Min Liu [Thu, 17 Oct 2019 08:03:03 +0000 (16:03 +0800)]
QCA vendor command for getting STA information
Add a QCA vendor subcommand QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO with
attributes defined in enum qca_wlan_vendor_attr_get_sta to get
information for a BSS in STA mode or for a peer STA in AP mode. This
vendor sub command can be used to get STA information from the driver to
userspace. The attributes defined in enum
qca_wlan_vendor_attr_get_sta_info are used to encapsulate required
information.
Vamsi Krishna [Fri, 6 Dec 2019 13:47:29 +0000 (19:17 +0530)]
6 GHz: Select channel width using configured op_class
Use op_class to derive channel width for the operating channel when
op_class is configured by the user in both fixed channel and ACS cases.
We can avoid using ht_capab field to derive channel width especially in
the 6 GHz band in which only HE is supported.
Ankita Bajaj [Tue, 26 Nov 2019 05:49:32 +0000 (11:19 +0530)]
Allow non-PCS 6 GHz channels to be excluded from ACS
Add support to exclude non-PSC 6 GHz channels from the input frequency
list to ACS. The new acs_exclude_6ghz_non_psc=1 parameter can be used by
6 GHz only APs.
Ankita Bajaj [Tue, 26 Nov 2019 05:49:32 +0000 (11:19 +0530)]
Allow ACS channel list to be configured as frequencies (in MHz)
The channel numbers are duplicated between 2.4 GHz / 5 GHz bands and 6
GHz band. Hence, add support to configure a list of frequencies to ACS
(freqlist) instead of a list of channel numbers (chanlist). Also, both 5
GHz and 6 GHz channels are referred by HOSTAPD_MODE_IEEE80211A. The 6
GHz channels alone can be configured by using both mode and frequency
list.
Ankita Bajaj [Tue, 19 Nov 2019 10:24:44 +0000 (15:54 +0530)]
Use frequency in HT/VHT validation steps done before starting AP
Using the channel parameter for validating allowed channel combinations
is not scalable to add 6 GHz support in the future since channel numbers
are duplicated between 2.4 GHz / 5 GHz bands and 6 GHz band. Hence use
frequency field for all channel combination validation steps done before
starting AP.
Ankita Bajaj [Wed, 27 Nov 2019 14:25:49 +0000 (19:55 +0530)]
ACS: Select current hw_mode based on the selected frequency
After receiving ACS offload results, select the current hw_mode based on
the frequency selected by the ACS algorithm. The current hw_mode will be
further used during other validation steps such as HT capability
validations, DFS validation, etc.
Ankita Bajaj [Mon, 18 Nov 2019 09:09:04 +0000 (14:39 +0530)]
AP: Populate iface->freq before starting AP
Using channel field while starting AP will cause issues with the new
6GHz band as the channel numbers are duplicated between the different
bands. Populate iface->freq before starting AP so that it can be used
instead of the channel number for all validations that need to be done
while starting AP.
Ankita Bajaj [Mon, 18 Nov 2019 09:09:04 +0000 (14:39 +0530)]
ACS: Use frequency params in ACS (offload) completed event interface
Replace channel fields with frequency fields in ACS completed event
interface from the driver layer. Use
QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY and
QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY attributes if the driver
includes them in the QCA_NL80211_VENDOR_SUBCMD_DO_ACS event, otherwise
use QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_CHANNEL and
QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_CHANNEL attributes to maintain
backwards compatibility with old drivers.
Ankita Bajaj [Mon, 18 Nov 2019 06:30:06 +0000 (12:00 +0530)]
Search through all hw_features sets in hw_get_channel_freq()
The 5 GHz channels are stored in one hw_features set with mode
HOSTAPD_MODE_IEEE80211A while the 6 GHz channels will need to stored in
a separate hw_features set (but with same mode HOSTAPD_MODE_IEEE80211A)
due to possibility of different HE capabilities being available between
the 5 GHz and 6 GHz bands.
