Benjamin Berg [Tue, 20 Feb 2024 13:18:26 +0000 (14:18 +0100)]
WNM: Follow BTM procedure if the last link is dropped
If the last link is dropped, it makes sense to follow the BTM procedure.
However, in that case we need to prevent reconnection to this link
specifically, while if the AP MLD is terminating we need to forbid
connecting to the AP MLD.
As such, add a new variable to track the BSSID or AP MLD MAC address.
Which one it refers to depends on whether wnm_link_removal is set.
This also simplifies the check in wnm_is_bss_excluded() and untangles it
from wpa_s->current_bss.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:25 +0000 (14:18 +0100)]
WNM: Remove dialog_token parameter
All callers of wnm_send_bss_transition_mgmt_resp() are explicitly
passing wpa_s->wnm_dialog_token. As such, we might as well not pass it
and use the variable directly.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:23 +0000 (14:18 +0100)]
WNM: Do not store coloc_intf_elems
The elements are (currently) not used except for sending an immediate
response similar to COLOC_INTF_REPORT with the main difference being
that the dialog token is included.
Do not store the elements. It easy enough to re-add this should the
implementation improve. And this fixes the fact that the variable is
cleared at odd times as wnm_deallocate_memory() is used specifically to
clear the neighbor report list of a BTM request.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Avraham Stern [Tue, 20 Feb 2024 13:18:18 +0000 (14:18 +0100)]
WNM: Wait for BTM response TX status before roaming
When accepting a BSS transition request there is a race between
sending the response and roaming to the target AP. As a result,
the response may not be sent because the station deauthenticated
from the AP before the response was actually sent.
To make sure the BSS transition response is sent, start roaming only
after the TX status is received for the BSS transition response.
Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:16 +0000 (14:18 +0100)]
WNM: Clean up old scan data processing
When receiving a BTM request, wpa_supplicant would try to fetch new
results from the driver, and, independently of that, would also process
the latest scan results that were partially updated by the previous
fetch.
Simplify the logic by using wpa_supplicant_get_scan_results() directly
and then process the old scan data as usual. However, this data may be
outdated, so add a new heuristic to avoid roaming to a BSS if it is
either outdated or bad.
Doing this moves all scan data processing into wnm_scan_process() and
removes duplicated functionality for scan result processing in scan.c.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Jouni Malinen [Sat, 2 Mar 2024 17:37:11 +0000 (19:37 +0200)]
DPP: Wait for TX wait expiration on moving to neg_freq for Auth Resp
Avoid potential race conditions with the driver operations between
stopping an ongoing wait for responses for an offchannel TX that was
used to send Authentication Request with a request to use a different
channel for Authentication Response and the start of a new ROC on the
other channel by waiting for the TX expiration event before issuing the
ROC request.
Jouni Malinen [Sat, 2 Mar 2024 17:34:17 +0000 (19:34 +0200)]
nl80211: Indicate EVENT_TX_WAIT_EXPIRE on match-saved
The event indicating expiration of an offchannel TX is useful for cases
where the wait is for a frame that was explicitly requested to have the
pending cookie to be saved.
Jouni Malinen [Sat, 2 Mar 2024 17:06:15 +0000 (19:06 +0200)]
DPP: Wait for ROC cancelled event on Auth Resp TX on another channel
Avoid potential race conditions with the driver operations between
cancelling an ongoing ROC that was used to receive Authentication
Request that requested a different channel to be used for the
negotiation by waiting for the ROC cancelled event before issuing the
offchannel TX command for the Authentication Response.
In addition, speed up the retry on Authentication Response in this type
of a case if the first attempt on the other channel is not AKC'ed since
it might take the peer device a bit more time to be ready to listen
there.
Benjamin Berg [Tue, 20 Feb 2024 13:18:14 +0000 (14:18 +0100)]
nl80211: Use valid_links bitmask for bss->links array
Most places in the codebase use a valid_links bitmask with an array.
Switch the bss->links array to use the same design with the Link ID
being used as the array index instead of having a link_id inside.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:12 +0000 (14:18 +0100)]
Use for_each_link() in most cases
This was done using the below semantic patch. There are a few more
places that were missed due to variable declarations or additional
checks in the for loop.
