Rohan Dutta [Sat, 7 Nov 2020 13:53:24 +0000 (19:23 +0530)]
nl80211: Send the sae_pwe value to the driver
Use NL80211_ATTR_SAE_PWE attribute to indicate the sae_pwe value
to the driver during the NL80211_CMD_START_AP and NL80211_CMD_CONNECT
in WPA3-Personal networks which are using SAE authentication.
Vamsi Krishna [Mon, 16 Nov 2020 07:01:34 +0000 (12:31 +0530)]
P2P: Disable P2P in the 6 GHz band for now
P2P usage in the 6 GHz band is not standardized yet by WFA. Disable P2P
operations in the 6 GHz band to avoid potential interop issues with
existing P2P devices in production. P2P operations in the 6 GHz band can
be reenabled later after defining standard ways to address potential
interop issues with existing P2P devices.
P2P: Include p2p_6ghz_disable in global configuration
Previously, the configuration to disable the 6 GHz band remained local
to the P2P interface. With this there is a possibility of 6 GHz channels
being included in the channel list when the channel list needs to be
updated if the state changes on one of the interfaces.
Include the configuration to disable the 6 GHz band for P2P as a global
configuration value to prevent the inclusion of 6 GHz channels in the
channel list for P2P when the channel list needs to be updated during
the state change in one of the interfaces.
Vinita S. Maloo [Thu, 15 Oct 2020 14:58:17 +0000 (20:28 +0530)]
Add connect fail reason code from the driver to assoc reject event
Add support to report a vendor specific connect fail reason code fetched
from the driver to users by adding the reason code to the event
CTRL-EVENT-ASSOC-REJECT. Fetch the connect fail reason code when the
driver sends a failure connection result and append the reason code, if
available, to assoc reject event.
Sunil Dutt [Wed, 4 Nov 2020 16:09:38 +0000 (21:39 +0530)]
Vendor feature capability to support concurrent sessions on Wi-Fi bands
Introduces a vendor specific feature capability
QCA_WLAN_VENDOR_FEATURE_CONCURRENT_BAND_SESSIONS to know if the device
supports concurrent network sessions on different Wi-Fi bands. This feature
capability is attributed to the hardware's capability to support the same
(e.g., DBS).
Vinita S. Maloo [Tue, 27 Oct 2020 18:03:59 +0000 (23:33 +0530)]
Set NLA_F_NESTED flag with NL80211_ATTR_VENDOR_DATA conditionally
The newer kernel versions enforce strict netlink attribute policy
validation and will cause cfg80211 to reject vendor commands with
NL80211_ATTR_VENDOR_DATA if NLA_F_NESTED attribute is not set but
if the vendor command is expecting nested data within
NL80211_ATTR_VENDOR_DATA attribute.
Most of the earlier instances were addressed by adding NLA_F_NESTED
flag in nla_nest_start(). This commit addresses the remaining
instance in which NL80211_ATTR_VENDOR_DATA is populated using data
set by user through the control interface.
Enhance the control interface VENDOR command to indicate whether the
vendor subcommand uses nested attributes within NL80211_ATTR_VENDOR_DATA
attribute or not.
Set NLA_F_NESTED flag for existing QCA vendor commands which use nested
attributes within the NL80211_ATTR_VENDOR_DATA attributes so that the
old frameworks implementations for already existing commands work
without any issues.
Add test configuration attr to enable/disable full bandwidth UL MU-MIMO
Define a QCA vendor attribute
QCA_WLAN_VENDOR_ATTR_WIFI_TEST_CONFIG_FULL_BW_UL_MU_MIMO to
enable/disable full bandwidth UL MU-MIMO subfield in the HE PHY
capabilities information field for testing purposes.
Jouni Malinen [Wed, 4 Nov 2020 17:50:34 +0000 (19:50 +0200)]
BSS/scan: More conversions to for_each_element_id()
Use the common IE parsing routine in hope of trying to make the length
checks easier for static analyzers. In addition, try to make the
*_vendor_ie_multi() cases easier to analyze as well even though they
cannot use for_each_element_id().
Jouni Malinen [Tue, 3 Nov 2020 18:11:17 +0000 (20:11 +0200)]
EAP-IKEv2: Try to make transform parser simpler to understand
Use a local variable to try to make ikev2_parse_proposal() easier for
static analyzers to understand. Bounds checking in the loop is really
done by the ikev2_parse_transform() function, so the p->num_transforms
value itself is of no importance for that part and even that was already
implicitly limited in range.
Jouni Malinen [Tue, 3 Nov 2020 17:56:39 +0000 (19:56 +0200)]
HS 2.0: Clarify OSU Friendly Name length validation
This extends the changes in commit 0570a3ea7d87 ("HS 2.0: Clarify OSU
Provider list length validation") to cover the length field for the OSU
Friendly Name value to try to get this easier for static analyzers to
understand.
