Jouni Malinen [Sat, 23 Mar 2024 20:22:07 +0000 (22:22 +0200)]
tests: Make rrm_reassociation more robust
It was possible for this test case to fail if a previously executed test
case left another BSS entry for the BSSID used by the second AP here.
That could have skipped the needed scan with scan_for_bss(bssid2). Force
this command to run a new scan to discover the second AP correctly.
Nikita Chernikov [Mon, 11 Mar 2024 16:58:21 +0000 (18:58 +0200)]
nl80211: Fix sending NL80211_CMD_DEL_BEACON command to wrong interface
The NL80211_CMD_DEL_BEACON command was always sent to the main interface
of the radio instead of the desired BSS interface, e.g., when sending a
STOP_AP control interface command from upper layer.
Shailendra Singh [Fri, 23 Feb 2024 11:49:32 +0000 (17:19 +0530)]
Add a vendor attribute per MLO link ratemask bitmap configuration
Define attribute QCA_WLAN_VENDOR_ATTR_RATEMASK_PARAMS_LINK_ID in
enum qca_wlan_vendor_attr_ratemask_params to configure ratemask
per MLO link. If the attribute is not provided, ratemask will be
applied for setup link.
Add QCA vendor sub-command and attribute for spectral scan completion
Add a new QCA vendor sub-command
QCA_NL80211_VENDOR_SUBCMD_SPECTRAL_SCAN_COMPLETE which will be used as a
netlink event to indicate the completion of a spectral scan request.
This event can also be sent incase of the spectral scan request timeout.
To be able to configure the timeout the value, add a new vendor
attribute QCA_WLAN_VENDOR_ATTR_SPECTRAL_SCAN_COMPLETION_TIMEOUT in
enum qca_wlan_vendor_attr_spectral_scan.
Add QCA vendor attribute indicating the spectral transport mode
Add a vendor attribute QCA_WLAN_VENDOR_ATTR_SPECTRAL_DATA_TRANSPORT_MODE
to indicate the current spectral data transport mechanism to be used to
get spectral scan samples from the driver to userspace.
Jouni Malinen [Wed, 20 Mar 2024 16:13:08 +0000 (18:13 +0200)]
tests: Clear scan cache for SAE-EXT-KEY tests
These test cases check the BSS entry information and if the kernel scan
cache maintains an old BSS entry for a previous test case for the same
BSSID this can result in a false failure.
Jouni Malinen [Wed, 20 Mar 2024 09:20:43 +0000 (11:20 +0200)]
Optimize internal BSS table updates based on a specific BSSID
When wpa_supplicant needed to update the internal BSS table with the
latest scan results from the driver, it fetched all BSSs and processed
them all. This is unnecessary for cases where an update is needed only
for a specific BSS. Optimize this by filtering out the unnecessary
entries from the results.
Jouni Malinen [Wed, 20 Mar 2024 09:08:16 +0000 (11:08 +0200)]
Update BSS entry on roaming only for actual BSS frequency change
Commit 117e812d06e6 ("Update BSS table entry if roaming event indicates
frequency change") added wpa_supplicant BSS table update based on the
latest driver scan results whenever processing an association event that
results in the current operating channel changing. While that is needed
to cover the case where an AP changes its own operating channel (and
that is noticed as a roam or new connection instead of a channel switch
event), this should not really be needed for cases where the
wpa_supplicant entry for the new BSS is already up to date.
Skip the full BSS table update on association event if the event is for
a roaming case to a different BSS and the BSS entry for the target is
already available and for the current operating channel. This avoids
undesired latency when processing the association event.
Manoj Sekar [Mon, 26 Feb 2024 12:59:13 +0000 (18:29 +0530)]
Multi-AP: WPS support for different Multi-AP profiles
Update EAP-WSC parameters to include Multi-AP profile info to pass the
profile information through the provisioning steps. This is needed for
provisioning the STA configuration when different profiles are used.
