SAE password configuration for AP mode requires additional steps
compared to PSK cases. Previous implementation allowed SAE to be
configured, but all authentication attempts would fail due to no
password being available. Now both psk and sae_password/sae_password_id
parameters are translated properly to the hostapd configuration
structures to fix this.
Roy Marples [Thu, 19 Sep 2019 09:59:09 +0000 (10:59 +0100)]
NetBSD: Fix compile
On NetBSD the ethernet header is net/if_ether.h
This also pulls in net/if.h which defines if_type, which in turn
conflicts with an enum in wpa_supplicant. As such we need to
include this at the bottom rather than at the top.
MBO/OCE: Work around misbehaving MBO/OCE APs that use RSN without PMF
The MBO and OCE specification require the station to mandate use of PMF
when connecting to an MBO/OCE AP that uses WPA2. The earlier
implementation prevented such misbehaving APs from being selected for
connection completely. This looks like the safest approach to take, but
unfortunately, there are deployed APs that are not compliant with the
MBO/OCE requirements and this strict interpretation of the station
requirements results in interoperability issues by preventing the
association completely.
Relax the approach by allowing noncompliant MBO/OCE APs to be selected
for RSN connection without PMF to avoid the main impact of this
interoperability issue. However, disable MBO/OCE functionality when PMF
cannot be negotiated to try to be as compliant as practical with the
MBO/OCE tech spec requirements (i.e., stop being an MBO/OCE STA for the
duration of such workaround association). Also disable support for BTM
in this workaround state since MBO would expect all BTM frames to be
protected.
Alexander Wetzel [Sun, 15 Sep 2019 20:08:22 +0000 (22:08 +0200)]
nl80211: Migrate to current netlink key message format
Linux 2.6.32 (December 2009) introduced alternate netlink messages
for setting and installing keys, deprecating the older ones.
To allow hostapd/wpa_supplicant to use new features only provided via
the new API this patch migrates all netlink messages to the current ones.
Since the nl80211 driver was sometimes already using the new format this
is only unifying the netlink API usage and not changing the minimal
kernel requirement.
The following netlink attributes have been retired for key installs:
When getting Michael MIC failure notifications or querying a key
sequence number the kernel continues to use the old attributes:
NL80211_ATTR_KEY_TYPE
NL80211_ATTR_KEY_SEQ
NL80211_ATTR_KEY_IDX
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
Alexander Wetzel [Sun, 15 Sep 2019 20:08:21 +0000 (22:08 +0200)]
AP: Provide correct keyid to wpa_send_eapol() for EAPOL-Key msg 3/4
PTKINITNEGOTIATING in the WPA state machine calls wpa_send_eapol() and
hands over the GTK instead of the PTK keyid.
Besides a confusing debug message this does not have any negative side
effects: The variable is only set to a wrong value when using WPA2 but
then it's not used.
With this patch PTKINITNEGOTIATING sets the PTK keyid unconditionally to
zero for EAPOL-Key msg 3/4 and differentiates more obviously between GTK
and PTK keyids.
Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
ACS: Stop before scan if no channels in chanlist are available
When we set "channel=0" in hostapd.conf to enable ACS function, and set
a wrong channel list, e.g., chanlist=222-999 on purpose, hostapd would
still start ACS process to compute the ideal channel, even when there
are no available channels with such configuration.
Though there is no problem since hostapd fails to initialize interface,
it spends time going through the scan and the debug log entries may make
it more difficult to tell what was behind the failure.
Thus, check if there are any available channels in acs_request_scan(),
and return -1 if no available channel, then it will fail at acs_init(),
without doing ACS computation. It will show the following in the log:
Could not select hw_mode and channel. (-3)
wlan0: interface state UNINITIALIZED->DISABLED
Then we can know the setting is incorrect already in
hostapd_select_hw_mode(), instead of waiting for scan callback function
to know if the setting is ok for ACS or not. This can save time and help
to tell if the setting is correct at the initial function at the first.
This will also allow the ENABLE control interface command to return FAIL
when adding an interface dynamically.
