hostapd: Maintain single wpa_driver_nl80211_data (drv) object across interfaces
Currently, the first BSS of each hostapd interface (struct hostapd_iface)
creates a new driver data object (struct wpa_driver_nl80211_data, referred
to as drv). When a non-first BSS of an interface initializes, it copies the
drv_priv and thus uses the first BSS’s drv object. This can lead to
situations where multiple drv objects are maintained for the same
underlying hardware in hostapd.
Some of such situations are:
1. Two different configs for two different wlanX interface but on the
same underlying radio. In this case, two drv objects will be
maintained.
2. MLO case - 5 GHz config having two BSS. 6 GHz config having one BSS.
5 GHz's second BSS is partnering with 6 GHz's BSS and forming MLD.
And 6 GHz config is enabled first and then 5 GHz. In this case, two
different driver instance will be maintained - one having 5 GHz BSS
and other having 5 GHz + 6 GHz MLO BSS. To visualize this:
Assumption: Only 1 phy (say phy0 exist on system). On this phy, the driver
has grouped both 5 GHz and 6 GHz underlying radio as a single
radio.
Config:
+--------------------+ +------------------+
| 5 GHz config | | 6 GHz config |
| | | |
| | | |
| +----------------+ | | |
| | BSS 1 | | | |
| | ssid: guest_ap | | | |
| +----------------+ | | |
| | | |
+------------------------------------------------------------------+
| | +----------------+ | | +--------------+ | |
| | | BSS 2 | | | | BSS 1 | | |
| | | ssid: mlo_ap | | | | ssid: mlo_ap | | 2 Link MLO AP |
| | +----------------+ | | +--------------+ | |
| +--------------------+ +------------------+ |
+------------------------------------------------------------------+
With this change, it will behave as per the expectation.
3. Three different underlying hardwares - 2.4 GHz, 5 GHz, 6 GHz, capable
of three different bands and they are grouped together and advertised
as single hardware supporting all bands to upper layer. In this case,
if one interface (wlanX) is enabled in each hardware (three
independent configs) three different drv will be maintained.
Because of this, at times during de-initialization, proper
deinitialization will not happen and WPA_TRACE could be seen:
Also, for situation #3, during handling of incoming NL commands, the
above is causing issue in routing the events. This is because since all
underlying hardwares are part of same phy, phy index is same in all the
drv objects. Hence when the event comes, it will be given to the first
drv which might not be having the intended BSS. For example, 5 GHz DFS
events (which does not have if_idx). The event can be passed to driver
having 2.4 GHz's BSS or 6 GHz's depending upon which was enabled first.
Hence to avoid these situations, try to maintain single drv object as
much as possible.
Liangwei Dong [Tue, 26 Nov 2024 09:50:38 +0000 (17:50 +0800)]
Add a vendor attribute to disable DFS owner capability
Add a u8 attribute QCA_WLAN_VENDOR_ATTR_CONFIG_DFS_OWNER_DISABLE to
disable DFS owner capability dynamically:
1: disable DFS owner capability in the driver.
0: reset DFS owner capability to the default DFS owner capability of
the driver.
If DFS owner capability is disabled, the driver will not start AP mode
operations on DFS channels, and all the features depending on DFS owner
functionality will not be supported.
Kashish Awasthi [Thu, 28 Nov 2024 06:15:32 +0000 (11:45 +0530)]
Add new QCA vendor attributes for TWT session updatability
Add the following new QCA vendor attributes to set whether
the TWT session is implicit and can be updated:
QCA_WLAN_VENDOR_ATTR_TWT_SETUP_UPDATABLE
QCA_WLAN_VENDOR_ATTR_TWT_SETUP_IMPLICIT
Hu Wang [Thu, 7 Nov 2024 07:00:03 +0000 (23:00 -0800)]
QCA vendor attribute to configure operating type for monitor mode
Extend monitor mode configuration from commit 1518638b70 ("QCA vendor
command to configure the parameters for monitor mode") to allow
monitoring operating type to be configured.
Yuvarani V [Mon, 23 Sep 2024 14:27:27 +0000 (19:57 +0530)]
AP MLD: Fix max number of simultaneous links in MLE during CAC
The Maximum Number Of Simultaneous Links field in MLD Capabilities And
Operations subfield in MLE is currently advertised as `num_links - 1`,
where `num_links` is the number of links added to the AP MLD. However,
when the 5 GHz band link is waiting for CAC timeout, this results in an
incorrect value being advertised for the maximum number of simultaneous
links in MLE, as the 5 GHz link is not active.
