Allow TKIP support to be removed from build

Add a build flag CONFIG_NO_TKIP=y to remove all TKIP functionality from
hostapd and wpa_supplicant builds. This disables use of TKIP as both the
pairwise and group cipher. The end result does not interoperate with a
WPA(v1)-only device or WPA+WPA2 mixed modes.

Signed-off-by: Disha Das <dishad@codeaurora.org>

diff --git a/hostapd/Android.mk b/hostapd/Android.mk
index 0f05565014ccae9c8c257e9267fe70c06217305a..d47b64f4e0d379bdeb8795454f317cff1a211b86 100644 (file)
--- a/hostapd/Android.mk
+++ b/hostapd/Android.mk
@@ -314,6 +314,10 @@ ifdef CONFIG_WEP
 L_CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+L_CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 
 include $(LOCAL_PATH)/src/drivers/drivers.mk
 

diff --git a/hostapd/Makefile b/hostapd/Makefile
index 326e91b8c80dc306345b6ab024b02e740941159d..9475f2e84cc60068eb876f1e86fd4da6a7ece302 100644 (file)
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -1243,6 +1243,10 @@ ifdef CONFIG_WEP
 CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 ALL=hostapd hostapd_cli
 
 all: verify_config $(ALL)

diff --git a/hostapd/defconfig b/hostapd/defconfig
index 5133db26bbd5c76dd8c510e68a0ff6ecc7a6aa00..64f03bd84f4baa3841fe60aeedf8b3afb93c605d 100644 (file)
--- a/hostapd/defconfig
+++ b/hostapd/defconfig
@@ -388,3 +388,10 @@ CONFIG_IPV6=y
 # release under this optional build parameter. This functionality is subject to
 # be completely removed in a future release.
 #CONFIG_WEP=y
+
+# Remove all TKIP functionality
+# TKIP is an old cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used anymore. For now, the default hostapd
+# build includes this to allow mixed mode WPA+WPA2 networks to be enabled, but
+# that functionality is subject to be removed in the future.
+#CONFIG_NO_TKIP=y

diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 5bf4502b004fc8ef7c30c8072e3ecbf8bc752d56..35a32a13052812f93e4df586b975db3712e12a04 100644 (file)
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -74,8 +74,13 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
        bss->wpa_disable_eapol_key_retries =
                DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES;
        bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
+#ifdef CONFIG_NO_TKIP
+       bss->wpa_pairwise = WPA_CIPHER_CCMP;
+       bss->wpa_group = WPA_CIPHER_CCMP;
+#else /* CONFIG_NO_TKIP */
        bss->wpa_pairwise = WPA_CIPHER_TKIP;
        bss->wpa_group = WPA_CIPHER_TKIP;
+#endif /* CONFIG_NO_TKIP */
        bss->rsn_pairwise = 0;
 
        bss->max_num_sta = MAX_STA_COUNT;

diff --git a/src/ap/wps_hostapd.c b/src/ap/wps_hostapd.c
index 1d77b946e0051267de37bf871e6f408fc94b9a1c..dc8aa8f65de731465d323860f523095673eb1811 100644 (file)
--- a/src/ap/wps_hostapd.c
+++ b/src/ap/wps_hostapd.c
@@ -364,6 +364,13 @@ static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
                bss->ssid.ssid_set = 1;
        }
 
+#ifdef CONFIG_NO_TKIP
+       if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK |
+                              WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
+               bss->wpa = 2;
+       else
+               bss->wpa = 0;
+#else /* CONFIG_NO_TKIP */
        if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
            (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
                bss->wpa = 3;
@@ -373,6 +380,7 @@ static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
                bss->wpa = 1;
        else
                bss->wpa = 0;
+#endif /* CONFIG_NO_TKIP */
 
        if (bss->wpa) {
                if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA))
@@ -387,8 +395,10 @@ static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
                        else
                                bss->wpa_pairwise |= WPA_CIPHER_CCMP;
                }
+#ifndef CONFIG_NO_TKIP
                if (cred->encr_type & WPS_ENCR_TKIP)
                        bss->wpa_pairwise |= WPA_CIPHER_TKIP;
+#endif /* CONFIG_NO_TKIP */
                bss->rsn_pairwise = bss->wpa_pairwise;
                bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa,
                                                            bss->wpa_pairwise,
@@ -559,6 +569,13 @@ static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
                fprintf(nconf, "\n");
        }
 