DPP: Debug print configRequest bandSupport on Configurator
Go through the received bandSupport JSON array and print its contents in
the debug log. This information might be exposed to upper layer
configuration generation/use somehow in the future.
Thomas Winter [Tue, 27 Aug 2019 03:55:38 +0000 (15:55 +1200)]
mka: Check OLPN for exhaustion on SAKuse decode
Most of the time is spent in the CP state machine RETIRE state where LKI
is not set and OKI is the currently used SAK so OLPN needs to be checked
for PN exhaustion.
hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
Thomas Winter [Tue, 27 Aug 2019 03:55:37 +0000 (15:55 +1200)]
mka: Check OLPN for exhaustion on SAKuse encode
Most of the time is spent in the CP state machine RETIRE state where LKI
is not set and OKI is the currently used SAK, so OLPN needs to be
checked for PN exhaustion.
hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
Thomas Winter [Tue, 27 Aug 2019 03:55:34 +0000 (15:55 +1200)]
mka: Change RECEIVE and RETIRE states to match the standard
The RECEIVE and RETIRE states were incorrect which can result in
incorrect information being advertised in SAKuse MKPDUs. Change these to
match IEEE Std 802.1X-2010, Figure 12-2 (CP state machine).
hostapd/wpa_supplicant implemented an interpretation of the standard as
described in a proposed amendment titled "MKA pending PN exhastion"
which was deemed to be wrong. This amendment was included in IEEE Std
802.1Xck-2018.
Signed-off-by: Thomas Winter <Thomas.Winter@alliedtelesis.co.nz>
This code block with dependency on PCSC_FUNCS was missed when conf->pin
was moved to conf->cert.pin. Fix this to get rid of compilation issues
with CONFIG_PCSC=y builds.
DPP: Allow name and mudurl to be configured for Config Request
The new hostapd and wpa_supplicant configuration parameters dpp_name and
dpp_mud_url can now be used to set a specific name and MUD URL for the
Enrollee to use in the Configuration Request. dpp_name replaces the
previously hardcoded "Test" string (which is still the default if an
explicit configuration entry is not included). dpp_mud_url can
optionally be used to add a MUD URL to describe the Enrollee device.
More consistent SA check for unexpected Data frames
Use the same rules for dropping driver notifications for Data frames
from unassociated stations as were added for Management frame reception.
This results in more consistent behavior in sending out Deauthentication
frames with Reason Code 6/7.
This case was already checking for unexpected multicast addresses, so
there was no issue for the PMF protections for unexpected disconnection.
Anyway, better avoid unnecessary Deauthentication frames consistently.
A new argument to the DPP_AUTH_INIT command (conn_status=1) can now be
used to set Configurator to request a station Enrollee to report
connection result after a successfully completed provisioning step. If
the peer supports this, the DPP-CONF-SENT event indicates this with a
new argument (wait_conn_status=1) and the Configurator remains waiting
for the connection result for up to 16 seconds.
Once the Enrollee reports the result, a new DPP-CONN-STATUS-RESULT event
is generated with arguments result, ssid, and channel_list indicating
what the Enrollee reported. result=0 means success while non-zero codes
are for various error cases as specified in the DPP tech spec. If no
report is received from the Enrollee, the event with "timeout" argument
is generated locally.
tests: Fix DPP wait_auth_success() check for Configurator success
This looked like a copy-paste error in the event message check and once
that was fixed, couple of test cases needed fixes to expect a success
from the Configurator.
Sujay Patwardhan [Mon, 26 Aug 2019 18:35:38 +0000 (11:35 -0700)]
wpa_supplicant: Don't return an error when successfully parsing WMM rules
The config file parser previously would fall through into an error if
CONFIG_AP is defined and it hit a wmm_ac_* rule with a valid value. Add
a return to prevent incorrectly printing an error message and returning
a non-zero exit code.
Hu Wang [Wed, 11 Sep 2019 03:04:40 +0000 (11:04 +0800)]
P2P: Use latest BSS entry if multiple P2P Device Addr matches found
If an AP (P2P GO) has changed its operating channel or SSID recently,
the BSS table may have multiple entries for the same BSSID.
