Jouni Malinen [Sat, 3 Dec 2011 11:20:40 +0000 (13:20 +0200)]
Update internal MAC address on EVENT_INTERFACE_ENABLED events
This allows the MAC address of the interface to be changed when the
interface is set down even if the interface does not get completed
removed and re-added.
Johan Hedlund [Sat, 3 Dec 2011 11:02:57 +0000 (13:02 +0200)]
Update RSN supplicant MAC address on driver reinitialization
I have a test case where I remove and insert another network adapter
between two connections to AP. The interface get the same interface name
but switches macadresses between the connections. When running WPA2 I
got a failure in EAPOL negotiation and found out that the reason for
this was that the supplicant did not update the MAC address in the
correct place.
Jouni Malinen [Thu, 1 Dec 2011 20:12:03 +0000 (22:12 +0200)]
wpa_supplicant AP: Allows passphrase to be fetched
"wpa_cli status wps" can now be used to fetch the WPA2-Personal
passphrase from AP mode operation with wpa_supplicant to make it
easier to meet WPS requirements for legacy STA support.
Jouni Malinen [Thu, 1 Dec 2011 19:46:19 +0000 (21:46 +0200)]
WPS: Disable WPS(v2) in WPA/TKIP-only configuration
When using wpa_supplicant AP mode, WPS support is enabled by default for
WPA/WPA2-Personal. Change this to enforce the WPS2 rules on not allowing
WPS to be used with WPA/TKIP-only configuration (i.e., at minimum, mixed
mode with WPA/TKIP and WPA2/CCMP has to be used for WPS to be enabled).
Jouni Malinen [Thu, 1 Dec 2011 16:22:56 +0000 (18:22 +0200)]
Call wpas_connection_failed() only if actually trying to connect
A disconnection event from the driver may end up getting delivered at a
time when wpa_supplicant is not even trying to connect (e.g., during a
scan that was already started after WPS provisioning step). In such a
case, there is not much point calling wpas_connection_failed() and
skipping this avoids confusing attempts of re-starting scanning while
the previous scan is still in progress.
Jouni Malinen [Thu, 1 Dec 2011 08:46:06 +0000 (10:46 +0200)]
P2P: Clear show_group_started on GO start
The show_group_started variable could be left to 1 based on an earlier
failed attempt to start P2P client operation. This can result in
unexpected P2P-GROUP-STARTED event when a GO is started without group
formation (e.g., re-invoke a persistent group or start an autonomous
GO). Avoid this by explicitly clearing show_group_start when setting up
the GO.
A new hostapd.conf parameter, wps_rf_bands, can now be used to fix the
RF Bands value in cases where hw_mode is not set or when operating a
dual band dual concurrent AP.
Subrat Dash [Wed, 30 Nov 2011 14:48:14 +0000 (16:48 +0200)]
WPS: Fix stopping of active WPS operation on dual concurrent AP
When hostapd controls multiple radios, WPS operations are started on
all interfaces. However, when the provisioning run had been completed
successfully, actiove WPS mode was stopped only a single interface. Fix
this to iterate through all interfaces so that this is handled
consistently with the starting of WPS operation.
Jouni Malinen [Wed, 30 Nov 2011 12:44:23 +0000 (14:44 +0200)]
WPS ER: Fix segfault in some selected registrar change cases
Commit 628d54639a90f779fd5c98c31e049638de56b17e introduced number
of new WPS related ctrl_iface messages to hostapd. Some of these
were for ER events which do not make any sense to hostapd that
cannot operate as an ER. The WPS_EV_ER_SET_SELECTED_REGISTRAR one
from wps_registrar_sel_registrar_changed_event() was especially
problematic since it can cause wpa_supplicant ER code segfault due
to missing event data.
Arik Nemtsov [Tue, 29 Nov 2011 21:45:07 +0000 (23:45 +0200)]
Set ht_capab from based on driver capabilities when in P2P GO mode
Set the HT capabilities of a P2P GO according to the wiphy supported
ones. Mask-in a white-list of HT capabilities that won't cause problems
for non-supporting stations.
Jouni Malinen [Tue, 29 Nov 2011 18:05:58 +0000 (20:05 +0200)]
Increase min sched_scan interval from 2 to 10 seconds
Trying to run sched_scan round every two seconds by defaults sounds way
too frequent since dualband cards are unlikely to be able to complete
the full scan cycle in two seconds. For now, set the hardcoded value to
10 seconds to make this somewhat more reasonable.