Manoj Sekar [Mon, 26 Feb 2024 12:56:38 +0000 (18:26 +0530)]
Multi-AP: Add support for VLAN related information
Add support to fill "multi_ap_vlanid" info to the hostapd config file.
Add the Multi-AP Default 802.1Q Setting subelement into Multi-AP element
generating and parsing.
Manoj Sekar [Mon, 26 Feb 2024 12:51:33 +0000 (18:21 +0530)]
Multi-AP: Add hostapd config option to disallow certain profiles
Add a new config option "multi_ap_client_disallow" to control allowing
backhaul STA with certain profiles alone to associate. This is done to
adhere to Wi-Fi EasyMesh specification which defined rules to
allow/disallow association of backhaul STA of certain profiles.
Manoj Sekar [Mon, 26 Feb 2024 12:48:21 +0000 (18:18 +0530)]
Multi-AP: Allow supported profile to be configured
Allow both hostapd and wpa_supplicant to be configured with the
supported Multi-AP profile. The configured value will be advertised in
the Multi-AP element.
Jouni Malinen [Tue, 19 Mar 2024 14:44:00 +0000 (16:44 +0200)]
Multi-AP: Use proper length for remaining buffer for the element
Replace the hardcoded buffer length with the actually number of
remaining bytes on the buffer. This is needed to be able to do real
buffer size validation within add_multi_ap_ie().
Furthermore, make hostapd_eid_multi_ap() static since it is not used
outside this file.
Jouni Malinen [Sun, 17 Mar 2024 17:55:11 +0000 (19:55 +0200)]
tests: cfg80211_tx_frame: filter frames based on SA
This makes the test care less likely to fail due to another STA
happening to be listening for Public Action frames and replying to the
P2P GO Negotiation Request.
Jouni Malinen [Sun, 17 Mar 2024 13:20:26 +0000 (15:20 +0200)]
tests: Verify test case function documentation
Check that each test case function includes a title in __doc__ and also
verify that the same test case is not added multiple times from
different files.
Evan Benn [Mon, 4 Mar 2024 02:24:31 +0000 (13:24 +1100)]
DPP: Emit a DPP PB_STATUS event when push button starts
To implement an action script that listens for DPP push button events
and for example blinks a LED it is useful to know when push button has
started. Emit an event when push button starts.
Johannes Berg [Mon, 29 Jan 2024 18:26:39 +0000 (19:26 +0100)]
tests: Set valid configuration for EHT puncturing tests
When puncturing is used on EHT, the HT/VHT/HE channel configuration must
not encompass the punctured subchannel, so must use a lower bandwidth.
Change the puncturing tests accordingly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jouni Malinen [Fri, 8 Mar 2024 08:03:41 +0000 (10:03 +0200)]
Revert "tests: Remove eht_5ghz_80mhz_puncturing_override_1 for now"
This reverts commit eecaceed8f03cee676d47dd9fb70efd25d50e3e9. This test
case can now be restored since hostapd is modified to allow test cases
changes to be done to cover the special impact from EHT puncturing to
available HT/VHT/HE channel bandwidth in this particular case.
Jouni Malinen [Wed, 6 Mar 2024 20:38:09 +0000 (22:38 +0200)]
tests: Remove eht_5ghz_80mhz_puncturing_override_1 for now
mac80211 has been modified to reject the configuration that is used in
this test case. For now, remove this until the puncturing of the second
20 MHz segment can be handled in a manner that allows mac80211 STA to
use EHT.
Jouni Malinen [Wed, 6 Mar 2024 20:34:57 +0000 (22:34 +0200)]
EHT: Use eht_oper_puncturing_override when constructing VHT elements
The testing functionality for overriding EHT puncturing bitmap was
applied only for the EHT elements. The mac80211 has been updated to
enforce compartibility between EHT and HT/VHT information and that made
the related test cases fail. Apply the override value for VHT element
generation to avoid some of those issues.