Commit 702621e6dd35 ('WPS: Use latest updated BSS entry if multiple
BSSID matches found') fetches latest updated BSS entry based on
BSSID. Do the same when fetching an entry based on the P2P Device
Address.
IEEE Std 802.11F-2003 was withdrawn in 2006 and as such it has not been
maintained nor is there any expectation of the withdrawn trial-use
recommended practice to be maintained in the future. Furthermore,
implementation of IAPP in hostapd was not complete, i.e., only parts of
the recommended practice were included. The main item of some real use
long time ago was the Layer 2 Update frame to update bridges when a STA
roams within an ESS, but that functionality has, in practice, been moved
to kernel drivers to provide better integration with the networking
stack.
Jouni Malinen [Thu, 29 Aug 2019 08:52:04 +0000 (11:52 +0300)]
AP: Silently ignore management frame from unexpected source address
Do not process any received Management frames with unexpected/invalid SA
so that we do not add any state for unexpected STA addresses or end up
sending out frames to unexpected destination. This prevents unexpected
sequences where an unprotected frame might end up causing the AP to send
out a response to another device and that other device processing the
unexpected response.
In particular, this prevents some potential denial of service cases
where the unexpected response frame from the AP might result in a
connected station dropping its association.
Mikael Kanstrup [Fri, 16 Aug 2019 06:50:54 +0000 (08:50 +0200)]
WPS: Update MAC address on address changes
The WPS component keeps a copy of the network interface MAC address.
When MAC address is changed the WPS copy was not updated so WPS M1
message contained the old address. Some devices check this field
and fail connection attempts.
Update the WPS MAC address on interface MAC address changes.
Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sony.com>
Rosen Penev [Sat, 24 Aug 2019 22:01:16 +0000 (15:01 -0700)]
os_sleep: Use nanosleep for POSIX versions 2008 and higher
uClibc-ng optionally disabled deprecated POSIX functions like usleep,
causing compilation failures. This switches to nanosleep while retaining
support for older libcs that do not support nanosleep.
wpa_cli: Do not pick p2p-dev-* interfaces by default
These are the driver-specific interface for the non-netdev P2P Device
interface and not something that useful for most use cases. Skip them to
allow the main netdev (e.g., wlan0 over p2p-dev-wlan0) to be selected.
FILS: Update connect params after sending connection notification
Update connect params will update auth_alg and fils_hlp_req in
wpa_supplicant structure before calling function
wpas_notify_state_changed(). This could have resulted in triggering
inconsistent state change events and messages in the Android framework.
Srinivas Dasari [Thu, 22 Aug 2019 09:40:16 +0000 (15:10 +0530)]
Correct the type/usage of QCA_ATTR_ROAM_CONTROL_SCAN_FREQ_LIST
Update the documentation of QCA_ATTR_ROAM_CONTROL_SCAN_FREQ_LIST
to make it a nested attribute to carry frequencies of type u32.
This is to be in sync with the nl80211 attribute
NL80211_ATTR_SCAN_FREQUENCIES.
Hardcode this to be defined and remove the separate build options for
PMF since this functionality is needed with large number of newer
protocol extensions and is also something that should be enabled in all
WPA2/WPA3 networks.
Hu Wang [Wed, 14 Aug 2019 09:31:19 +0000 (17:31 +0800)]
DFS offload: Fix hostapd state and CAC info in STATUS output
With DFS offloaded to the driver, hostapd state and CAC info was not
updated in DFS-CAC-START event, so STATUS output showed wrong info. Fix
this by updating the CAC related state when processing the driver event.
EAP-TEAP peer: Add support for machine credentials using certificates
This allows EAP-TLS to be used within an EAP-TEAP tunnel when there is
an explicit request for machine credentials. The network profile
parameters are otherwise same as the Phase 1 parameters, but each one
uses a "machine_" prefix for the parameter name.
ENOTCONN, EOPNOTSUPP, and ECANCELED are defined in a newer version of
MinGW, so make this workaround conditional on what is defined in the
header files.