+#ifdef CONFIG_NO_TKIP
+       if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK |
+                              WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
+               wpa = 2;
+       else
+               wpa = 0;
+#else /* CONFIG_NO_TKIP */
        if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
            (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
                wpa = 3;
@@ -568,6 +585,7 @@ static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
                wpa = 1;
        else
                wpa = 0;
+#endif /* CONFIG_NO_TKIP */
 
        if (wpa) {
                char *prefix;
@@ -611,9 +629,11 @@ static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
 
                        prefix = " ";
                }
+#ifndef CONFIG_NO_TKIP
                if (cred->encr_type & WPS_ENCR_TKIP) {
                        fprintf(nconf, "%sTKIP", prefix);
                }
+#endif /* CONFIG_NO_TKIP */
                fprintf(nconf, "\n");
 
                if (cred->key_len >= 8 && cred->key_len < 64) {
@@ -1160,12 +1180,24 @@ int hostapd_init_wps(struct hostapd_data *hapd,
                        wps->encr_types_rsn |= WPS_ENCR_AES;
                }
                if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
+#ifdef CONFIG_NO_TKIP
+                       wpa_printf(MSG_INFO, "WPS: TKIP not supported");
+                       goto fail;
+#else /* CONFIG_NO_TKIP */
                        wps->encr_types |= WPS_ENCR_TKIP;
                        wps->encr_types_rsn |= WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
                }
        }
 
        if (conf->wpa & WPA_PROTO_WPA) {
+#ifdef CONFIG_NO_TKIP
+               if (!(conf->wpa & WPA_PROTO_RSN)) {
+                       wpa_printf(MSG_INFO, "WPS: WPA(v1) not supported");
+                       goto fail;
+               }
+               conf->wpa &= ~WPA_PROTO_WPA;
+#else /* CONFIG_NO_TKIP */
                if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
                        wps->auth_types |= WPS_AUTH_WPAPSK;
                if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
@@ -1179,6 +1211,7 @@ int hostapd_init_wps(struct hostapd_data *hapd,
                        wps->encr_types |= WPS_ENCR_TKIP;
                        wps->encr_types_wpa |= WPS_ENCR_TKIP;
                }
+#endif /* CONFIG_NO_TKIP */
        }
 
        if (conf->ssid.security_policy == SECURITY_PLAINTEXT) {
@@ -1218,10 +1251,17 @@ int hostapd_init_wps(struct hostapd_data *hapd,
        wps->ap_encr_type = wps->encr_types;
        if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) {
                /* Override parameters to enable security by default */
+#ifdef CONFIG_NO_TKIP
+               wps->auth_types = WPS_AUTH_WPA2PSK;
+               wps->encr_types = WPS_ENCR_AES;
+               wps->encr_types_rsn = WPS_ENCR_AES;
+               wps->encr_types_wpa = WPS_ENCR_AES;
+#else /* CONFIG_NO_TKIP */
                wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
                wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
                wps->encr_types_rsn = WPS_ENCR_AES | WPS_ENCR_TKIP;
                wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
        }
 
        if ((hapd->conf->multi_ap & FRONTHAUL_BSS) &&
@@ -1801,8 +1841,10 @@ int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid,
 
        if (os_strncmp(auth, "OPEN", 4) == 0)
                cred.auth_type = WPS_AUTH_OPEN;
+#ifndef CONFIG_NO_TKIP
        else if (os_strncmp(auth, "WPAPSK", 6) == 0)
                cred.auth_type = WPS_AUTH_WPAPSK;
+#endif /* CONFIG_NO_TKIP */
        else if (os_strncmp(auth, "WPA2PSK", 7) == 0)
                cred.auth_type = WPS_AUTH_WPA2PSK;
        else
@@ -1811,8 +1853,10 @@ int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid,
        if (encr) {
                if (os_strncmp(encr, "NONE", 4) == 0)
                        cred.encr_type = WPS_ENCR_NONE;
+#ifndef CONFIG_NO_TKIP
                else if (os_strncmp(encr, "TKIP", 4) == 0)
                        cred.encr_type = WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
                else if (os_strncmp(encr, "CCMP", 4) == 0)
                        cred.encr_type = WPS_ENCR_AES;
                else