For example, an AP MLD with 3 links (2.4 GHz, 5 GHz (waiting for CAC
timeout), and 6 GHz) during bringup has `num_links` set to 3.
Consequently, the maximum number of simultaneous links in MLE is
advertised as 2 according to the current code, despite the 5 GHz link
being in CAC timeout. The field should have been set to 1 to indicate
maximum of 2 links.
Fix this issue by determining the number of currently active links of
the AP MLD (instead of hapd->num_links which may include currently
inactive links) and use it to set the value for the maximum number of
simultaneous links in MLE.
Signed-off-by: Yuvarani V <quic_yuvarani@quicinc.com>
Jouni Malinen [Sat, 30 Nov 2024 09:51:44 +0000 (11:51 +0200)]
tests: Make autogo_interworking more robust
Clear scan cache to avoid issues with older BSS entries with the same
BSSID from causing test failures due to not finding the expected
Interworking element.
AP: Fix dangling pointer access during 6 GHz NO_IR channel list update
Whenever the channel list change event is received along with regulatory
domain set initiated by the driver for the 6 GHz band, memory is
reallocated for new hw modes to update the no_ir channel list, but the
interface current_mode pointer is still referring the old memory
allocation which can cause a dangling pointer access and crash.
Use locally allocated data to update the no_ir channel list to avoid
this and later regdomain changes are properly updated using setup
interface subroutine.
Fixes: 0837863fbc62 ("AP: Handle 6 GHz AP state machine with NO_IR flags") Signed-off-by: Govindaraj Saminathan <quic_gsaminat@quicinc.com>
Amith A [Fri, 30 Aug 2024 04:36:59 +0000 (10:06 +0530)]
Force a global operating class to be used with Wi-Fi Agile Multiband
Wi-Fi Agile Multiband spec requires the AP to set the last octet of the
Country String to 0x04, i.e., to use a global operating class from Table
E-4. Enforce this similarly to the way the 6 GHz case was already done.
Signed-off-by: Amith A <quic_amitajit@quicinc.com>
SAE: Reject association for no PMKID match only for PMKSA caching
Authenticator needs to have a PMKSA corresponding to a PMKID (if
present) included by the STA in (Re)Association Request frame if PMKSA
caching is attempted to be used. In case of SAE, this follows Open
System authentication. IEEE Std 802.11 mandates the AP to reject
(re)association trying to use PMKSA caching for SAE authentication.
While the PMKID (if any) in the RSNE in (Re)Association Request frame
following SAE authentication (i.e., in the case of no PMKSA caching) is
not really supposed to include an unknown PMKID, the standard does not
require the AP to reject association. The PMKSA that was just derived
using SAE authentication can be used regardless of which PMKID(s) are
indicated in the (Re)Association Request frame.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
Arunpandi Kannan [Tue, 28 May 2024 12:42:48 +0000 (18:12 +0530)]
DPP: Deinit Configurator process if Config Requst is not received
After DPP authentication success, if the Configurator did not receive
the Config Request (GAS query request) due to some reason (e.g., a frame
is lost over the air or Enrollee abandoned the DPP process), it would
have waited indefinitely in the same auth process, as there is no
timeout function running to clear the existing DPP process. Due to this
the subsequent DPP authentication requests gets rejected.
Terminate the DPP process, if no Config Request is received within ten
seconds after successful completion of the DPP authentication exchange.
Ajith C [Tue, 3 Sep 2024 05:09:05 +0000 (10:39 +0530)]
AP MLD: Fix crash during config reload from non-ML to ML
When an AP switches from a non-ML to an ML configuration, hostapd
crashes. The crash occurs because the memory allocation for the 'mld'
structure happens only during the AP’s startup if the 'mld_ap' option is
enabled. Consequently, when hostapd transitions from a non-ML to an ML
configuration, the MLD structure’s memory remains unallocated, leading
to a crash when accessed.
Fix this by initiating hostapd_init() whenever the AP transitions
between ML and non-ML configurations to ensure proper memory allocation
for the MLD structure.
AP: Handle (Re)Association Response frame if rsn_override_omit_rsnxe is set
When rsn_override_omit_rsnxe is set, exclude the RSNXE from the IE
template that is configured to the drivers that generate (Re)Association
Response frame internally. This was previously done only for the case of
hostapd generated (Re)Association Response frames.
Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
P2P: Avoid infinite loop with radio_remove_works(p2p-listen)
Commit 3242793cb8df ("P2P: Remove pending p2p-listen radio work on
stopping listen") added removal of all pending p2p-listen radio works
when P2P listen is stopped. It looks like there is a possible code path
that results in wpas_p2p_listen_work_done() not being able to mark the
possibly pending and already started p2p-listen radio work completed.
It is not clear what exactly could cause this, but if something manages
to clear wpa_s->p2p_listen_work, this could happen. Theoretically,
having two started p2p-listen works might also cause something like
this, but that should not happen either. In any case, if this happens,
the call to radio_remove_works() from wpas_stop_listen() would end up
calling the radio work callback handler (i.e., wpas_start_listen_cb() in
this case) to deinit the work for the same work multiple times and if
that radio work item has been started, this would result in a recursive
call back to wpas_stop_listen() and infinite recursion killing the
process.
Even though the desired fix would be to get rid of whatever ends up
messing up wpa_s->p2p_listen_work, it is not clear what that could be.
Regardless, since this has show up in testing, recover from this cleanly
without hitting infinite recursion.
Pavithra Ganesan [Mon, 11 Nov 2024 03:42:21 +0000 (09:12 +0530)]
AP MLD: Remove common elements from per STA profile
Even when an element and its contents in the reported link match those
in the reporting link, the element was still added to the per-STA
profile of the reported link. This occurs because the parsed bitmap is
not updated when a match is found, resulting in the element being added
later. This results in per STA profile carrying extra information which
it should not.
Fix this issue by updating the parsed element ID bitmap accordingly.
Fixes: b5359d01ed55 ("AP MLD: Intersect per STA profile with the reporting BSS") Signed-off-by: Pavithra Ganesan <quic_pavigane@quicinc.com> Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
AP MLD: Send EML capabilities of an ML station to the driver
When EMLSR is enabled for an ML association, the EML capabilities
advertised by an ML station needs to be updated to the driver to enable
EMLSR operation and to transmit and receive initial Control frame and
Data frames.
Send EML capabilities advertised by an ML station during association to
the underlying driver via the NL80211_ATTR_EML_CAPABILITY attribute.
AP MLD: Add NULL check for mld pointer during MLD link removal
MLD control interface creation failed randomly because the existing
control interface was not properly cleaned up. During the failure case
handling, the memory allocated for hapd->mld is freed in
hostapd_bss_setup_multi_link(). Subsequently, when performing MLD link
removal during the interface down, hostapd_mld_remove_link() attempts to
access the mld pointer without NULL check, causing a segmentation fault.
To prevent this issue, add a validation to check if the mld pointer
is NULL before accessing it.
AP MLD: Remove unnecessary wpa_group get and put for ML cases
Remove unnecessary wpa_group_get() and wpa_group_put() calls where the
arguments are ML wpa_auth and wpa_auth->group, which are bound to be
no-op since such cases are not icluded in the references counter.
In practice, this reverts the third item listed in the commit message
for commit 3ea7cf11db4a ("AP MLD: Enhance authenticator state machine").
Signed-off-by: Adil Saeed Musthafa <quic_adilm@quicinc.com>
AP MLD: Remove unnecessary outer for loop in authorizing ML STA
Remove unnecessary outer for loop in ieee802_1x_ml_set_sta_authorized().
The inner for loop in this function is what actually iterates over the
partner links. The outer for loop did not have any relevance. Fix this.
Signed-off-by: Adil Saeed Musthafa <quic_adilm@quicinc.com>
Shivani Baranwal [Sat, 31 Aug 2024 16:51:26 +0000 (22:21 +0530)]
P2P2: Set P2P mode (R1 vs. R2) in the driver
Add support to set P2P mode in which P2P interface should be brought up.
It has Wi-Fi Direct R1 only mode, Wi-Fi Direct R2 only mode, and P2P
connection compatibility mode which support both R1 and R2. PCC mode is
applicable only for the Group Owner.
For now, this can be configured only with a QCA vendor command.