@@
iterator name for_each_link;
identifier max_links =~ "MAX_NUM_MLD_LINKS|MAX_NUM_MLO_LINKS";
expression links;
expression further_tests;
identifier i;
statement stmt;
@@
-for (i = 0; i < max_links; i++)
+for_each_link(links, i)
{
(
- if (!(links & BIT(i)))
- continue;
...
|
- if (!(links & BIT(i)) || further_tests)
+ if (further_tests)
continue;
...
|
- if (further_tests || !(links & BIT(i)))
+ if (further_tests)
continue;
...
|
- if (links & BIT(i))
stmt
|
- if (further_tests && (links & BIT(i)))
+ if (further_tests)
stmt
|
- if ((links & BIT(i)) && further_tests)
+ if (further_tests)
stmt
)
}
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:11 +0000 (14:18 +0100)]
common: Introduce for_each_link() macro
This is a simple macro iterating the given bitmask using the given
variable. Having the macro avoids the for loop-continuation making it
more readable overall.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:10 +0000 (14:18 +0100)]
nl80211: Fix link indexing in nl80211_connect_common()
In some places the wrong index variable was used to access the link
configuration. Fix this by simply using link_id instead of i.
With this, the i loop variable is not needed anymore. We can simply
always pass 0 to nla_nest_start(). Also, the kernel does not care about
the order that the links are provides, so just remove the special
handling for the association link.
Fixes: a2c4c0b1b6bb ("nl80211: Support MLD association request") Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Ilan Peer [Tue, 20 Feb 2024 13:18:09 +0000 (14:18 +0100)]
nl80211: Explicitly differentiate between 5 GHz and 6 GHz modes
When a device supports both the 5 GHz band and the 6 GHz band,
these are reported as two separate modes, both with mode set to
HOSTAPD_MODE_IEEE80211A. However, as these are different modes,
each with its own characteristics, e.g., rates, capabilities etc.,
specifically differentiate between them by adding a flag to indicate
whether the mode describes a 6 GHz band capabilities or not.
Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Sunil Ravi [Thu, 29 Feb 2024 01:36:40 +0000 (01:36 +0000)]
P2P: Notify the IP address of the connected P2P Client
When wpa_supplicant assigns the IP address (WFA EAPOL IP address
allocation feature), the assigned IP address of the P2P Client on the GO
side is notified in the AP-STA-CONNECTED event. So to obtain the IP info
to external programs, modify the STA authorized event to include the the
assigned IP address of the P2P Client.
Test: Establish P2P connection and verified from the logs that
the P2P Client IP address is notified. Signed-off-by: Sunil Ravi <sunilravi@google.com>
Sunil Ravi [Mon, 3 Oct 2022 00:53:41 +0000 (00:53 +0000)]
P2P: Disable pri/sec channel switch for GO with forced frequency
When wpa_supplicant receives a request to start a P2P group owner on a
fixed frequency with bandwidth wider than 20 MHz, wpa_supplicant scans
for neighboring BSSs prior to starting the GO. This is done to switch
the primary/secondary channels if there are any other networks which are
operating on the same secondary channel. Though this logic is defined
for 20/40 MHz coexistence and might improve throughput, there are P2P
use cases where this logic causes problem:
1. The file transfer use case takes time to start the file transfer or
even fails when the 20/40 coex scan repeatedly fails due to an
ongoing externally triggered scan happening in the system.
2. wpa_supplicant overrides the channel which is selected by the
application based on the best channel it derived by looking into
the channel conditions. This degrades the expected throughput.
3. Latency sensitive applications experience long time to
start the group owner which gives a bad user experience.
So do not allow 40 MHz co-ex PRI/SEC switch to force a change to
Autonomous GO PRI channel when the P2P group add is called with a forced
frequency.
Test: Tested autonomous GO and confirmed from the logs that
P2P GO is not triggering 20/40 coex scan.
Jouni Malinen [Thu, 29 Feb 2024 09:55:31 +0000 (11:55 +0200)]
tests: Make ap_wpa2_gtk_rekey_fail_1_sta more robust
Slight differences in timing might make the final data connectivity
check fail, so disable the incorrect behavior first and wait for a
successfully completed GTK rekeying at the end before the final test.
Jouni Malinen [Sun, 25 Feb 2024 15:15:01 +0000 (17:15 +0200)]
RADIUS: Preliminary support RADIUS/TLS as an alternative to RADIUS/UDP
This adds initial parts for RADIUS/TLS support in the RADIUS client.
This can be used with eapol_test and hostapd. This functionality is not
included by default and CONFIG_RADIUS_TLS=y in .config can be used to
enable it.
This version does not yet include all the needed functionality for TLS
validation and the rules for dropping a TCP connection based on invalid
RADIUS attributes.
Jouni Malinen [Sun, 25 Feb 2024 15:49:40 +0000 (17:49 +0200)]
RADIUS: Simplify IPv4/IPv6 socket handling in client
There is only one connection in use in parallel to a RADIUS
authentication server (and similarly to a RADIUS accounting server). As
such, there is not really any need to maintain separate open IPv4 and
IPv6 sockets. Instead, open the socket for the appropriate IP version
only when actually connecting to a specific server.