diff --git a/src/common/wpa_common.c b/src/common/wpa_common.c
index 1284743023c6b86de47bc39404541432ab8c1301..46b647bcd05ec39399d7d4b4500767d1bcb2c7e8 100644 (file)
--- a/src/common/wpa_common.c
+++ b/src/common/wpa_common.c
@@ -2319,11 +2319,18 @@ enum wpa_alg wpa_cipher_to_alg(int cipher)
 
 int wpa_cipher_valid_pairwise(int cipher)
 {
+#ifdef CONFIG_NO_TKIP
+       return cipher == WPA_CIPHER_CCMP_256 ||
+               cipher == WPA_CIPHER_GCMP_256 ||
+               cipher == WPA_CIPHER_CCMP ||
+               cipher == WPA_CIPHER_GCMP;
+#else /* CONFIG_NO_TKIP */
        return cipher == WPA_CIPHER_CCMP_256 ||
                cipher == WPA_CIPHER_GCMP_256 ||
                cipher == WPA_CIPHER_CCMP ||
                cipher == WPA_CIPHER_GCMP ||
                cipher == WPA_CIPHER_TKIP;
+#endif /* CONFIG_NO_TKIP */
 }
 
 
@@ -2476,8 +2483,10 @@ int wpa_parse_cipher(const char *value)
                        val |= WPA_CIPHER_CCMP;
                else if (os_strcmp(start, "GCMP") == 0)
                        val |= WPA_CIPHER_GCMP;
+#ifndef CONFIG_NO_TKIP
                else if (os_strcmp(start, "TKIP") == 0)
                        val |= WPA_CIPHER_TKIP;
+#endif /* CONFIG_NO_TKIP */
 #ifdef CONFIG_WEP
                else if (os_strcmp(start, "WEP104") == 0)
                        val |= WPA_CIPHER_WEP104;

diff --git a/src/common/wpa_common.h b/src/common/wpa_common.h
index da58159e4316be107d4b854e169660b799e10344..c0ef689c68e0a0493ca7d815dc01639e4ae6f4a9 100644 (file)
--- a/src/common/wpa_common.h
+++ b/src/common/wpa_common.h
@@ -22,6 +22,15 @@
 
 #define OWE_DH_GROUP 19
 
+#ifdef CONFIG_NO_TKIP
+#define WPA_ALLOWED_PAIRWISE_CIPHERS \
+(WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_NONE | \
+WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256)
+#define WPA_ALLOWED_GROUP_CIPHERS \
+(WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | \
+WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256 | \
+WPA_CIPHER_GTK_NOT_USED)
+#else /* CONFIG_NO_TKIP */
 #define WPA_ALLOWED_PAIRWISE_CIPHERS \
 (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_TKIP | WPA_CIPHER_NONE | \
 WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256)
@@ -29,6 +38,7 @@ WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256)
 (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP | WPA_CIPHER_TKIP | \
 WPA_CIPHER_GCMP_256 | WPA_CIPHER_CCMP_256 | \
 WPA_CIPHER_GTK_NOT_USED)
+#endif /* CONFIG_NO_TKIP */
 #define WPA_ALLOWED_GROUP_MGMT_CIPHERS \
 (WPA_CIPHER_AES_128_CMAC | WPA_CIPHER_BIP_GMAC_128 | WPA_CIPHER_BIP_GMAC_256 | \
 WPA_CIPHER_BIP_CMAC_256)

