Interworking: Fix network selection warning without SIM/USIM support
interworking_credentials_available_3gpp() would have left excluded2
uninitialized without INTERWORKING_3GPP in the build. This could result
in a static analyzer warning within
interworking_credentials_available_helper() about use of uninitialized
variable. Get rid of that warning by explicitly initializing excluded2
even though this does not really result in any difference in behavior
since the excluded2 value would be used only if the non-NULL is returned
and that could not have been the case here without INTERWORKING_3GPP.
Michael Braun [Sun, 26 Apr 2015 12:22:56 +0000 (14:22 +0200)]
tests: Change vlan_id back and forth
Enhance test ap_vlan_wpa2_radius_id_change to change the VLAN-ID
back as a last step. This ensures that the wpa_group for VLAN-ID 1
did not enter FATAL_FAILURE state during the test.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Michael Braun [Sun, 26 Apr 2015 12:22:55 +0000 (14:22 +0200)]
Remove WPA per-VLAN groups when no more stations remain
Previously, struct wpa_group was created when the first station enters
the group and the struct wpa_group was not freed when all station left
the group. This causes a problem because wpa_group will enter
FATAL_FAILURE when a wpa_group is running while the AP_VLAN interface
has already been removed.
Fix this by adding a reference counter to struct wpa_group and free a
group if it is unused.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
In addition, this adds some delay between the authentication and data
connectivity test through the newly added VLAN and by doing so, makes
ap_vlan_wpa2_radius_id_change a bit more robust. It was possible for the
EAPOL-Key message 4/4 not having yet been processed by hostapd at the
time the data test started.
Make VLAN ID available in STA info over control interface
If hostapd has bound a STA into a specific VLAN, the new vlan_id
parameter in the control interface STA command can now be used to check
which VLAN ID is in use.
P2P: Allow wpa_supplicant to start if social channels are not supported
It was possible for an nl80211-based driver to be determined to support
P2P even when the radio supports only the 5 GHz band. This resulted in
P2P initialization failing due to not being able to pick a social
channel and wpa_supplicant not starting. Fix this by not enabling P2P,
but still allowing wpa_supplicant initialization to complete.
Signal strength meter uses non-standard icons (not included in the
freedesktop icon specification), which might not be available in all
icon sets on the market. What's more, according to the latest Ubuntu
practices, in the status-like places one should use symbolic icons.
Unfortunately not all icon sets provide them.
In order to overcome this inconsistency, we are going to try to load
more than one icon from the current theme in the fallback-like
fashion.
Mike Gerow [Thu, 16 Apr 2015 00:57:51 +0000 (17:57 -0700)]
OpenSSL: Try to ensure we don't throw away the PIN unnecessarily
Now on an engine error we decode the error value and determine if the
issue is due to a true PIN error or not. If it is due to incorrrect PIN,
delete the PIN as usual, but if it isn't let the PIN be.
mesh: Retransmit the last Commit Message in the Committed state
Previously, mesh state machine transmits updated Commit Message when
receiving a Confirm Message in Committed state. According to the
standard, it should (re)send the latest Commit Message previously sent.
IEEE Std 802.11-2012, 11.3.8.6.4 Protocol instance behavior - Committed
state:
"Upon receipt of a Con event, ... If Sync is not greater than
dot11RSNASAESync, the protocol instance shall increment Sync, transmit
the last Commit Message sent to the peer, and set the t0
(retransmission) timer."
WPS: Use shorter authentication timeout during no-SelReg iteration
When iterating through WPS APs that do not advertise Selected Registrar
TRUE, limit the authentication timeout to 10 seconds instead of the full
70 second value used with IEEE 802.1X/EAP/WPS in general. This helps
speed up AP iteration for cases where a selected AP misbehaves and does
not reply to EAP exchanges. This should not really be needed, but there
seems to be deployed APs that do not implement WPS correctly and with
such APs in the radio range, this extra timeout can speed up the
iteration to allow the correct AP to be found before the WPS operation
times out.