Dmitry Shmidt [Wed, 23 Nov 2011 14:29:28 +0000 (16:29 +0200)]
Android: nl80211: Add Android specific PNO configuration
This is based on the Android driver_cmd changes that are converted to
use the sched_scan/stop_sched_scan driver_ops for the case where the
driver does not support the new nl80211 commands.
Dmitry Shmidt [Fri, 25 Nov 2011 19:49:03 +0000 (21:49 +0200)]
Android: wext: Add sched_scan functions for PNO
(jm: This is based on the Android change that used driver_cmd. The same
implementation is used for the actual driver interface, but the commands
are now accessed through sched_scan/stop_sched_scan driver_ops instead
of driver_cmd)
Jouni Malinen [Mon, 28 Nov 2011 16:36:36 +0000 (18:36 +0200)]
Use normal scan before sched_scan if that can speed up connection
When normal scan can speed up operations, use that for the first three
scan runs before starting the sched_scan to allow user space sleep more.
We do this only if the normal scan has functionality that is suitable
for this or if the sched_scan does not have better support for multiple
SSIDs.
Jouni Malinen [Mon, 28 Nov 2011 16:12:38 +0000 (18:12 +0200)]
Add broadcast SSID for sched_scan for scan_ssid=0 networks
Previously, only networks with scan_ssid=1 were included in sched_scan.
This needs to behave similarly to the normal scan where broadcast SSID
is used to find networks that are not scanned for with a specific SSID.
Jouni Malinen [Mon, 28 Nov 2011 15:52:36 +0000 (17:52 +0200)]
Drop sched_scan filter if not enough match sets supported
Instead of including only a single SSID in the sched_scan request if
the driver does not support match sets, just drop the SSID filter and
configure more SSIDs up to the sched_scan limit.
Jouni Malinen [Mon, 28 Nov 2011 14:32:44 +0000 (16:32 +0200)]
Add preferred network offload (PNO) functionality
"SET pno <1/0>" ctrl_iface command can now be used to start/stop PNO
with sched_scan driver commands. This will request offloading of
scanning to find any of the enabled networks in the configuration.
Add support for generating and verifying RFC 3447 RSASSA-PKCS1-v1_5
style DigestInfo for TLS v1.2 CertificateVerify. For now, this is
hardcoded to only support SHA256-based digest.
Jouni Malinen [Sun, 27 Nov 2011 19:45:07 +0000 (21:45 +0200)]
TLS: Add build configuration for TLS v1.2 support
This allows the internal TLS implementation to be built for TLS v1.2
support. In addition to the build option, this changes the TLS PRF
based on the negotiated version number. Though, this commit does not
yet complete support for TLS v1.2.
Jouni Malinen [Sun, 27 Nov 2011 19:27:01 +0000 (21:27 +0200)]
Rename tls_prf() to tls_prf_sha1_md5()
Prepare for multiple TLS PRF functions by renaming the SHA1+MD5 based
TLS PRF function to more specific name and add tls_prf() within the
internal TLS implementation as a wrapper for this for now.
P2P: Send STA connected/disconnected events to parent ctrl_iface
Send the connection events from P2P group to both the group interface
and parent interface ctrl_ifaces to make it easier for external monitor
programs to see these events without having to listen to all group
interfaces when virtual group interfaces are used.
Jouni Malinen [Fri, 25 Nov 2011 15:46:00 +0000 (17:46 +0200)]
nl80211: Do not set sched_scan filter if driver does not support it
cfg80211 will reject the NL80211_CMD_START_SCHED_SCAN if too many
match sets are requested. To avoid being completely unable to start
any scheduled scans, skip setting these filters if the driver did
not advertise support for large enough number of match sets.
Jouni Malinen [Thu, 24 Nov 2011 20:30:15 +0000 (22:30 +0200)]
Do not save an invalid network block in wpa_supplicant.conf
wpa_supplicant is going to reject a configuration file that uses
WPA/WPA2-Personal (the default key_mgmt), but does not define
passphrase/PSK. Refuse to save such a configuration to avoid getting
stuck with a configuration that wpa_supplicant will reject.
Jouni Malinen [Thu, 24 Nov 2011 20:05:33 +0000 (22:05 +0200)]
WPS: Include WSC IE in (Re)Association Response for maybe-WPS case
If the station is indicating use of WPS, WSC IE should be added into the
(Re)Association Response frame. This is clear for the case when WSC IE
was included in the (Re)Association Request frame. However, even the
WLAN_STA_MAYBE_WPS case may actually indicate use of WPS. Assume that to
be the case when WPA/WPA2 is enabled (i.e., when the STA does not
include WPA/RSN/WSC IE while AP has WPA/RSN enabled).