diff --git a/src/wps/wps_attr_build.c b/src/wps/wps_attr_build.c
index 5ec7133afc3302d4facc289e43160f12529aface..f3722567611c03ebf3bff9377b51562601f9114b 100644 (file)
--- a/src/wps/wps_attr_build.c
+++ b/src/wps/wps_attr_build.c
@@ -310,6 +310,9 @@ int wps_build_auth_type_flags(struct wps_data *wps, struct wpabuf *msg)
        auth_types &= ~WPS_AUTH_WPA;
        auth_types &= ~WPS_AUTH_WPA2;
        auth_types &= ~WPS_AUTH_SHARED;
+#ifdef CONFIG_NO_TKIP
+       auth_types &= ~WPS_AUTH_WPAPSK;
+#endif /* CONFIG_NO_TKIP */
 #ifdef CONFIG_WPS_TESTING
        if (wps_force_auth_types_in_use) {
                wpa_printf(MSG_DEBUG,
@@ -331,6 +334,9 @@ int wps_build_encr_type_flags(struct wps_data *wps, struct wpabuf *msg)
 {
        u16 encr_types = WPS_ENCR_TYPES;
        encr_types &= ~WPS_ENCR_WEP;
+#ifdef CONFIG_NO_TKIP
+       encr_types &= ~WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
 #ifdef CONFIG_WPS_TESTING
        if (wps_force_encr_types_in_use) {
                wpa_printf(MSG_DEBUG,

diff --git a/src/wps/wps_enrollee.c b/src/wps/wps_enrollee.c
index 80ed603fc3847a5541a0fec2e60a30889d66bf6f..819cd43f6afdb4f942aa9d6944687f639ebac56f 100644 (file)
--- a/src/wps/wps_enrollee.c
+++ b/src/wps/wps_enrollee.c
@@ -880,6 +880,17 @@ static int wps_process_ap_settings_e(struct wps_data *wps,
                cred.auth_type |= WPS_AUTH_WPA2PSK;
        }
 
+#ifdef CONFIG_NO_TKIP
+       if (cred.encr_type & WPS_ENCR_TKIP) {
+               wpa_printf(MSG_DEBUG, "WPS: Disable encr_type TKIP");
+               cred.encr_type &= ~WPS_ENCR_TKIP;
+       }
+       if (cred.auth_type & WPS_AUTH_WPAPSK) {
+               wpa_printf(MSG_DEBUG, "WPS: Disable auth_type WPAPSK");
+               cred.auth_type &= ~WPS_AUTH_WPAPSK;
+       }
+#endif /* CONFIG_NO_TKIP */
+
        if (wps->wps->cred_cb) {
                cred.cred_attr = wpabuf_head(attrs);
                cred.cred_attr_len = wpabuf_len(attrs);

diff --git a/src/wps/wps_registrar.c b/src/wps/wps_registrar.c
index 9ee89ae340a328c5ae09d4f5e7e331963ebe9942..9e1ee36da890958a6b8f58d21b690504205a7e9f 100644 (file)
--- a/src/wps/wps_registrar.c
+++ b/src/wps/wps_registrar.c
@@ -1677,8 +1677,10 @@ int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
                   wps->wps->auth_types, wps->auth_type);
        if (wps->auth_type & WPS_AUTH_WPA2PSK)
                wps->auth_type = WPS_AUTH_WPA2PSK;
+#ifndef CONFIG_NO_TKIP
        else if (wps->auth_type & WPS_AUTH_WPAPSK)
                wps->auth_type = WPS_AUTH_WPAPSK;
+#endif /* CONFIG_NO_TKIP */
        else if (wps->auth_type & WPS_AUTH_OPEN)
                wps->auth_type = WPS_AUTH_OPEN;
        else {
@@ -1700,8 +1702,10 @@ int wps_build_cred(struct wps_data *wps, struct wpabuf *msg)
            wps->auth_type == WPS_AUTH_WPAPSK) {
                if (wps->encr_type & WPS_ENCR_AES)
                        wps->encr_type = WPS_ENCR_AES;
+#ifndef CONFIG_NO_TKIP
                else if (wps->encr_type & WPS_ENCR_TKIP)
                        wps->encr_type = WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
                else {
                        wpa_printf(MSG_DEBUG, "WPS: No suitable encryption "
                                   "type for WPA/WPA2");