TDLS: Defer the start request until the discovery response RX for MLO
When the station (non-AP MLD) is associated with an AP MLD the link ID
for TDLS setup is derived from the discovery response frame and the link
ID is used in TDLS setup operation when acting as initiator. The driver
sends the received discovery response frame followed by the TDLS setup
request event. But the discovery response frame is received after the
setup request event leading to use incorrect link ID value for TDLS
setup operation causing the setup failure. Process the TDLS setup
request if the discovery response frame is received, else defer the
process until the discovery response frame is received and process the
setup request after discovery response frame is processed.
When the CHAN_SWITCH command is executed during multi BSSID case (say
BSS1, BSS2, and BSS3), if one of the BSS is disabled (say BSS2), the
CHAN_SWITCH command returns an error in BSS2 and does not proceed to the
next BSS (BSS3).
The CHAN_SWITCH command handler iterates over all configured BSSs and
attempts to send the switch_channel to each one. However, if any one of
the BSSs fails, the entire command is aborted and returns a failure.
Continue the iteration even if one BSS is failing to make sure the
configuration is applied to other BSSs.
During high battery voltage scenario, higher MCS data rate leads to poor
EVM accuracy which causes poor user experience. Hence to provide better
user experience, EVM accuracy needs to be improved by adjusting TX power
for MCS rate of specific band/radio chain. To achieve this, add a new
vendor command to configure required parameters in the WLAN driver.
Jouni Malinen [Thu, 15 Feb 2024 15:41:05 +0000 (17:41 +0200)]
NAN: USD in hostapd
Add hostapd support for interacting with the NAN discovery engine to
allow single-channel (i.e., the AP's operating channel) USD as Publisher
or Subscriber.
Jouni Malinen [Sat, 3 Feb 2024 18:13:46 +0000 (20:13 +0200)]
FT: Allow wpa_supplicant to be configured to prepend PMKR1Name
The standard is somewhat unclear on whether the PMKIDs used in
(Re)Association Request frame (i.e., potential PMKIDs that could be used
for PMKSA caching during the initial mobility domain association) are to
be retained or removed when generating EAPOL-Key msg 2/4.
wpa_supplicant has replaced the PMKID List contents from (Re)Association
Request frame with PMKR1Name when generating EAPOL-Key msg 2/4 for FT.
Allow it to be configured (ft_prepend_pmkid=1) to prepend the PMKR1Name
without removing the PMKIDs from (Re)Association Request frame.
Jouni Malinen [Sat, 3 Feb 2024 18:39:56 +0000 (20:39 +0200)]
FT: Allow PMKIDs from AssocReq to be in EAPOL-Key msg 2/4
The standard is somewhat unclear on whether the PMKIDs used in
(Re)Association Request frame (i.e., potential PMKIDs that could be used
for PMKSA caching during the initial mobility domain association) are to
be retained or removed when generating EAPOL-Key msg 2/4.
hostapd used to require that only the PMKR1Name is included in the PMKID
List of RSNE in EAPOL-Key msg 2/4. Extend this to allow the PMKIDs that
were included in the (Re)Association Request frame to be present as long
as the correct PMKR1Name is also present. This would allow PMKSA caching
to be used in initial mobility domain association with supplicant
implementations that insert the PMKR1Name without removing the PMKIDs
used in the (Re)Association Request frame. wpa_supplicant did not use to
that, but other implementations might.
Chenming Huang [Thu, 23 Nov 2023 09:49:22 +0000 (15:19 +0530)]
AP MLD: Handle EAPOL only on the association link
For some implementation, there is no link id in EAPOL event, e.g., use
drv_event_eapol_rx for receiving. Current design for such case is switch
to a link that stores the peer. However, this is error-prone because for
non-AP MLD case, sta_info is stored in all valid links but EAPOL sm is
only initialized in the association link. If EAPOL RX event is handled
in a non-association link, it will be discarded and this leads to EAPOL
timeout.
So find the association link to handle received EAPOL frame in such
case. This replaces the previously used workaround for RSN/wpa_sm for
the no link id specified case.
Chenming Huang [Wed, 20 Dec 2023 08:39:18 +0000 (14:09 +0530)]
AP MLD: Do not allow disabling first interface affiliated with an AP MLD
Disabling the first interface calls hapd_deinit(), which causes some
issues, e.g., failure when trying to disable other interfaces due to
NULL drv_priv.
So check that all other interfaces are already disabled before disable
the first interface.