Jouni Malinen [Sun, 20 Nov 2011 10:53:29 +0000 (12:53 +0200)]
Move wpa_sm_remove_pmkid() call to PMKSA cache entry freeing
This makes it clearer that the PMKSA caching entry gets removed from
the driver regardless of how the internal entry from wpa_supplicant
gets cleared. In practice, this call was skipped only for the case
when the entry for the current AP was being updated, so the previous
version was likely to work with all drivers. Anyway, it is cleaner
to explicitly remove the old entry even in that case before the new
entry gets added.
Jouni Malinen [Sun, 20 Nov 2011 10:42:47 +0000 (12:42 +0200)]
Fix wired EAPOL authenticator
Commit 940a0ce9702095bb079bd97857a2605516f83157 moved the STA associated
check from driver_*.c into ieee802_1x_receive(), but failed to take into
account that wired networks and driver_wired.c do not mark the STA entry
associated. Fix this by skipping the check if the driver wrapper is
using a wired network.
Kel Modderman [Sat, 19 Nov 2011 18:10:37 +0000 (20:10 +0200)]
wpa_gui-qt4: Improve scan results signal display
Display signal strength in dBm with visual indicator in the form of a
bar for scan results displayed by wpa_gui-qt4. Any signal > -35dBm is
treated as full signal bar, signals between range of -95<->-35dBm are
displayed linearly. Convert WEXT signal level value to scale that
nl80211 typically reports in dBm. The condition which differentiates
8-bit WEXT dBm and regular dBm is probably fragile, but there is
currently no way to know what the driver is going to report for signal
strength.
Jouni Malinen [Sat, 19 Nov 2011 17:15:10 +0000 (19:15 +0200)]
P2P: Send Listen state Probe Response frames without retries
Use the no-ACK send_mlme request to transmit Probe Response frames
in P2P Listen state. This reduces number of unnecessary transmissions
if the peer device has already moved away from the channel. It will most
likely go through Search state multiple times anyway, so even if the
response were to be lost, a new retry will happen at higher layer.
Helmut Schaa [Sat, 19 Nov 2011 17:09:49 +0000 (19:09 +0200)]
Avoid excessive probe response retries
Some client implementations only wait a few ms after sending a probe
request while scanning. Since probe responses are always sent at a low
rate this can eat quite some airtime and it might be impossible to get
the frame out before the client leaves the channel again. If the client
leaves before all probe reponses where acked this can cause the probe
reponse to be retried quite often consuming even more airtime.
Hence, add a new noack flag to the driver's send_mlme callback that
allows hostapd to request whether the driver should expect an ACK for
this frame or not.
Use the new noack-policy only for broadcast probe requests that contain
a wildcard SSID.
Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
Helmut Schaa [Sat, 19 Nov 2011 17:02:05 +0000 (19:02 +0200)]
Allow MLME frames to be sent without expecting an ACK (no retries)
In some situations it might be benefical to send a unicast frame without
the need for getting it ACKed (probe responses for example). In order to
achieve this add a new noack parameter to the drivers send_mlme callback
that can be used to advise the driver to not wait for an ACK for this
frame.
Signed-hostap: Helmut Schaa <helmut.schaa@googlemail.com>
Jouni Malinen [Sat, 19 Nov 2011 14:52:52 +0000 (16:52 +0200)]
EAP-pwd: Remove struct eap_pwd_hdr
This structure was not really used for anything apart from figuring out
length of the EAP-pwd header (and even that in a way that would not work
with fragmentation). Since the bitfields in the structure could have
been problematic depending on target endianness, remove this unnecessary
structure.
Dan Harkins [Sat, 19 Nov 2011 14:47:25 +0000 (16:47 +0200)]
EAP-pwd: Fix zero-padding of input to H()
Another niceness of OpenSSL is that if the high-order bit of a 521-bit
big num is not set then BN_bn2bin() will just return 65 bytes instead of
66 bytes with the 1st (big endian, after all) being all zero. When this
happens the wrong number of octets are mixed into function H(). So
there's a whole bunch of "offset" computations and BN_bn2bin() dumps the
big number into a buffer + offset. That should be obvious in the patch
too.