Jouni Malinen [Wed, 6 Mar 2024 17:32:16 +0000 (19:32 +0200)]
tests: Do not drop HT capability on CS to avoid test failures
Leave the HT capability of the AP as-is when running channel switch test
cases that started failing with a recent kernel change that disconnects
on such "unexpected" change in AP capabilities.
Jouni Malinen [Wed, 6 Mar 2024 15:36:10 +0000 (17:36 +0200)]
tests: Fix fuzzing tester for WNM
Processing of WNM frames can results in a lookup of the current BSS
table. As such, the testing tool needs to initialize the BSS table to
avoid NULL pointer dereferences. This is not an issue that would show up
with real production uses with wpa_supplicant since wpa_bss_init() is
called there.
Credit to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67244 Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Jouni Malinen [Tue, 5 Mar 2024 15:02:45 +0000 (17:02 +0200)]
tests: Update Supported Operating Classes element validation
The wpa_supplicant implementation for building the Supported Operating
Classes element was modified to add support for 80 MHz and wider
bandwidth on the 6 GHz band, 2-octet operating classes, and freq_list on
the 6 GHz band. Update the test cases that verify exact encoding of this
information to match the implementation changes.
Jouni Malinen [Tue, 5 Mar 2024 15:01:30 +0000 (17:01 +0200)]
Handle 6 GHz channels in Supported Operating Classes with freq_list
Only the 2.4 and 5 GHz channels were handled previously when removing
operating classes from the Supported Operating Classes element based on
the freq_list parameter. Extend this to include the 6 GHz band as well.
Jouni Malinen [Tue, 5 Mar 2024 14:07:22 +0000 (16:07 +0200)]
2-octet operating classes in Support Operating Classes element
A previous workaround was used to move the special operating class 130
to the end of the Supported Operating Classes element to avoid getting
any following entry being ignored or misunderstood. That is not really
the correct way of encoding the special cases, i.e., 80+80 MHz channels
that use two nonadjacent frequency segments.
Add support for encoding the 80+80 MHz channel with the 2-octet
operating class design using the Operating Class Duple sequence field of
the Supported Operating Classes element instead of listing the operating
classes that have the 80+ behavior limit set indication in Table E-4
(i.e., opclass 130 and 135) as 1-octet operating classes in the
Operating Classes field.
Fixes: a92660a00e10 ("Work around Supported Operating Classes element issues for 6 GHz") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
Ainy Kumari [Thu, 22 Feb 2024 04:02:04 +0000 (09:32 +0530)]
Extend support for the 6 GHz operating class 137 (320 MHz)
Commit 085a3fc76e6b ("EHT: Add 320 channel width support") added this in
various places, but it did not cover everything. Extend this support to
be more complete. In particular, this allows wpa_supplicant to report
the operating class 137 in the Supported Operating Classes element and
to use it when processing beacon requests.
short_ssid in the own neighbor report might get out of sync, causing
advertising RNR element based on the old SSID, when SSID is changed
either with control interface command SET or with SIGHUP. Therefore,
sync the own report entry by removing the old entry and setting own
report again if the short SSID value has changed.
Michael-CY Lee [Thu, 15 Feb 2024 07:36:41 +0000 (15:36 +0800)]
AP MLD: Set link address only when non-AP MLD is not added to driver
Once the non-AP MLD is added to the driver, the driver handles the
address translation so that hostapd receives Management frames with
SA/DA being translated into MLD MAC addresses.
If the Authentication frmae is retransmitted with transaction being 1,
SA of the retransmitted Authentication frame is translated into the MLD
MAC address by the driver, and then in the function handle_auth(),
sta->mld_info.links[].peer_addr would be replaced by the MLD MAC address
even though it is supposed to be the link address.
Therefore, update the MLD information only when the STA has not yet been
added into the driver to avoid replacing the previously determined link
address with the MLD MAC address.