Search through all hw_features sets whose mode is same as the input mode
while finding channel corresponding to the input frequency in
hw_get_channel_freq().
Ankita Bajaj [Mon, 18 Nov 2019 06:06:51 +0000 (11:36 +0530)]
ACS: Add channels from all modes matching with configured hw mode
The 5 GHz channels are stored in one hw_features set with mode
HOSTAPD_MODE_IEEE80211A while the 6 GHz channels will need to stored in
a separate hw_features set (but with same mode HOSTAPD_MODE_IEEE80211A)
due to possibility of different HE capabilities being available between
the 5 GHz and 6 GHz bands.
Iterate through all hw_features sets and populate channels from all
hw_features sets whose hardware mode is matching the configured hardware
mode while preparing the channel list for ACS.
Ahmad Masri [Thu, 17 Oct 2019 17:44:14 +0000 (20:44 +0300)]
P2P: Add support for EDMG channels
This allows a P2P connection over P802.11ay EDMG channels to achieve the
highest link speed that the standard allows for channel bonding (CB) up
to CB4.
Let each P2P peer add its EDMG channels to the Supported Channels IE
advertised in P2P GO negotiation. Give EDMG channels priority when peers
negotiate for operating channel.
User may add 'edmg' parameter to p2p_connect, p2p_add_group, and
p2p_invite commands to prefer an EDMG channel for the P2P link. User may
also set p2p_go_edmg=1 in wpa_supplicant configuration file to prefer
EDMG.
When EDMG is used, P2P will try to find the highest channel bonding
supported channel that matches the frequency parameter, if the devices
do not support EDMG, the P2P connection will use a legacy (1-6) 60 GHz
channel.
Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
Ahmad Masri [Wed, 4 Dec 2019 14:40:22 +0000 (16:40 +0200)]
Update operating classes and channels for the 60 GHz band
Update new channels in Channel Bonding (CB2 ... CB4) in the 60 GHz band
for different regulatory regions according to the latest draft amendment
IEEE P802.11ay/D5.0.
Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
Jouni Malinen [Wed, 18 Dec 2019 15:12:23 +0000 (17:12 +0200)]
tests: Clear IP configuration from sigma_dut explicitly
The 127.0.0.11/24 address that could have been left on the wlan0
interface resulted in some test case sequence failures. Fix this by
explicitly clearing that address when terminating sigma_dut.
Jouni Malinen [Fri, 13 Dec 2019 19:19:36 +0000 (21:19 +0200)]
tests: Fix skipping of new sigma_dut test cases
start_sigma_dut() can raise an exception and as such, assigning a
variable to its return value within a try block does not work in this
manner when the result is supposed to be used in the finally statement.
Jouni Malinen [Fri, 13 Dec 2019 01:05:38 +0000 (03:05 +0200)]
SAE H2E: Fix RSNXE override in EAPOL-Key msg 2/4 for testing purposes
The previous implementation missed the case where EAPOL-Key frame may be
reported as having been received before the association event is
processed. This would have resulted in not using the RSNXE override for
EAPOL-Key msg 2/4 when the pending EAPOL-Key frame gets processed
immediately after processing the association event. Fix this by moving
the override case to be handled before that.
Jouni Malinen [Sat, 7 Dec 2019 10:54:54 +0000 (12:54 +0200)]
SAE H2E: RSNXE override for testing purposes
"SET rsnxe_override_{assoc,eapol} <hexdump>" can now be used to override
RSNXE in (Re)Association Request frames and EAPOL-Key msg 2/4 for
testing purposes.
Jouni Malinen [Fri, 6 Dec 2019 22:39:46 +0000 (00:39 +0200)]
SAE: Reject invalid rejected group report in SAE commit explicitly (AP)
Previously, this case was ignored silently in AP mode. While that could
be a reasonable approach for an unexpected condition, it would be fine
to reject this case explicitly as well. This makes it somewhat easier to
test unexpected SAE H2E vs. looping behavior.