Hu Wang [Fri, 24 Apr 2015 12:53:08 +0000 (15:53 +0300)]
WPS: Enforce five second minimum time before AP iteration
Previously, wpa_supplicant was using number of scan iterations
(WPS_PIN_SCAN_IGNORE_SEL_REG = 3) to give some time for finding a WPS AP
with Selected Registrar TRUE before starting to iterate through all WPS
APs. While this works fine in most cases, some drivers may return the
initial three scan results so quickly that the total amount of time is
only couple of seconds in case none of the APs are initially advertising
Selected Registrar TRUE. To give some more time for APs (WPS Registrars)
to become ready, add an additional constraint on the iteration based on
time (WPS_PIN_TIME_IGNORE_SEL_REG = 5 seconds).
The time before trying to associate with an AP that does not advertise
Selected Registrar TRUE is going to be incremented, so increase the
autogo_m2d timeout to avoid reporting incorrect errors due to missing
M2D events.
nl80211: Extend unique MAC address assignment for station iftype
Previously, only P2P and mesh use cases enforced unique MAC address for
a dynamically added virtual interface. Extend this to cover normal
station mode interfaces since those can now be added with INTERFACE_ADD.
WPS: Explicitly reject Public Key attribute with unexpected length
There is no need to try to derive DH shared key with a peer that tries
to use too short or too long DH Public Key. Previously, such cases ended
up implicitly getting rejected by the DH operations failing to produce
matching results. That is unnecessarily, so simply reject the message
completely if it does not have a Public Key with valid length. Accept
couple of octets shorter value to be used to avoid interoperability
issues if there are implementations that do not use zero-padding
properly.
WPS: Truncate variable length string attributes to maximum length
This enforces variable length strings Manufacturer, Model Name, Model
Number, and Serial Number to be within the maximum length defined in the
WSC specification. While none of the existing users for these within
hostapd/wpa_supplicant had problems with longer strings, it is good to
ensure the strings are not longer to avoid potential issues at higher
layer components.
FT: Check FT, MD, and Timeout Interval length in the parser
All the existing users of these elements were already validating the
element length. However, it is clearer to validate this already at the
parser for extra layer of protection for any future changes.
Should there not be enough room in the output buffer, the
bss_basic_rate_set line would not be printed. This error case was
handled otherwise, but the temporary memory allocation for building the
information was not freed.
tdls_verify_mic() and tdls_verify_mic_teardown() could have tried to
read the 16-octet FTIE MIC when processing a TDLS frame even if the
received FTIE is truncated. At least in theory, this could result in
reading couple of octets beyond the frame buffer.
FT: Fix WMM TSPEC validation in driver-based AP MLME case
Commit 88b32a99d30894b2d6bb391371c442fc117edbab ('FT: Add FT AP support
for drivers that manage MLME internally') added an alternative way of
processing the WMM TSPEC from RIC. However, that change did not seem to
include the same checks for WMM TSPEC element length that were used in
the original implementation for MLME-in-hostapd case. Fix this by
sharing the older implementation of copying the WMM TSPEC from RIC for
both cases.
It looks like the destination buffer for the response is sufficiently
long for the fixed length copy, but it may have been possible to trigger
a read beyond the end of the FTIE by about 50 bytes. Though, that seems
to be within the buffer received for RX buffer in the case that uses
this driver-based AP MLME design for FT.
wlantest: Fix Beacon and Probe Response frame parser
These functions did not verify that the received frame is long enough to
contain the beginning of the variable length IE area. A truncated frame
could have caused a segmentation fault due to reading beyond the buffer.
This program can be used to run fuzzing tests for areas related to P2P
message parsing and processing. p2p-fuzzer allows data files to be used
to inject Probe Response and Action frames for processing by the P2P
module.
P2P: Use WPS_SEC_DEV_TYPE_MAX_LEN in P2P array definition
This makes it more obvious that the wps_parse_msg() bounds checking is
used to verify that there is sufficient space in the P2P buffer for the
secondary device types.