Fixes: bcbe80a66 ("AP: MLO: Handle Multi-Link element during authentication") Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
Fix INTERFACES command buffer size to allow more data
reply_size instead sizeof(buffer) should be provided to
hostapd_global_ctrl_iface_interfaces() when processing INTERFACES
commands. The previous use of sizeof(buffer) used a significantly
shorter limit (256 vs. 4096 bytes) for the output and this could have
resulted in unnecessary truncation of the output.
Jouni Malinen [Sun, 3 Mar 2024 18:01:27 +0000 (20:01 +0200)]
Use os_snprintf_error() more consistently in STA output generation
In theory, os_snprintf() could return a negative value and as such,
os_snprintf_error() should be used in all cases where the buffer might
not be large enough.
Jouni Malinen [Sun, 3 Mar 2024 17:55:45 +0000 (19:55 +0200)]
Do not change out-of-range configuration parameters
The INT_RANGE() cases for wpa_supplicant global and network profile
parameters ended up changing the configured value to the minimum value
if the provided value was too small or to the maximum value if the
provided value was too large. This does not seem most logical. Change
this to not change the configured value at all if the provided value is
outside the valid range.
Jouni Malinen [Sun, 3 Mar 2024 16:15:18 +0000 (18:15 +0200)]
Enforce valid range check for SET mbo_cell_capa and oce
These parameters have both a separate SET command handler and a global
configuration parameter handler. Only the global configuration parameter
handler for enforcing valid range checking. Do that for the SET command
as well.
Chien Wong [Thu, 29 Feb 2024 13:08:31 +0000 (21:08 +0800)]
wpa_supplicant: Fix ignoring boundary 0 in config parser
The following config file contains invalid items:
----
filter_rssi=1234 # should be rejected
network={
mode=-1 # should be rejected
ssid="ssid"
psk="password"
}
----
But it is accepted by the config parser. The issue is due to using NULL
to represent no limit. If a boundary is set to 0, it's disregarded.
Fix this.
Note that string parser is not affected as length cannot be negative and
we are not limiting any string to be always empty.
Jouni Malinen [Sat, 2 Mar 2024 19:04:30 +0000 (21:04 +0200)]
P2P: Fix pri/sec channel switch skipping for GO
Use of wpa_s->p2p_go_no_pri_sec_switch needs to be conditional on
CONFIG_P2P being defined for the build to avoid a compilation error and
ssid->p2p_group to avoid using this for non-P2P AP mode case in
wpa_supplicant. Furthermore, it is better to clear this flag when
stopping a P2P GO to reduce risk of this getting used for a separate
instance of starting a GO.
Fixes: b18d95759375 ("P2P: Disable pri/sec channel switch for GO with forced frequency") Signed-off-by: Jouni Malinen <j@w1.fi>
Benjamin Berg [Tue, 20 Feb 2024 13:18:27 +0000 (14:18 +0100)]
WNM: Keep BTM information until connection completes
In the MLD case, the information from the transition management request
is relevant during the association process in order to filter out links
that were disallowed by the BTM request. Also, the information remains
useful should a connection attempt fail.
To enable these scenarios, keep the information around until the
connection has completed. As this might make it impossible to establish
a connection, also clear this information at the same time that a normal
BSS ignore is cleared to avoid getting stuck in case the transition
fails unexpectedly.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:26 +0000 (14:18 +0100)]
WNM: Follow BTM procedure if the last link is dropped
If the last link is dropped, it makes sense to follow the BTM procedure.
However, in that case we need to prevent reconnection to this link
specifically, while if the AP MLD is terminating we need to forbid
connecting to the AP MLD.
As such, add a new variable to track the BSSID or AP MLD MAC address.
Which one it refers to depends on whether wnm_link_removal is set.