OCSP configuration is applicable to each instance of TLS-based
authentication and as such, the configuration might need to be different
for Phase 1 and Phase 2. Move ocsp into struct eap_peer_cert_config and
add a separate ocsp2 network profile parameter to set this for Phase 2.
EAP server: Configurable maximum number of authentication message rounds
Allow the previously hardcoded maximum numbers of EAP message rounds to
be configured in hostapd EAP server. This can be used, e.g., to increase
the default limits if very large X.509 certificates are used for EAP
authentication.
EAP peer: Move certificate configuration params into shared struct
These parameters for certificate authentication are identical for the
Phase 1 (EAP-TLS alone) and Phase 2 (EAP-TLS inside a TLS tunnel).
Furthermore, yet another copy would be needed to support separate
machine credential in Phase 2. Clean this up by moving the shared
parameters into a separate data struct that can then be used for each
need without having to define separate struct members for each use.
Sven Eckelmann [Tue, 13 Aug 2019 13:50:52 +0000 (15:50 +0200)]
mesh: Do not enable HE on 5 GHz without VHT
The commit ad9a1bfe788e ("nl80211: Share VHT channel configuration for
HE") always enforced that VHT is enabled when HE was enabled. This broke
the mesh functionality on 2.4 GHz with HE because ibss_mesh_setup_freq()
isn't setting up the VHT parameters for 2.4 GHz.
This problem was resolved for 2.4 GHz by commit df4f959988b6 ("nl80211:
Don't force VHT channel definition with HE"), but it is still possible
to disable VHT during the mesh/IBSS freq setup on 5 GHz - which would
result in the same problem as seen on 2.4 GHz.
The code enabling HE for IBSS/mesh must now make sure that it doesn't
enable HE when VHT could be enforced by the nl80211 driver code but
disabled by the user.
Fixes: 3459c54ac78b ("mesh: Add support for HE mode") Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
John Crispin [Tue, 13 Aug 2019 13:10:46 +0000 (15:10 +0200)]
HE: Fix HE Capabilities element size
Set the max value of optional bytes inside the data structure. This
requires us to calculate the actually used size when copying the
HE capabilities and generating the IE.
Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
Jouni Malinen [Fri, 30 Aug 2019 12:41:58 +0000 (15:41 +0300)]
HS 2.0: Do not add two copies of OSEN element into Beacon/Probe Resp
OSEN element was getting added both through the Authenticator IEs
(before some non-vendor elements) and separately at the end of the
frames with other vendor elements. Fix this by removing the separate
addition of the OSEN element and by moving the Authenticator IE addition
for OSEN to match the design used with WPA so that the vendor element
gets added in the proper place in the sequence of IEs.
Jouni Malinen [Fri, 30 Aug 2019 12:22:42 +0000 (15:22 +0300)]
HS 2.0 AP: Do not mandate PMF for HS 2.0 Indication in open OSU network
Even though the station is not supposed to include Hotspot 2.0
Indication element in the Association Request frame when connecting to
the open OSU BSS, some station devices seem to do so. With the strict
PMF-required-with-Hotspot-2.0-R2 interpretation, such connection
attempts were rejected. Relax this to only perform the PMF check if the
local AP configuration has PMF enabled, i.e., for the production BSS.
Jouni Malinen [Sat, 24 Aug 2019 19:52:52 +0000 (22:52 +0300)]
tests: Make nfc_wps more robust by avoiding race conditions
The hostapd side operations and data connectivity test were executed
without explicitly waiting for hostapd to report connection as having
been completed. This could result in trying to transmit data before
EAPOL-Key msg 4/4 was processed especially when using UML time-travel.
Make this more robust by waiting for hostapd to be ready before the data
test.
Jouni Malinen [Sat, 24 Aug 2019 16:20:40 +0000 (19:20 +0300)]
tests: Fix ap_ft_reassoc_replay for case where wlantest has the PSK
This test case was failing if wlantest was able to decrypt the CCMP
protected frames. Fix the tshark filter string to include only the
actually encrypted frames for PN comparison.