diff --git a/wpa_supplicant/Android.mk b/wpa_supplicant/Android.mk
index e44b366b5b3062f54fea4ab6ed310087d42b69a3..a08da4d64423cabaa222671b2dfa5fa593ad6644 100644 (file)
--- a/wpa_supplicant/Android.mk
+++ b/wpa_supplicant/Android.mk
@@ -387,6 +387,10 @@ ifdef CONFIG_WEP
 L_CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+L_CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 
 include $(LOCAL_PATH)/src/drivers/drivers.mk
 

diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 6138a3120c39e9f3f27cb8df6f4d2c19ebbbcca1..7a02027e20912fdeb8e11aec69a91f621f1b1623 100644 (file)
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1852,6 +1852,10 @@ ifdef CONFIG_WEP
 CFLAGS += -DCONFIG_WEP
 endif
 
+ifdef CONFIG_NO_TKIP
+CFLAGS += -DCONFIG_NO_TKIP
+endif
+
 ifndef LDO
 LDO=$(CC)
 endif

diff --git a/wpa_supplicant/config_ssid.h b/wpa_supplicant/config_ssid.h
index 979f868e3374d669fb8a9bd4e3d5de59276529b8..1e2c322686de5202872a85342d73a496cafea37e 100644 (file)
--- a/wpa_supplicant/config_ssid.h
+++ b/wpa_supplicant/config_ssid.h
@@ -19,8 +19,13 @@
                             EAPOL_FLAG_REQUIRE_KEY_BROADCAST)
 #define DEFAULT_PROTO (WPA_PROTO_WPA | WPA_PROTO_RSN)
 #define DEFAULT_KEY_MGMT (WPA_KEY_MGMT_PSK | WPA_KEY_MGMT_IEEE8021X)
+#ifdef CONFIG_NO_TKIP
+#define DEFAULT_PAIRWISE (WPA_CIPHER_CCMP)
+#define DEFAULT_GROUP (WPA_CIPHER_CCMP)
+#else /* CONFIG_NO_TKIP */
 #define DEFAULT_PAIRWISE (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
 #define DEFAULT_GROUP (WPA_CIPHER_CCMP | WPA_CIPHER_TKIP)
+#endif /* CONFIG_NO_TKIP */
 #define DEFAULT_FRAGMENT_SIZE 1398
 
 #define DEFAULT_BG_SCAN_PERIOD -1

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index ae7cc8f6a6dfca84193cdc7e8f548088f3b80923..13e2f41a9c17f6794243a24118d8a80b9576650c 100644 (file)
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -3959,7 +3959,9 @@ static const struct cipher_info ciphers[] = {
        { WPA_DRIVER_CAPA_ENC_GCMP_256, "GCMP-256", 0 },
        { WPA_DRIVER_CAPA_ENC_CCMP, "CCMP", 0 },
        { WPA_DRIVER_CAPA_ENC_GCMP, "GCMP", 0 },
+#ifndef CONFIG_NO_TKIP
        { WPA_DRIVER_CAPA_ENC_TKIP, "TKIP", 0 },
+#endif /* CONFIG_NO_TKIP */
        { WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE, "NONE", 0 },
 #ifdef CONFIG_WEP
        { WPA_DRIVER_CAPA_ENC_WEP104, "WEP104", 1 },
@@ -3990,7 +3992,11 @@ static int ctrl_iface_get_capability_pairwise(int res, char *strict,
        if (res < 0) {
                if (strict)
                        return 0;
+#ifdef CONFIG_NO_TKIP
+               len = os_strlcpy(buf, "CCMP NONE", buflen);
+#else /* CONFIG_NO_TKIP */
                len = os_strlcpy(buf, "CCMP TKIP NONE", buflen);
+#endif /* CONFIG_NO_TKIP */
                if (len >= buflen)
                        return -1;
                return len;
@@ -4027,9 +4033,17 @@ static int ctrl_iface_get_capability_group(int res, char *strict,
                if (strict)
                        return 0;
 #ifdef CONFIG_WEP
+#ifdef CONFIG_NO_TKIP
+               len = os_strlcpy(buf, "CCMP WEP104 WEP40", buflen);
+#else /* CONFIG_NO_TKIP */
                len = os_strlcpy(buf, "CCMP TKIP WEP104 WEP40", buflen);
+#endif /* CONFIG_NO_TKIP */
 #else /* CONFIG_WEP */
+#ifdef CONFIG_NO_TKIP
+               len = os_strlcpy(buf, "CCMP", buflen);
+#else /* CONFIG_NO_TKIP */
                len = os_strlcpy(buf, "CCMP TKIP", buflen);
+#endif /* CONFIG_NO_TKIP */
 #endif /* CONFIG_WEP */
                if (len >= buflen)
                        return -1;