This also simplifies the check in wnm_is_bss_excluded() and untangles it
from wpa_s->current_bss.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:25 +0000 (14:18 +0100)]
WNM: Remove dialog_token parameter
All callers of wnm_send_bss_transition_mgmt_resp() are explicitly
passing wpa_s->wnm_dialog_token. As such, we might as well not pass it
and use the variable directly.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:23 +0000 (14:18 +0100)]
WNM: Do not store coloc_intf_elems
The elements are (currently) not used except for sending an immediate
response similar to COLOC_INTF_REPORT with the main difference being
that the dialog token is included.
Do not store the elements. It easy enough to re-add this should the
implementation improve. And this fixes the fact that the variable is
cleared at odd times as wnm_deallocate_memory() is used specifically to
clear the neighbor report list of a BTM request.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Avraham Stern [Tue, 20 Feb 2024 13:18:18 +0000 (14:18 +0100)]
WNM: Wait for BTM response TX status before roaming
When accepting a BSS transition request there is a race between
sending the response and roaming to the target AP. As a result,
the response may not be sent because the station deauthenticated
from the AP before the response was actually sent.
To make sure the BSS transition response is sent, start roaming only
after the TX status is received for the BSS transition response.
Signed-off-by: Avraham Stern <avraham.stern@intel.com> Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:16 +0000 (14:18 +0100)]
WNM: Clean up old scan data processing
When receiving a BTM request, wpa_supplicant would try to fetch new
results from the driver, and, independently of that, would also process
the latest scan results that were partially updated by the previous
fetch.
Simplify the logic by using wpa_supplicant_get_scan_results() directly
and then process the old scan data as usual. However, this data may be
outdated, so add a new heuristic to avoid roaming to a BSS if it is
either outdated or bad.
Doing this moves all scan data processing into wnm_scan_process() and
removes duplicated functionality for scan result processing in scan.c.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Jouni Malinen [Sat, 2 Mar 2024 17:37:11 +0000 (19:37 +0200)]
DPP: Wait for TX wait expiration on moving to neg_freq for Auth Resp
Avoid potential race conditions with the driver operations between
stopping an ongoing wait for responses for an offchannel TX that was
used to send Authentication Request with a request to use a different
channel for Authentication Response and the start of a new ROC on the
other channel by waiting for the TX expiration event before issuing the
ROC request.
Jouni Malinen [Sat, 2 Mar 2024 17:34:17 +0000 (19:34 +0200)]
nl80211: Indicate EVENT_TX_WAIT_EXPIRE on match-saved
The event indicating expiration of an offchannel TX is useful for cases
where the wait is for a frame that was explicitly requested to have the
pending cookie to be saved.
Jouni Malinen [Sat, 2 Mar 2024 17:06:15 +0000 (19:06 +0200)]
DPP: Wait for ROC cancelled event on Auth Resp TX on another channel
Avoid potential race conditions with the driver operations between
cancelling an ongoing ROC that was used to receive Authentication
Request that requested a different channel to be used for the
negotiation by waiting for the ROC cancelled event before issuing the
offchannel TX command for the Authentication Response.
In addition, speed up the retry on Authentication Response in this type
of a case if the first attempt on the other channel is not AKC'ed since
it might take the peer device a bit more time to be ready to listen
there.
Benjamin Berg [Tue, 20 Feb 2024 13:18:14 +0000 (14:18 +0100)]
nl80211: Use valid_links bitmask for bss->links array
Most places in the codebase use a valid_links bitmask with an array.
Switch the bss->links array to use the same design with the Link ID
being used as the array index instead of having a link_id inside.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:12 +0000 (14:18 +0100)]
Use for_each_link() in most cases
This was done using the below semantic patch. There are a few more
places that were missed due to variable declarations or additional
checks in the for loop.