Jouni Malinen [Fri, 6 Dec 2019 22:26:13 +0000 (00:26 +0200)]
SAE H2E: Testing option to report extra rejected groups
"SET extra_sae_rejected_groups <groups>" can now be used to enable test
mode in which wpa_supplicant will report additional groups (configured
as space separated integers) when using SAE H2E.
Jouni Malinen [Fri, 6 Dec 2019 15:26:57 +0000 (17:26 +0200)]
SAE: Reject unexpected Status Code in SAE commit explicitly (AP)
Previously, this case was ignored silently in AP mode. While that could
be a reasonable approach for an unexpected condition, it would be fine
to reject this case explicitly as well. This makes it somewhat easier to
test unexpected SAE H2E vs. looping behavior.
Jouni Malinen [Fri, 6 Dec 2019 15:13:59 +0000 (17:13 +0200)]
SAE: Testing option to ignore H2E requirement mismatch
"SET ignore_sae_h2e_only 1" can now be used to configurate
wpa_supplicant to a test mode where it ignores AP's H2E-required
advertisement and try to connect with hunt-and-pecking loop instead.
This is used only for testing AP behavior with unexpected STA behavior.
Ankita Bajaj [Tue, 19 Nov 2019 13:11:34 +0000 (18:41 +0530)]
ACS: Remove redundant ch_list parameters from do_acs interface
Clean up do_acs interface to not pass ch_list to drivers as the same
information is available in freq_list. The channel numbers are
duplicated between 2.4 GHz and 5 GHz bands and the 6 GHz band. So, use
the QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST to populate only 2.4 GHz and 5 GHz
channels to ensure backwards compatibility with old drivers which do not
have support to decode the newer QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST
attribute.
Jouni Malinen [Tue, 3 Dec 2019 16:22:36 +0000 (18:22 +0200)]
DPP: Bootstrapping via NFC URI Record
This extends hostapd and wpa_supplicant DPP implementation to allow the
bootstrapping URI to be generated for and parsed from an NFC Tag with an
NFC URI Record. This is similar to the way the bootstrapping URI is used
with QR Code for unidirectional authentication.
The DPP_BOOTSTRAP_GEN command uses "type=nfc-uri" to request the URI to
be assigned for NFC URI Record. In practice, the URI is generated
identically to the QR Code case, but the internal entry maintains the
NFC-URI type.
A new command "DPP_NFC_URI <uri>" can now be used to parse the URI read
from an NFC Tag with the NFC URI Record. This is similar to the
DPP_QR_CODE command.
Other commands (mainly, DPP_LISTEN and DPP_AUTH_INIT) are used for NFC
URI in the same way as they are used for QR Code.
Hu Wang [Wed, 23 Oct 2019 09:54:18 +0000 (17:54 +0800)]
Extend hostapd to support setband to driver via QCA vendor command
Commit 844dfeb804af ("QCA vendor command support to set band to driver")
added a vendor command to pass 'SET setband' command information to the
driver in wpa_supplicant. Add similar changes to hostapd control
interface.
hostapd: Register wpa_msg callback even if only global ctrl_iface is used
Previously, wpa_msg_register_cb() was called only from successful
completion of per-interface control interface initialization. This would
leave the callback unregistered in case only the global control
interface is used which would result in not delivering control interface
events on the global interface. Fix this by registering the callback
handler also from successful initialization of the global control
interface.
hostapd: Extend global control interface notifications
Previously, hostapd sent only WPA_MSG_ONLY_GLOBAL type notifications to
the global control interface and all other notifications to
per-interface control interface. Extend this by making it similar to
wpa_supplicant global control interface notifications handling. With
this hostapd now sends all notifications except WPA_MSG_NO_GLOBAL to the
global control interface. In addition, WPA_MSG_PER_INTERFACE type
messages will be prefixed with "IFNAME=<interface name> " while sending
to the global control interface to indicate that the message is
interface specific.