While it looks like all the users of this parsed attribute were able to
handle longer SSID values, there is no valid use case for these and to
avoid any potential future issues, enforce maximum length (32 bytes) on
the SSID during parsing.
While it looks like all the users of this parsed attribute were able to
handle longer Device Name values, there is no valid use case for these
and to avoid any potential issues in upper layer components, enforce
maximum length (32 bytes) on the Device Name during parsing.
P2PS: Check for maximum SSID length in Persistent Group Info
While none of the current users of msg.persistent_ssid{,_len} would have
issues with too long SSID value, it is safer to enforce bounds checking
on the SSID while parsing the attribute to avoid any potential issues in
the future.
The SSID element is defined to have a valid length range of 0-32. While
this length was supposed to validated by the users of the element
parser, there are not really any valid cases where the maximum length of
32 octet SSID would be exceeded and as such, the parser itself can
enforce the limit as an additional protection.
P2P: Validate SSID element length before copying it (CVE-2015-1863)
This fixes a possible memcpy overflow for P2P dev->oper_ssid in
p2p_add_device(). The length provided by the peer device (0..255 bytes)
was used without proper bounds checking and that could have resulted in
arbitrary data of up to 223 bytes being written beyond the end of the
dev->oper_ssid[] array (of which about 150 bytes would be beyond the
heap allocation) when processing a corrupted management frame for P2P
peer discovery purposes.
This could result in corrupted state in heap, unexpected program
behavior due to corrupted P2P peer device information, denial of service
due to process crash, exposure of memory contents during GO Negotiation,
and potentially arbitrary code execution.
Thanks to Google security team for reporting this issue and smart
hardware research group of Alibaba security team for discovering it.
The multi-SSID design that used a single beaconing BSSID with multiple
SSIDs was never completed in this repository, so there is no need to
maintain the per-STA ssid/ssid_probe pointers that could only point to
&hapd->conf->ssid. Save some memory and reduce code complexity by
removing this unused partial capability.
Commit fa0e715100b0e6fd956b6de67c3cdf908437436a ('Use
tls_connection_prf() for all EAP TLS-based key derivation') copied some
pointer checks from the generic implementation to tls_openssl.c.
However, these are arrays and cannot be NULL in OpenSSL data. Remove the
unnecessary checks and add master_key_length check for completeness.
(CID 109619).
eap_example: Fix configuration by added DH parameters
The internal TLS implementation supports number of additional cipher
suites that require DH parameters to be set on the server. Such a cipher
suite is selected by default in the eap_example case which prevented the
TLS handshake from completing successfully. Fix this by adding DH
parameters to the server configuration.
Michael Braun [Fri, 10 Apr 2015 12:49:45 +0000 (14:49 +0200)]
tests: Verify RSN preauth with dynamic VLANs
This change add two new tests to verify hostapd operation when used with
VLANs. Both are based on pmksa_cache_preauth and enable dynamic VLANs,
pmksa_cache_preauth_vlan_used additionally uses a station with VID 1.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Michael Braun [Fri, 10 Apr 2015 12:49:50 +0000 (14:49 +0200)]
Remove VLAN interface on STA free
Currently, vlan_remove_dynamic() is only called when the station VLAN ID
is changed (ap_sta_bind_vlan), but not when the station is freed. So
dynamic VLAN interfaces are not removed actually except within 1x
reauthentification VLAN ID change, although most of the code is already
there.
This patch fixes this by calling vlan_remove_dynamic() in ap_free_sta().
It cannot just use sta->vlan_id for this, as this might have been
changed without calling ap_sta_bind_vlan() (ap/ieee802_11.c:handle_auth
fetches from RADIUS cache for WPA-PSK), thus reference counting might
not have been updated. Additionally, reference counting might get wrong
due to old_vlanid = 0 being passed unconditionally, thus increasing the
reference counter multiple times.
So tracking the currently assigned (i.e., dynamic_vlan counter
increased) VLAN is done in a new variable sta->vlan_id_bound. Therefore,
the old_vlan_id argument of ap_sta_bind_vlan() is no longer needed and
setting the VLAN for the sta in driver happens unconditionally.