Shivani Baranwal [Thu, 10 Oct 2024 15:16:42 +0000 (20:46 +0530)]
P2P2: P2P connection compatibility mode with RSN overriding
P2P2 GO supporting PCC mode operates in WPA3-Personal Compatibility Mode
and allows both P2P2 (WFD-R2) and WFD-R1 clients to connect. P2P2
clients that support RSN overriding will connect with WPA3 SAE
authentication, while the legacy clients connect with WPA2-PSK.
Aditya Kodukula [Mon, 4 Nov 2024 18:19:09 +0000 (10:19 -0800)]
Add new QCA vendor attributes for TWT setup parameters
Add downlink and uplink TID vendor attributes to enum
qca_wlan_vendor_attr_twt_setup for setting up restricted TWT schedules.
Extend the range of Broadcast TWT Recommendation field values to include
the new value 4 defined in IEEE P802.11be/D7.0.
Jouni Malinen [Wed, 20 Nov 2024 11:11:45 +0000 (13:11 +0200)]
P2P: Clear wpa_s->p2p2 for NFC cases
wpa_s->p2p2 is used to track whether a new P2P connection is using P2P2.
However, it was not cleared in some cases and that could result in
unexpected behavior and failures, e.g., with NFC-initiated P2P.
Clear wpa_s->p2p2 for the operations that start NFC-based P2P
connection. In addition, clear it on the FLUSH control interface
command.
This showed up with the following test case sequence:
p2p_pairing_opportunistic nfc_p2p_static_handover_tagdev_client
Jouni Malinen [Wed, 20 Nov 2024 10:30:05 +0000 (12:30 +0200)]
wlantest: Use AP's RSNXOE for capabilities when RSNO is used
If an association uses RSN overriding and the AP advertises an RSNXOE,
use the RSNXOE instead of the RSNXE when determining AP's RSN
capabilities. In particular, this is needed to determine the correct KDK
length for PTK derivation in a case where the RSNXOE advertises support
for secure ranging while the RSNXE does not.
Shivani Baranwal [Thu, 14 Nov 2024 08:37:34 +0000 (14:07 +0530)]
NAN USD: Use different group address for P2P2
P2P2 uses USD with a different group address than the NAN Network ID
defined in the Wi-Fi Aware specification. Select the group address based
on whether USD is used with P2P2 or something else. This changes
behavior only for the P2P2 cases.
P2P2: Allow device address change when reinvoking a persistent group
In P2P-R2 while reinvoking a persistent group, the devices of the group
can have a different P2P device address for the invite session. As
devices supports MAC randomization, we should identify the peers based
on the device identity key. Hence, remove the ether_addr_equal() check.
P2P2: Store device identity key in wpa_supplicant configuration
When persistence is enabled, store the identity key into wpa_supplicant
configuration file since this information is needed for pairing
verification to invoke the persistent group and that can happen after
the wpa_supplicant process has been restarted.
Shivani Baranwal [Mon, 18 Nov 2024 06:00:26 +0000 (11:30 +0530)]
P2P2: Store WPA3 connection credentials in the configuration
Persistent connection details were stored only for WPA2-PSK mode. Enable
the storage of WPA3 sae_password, authentication algorithm, key
management, and protocol type. Also, allow credentials without
sae_password for the pmk_valid case.
hostapd: Pass link ID for non-link agnostic Action frames
With the recently added support for passing Link ID for transmitting
Action frames, pass the Link ID is if the Action frame is not link
agnostic.
According to IEEE P802.11be/D7.0, 35.3.14 (MLD individually addressed
Management frame delivery), between an AP MLD and a non-AP MLD, certain
Action frames such as Block Ack Action frame, SA Query Action frame, and
WNM Sleep Mode Request/Response frame, etc. which are individually
addressed MMPDUs, are intended for an MLD. Therefore, there is no need
to pass the Link ID for these types of frames.
However, for rest of the Action frames since it is not said to be
intended for an MLD, use the link ID.
Hu Wang [Wed, 6 Nov 2024 10:50:04 +0000 (02:50 -0800)]
AP: Avoid double free of key data buffer if AES unwrap fails
key_data_buf was freed when aes_unwrap() failed, and then after goto
out, key_data_buf would be freed again. The separate feeing on
aes_unwrap() failure is not needed, so remove it.
Fixes: 4abc37e67b ("Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Hu Wang [Wed, 6 Nov 2024 10:39:05 +0000 (02:39 -0800)]
AP: NULL pointer check for bssid in hostapd_mgmt_tx_cb()
The BSSID pointer returned by get_hdr_bssid() may be NULL and it could
have been dereferenced by ether_addr_equal() here at least in theory
(though this is based only on the TX status events, i.e., own frames).