Jouni Malinen [Thu, 28 Nov 2019 22:07:57 +0000 (00:07 +0200)]
SAE H2E: Do not use sae_h2e param in AP mode if SAE is disabled
Previously, nonzero sae_h2e parameter values were used to perform SAE
H2E specific operations (deriving PT, adding RSNXE, adding H2E-only BSS
membership selector) in AP mode even if SAE was not enabled for the
network. This could result in unexpected behavior if sae_pwe=1 or
sae_pwe=2 were set in the configuration. Fix this by making the SAE
operations conditional on SAE being actually enabled.
Jouni Malinen [Thu, 28 Nov 2019 22:06:50 +0000 (00:06 +0200)]
tests: Clear sae_pwe at the end of sigma_dut test cases
sigma_dut does not clear sae_pwe value when the command line argument
"-2" is used, so we need to explicitly clear this from wpa_supplicant at
the end of the test case.
Jouni Malinen [Wed, 27 Nov 2019 13:55:33 +0000 (15:55 +0200)]
Clean up base64_{encode,decode} pointer types
Allow any pointer to be used as source for encoding and use char * as
the return value from encoding and input value for decoding to reduce
number of type casts needed in the callers.
Jouni Malinen [Wed, 27 Nov 2019 13:30:53 +0000 (15:30 +0200)]
Clean up base64_url_{encode,decode} pointer types
Allow any pointer to be used as source for encoding and use char * as
the return value from encoding and input value for decoding to reduce
number of type casts needed in the callers.
Jouni Malinen [Wed, 27 Nov 2019 13:21:28 +0000 (15:21 +0200)]
Simplify base64_url_encode() prototype
There is no use case for adding padding into the base64url encoded
strings, so remove the unneeded add_pad argument that was hardcoded to 0
in all callers.
Jouni Malinen [Sat, 23 Nov 2019 15:39:55 +0000 (17:39 +0200)]
WMM: Do not modify input TSPEC buffer during processing
The WMM TSPEC processor used the input buffer for processing the request
and building the response. This was fine for the FT case, but for the
WMM Action frame case, the input buffer is marked const, so it should
not really be modified. This modification could not really cause any
noticeable harm, but it can result in error reports from fuzzing and
potentially even from some static analyzers.
Fix this by marking the input arguments const more consistently (the
parsed IE was able to drop the const) and copy the const input data to a
temporary buffer for processing and modification instead of allowing the
input data to be modified.
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19050 Signed-off-by: Jouni Malinen <j@w1.fi>
Jouni Malinen [Sat, 23 Nov 2019 15:19:49 +0000 (17:19 +0200)]
tests: Remove a multi-line test description
The previous description of wmediumd_scan_only_one used multiple lines
and that resulted in parallel-vm.py miscounting total number of test
cases. Fix that by getting rid of the newlines from the description.
Jouni Malinen [Sat, 23 Nov 2019 15:09:56 +0000 (17:09 +0200)]
tests: Fix 'unexpected exit' detection in parallel-vm.py
Now that parallel-vm.py is actually stopping VMs as soon as they are not
needed for retries, it is not really an unexpected exit to see a VM exit
while test cases remain in the queue as long as at least that many VMs
remain running. Get rid of confusing 'unexpected exit' status from the
UI in such cases.
Fixes: 4aaddecdd85a ("tests: Handle test retries through the same queue") Signed-off-by: Jouni Malinen <j@w1.fi>
Jouni Malinen [Sun, 17 Nov 2019 19:02:42 +0000 (21:02 +0200)]
tests: ap_hs20_cred_and_no_roaming_consortium to match implementation
Now that wpa_supplicant was modified to use NAI realm query even if
roaming_consortium is set, this test case is actually able to find a
match. Update it to avoid cause incorrect test failures.
HS2.0: Skip check for roaming_consortium for NAI realm query
Previously ANQP fetch considered NAI realm query only when cred block
did not specify roaming_consortium to optimize ANQP operations (NAI
realm list can have a very long value). In certain cases, both NAI realm
and roaming_consortium are configured in credential block and this
resulted in ANQP fetch for NAI realm not being initiated. That could
result in not being able to select the highest priority available
credential/network.
