that RSNXE is used. This is needed to protect against
downgrade attacks based on the design proposed in 20/332r3.
Jouni Malinen [Fri, 20 Mar 2020 19:33:02 +0000 (21:33 +0200)]
FT: Verify that RSNXE is used consistently in Reassociation Request
Verify that the STA includes RSNXE if it indicated in FTE that RSNXE is
used and the AP is also using RSNXE. This is needed to protect against
downgrade attacks based on the design proposed in 20/332r3.
Jouni Malinen [Fri, 20 Mar 2020 19:23:48 +0000 (21:23 +0200)]
FT: Set the new RSNXE Used subfield in FT reassociation
This is a workaround needed to keep FT protocol backwards compatible for
the cases where either the AP or the STA uses RSNXE, but the other one
does not. This commit adds setting of the new field to 1 in
Reassociation Request/Response frame during FT protocol when the STA/AP
uses RSNXE in other frames. This mechanism is described in 20/332r3.