AP MLD: Add support for hostapd_cli to disable/enable AP MLD
Existing commands ENABLE/DISABLE only enable/disable the corresponding
link. To disable all links, multiple calls from different control
interfaces would be needed.
Add new commands "disable_mld" and "enable_mld" for hostapd_cli to
support disabling/enabling AP MLD for convenience.
Jouni Malinen [Fri, 2 Feb 2024 20:26:29 +0000 (22:26 +0200)]
hostapd: Do not use prefix matching for ENABLE/RELOAD/DISABLE
These control interface commands do not take any parameters and as such,
do not need to use a prefix match. Replace that with an exact string
match to avoid matching other potential command strings.
Jouni Malinen [Fri, 2 Feb 2024 15:50:40 +0000 (17:50 +0200)]
Handle both HT40+ and HT40- allowed consistently in channel check
Return the result from the first hostapd_is_usable_chan() call instead
of the following attempts in case of ht40_plus_minus_allowed to have
consistent behavior with the case where only one option is specified.
This allows the fallback to 20 MHz to work in additional cases.
Jouni Malinen [Thu, 1 Feb 2024 17:51:56 +0000 (19:51 +0200)]
wlantest: Fix TK iteration based on the PTK file
Use of ptk_len is not valid here to check what is the length of the
actual TK. Fix this by using ptk->tk_len instead so that the appropriate
decryption function can be selected for cases where the TKs are
configured through the PTK file.
Fixes: ce7bdb54e5c9 ("wlantest: Extend Management frame decryption to support GCMP and CCMP-256") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Jouni Malinen [Wed, 31 Jan 2024 10:16:36 +0000 (12:16 +0200)]
tests: Close wpa_supplicant control interface sockets at the end
Close all the control interface sockets and delete the client socket
files explicitly at the end of the test loop. This removes needs for
various workarounds that tried to force WpaSupplicant and Ctrl class
__del__() to remove the sockets.
Johannes Berg [Tue, 30 Jan 2024 16:21:29 +0000 (17:21 +0100)]
test: dbus: Wait for connection before disconnect (again)
The same thing as we did previously in dbus_p2p_autogo_pbc
can evidently also happen in dbus_p2p_autogo.
The test here wants to connect and then disconnect again,
but it's driven only by the GO side, so the client may end
up (with UML time-travel) not fully connecting, and then
it all fails. Wait for the client to have connected first.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Sun, 28 Jan 2024 19:59:09 +0000 (20:59 +0100)]
test: dbus: Wait for connection before disconnect
The test here wants to connect and then disconnect again, but it's
driven only by the GO side, so the client may end up (with UML
time-travel) not fully connecting, and then it all fails. Wait for the
client to have connected first.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jouni Malinen [Sun, 28 Jan 2024 18:18:07 +0000 (20:18 +0200)]
OpenSSL: Use library functions for HPKE when possible
OpenSSL 3.2 added support for HPKE. Use that implementation when
possible. At least for now, the internal version needs to be included as
well to be able to cover the special DPP use case with brainpool curves.
Jouni Malinen [Sun, 28 Jan 2024 17:15:08 +0000 (19:15 +0200)]
Remove forgotted STAKey related functionality in EAPOL-Key Request
The use of a MAC KDE in the Key Data field of an EAPOL-Key Request frame
was only for the STAKey handshake. That handshake was implemented in
2005 as an experimental functionality and it was then removed in 2006.
However, this part of the functionality was forgotten. This does not do
anything in practice, so simplify the implementation and remove it.
Jouni Malinen [Sun, 28 Jan 2024 16:56:47 +0000 (18:56 +0200)]
FILS: Fix EAPOL-Key request generation
The Encrypted Key Data field need to be set to 1 whenever using an AEAD
cipher. Without this, the Authenticator would discard the EAPOL-Key
request frame when using FILS.
Jouni Malinen [Sun, 28 Jan 2024 16:41:06 +0000 (18:41 +0200)]
Discard EAPOL-Key request without Secure=1
EAPOL-Key request is accepted only if the MIC has been verified, so PTK
must have already been derived and Secure=1 needs to be used. Check the
Secure bit explicitly for completeness even though the MIC verification
is already taking care of validating that the sender is in the
possession of valid keys.
Jouni Malinen [Sun, 28 Jan 2024 16:32:03 +0000 (18:32 +0200)]
Discard EAPOL-Key Request frames during 4-way handshake
While the Authenticator state machine conditions are already checking
for sm->EAPOLKeyRequest, it seems clearer to explicitly discard any
EAPOL-Key Request frame that is received unexpectedly during a 4-way
handshake.