Remove roaming_consortium check for NAI realm query inclusion in ANQP
request so that we will request NAI realm information whenever it can
result in matching additional networks. This makes the ANQP queries more
costly in some cases, but the additional information is needed for
correct behavior in network selection.
Hu Wang [Wed, 13 Nov 2019 04:54:55 +0000 (12:54 +0800)]
P2P: Fix listen state machine getting stuck in send_action() scheduled case
Commit 947b5a1532f9 ("P2P: Stop listen state if Action frame TX is
needed on another channel") added an optimization for P2P response
transmission in certain concurrent operation cases. However, it did not
take into account possibility of the driver not being in listen
state (p2p->drv_in_listen == 0) and could end up getting stuck with the
P2P state machine in a manner that made the device not listen for
following messages. This showed up in following manner in the debug log:
P2P: Starting short listen state (state=SEARCH)
P2P: Driver ended Listen state (freq=2437)
process received frame and send a response
P2P: Stop listen on 0 MHz to allow a frame to be sent immediately on 2437 MHz
P2P: Clear timeout (state=SEARCH)
--> state machine stuck
Fix this by adding drv_in_listen > 0 condition for the optimization to
stop the listen operation in send_action() resulting in scheduled TX.
Fixes: 947b5a1532f9 ("P2P: Stop listen state if Action frame TX is needed on another channel") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Jouni Malinen [Fri, 8 Nov 2019 22:33:58 +0000 (00:33 +0200)]
Fix status code in SAE/DPP association PMKID mismatch (driver-AP-SME)
wpa_validate_wpa_ie() was already extended to cover these cases with
WPA_INVALID_PMKID return value, but hostapd_notif_assoc() did not have
code for mapping this into the appropriate status code
(STATUS_INVALID_PMKID) and ended up using the default
(WLAN_STATUS_INVALID_IE) instead. This caused AP SME-in-driver cases
returning incorrect status code when the AP did not have a matching
PMKSA cache entry. This could result in unexpected station behavior
where the station could continue trying to use a PMKSA cache entry that
the AP does not have and not being able to recover this.
Fix this by adding the previously missed mapping of validation errors to
status/reason codes.
Fixes: 567da5bbd027 ("DPP: Add new AKM") Fixes: 458d8984de1d ("SAE: Reject request with mismatching PMKID (no PMKSA cache entry)") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Eric Caruso [Thu, 17 Oct 2019 23:03:52 +0000 (16:03 -0700)]
Allow scans triggered by D-Bus to use MAC address randomization
wpas_dbus_handler_scan() constructs a set of 'params' each time, but it
doesn't acknowledge the existing randomization settings when doing so.
That means that any D-Bus initiated scans weren't going to follow the
configured settings.
Signed-off-by: Eric Caruso <ejcaruso@chromium.org>
Eric Caruso [Thu, 17 Oct 2019 23:03:50 +0000 (16:03 -0700)]
Move ownership of MAC address randomization mask to scan params
This array can be freed either from the scan parameters or from
clearing the MAC address randomization parameters from the
wpa_supplicant struct. To make this ownership more clear, we have
each struct own its own copy of the parameters.
Signed-off-by: Eric Caruso <ejcaruso@chromium.org>
Johannes Berg [Tue, 8 Oct 2019 12:11:09 +0000 (14:11 +0200)]
tests: Add negative scan tests
There was a bug in wmediumd in that it didn't set the
frequency of frames, and thus they were always received
by mac80211_hwsim, regardless of channel it was on.
Add two tests that verify we only find a single instance
of an AP if we only have that one, and run this both with
and without wmediumd.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jouni Malinen [Sun, 27 Oct 2019 14:20:19 +0000 (16:20 +0200)]
tests: Make wpas_mesh_pmksa_caching_ext more robust
Avoid race conditions in completing mesh group removal/re-addition steps
and starting connectivity check. It seemed to be possible to get to the
connectivity test in some cases before the mesh STA had rejoined the
mesh and completed key configuration.