@@
iterator name for_each_link;
identifier max_links =~ "MAX_NUM_MLD_LINKS|MAX_NUM_MLO_LINKS";
expression links;
expression further_tests;
identifier i;
statement stmt;
@@
-for (i = 0; i < max_links; i++)
+for_each_link(links, i)
{
(
- if (!(links & BIT(i)))
- continue;
...
|
- if (!(links & BIT(i)) || further_tests)
+ if (further_tests)
continue;
...
|
- if (further_tests || !(links & BIT(i)))
+ if (further_tests)
continue;
...
|
- if (links & BIT(i))
stmt
|
- if (further_tests && (links & BIT(i)))
+ if (further_tests)
stmt
|
- if ((links & BIT(i)) && further_tests)
+ if (further_tests)
stmt
)
}
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:11 +0000 (14:18 +0100)]
common: Introduce for_each_link() macro
This is a simple macro iterating the given bitmask using the given
variable. Having the macro avoids the for loop-continuation making it
more readable overall.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Benjamin Berg [Tue, 20 Feb 2024 13:18:10 +0000 (14:18 +0100)]
nl80211: Fix link indexing in nl80211_connect_common()
In some places the wrong index variable was used to access the link
configuration. Fix this by simply using link_id instead of i.
With this, the i loop variable is not needed anymore. We can simply
always pass 0 to nla_nest_start(). Also, the kernel does not care about
the order that the links are provides, so just remove the special
handling for the association link.
Fixes: a2c4c0b1b6bb ("nl80211: Support MLD association request") Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Ilan Peer [Tue, 20 Feb 2024 13:18:09 +0000 (14:18 +0100)]
nl80211: Explicitly differentiate between 5 GHz and 6 GHz modes
When a device supports both the 5 GHz band and the 6 GHz band,
these are reported as two separate modes, both with mode set to
HOSTAPD_MODE_IEEE80211A. However, as these are different modes,
each with its own characteristics, e.g., rates, capabilities etc.,
specifically differentiate between them by adding a flag to indicate
whether the mode describes a 6 GHz band capabilities or not.
Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Sunil Ravi [Thu, 29 Feb 2024 01:36:40 +0000 (01:36 +0000)]
P2P: Notify the IP address of the connected P2P Client
When wpa_supplicant assigns the IP address (WFA EAPOL IP address
allocation feature), the assigned IP address of the P2P Client on the GO
side is notified in the AP-STA-CONNECTED event. So to obtain the IP info
to external programs, modify the STA authorized event to include the the
assigned IP address of the P2P Client.
Test: Establish P2P connection and verified from the logs that
the P2P Client IP address is notified. Signed-off-by: Sunil Ravi <sunilravi@google.com>
Sunil Ravi [Mon, 3 Oct 2022 00:53:41 +0000 (00:53 +0000)]
P2P: Disable pri/sec channel switch for GO with forced frequency
When wpa_supplicant receives a request to start a P2P group owner on a
fixed frequency with bandwidth wider than 20 MHz, wpa_supplicant scans
for neighboring BSSs prior to starting the GO. This is done to switch
the primary/secondary channels if there are any other networks which are
operating on the same secondary channel. Though this logic is defined
for 20/40 MHz coexistence and might improve throughput, there are P2P
use cases where this logic causes problem:
1. The file transfer use case takes time to start the file transfer or
even fails when the 20/40 coex scan repeatedly fails due to an
ongoing externally triggered scan happening in the system.
2. wpa_supplicant overrides the channel which is selected by the
application based on the best channel it derived by looking into
the channel conditions. This degrades the expected throughput.
3. Latency sensitive applications experience long time to
start the group owner which gives a bad user experience.
So do not allow 40 MHz co-ex PRI/SEC switch to force a change to
Autonomous GO PRI channel when the P2P group add is called with a forced
frequency.
Test: Tested autonomous GO and confirmed from the logs that
P2P GO is not triggering 20/40 coex scan.
Jouni Malinen [Thu, 29 Feb 2024 09:55:31 +0000 (11:55 +0200)]
tests: Make ap_wpa2_gtk_rekey_fail_1_sta more robust
Slight differences in timing might make the final data connectivity
check fail, so disable the incorrect behavior first and wait for a
successfully completed GTK rekeying at the end before the final test.
projects / thirdparty / hostap.git / log