Add an explicit check to avoid that.
Fixes: d75ebe23d8 ("AP: Handle Management frame TX status for AP MLD address") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Hu Wang [Wed, 6 Nov 2024 10:17:04 +0000 (02:17 -0800)]
nl80211: NULL pointer check for msg in i802_flush()
Pointer 'msg' from nl80211_bss_msg() might be NULL and might be
dereferenced by nla_put_u8(), so need to check for memory allocation
failure explicitly here.
Jouni Malinen [Wed, 6 Nov 2024 17:41:44 +0000 (19:41 +0200)]
Convert wpa_s->hw_capab into a bitmap and add HE and EHT
This makes wpa_s->hw_capab more useful for determining local
capabilities, e.g., for reporting them using Wi-Fi Alliance generational
capabilities indication.
Jouni Malinen [Tue, 5 Nov 2024 16:45:10 +0000 (18:45 +0200)]
Wi-Fi Generational Capabilities Indication transmission on STA
Add support to send generational capabilities indication to the
associated AP. This includes generation of the Generational Capabilities
Indication attribute and sending it in either the (Re)Association Request
frame or the W-Fi Capabilities frame.
By default, this functionality is disabled. It can be enabled by setting
the global wpa_supplicant configuration parameter wfa_gen_capa to either
1 (protected) or 2 (unprotected) and setting the supported (and
optionally also certified) generational capabilities in
wfa_gen_capa_supp (and wfa_gen_capa_cert).
Jouni Malinen [Tue, 5 Nov 2024 16:42:51 +0000 (18:42 +0200)]
Wi-Fi Generational Capabilities Indication reception on AP
Process the received generational capabilities indication on AP. This
covers the Generational Capabilities Indication attribute parsing in
both (Re)Association Request frames and W-Fi Capabilities frames.
Jouni Malinen [Tue, 5 Nov 2024 16:48:20 +0000 (18:48 +0200)]
AP: Update the list of Action frame categories that are not robust
Number of new Action frame categories have been identified as being not
robust, i.e., not using management frame protection. Update AP mode
implementation to cover those to allow reception unprotection Action
frames from those categories.
Jouni Malinen [Tue, 5 Nov 2024 17:01:34 +0000 (19:01 +0200)]
tests: Remove registration for Vendor Specific Protected action frames
This additional registration is not needed anymore since hostapd
registers for these frames internally. In fact, this additional
registration is now failing.
Jouni Malinen [Tue, 5 Nov 2024 16:39:07 +0000 (18:39 +0200)]
nl80211: Register to receive Vendor Specific Protected action frames
This is needed to be able to process Vendor Specific Protection action
frames. In particular, this is needed for the Wi-Fi Alliance
Capabilities frame on an AP.
Shivani Baranwal [Sun, 18 Aug 2024 10:54:23 +0000 (16:24 +0530)]
Control interface command to generate new random MAC address
Add NEW_RANDOM_MAC_ADDRESS command to allow wpa_supplicant to be
requested to change the currently used MAC address to a random one. This
is applicable only when not connected (or trying to connect).
Jouni Malinen [Mon, 4 Nov 2024 21:03:19 +0000 (23:03 +0200)]
NAN: Do not expire USD services based on last TX/RX message
This behavior is not described in the Wi-Fi Aware specification, so
remove it and instead, expect services to terminate USD explicitly when
no further Follow-up messages are needed.
Jouni Malinen [Mon, 4 Nov 2024 20:42:44 +0000 (22:42 +0200)]
NAN: Make DE aware of maximum driver supported listen time
This can be used to optimize listen operations to be as long as the
driver supports instead of having to use a small enough value to work
with all drivers.
Jouni Malinen [Mon, 4 Nov 2024 20:05:29 +0000 (22:05 +0200)]
NAN: Do not unpause publisher on fixed Follow-up message timeout
Do not unpause publisher if more than one second has passed from the
last Follow-up message TX or RX. There is no such behavior described in
the Wi-Fi Aware specification and it is possible for a service to need
more time to generate Follow-up messages. Leave it to the service itself
to force timeout, if desired, or terminate pauseState after the 60
second overall timeout.