diff --git a/wpa_supplicant/dbus/dbus_new.c b/wpa_supplicant/dbus/dbus_new.c
index e9e77bd182a05f44dcde71823648d0fbad38c12f..793a881efb0edbdc4549765e51d70015578228e3 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new.c
+++ b/wpa_supplicant/dbus/dbus_new.c
@@ -750,10 +750,12 @@ void wpas_dbus_signal_wps_cred(struct wpa_supplicant *wpa_s,
 
        if (cred->auth_type & WPS_AUTH_OPEN)
                auth_type[at_num++] = "open";
+#ifndef CONFIG_NO_TKIP
        if (cred->auth_type & WPS_AUTH_WPAPSK)
                auth_type[at_num++] = "wpa-psk";
        if (cred->auth_type & WPS_AUTH_WPA)
                auth_type[at_num++] = "wpa-eap";
+#endif /* CONFIG_NO_TKIP */
        if (cred->auth_type & WPS_AUTH_WPA2)
                auth_type[at_num++] = "wpa2-eap";
        if (cred->auth_type & WPS_AUTH_WPA2PSK)
@@ -761,8 +763,10 @@ void wpas_dbus_signal_wps_cred(struct wpa_supplicant *wpa_s,
 
        if (cred->encr_type & WPS_ENCR_NONE)
                encr_type[et_num++] = "none";
+#ifndef CONFIG_NO_TKIP
        if (cred->encr_type & WPS_ENCR_TKIP)
                encr_type[et_num++] = "tkip";
+#endif /* CONFIG_NO_TKIP */
        if (cred->encr_type & WPS_ENCR_AES)
                encr_type[et_num++] = "aes";
 

diff --git a/wpa_supplicant/dbus/dbus_new_handlers.c b/wpa_supplicant/dbus/dbus_new_handlers.c
index 4e17e31a70915cf24a4f16ac6b337c28197a2ea4..d1f9607c602d16da46e46618cd7135b3a8c92db7 100644 (file)
--- a/wpa_supplicant/dbus/dbus_new_handlers.c
+++ b/wpa_supplicant/dbus/dbus_new_handlers.c
@@ -2632,7 +2632,11 @@ dbus_bool_t wpas_dbus_getter_capabilities(
 
        /***** pairwise cipher */
        if (res < 0) {
+#ifdef CONFIG_NO_TKIP
+               const char *args[] = {"ccmp", "none"};
+#else /* CONFIG_NO_TKIP */
                const char *args[] = {"ccmp", "tkip", "none"};
+#endif /* CONFIG_NO_TKIP */
 