Additionally, vlan->dynamic_vlan is only incremented when it actually
is a dynamic VLAN.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Michael Braun [Fri, 10 Apr 2015 12:49:49 +0000 (14:49 +0200)]
vlan: Ignore multiple NEWLINK messages
hostapd receives NEWLINK messages multiple times and thus does
configuration of the the vlan interface multiple times.
This is not required and leads to the following during cleanup in
test pmksa_cache_preauth_vlan_used:
1. run-test.py does: brctl delif brvlan1 wlan3.1
2. hostapd processes NEWLINK and does: brctl addif brvlan1 wlan3.1
3. run-test.py does: brctl delbr brvlan1
-> fails as wlan3.1 is still in the bridge
This patch fixes this by ignoring repeated NEWLINK messages.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Michael Braun [Fri, 10 Apr 2015 12:49:48 +0000 (14:49 +0200)]
vlan: Ignore DELLINK on interfaces that exists
When hitting
> Failed to create interface wlan3.1: -23 (Too many open files in system)
> Try to remove and re-create wlan3.1
hostapd deletes the AP_VLAN interface and then recreates it. Thus the
kernel assigns the same ifidx to the new interfaces and sends DELLINK
and NEWLINK mesages.
As the DELLINK messages are processed after the struct hostapd_vlan is
added, hostapd deletes the struct hostapd_vlan entry, deconfigures the
AP_VLAN interface and leaves vlan_newlink nothing to find afterwards.
So this patch makes DELLINK messages to be ignored when the interface
exists.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Michael Braun [Fri, 10 Apr 2015 12:49:47 +0000 (14:49 +0200)]
Fix STA VLAN bind for RSN pre-authentication case
Previously, during RSN preauthentication, ap_sta_bind_vlan() was called,
which fails for non-zero sta->vlan_id as the station is not known to the
kernel driver.
Fix this by binding the station only if it is associated. If it is not
associated, ap_sta_bind_vlan() will be done later during association.
In addition, reject Access-Accept if the returned VLAN ID is not valid
in the current hostapd configuration.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
dbus: Fix WPS property of fi.w1.wpa_supplicant1.BSS interface
The dbus interface documentation says the following about the
WPS property of the fi.w1.wpa_supplicant1.BSS interface:
==
WPS information of the BSS. Empty dictionary indicates no WPS support.
Dictionary entries are:
Type s "pbc", "pin", ""
==
However the implementation returns "type" => "" for BSSes
that do not support WPS.
Fix the implementation to match the documentation.
Return empty dictionary if there is no WPS support.
And "type" => "" if WPS is supported, but is not in progress
right now.
Nick Kralevich [Sun, 12 Apr 2015 20:20:26 +0000 (13:20 -0700)]
Updates for stricter automatic memcpy bounds checking
Both Android's libc and glibc support _FORTIFY_SOURCE, a compiler
and libc feature which inserts automatic bounds checking into
common C functions such as memcpy() and strcpy(). If a buffer
overflow occurs when calling a hardened libc function, the
automatic bounds checking will safely shutdown the program and
prevent memory corruption.
Android is experimenting with _FORTIFY_SOURCE=3, a new fortify
level which enhances memcpy() to prevent overflowing an element
of a struct. Under the enhancements, code such as
int main() {
foo myfoo;
int n = atoi("11");
memcpy(myfoo.a, "01234567890123456789", n);
return 0;
}
will cleanly crash when the memcpy() call is made.
Fixup hostap code to support the new level. Specifically:
* Fixup sha1_transform so it works with the enhanced bounds checking.
The old memcpy() code was attempting to write to context.h0, but that
structure element is too small and the write was extending (by design)
into h1, h2, h3, and h4. Use explicit assignments instead of
overflowing the struct element.
* Modify most of the structures in ieee802_11_defs.h to use ISO C99
flexible array members (https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html)
instead of a zero length array. Zero length arrays have zero length,
and any attempt to call memcpy() on such elements will always overflow.