Jouni Malinen [Mon, 4 Nov 2024 21:01:58 +0000 (23:01 +0200)]
tests: Do not expect NAN USD services to terminate automatically
If further service discovery is needed, the USD services will not be
expiring automatically based on the last exchanged message, so modify
the test cases to explicitly terminate USD instead of waiting for the
timeout.
Shivani Baranwal [Thu, 29 Aug 2024 06:08:46 +0000 (11:38 +0530)]
Channel Usage, peer-to-peer TWT and TWT requester support
Add config support for channel usage procedure and peer-to-peer TWT on
AP and TWT Requester support on STA. The actual functionality of these
operations is expected to be implemented within the drivers.
Jouni Malinen [Fri, 1 Nov 2024 19:58:07 +0000 (21:58 +0200)]
Avoid undefined behavior in RSNXE capability bit checker
Integer promotion converts u8 rsnxe[i] to an int which is not
sufficiently large to be able to handle the maximum shift left of 24
bits here. Type cast rsnxe[i] to u32 explicitly to get rid of the sign
bit and avoid this undefined behavior from the shift operation.
Credit to OSS-Fuzz: https://issues.oss-fuzz.com/issues/376786400 Fixes: d675d3b15b40 ("Add helper functions for parsing RSNXE capabilities") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
P2P2: Add device identity block to wpa_supplicant configuration
Add device identity block to store DIK, PMK, PMKID, and cipher version.
This persistent data is used during pairing verification of previously
paired peers. This commit defines the data structures and adds reading
and writing routines. The actual use of the information will be added in
following commits.
Shivani Baranwal [Sun, 18 Aug 2024 10:54:23 +0000 (16:24 +0530)]
P2P2: Update P2P Device Address when changing netdev address
P2P2 adds support for privacy and needs ability to update the P2P Device
Address. Update that whenever changing the interface address in
wpa_supplicant for other (non-P2P) MAC address randomization purposes.
Jouni Malinen [Fri, 1 Nov 2024 10:24:34 +0000 (12:24 +0200)]
tests: Update sae_password_id_pwe_looping to match implementation
Now that hostapd was changed to explicitly reject attempts of using SAE
password identifiers without H2E, this test case needs to be updated to
not expect connection.
Jouni Malinen [Fri, 1 Nov 2024 10:06:10 +0000 (12:06 +0200)]
SAE: Do not allow password identifier to be used without H2E
When the concept of SAE password identifiers was introduced in IEEE
P802.11REVme/D1.0, there was no requirement to use H2E with them.
However, this was changed for the published IEEE Std 802.11-2020 to
require H2E to avoid certain cases where the password identifier could
not have been parsed robustly.
Commit e36a5894d0c0 ("SAE: Use H2E whenever Password Identifier is
used") started forcing H2E to be used when password identifiers were in
use with SAE. However, it did not enforce rejection of cases where H2E
was not enabled by a non-compliant implementation. Add that explicit
check during parsing of SAE commit messages.
Jouni Malinen [Fri, 1 Nov 2024 10:18:41 +0000 (12:18 +0200)]
SAE: Send Commit message with unknown-password-id from Nothing state
The unknown-password-id case (i.e., BadId indicator in the SAE finite
state machine in the standard) is supposed to have different behavior
based on whether the current state is Nothing or Committed. The previous
hostapd implementation did not send a response Authentication frame in
either case, but the standard describes that behavior only for the
Committed state while the Nothing state is expected to report the
failure.
Update hostapd to send the Authentication frame with status code
indicating unknown password identifier when processing a Commit message
in the Nothing state.
Jouni Malinen [Thu, 31 Oct 2024 21:59:45 +0000 (23:59 +0200)]
SAE: Do not use the wpa_passphrase if SAE password identifier was used
Sharing of the WPA-PSK passphrase as the SAE password is only for the
case where no SAE password identifiers are used. Do not consider that on
an AP if a STA includes SAE password identifier in an SAE commit
message. This avoids confusing cases where SAE would be allowed to
continue with the AP and the STA using different password identifier
which is going to fail in the end.
Kashish Awasthi [Wed, 23 Oct 2024 19:25:48 +0000 (00:55 +0530)]
Add new QCA vendor attributes for TWT statistics
Add the following vendor attributes to get TWT early service period
termination metrices in enum qca_wlan_vendor_attr_twt_stats.