Export a new 'owe' capability to indicate that wpa_supplicant was
built with OWE support and accepts 'key_mgmt=OWE'. Also, support 'owe'
in the array of BSS' available key managements.
Davide Caratti [Wed, 2 Oct 2019 12:08:41 +0000 (14:08 +0200)]
D-Bus: Fix P2P NULL dereference after interface removal
When the P2P management interface is deleted, P2P is then disabled and
global->p2p_init_wpa_s is set to NULL. After that, other interfaces can
still trigger P2P functions (like wpas_p2p_find()) using D-Bus. This
makes wpa_supplicant terminate with SIGSEGV, because it dereferences a
NULL pointer. Fix this by adding proper checks, like it's done with
wpa_cli.
CC: Beniamino Galvani <bgalvani@redhat.com> CC: Benjamin Berg <benjamin@sipsolutions.net> Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Davide Caratti <davide.caratti@gmail.com>
Mikael Kanstrup [Tue, 1 Oct 2019 14:19:29 +0000 (16:19 +0200)]
nl80211: Indicate SUITE_B_192 capa only when CCMP-256/GCMP-256 supported
SUITE_B_192 AKM capability was indicated for all devices using the
nl80211 driver (without the QCA vendor specific AKM capability
indication). However, some devices can't handle Suite B 192 due to
insufficient ciphers supported. Add a check for CCMP-256 or GCMP-256
cipher support and only indicate SUITE_B_192 capability when such cipher
is supported. This allows compiling with CONFIG_SUITEB192 and still get
proper response to the 'GET_CAPABILITY key_mgmt' command. Under Android
it can also serve as a dynamic way for HAL to query platform for
WPA3-Enterprise 192-bit support.
Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sony.com>
Jouni Malinen [Sun, 27 Oct 2019 12:35:04 +0000 (14:35 +0200)]
SAE: Ignore commit message when waiting for confirm in STA mode
Previously, an unexpected SAE commit message resulted in forcing
disconnection. While that allowed recovery by starting from scratch,
this is not really necessary. Ignore such unexpected SAE commit message
instead and allow SAE confirm message to be processed after this. This
is somewhat more robust way of handling the cases where SAE commit
message might be retransmitted either in STA->AP or AP->STA direction.
Jouni Malinen [Sun, 27 Oct 2019 10:54:40 +0000 (12:54 +0200)]
Do not indicate possible PSK failure when using SAE
wpa_key_mgmt_wpa_psk() includes SAE AKMs. However, with SAE, there is no
way of reaching 4-way handshake without the password having already been
verified as part of SAE authentication. As such, a failure to complete
4-way handshake with SAE cannot indicate that the used password was
incorrect.
Yu Wang [Tue, 15 Oct 2019 09:10:07 +0000 (17:10 +0800)]
Add QCA vendor cmd for setting BT coex chain mode
To config BT coex chain mode, add a new QCA sub command
QCA_NL80211_VENDOR_SUBCMD_BTC_CHAIN_MODE.
This new command has two attributes:
1. QCA_VENDOR_ATTR_COEX_BTC_CHAIN_MODE: u32 attribute. Indicates the
BT coex chain mode, are 32-bit values from enum qca_btc_chain_mode.
2. QCA_VENDOR_ATTR_COEX_BTC_CHAIN_MODE_RESTART: flag attribute.
If set, vdev should be restarted once BT coex chain mode is updated.
Extend QCA OEM data vendor subcmd to allow use as an event
The QCA_NL80211_VENDOR_SUBCMD_OEM_DATA command was previously defined
only to pass data blobs from user space to kernel (application to
firmware) but there was no mechanism to send the data blobs from
firmware to application. Extend this to define use of the same
subcommand and attributes as vendor events.
projects / thirdparty / hostap.git / log