Flexible array members have no such limitation. The only element not
adjusted is probe_req, since doing so will generate a compile time error,
and it's not obvious to me how to fix it.
Ben Greear [Fri, 3 Apr 2015 23:34:33 +0000 (19:34 -0400)]
Fix INTERFACE_ADD parsing
This fixes a regression caused by commit efa232f9159e33e18ed624906b0093e11ddcf78e ('Add support for virtual
interface creation/deletion') for the case where an empty extra argument
is included.
Signed-off-by: Ben Greear <greearb@candelatech.com>
hlr_auc_gw: Allow Milenage RES length to be reduced
Some USIM use shorter RES length than the 64-bit default from Milenage.
Such cases did not interoperate with the hlr_auc_gw implementation. Make
it possible to configure the RES length 4..8 octets, i.e., 32 to 64
bits) to support such USIM.
Jason Abele [Fri, 3 Apr 2015 00:30:48 +0000 (17:30 -0700)]
wpa_supplicant: Clear blacklist on connect
It has been noticed that the band steering/load balancing of some
multi-AP networks will lead to an ever-growing list of blacklisted
BSSIDs. This eventually leads to a connection drop when the connection
is pushed to a distant AP.
Fix this issue by clearing the blacklist upon successful connect.
Mark Salyzyn [Wed, 1 Apr 2015 00:58:11 +0000 (17:58 -0700)]
Android: wpa_ctrl missing include for sys/stat.h
wpa_ctrl.c gets sys/stat.h inherited from
private/android_filesystem_config.h it should
not rely on this in the future. The intent is
to move fs_config function into libcutils and
thus deprecate any need for sys/stat.h in this
include file.
Dmitry Shmidt [Mon, 30 Mar 2015 20:44:11 +0000 (13:44 -0700)]
Reschedule scan from wpas_stop_pno if it was postponed
This reschedules the postponed scan request (if such a request is
pending) from EVENT_SCHED_SCAN_STOPPED event handler to speed up
scanning after PNO/sched_scan stop has been requested.
Jouni Malinen [Tue, 31 Mar 2015 13:17:48 +0000 (16:17 +0300)]
TLS: Fix memory leaks on tls_connection_set_params() error paths
The internal TLS implementation started rejecting number of unsupported
configuration parameters recently, but those new error paths did not
free the allocated tlsv1_credentials buffer.
Jouni Malinen [Tue, 31 Mar 2015 13:15:39 +0000 (16:15 +0300)]
Make tls_connection_get_keyblock_size() internal to tls_*.c
This function exposes internal state of the TLS negotiated parameters
for the sole purpose of being able to implement PRF for EAP-FAST. Since
tls_connection_prf() is now taking care of all TLS-based key derivation
cases, it is cleaner to keep this detail internal to each tls_*.c
wrapper implementation.
Jouni Malinen [Tue, 31 Mar 2015 12:52:40 +0000 (15:52 +0300)]
Remove master key extraction from tls_connection_get_keys()
This is not needed anymore with the tls_connection_prf() being used to
handle all key derivation needs. tls_connection_get_keys() is a bit
misnamed for now, but it is only used to fetch the client and server
random for Session-Id derivation.
Jouni Malinen [Tue, 31 Mar 2015 12:47:32 +0000 (15:47 +0300)]
Use tls_connection_prf() for all EAP TLS-based key derivation
tls_openssl.c is the only remaining TLS/crypto wrapper that needs the
internal PRF implementation for EAP-FAST (since
SSL_export_keying_material() is not available in older versions and does
not support server-random-before-client case). As such, it is cleaner to
assume that TLS libraries support tls_connection_prf() and move the
additional support code for the otherwise unsupported cases into
tls_openssl.c.
Jouni Malinen [Mon, 30 Mar 2015 09:58:41 +0000 (12:58 +0300)]
Rename HT 20/40 coex variable to be more descriptive
is_ht_allowed is a confusing name since this variable is used to track
whether 40 MHz channel bandwidth is allowed instead of whether HT is
allowed in general.
projects / thirdparty / hostap.git / log