                if (!wpa_dbus_dict_append_string_array(
                            &iter_dict, "Pairwise", args,
@@ -2655,9 +2659,11 @@ dbus_bool_t wpas_dbus_getter_capabilities(
                    ((capa.enc & WPA_DRIVER_CAPA_ENC_GCMP) &&
                     !wpa_dbus_dict_string_array_add_element(
                             &iter_array, "gcmp")) ||
+#ifndef CONFIG_NO_TKIP
                    ((capa.enc & WPA_DRIVER_CAPA_ENC_TKIP) &&
                     !wpa_dbus_dict_string_array_add_element(
                             &iter_array, "tkip")) ||
+#endif /* CONFIG_NO_TKIP */
                    ((capa.key_mgmt & WPA_DRIVER_CAPA_KEY_MGMT_WPA_NONE) &&
                     !wpa_dbus_dict_string_array_add_element(
                             &iter_array, "none")) ||
@@ -2671,7 +2677,10 @@ dbus_bool_t wpas_dbus_getter_capabilities(
        /***** group cipher */
        if (res < 0) {
                const char *args[] = {
-                       "ccmp", "tkip",
+                       "ccmp",
+#ifndef CONFIG_NO_TKIP
+                       "tkip",
+#endif /* CONFIG_NO_TKIP */
 #ifdef CONFIG_WEP
                        "wep104", "wep40"
 #endif /* CONFIG_WEP */
@@ -2698,9 +2707,11 @@ dbus_bool_t wpas_dbus_getter_capabilities(
                    ((capa.enc & WPA_DRIVER_CAPA_ENC_GCMP) &&
                     !wpa_dbus_dict_string_array_add_element(
                             &iter_array, "gcmp")) ||
+#ifndef CONFIG_NO_TKIP
                    ((capa.enc & WPA_DRIVER_CAPA_ENC_TKIP) &&
                     !wpa_dbus_dict_string_array_add_element(
                             &iter_array, "tkip")) ||
+#endif /* CONFIG_NO_TKIP */
 #ifdef CONFIG_WEP
                    ((capa.enc & WPA_DRIVER_CAPA_ENC_WEP104) &&
                     !wpa_dbus_dict_string_array_add_element(
@@ -4759,9 +4770,11 @@ static dbus_bool_t wpas_dbus_get_bss_security_prop(
                group = "wep104";
                break;
 #endif /* CONFIG_WEP */
+#ifndef CONFIG_NO_TKIP
        case WPA_CIPHER_TKIP:
                group = "tkip";
                break;
+#endif /* CONFIG_NO_TKIP */
        case WPA_CIPHER_CCMP:
                group = "ccmp";
                break;
@@ -4784,8 +4797,10 @@ static dbus_bool_t wpas_dbus_get_bss_security_prop(
 
        /* Pairwise */
        n = 0;
+#ifndef CONFIG_NO_TKIP
        if (ie_data->pairwise_cipher & WPA_CIPHER_TKIP)
                pairwise[n++] = "tkip";
+#endif /* CONFIG_NO_TKIP */
        if (ie_data->pairwise_cipher & WPA_CIPHER_CCMP)
                pairwise[n++] = "ccmp";
        if (ie_data->pairwise_cipher & WPA_CIPHER_GCMP)

diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
index a87b5862082ba84e0fe6310958a2f8d78409421d..cbe49c8ec0736ac77d6126ee210f1aee7a0822dc 100644 (file)
--- a/wpa_supplicant/defconfig
+++ b/wpa_supplicant/defconfig
@@ -611,3 +611,12 @@ CONFIG_DPP=y
 # release under this optional build parameter. This functionality is subject to
 # be completely removed in a future release.
 #CONFIG_WEP=y
+
+# Remove all TKIP functionality
+# TKIP is an old cryptographic data confidentiality algorithm that is not
+# considered secure. It should not be used anymore for anything else than a
+# backwards compatibility option as a group cipher when connecting to APs that
+# use WPA+WPA2 mixed mode. For now, the default wpa_supplicant build includes
+# support for this by default, but that functionality is subject to be removed
+# in the future.
+#CONFIG_NO_TKIP=y

diff --git a/wpa_supplicant/wps_supplicant.c b/wpa_supplicant/wps_supplicant.c
index a10c34cf0eb9fe6316e54f9c3b4da7fe22b40538..d34e059a83fd5f0d6707a1b7f07036645af5ec7a 100644 (file)
--- a/wpa_supplicant/wps_supplicant.c
+++ b/wpa_supplicant/wps_supplicant.c
@@ -1618,8 +1618,13 @@ int wpas_wps_init(struct wpa_supplicant *wpa_s)
        os_memcpy(wps->dev.mac_addr, wpa_s->own_addr, ETH_ALEN);
        wpas_wps_set_uuid(wpa_s, wps);
 
+#ifdef CONFIG_NO_TKIP
+       wps->auth_types = WPS_AUTH_WPA2PSK;
+       wps->encr_types = WPS_ENCR_AES;
+#else /* CONFIG_NO_TKIP */
        wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
        wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
+#endif /* CONFIG_NO_TKIP */
 
        os_memset(&rcfg, 0, sizeof(rcfg));
        rcfg.new_psk_cb = wpas_wps_new_psk_cb;