Jouni Malinen [Sun, 28 Jan 2024 09:26:16 +0000 (11:26 +0200)]
Check Key Descriptor Version value earlier in the process
There is no need to try to process the EAPOL-Key frame if it has an
unexpected Key Descriptor Version value. Move these checks to happen
earlier in the sequence. In adition, use a separate helper function for
this to simplify wpa_receive() a bit.
Jouni Malinen [Sun, 28 Jan 2024 09:22:47 +0000 (11:22 +0200)]
Reject undefined Key Descriptor Version values explicitly
Check that the EAPOL-Key frame Key Descriptor Version value is one of
the defined values explicitly instead of failing to process the Key Data
field later (or end up ignoring the unexpected value if no processing of
Key Data is needed).
Jouni Malinen [Sun, 28 Jan 2024 09:18:40 +0000 (11:18 +0200)]
Use more generic checks for Key Descriptor Version 2 and 3
IEEE Std 802.11-2020 describes the rule based on not-TKIP for value 2
and no pairwise cipher condition on value 3, so use that set of more
generic rules here.
Jouni Malinen [Sat, 27 Jan 2024 09:35:31 +0000 (11:35 +0200)]
tests: Use the provided timeout for P2P peer discovery
p2p_go_neg_init() ignored the provided timeout value and used the
default 15 second timeout in discover_peer(). This did not allow the
recently added go_neg_pbc() timeout increase for concurrent cases to be
used fully.
Muna Sinada [Wed, 17 Jan 2024 03:30:21 +0000 (19:30 -0800)]
Add a QCA vendor attribute to determine QCA device
Add a new attribute for
%QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION subcommand. This
attribute is an 8 bit unsigned value used to specify whether an
associated peer is a QCA device.
Jouni Malinen [Fri, 26 Jan 2024 15:12:16 +0000 (17:12 +0200)]
P2P: Accept P2P SD response without TX status
If a GAS response is received for a pending SD query, process it even if
the TX status event for the query has not yet been received. It is
possible for the TX status and RX events to be reordered especially when
using UML time-travel, so this is needed to avoid race conditions to
make SD more robust.
Jouni Malinen [Fri, 26 Jan 2024 10:26:36 +0000 (12:26 +0200)]
nl80211: Increase the hard scan timeout for initial attempt
If both 6 GHz and S1G channels are included, the previously used timeout
was not long enough at least with mac80211_hwsim. Increase the initial
timeout to allow such a scan to be completed.
Jouni Malinen [Fri, 26 Jan 2024 10:18:32 +0000 (12:18 +0200)]
tests: Allow more time for chirping in dpp_chirp_ap_5g
The full scan at the beginning of the chirping step can take over 15
seconds when 6 GHz and S1G channels are included and the timeout here is
not enough to handle that.
Jouni Malinen [Fri, 26 Jan 2024 10:10:41 +0000 (12:10 +0200)]
tests: Flush scan cache for rrm_beacon_req_table_detail
Explicitly flush the scan cache in wpa_supplicant and cfg80211 to avoid
test failures here. An additional BSS table entry from a scan based on a
previous test case could result in causing this test case to report
failure since each beacon response could include multiple entries and
the check for the details would fail due to the unexpected data.
Jouni Malinen [Fri, 26 Jan 2024 09:18:24 +0000 (11:18 +0200)]
tests: Add more time for concurrent GO group negotiation cases
It is possible for the parallel connection attempt with an AP and P2P
device discovery with P2P search on social channels to take close to the
15 second timeout and these test cases could fail because of that
instead of a real issue. Increase the timeout to make this less likely
to cause test failures. In addition, add a debug entry to the log on the
r_dev timeout to avoid confusing print from the i_dev thread reporting a
timeout even when the first timeout was on the rdev_
Send actual BTM capability when the driver takes care of BSS selection
wpa_supplicant disables BTM capability in Extended Capabilities element
when wpa_supplicant selects a misbehaving MBO/OCE AP that uses RSN
without PMF, but this is disabling BTM support for whole ESS connection
lifetime though the BTM support can be enabled when the driver takes
care of BSS selection and selects/roams to a BSS which is MBO and OCE
specification compliant. Thus, always set the actual BTM capability in
Extended Capabilities element when the driver takes care of BSS
selection.
wlantest: Adjust kdk_len according to RSNX capability for FT
Commit 0660f31ba0d0 ("wlantest: wlantest: Adjust kdk_len according to
RSNX capability") added support for PTK derivation and the additional
KDK component when Secure LTF support is used in the non-FT case.
Cover the same for the FT case to derive the correct PTK and consider
the additional KDK component when Secure LTF support is used.
projects / thirdparty / hostap.git / log