Dan Harkins [Sat, 19 Nov 2011 14:43:49 +0000 (16:43 +0200)]
EAP-pwd: Fix KDF for group 21
The previous EAP-pwd KDF implemented has an issue with group 21, that is
an elliptic curve group based on a 521 bit prime. 521 is not an even
multiple of 8, and therein lies the problem.
OpenSSL's BN library interprets a string of bits as in big-endian format
so all the calls of BN_bin2bn() will take the binary blob of bits and
turn it into a big number in big-endian format. In the EAP-pwd KDF, I am
stretching the key to "primebitlen". When that is not an even multiple
of 8 I have to mask off the excess. But I was masking off the excess
bits in the 1st octet (big endian after all) but that isn't right. The
KDF produces a string of endian-less bits. The 521st bit is the first
bit in the last octet, not the 7th bit in the first octet. So that has
been fixed and you can see in the attached diff what I'm doing.
Johannes Berg [Sat, 19 Nov 2011 12:00:53 +0000 (14:00 +0200)]
nl80211: Use non-receiving socket for EAPOL TX
The non-monitor TX currently uses a normal L2 abstraction
socket, but that will also receive frames we don't want,
so use a plain socket that isn't bound for RX. This might
be possible using the L2 abstraction, but we need a plain
socket later for getting TX status events here.
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Sat, 19 Nov 2011 11:42:49 +0000 (13:42 +0200)]
nl80211: Use device AP SME capability
This changes the auto-detection of whether or not the device contains
the AP SME away from monitor interface addition failing to the explicit
attribute in nl80211. Keep the old auto-detection for a little while so
that ath6kl isn't broken right away.
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Sat, 19 Nov 2011 11:00:30 +0000 (13:00 +0200)]
AP: Add explicit EAPOL TX status event
The new event can be used when EAPOL TX status can't be reported as a
complete 802.11 frame but is instead reported as just the EAPOL data as
originally passed to hapd_send_eapol().
Signed-hostap: Johannes Berg <johannes.berg@intel.com>
Maciej Szmigiero [Sat, 19 Nov 2011 10:06:59 +0000 (12:06 +0200)]
OpenSSL: Read certificate chain from server_cert file
Currently OpenSSL implementation of TLS in hostapd loads only top
certificate in server certificate file. Change this to try to the
whole chain first and only if that fails, revert to old behavior.
Alan T. DeKok [Sat, 19 Nov 2011 09:46:39 +0000 (11:46 +0200)]
wpa_supplicant: Make objects depend on the .config file
The source code compiles into different objects depending on
the contents of .config. Therefore, the objects should depend
on .config.
Previously, only the executables depended on .config. This meant
that they were re-linked when .config changed. But that relink
process used the old (and now wrong) objects.
Jithu Jance [Sat, 19 Nov 2011 09:23:49 +0000 (11:23 +0200)]
nl80211: Implement shared_freq
This patch implements shared_freq handler for driver_nl80211.c. If a
"p2p_group_add" happens after legacy STA association, then this patch
will help to start the GO on the same frequency. This is useful when
supplicant is started on multiple interface running over a singly "PHY"
and the station interface is not used for the P2P device operations.
For example, wpa_supplicant -iwlan0 .. -N -iwlan1 ... and wlan0 is used
for station connection and wlan1 as the P2P device interface.
Johannes Berg [Fri, 18 Nov 2011 21:34:53 +0000 (23:34 +0200)]
P2P: Clear WPS method when GO negotiation fails
When GO negotation fails the WPS method is currently not cleared, which
can result in GO negotiation being resumed when a GO negotiation request
frame is received from the peer. That is unexpected as locally we
already gave up.
This manifests itself in getting
1319574733.955685: wlan0: P2P-GO-NEG-FAILURE status=-1 1319574733.955723: P2P: Removing pending group interface p2p-wlan0-0
... 1319574736.648378: wlan0: P2P: Starting GO Negotiation with previously
authorized peer
... 1319574736.650115: wlan0: P2P: Sending GO Negotiation Response
... 1319574736.988038: wlan0: P2P-GO-NEG-SUCCESS 1319574736.988233: P2P: No pending group interface 1319574736.988268: P2P: Create a new interface p2p-wlan0-1 for the group
Clear the WPS method to avoid this situation. I wasn't
able to test this though, but given the log I can only
assume this is how the situation happened.
Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-hostap: Johannes Berg <johannes.berg@intel.com>