- QCA_WLAN_VENDOR_ATTR_TWT_STATS_AVG_EOSP_DUR_US
- QCA_WLAN_VENDOR_ATTR_TWT_STATS_EOSP_COUNT
Kashish Awasthi [Tue, 29 Oct 2024 13:26:47 +0000 (18:56 +0530)]
Add new QCA vendor TWT status values
Add the following new status values in enum qca_wlan_vendor_twt_status
to enhance TWT session and operation handling, to cover various
scenarios such as peer rejections, timeouts and local teardown requests.
- QCA_WLAN_VENDOR_TWT_STATUS_TWT_ALREADY_RESUMED
- QCA_WLAN_VENDOR_TWT_STATUS_PEER_REJECTED
- QCA_WLAN_VENDOR_TWT_STATUS_TIMEOUT
Shivani Baranwal [Thu, 24 Oct 2024 14:10:42 +0000 (19:40 +0530)]
Add QCA vendor interface for additional TWT Setup command types
Add support to include TWT setup command type TWT Grouping, Accept TWT,
Alternate TWT, Dictate TWT, and Reject TWT. These commands are valid if
the TWT Request field is 0.
In P2P2, the PMKSA is generated through the PASN frame exchange during
the pairing process. Once pairing and group negotiation are successful,
the P2P Client initiates a connection with the P2P GO using the PMKID
derived during the pairing process. In the case of AP SME offload to the
driver, the driver handles the Association Request and Response frames
and needs to be able to determine whether the provided PMKID is known.
Therefore, configure the PMKID to the driver on the P2P GO to allow
association with the P2P Client.
Shivani Baranwal [Wed, 30 Oct 2024 13:26:14 +0000 (18:56 +0530)]
Control interface command to flush NAN publish and subscribe sessions
Add a control interface command for NAN_FLUSH to terminate all the
publish and subscribe sessions. This was previously done as a part of
the complete FLUSH operation, but it can be useful to be able to do this
specifically for NAN services without impacting other areas.
Shivani Baranwal [Thu, 17 Oct 2024 09:41:53 +0000 (15:11 +0530)]
P2P2: Fix pairing verification without encrypted elements
During the pairing verification process, the KEK might not be derived,
and the PASN encrypted elements are absent in the P2P2 IE. Therefore, it
is necessary to permit other attributes such as PCEA and the Action
Frame Wrapper attribute in the Authentication frame for the invitation
process.
P2P2: Determine PASN KEK derivation based on peer capabilities
P2P pairing setup requires KEK derivation during PTK generation in PASN,
as the Encrypted PASN element is needed to share the Device Identity Key
or opportunistic SAE password for association. However, during the
pairing verification process, the P2P peer might not indicate support
for KEK derivation in its capabilities since strictly speaking KEK is
not needed in that case even when the STAs are capable for deriving it.
Therefore, based on the peer's capabilities, avoid generating KEK while
deriving PTK.
P2P2: Support for GO to allow a client to join the group
Enable P2P GO to authorize a client device to join the group. In the
case of opportunistic bootstrapping, P2P GO must share the password with
the client device during PASN authentication in an Encrypted Data
element. P2P GO retrieves the ssid->sae_password and stores it in
p2p->dev_sae_password and authorizes the client. The SAE password and
the random passphrase derived for WPA-PSK connection are same. This
allows use of the get_passphrase API to connect a P2P-R1 and P2P-R2
client in PCC mode which will be covered in separate commits.
The P2P Client initiates PASN authentication with the GO using either
the password or opportunistic bootstrapping method. In the password
method, the client initiates PASN authentication with SAE tunneling
using the password and proceeds with the connection using open
authentication. In the opportunistic bootstrapping method, the client
obtains the SAE password from the GO and initiates the connection with
SAE authentication.
Add the PMKSA on the P2P2 GO when a new P2P2 Client joins the group
instead of going through the WPS step. This commit is adding just the
mechanism to add the PMKSA and the actual use for this is in a separate
commit.
Jouni Malinen [Tue, 29 Oct 2024 10:27:12 +0000 (12:27 +0200)]
P2P2: Fix peer entry generation based on USD
All cases calling dev_found() for a P2P peer will need to set the peer
flags to indicate it has been reported. In particular, this is needed to
avoid memory leaks in D-Bus code and in P2P peer cleanup. The recently
added P2P2 case using USD did not update the flags, so fix it to match
other cases.
Fixes: b4f9742ee246 ("P2P2: Process Element container attribute from NAN SDFs") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
projects / thirdparty / hostap.git / log