Jouni Malinen [Sat, 24 Aug 2019 13:55:26 +0000 (16:55 +0300)]
EAP-TEAP peer: Fix protected indication of inner EAP method failure
Need to leave EAP-TEAP methodState == MAY_CONT when marking decision =
FAIL based on inner EAP method failure since this message will be
followed by protected failure indication.
Jouni Malinen [Sat, 24 Aug 2019 13:48:34 +0000 (16:48 +0300)]
EAP-TEAP server: Add support for requiring user and machine credentials
The new eap_teap_id=5 hostapd configuration parameter value can be used
to configure EAP-TEAP server to request and require user and machine
credentials within the tunnel. This can be done either with Basic
Password Authentication or with inner EAP authentication methods.
Jouni Malinen [Fri, 23 Aug 2019 21:14:41 +0000 (00:14 +0300)]
tests: Import helper functions directly from utils.py
These were moved from test_sae.py to utils.py, so import them from the
correct location instead of through test_sae.py that imports them from
utils.py.
Jouni Malinen [Thu, 22 Aug 2019 19:14:47 +0000 (22:14 +0300)]
wlantest: Derive PMK-R1 and PTK for FT protocol cases
Track PMK-R0/PMK-R0-Name from the initial mobility domain association
and derive PMK-R1/PTK when the station uses FT protocol. This allows
frames from additional roaming cases to be decrypted.
Jouni Malinen [Tue, 20 Aug 2019 10:10:34 +0000 (13:10 +0300)]
EAP peer: Add a concept of a separate machine credential
This is an initial step in adding support for configuring separate user
and machine credentials. The new wpa_supplicant network profile
parameters machine_identity and machine_password are similar to the
existing identity and password, but explicitly assigned for the purpose
of machine authentication.
This commit alone does not change actual EAP peer method behavior as
separate commits are needed to determine when there is an explicit
request for machine authentication. Furthermore, this is only addressing
the username/password credential type, i.e., additional changes
following this design approach will be needed for certificate
credentials.
Jouni Malinen [Mon, 19 Aug 2019 23:57:58 +0000 (02:57 +0300)]
RADIUS server: Abort startup on allocation failures
Be more consistent on checking all parameter allocation and copying
steps within radius_server_init() and abort startup if anything fails
instead of trying to continue with other parts of the configuration.
Jouni Malinen [Mon, 19 Aug 2019 23:32:05 +0000 (02:32 +0300)]
RADIUS server: Use struct eap_config to avoid duplicated definitions
Use struct eap_config as-is within RADIUS server to avoid having to
duplicate all the configuration variables at each interface. This
continues cleanup on struct eap_config duplication in hostapd.
Jouni Malinen [Mon, 19 Aug 2019 23:11:31 +0000 (02:11 +0300)]
EAP-TEAP server: Fix Crypto-Binding check in PAC no-inner-auth case
The Crypto-Binding TLV is included without Intermediate-Result TLV in
this sequence since the server is skipping all inner authentication
methods and is only sending out Result TLV with the Crypto-Binding TLV.
Jouni Malinen [Mon, 19 Aug 2019 22:35:36 +0000 (01:35 +0300)]
EAP-TEAP peer: Support Identity-Type TLV
Parse the received Identity-Type TLV and report the used Identity-Type
in response if the request included this TLV. For now, only the
Identity-Type 1 (User) is supported.
Jouni Malinen [Mon, 19 Aug 2019 14:22:41 +0000 (17:22 +0300)]
tests: Make mbo_cell_capa_update_pmf more robust
Wait for hostapd to report completion of connection so that the WNM
Notification Request frame does not get sent before the AP has processed
EAPOL-Key msg 4/4 and configured the TK. This could result in a race
condition especially when testing using UML with time-travel.
Jouni Malinen [Sun, 18 Aug 2019 14:46:34 +0000 (17:46 +0300)]
tests: ap_wpa2_eap_too_many_roundtrips to use shorter fragment
This is needed with the increased maximum EAP round limit since the
server side sends out longer messages in this exchange and that prevent
the short message limit from being reached.
projects / thirdparty / hostap.git / log