Jouni Malinen [Mon, 2 Nov 2020 16:46:35 +0000 (18:46 +0200)]
Avoid undefined behavior with memcpy PMK/PSK update
When SAE is used, the local pointer pmk may point to sm->PMK. Skip the
memcpy operation in such a case since it is not really needed and use of
overlapping memory buffers is undefined behavior for memcpy().
Jouni Malinen [Mon, 2 Nov 2020 16:38:41 +0000 (18:38 +0200)]
nl80211: Fix filtering of unsupported bands/modes
The loop for removing unsupported bands was assuming there is always
exactly one band/mode following the removed band. That was not at all
correct, so fix this by dynamically determining how many (if any) bands
need to be moved.
Jouni Malinen [Mon, 2 Nov 2020 15:26:04 +0000 (17:26 +0200)]
TDLS: Fix error path handling for TPK M1 send failures
Local allocation error or failure to get a random number could have
resulted in the peer entry getting freed and couple of the error path
cases in callers could have tried to reference or delete the peer after
that. Fix this by tracking the errors where the peer is freed.
Jouni Malinen [Mon, 2 Nov 2020 14:52:01 +0000 (16:52 +0200)]
DPP2: Fix error path handling in enterprise provisioning
The allocated memory pointed by the pem pointer was freed on an error
path without clearing the pointer to NULL before returning it from the
function. This could have resulted in use of freed memory in an error
case. Fix this by clearing the pointer so that the function returns NULL
properly in the case of this error.
Jouni Malinen [Mon, 2 Nov 2020 14:36:14 +0000 (16:36 +0200)]
Remove unused variable update
Commit e8b85c078e73 ("iface match: Unspecified matched interfaces should
not log driver fails") removed the only use of the added interface wpa_s
pointer, but left that pointer setting in place. Remove it to keep
static analyzers happy.
Jouni Malinen [Mon, 2 Nov 2020 14:31:02 +0000 (16:31 +0200)]
DPP2: Fix ppkey parsing
DPP_CONFIGURATOR_ADD processing of the new ppkey parameter had a
copy-paste error in determining the correct length of this parameter.
Fix that by referencing the correct pointer.
Fixes: 9c1fbff07404 ("DPP2: Generate a privacy protection key for Configurator") Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
6 GHz: Fix opclasses mapping in ieee80211_freq_to_channel_ext()
Previously only primary channel number used to calculate 6GHz operating
class in ieee80211_freq_to_channel_ext() and it is always giving 131
operating class. Fix this by mapping operating class using chanwidth and
sec_channel also.
This is needed to avoid OCV failures on the 6 GHz band when the channel
width is larger than 20 MHz.
Hai Shalom [Fri, 16 Oct 2020 19:47:28 +0000 (12:47 -0700)]
EAP-SIM peer: Send AT_IDENTITY first
For EAP-SIM connections, reorder the order of the attributes in
EAP-Response/SIM/Start message: Send AT_IDENTITY first, then
AT_NONCE and AT_VERSION instead of AT_IDENTITY last. Even though there
is no order requirements in the RFC, some implementations expect the
order of the attributes to be exactly as described in the RFC figures.
Peer Authenticator
| |
| +------------------------------+
| | Server does not have a |
| | Subscriber identity available|
| | When starting EAP-SIM |
| +------------------------------+
| |
| EAP-Request/SIM/Start |
| (AT_ANY_ID_REQ, AT_VERSION_LIST) |
|<------------------------------------------------|
| |
| |
| EAP-Response/SIM/Start |
| (AT_IDENTITY, AT_NONCE_MT, |
| AT_SELECTED_VERSION) |
|------------------------------------------------>|
| |
Pooventhiran G [Tue, 27 Oct 2020 06:24:21 +0000 (11:54 +0530)]
nl80211: Check for proper nlmsg allocation in send_and_recv_msgs_owner()
When nlmsg allocation fails, nl80211_drv_msg() returns NULL and the call
to send_and_recv_msgs_owner() from nl80211_leave_ibss() could have ended
up dereferencing a NULL pointer. Fix this by make
send_and_recv_msgs_owner() more consistent with other send_and_recv*()
cases that check msg == NULL internally.
Fixes: 12ea7dee311b ("nl80211: Use nl80211 control port for receiving EAPOL frames") Signed-off-by: Pooventhiran G <pooventh@codeaurora.org>
P2P: Consider BSS entry pending for P2P joining as a known BSS
Consider the BSS entry that is pending for the P2P group join operation
also as a known network along with the existing configured networks.
This prevents removal of the BSS entry that is still in the process of
P2P join operation from the BSS table when the number of entries exceed
bss_max_count.
Jouni Malinen [Mon, 26 Oct 2020 20:34:07 +0000 (22:34 +0200)]
nl80211: Filter out unsupported bands
If the driver indicates capability for a band that
hostapd/wpa_supplicant does not support, the struct hostapd_hw_modes
array of bands got an empty entry for that with NUM_HOSTAPD_MODES as the
mode. This resulted in various issues, e.g., with fst_hw_mode_to_band()
hitting a WPA_ASSERT(0).
Fix this by filtering out unsupported bands from the internal data
structures.
P2P: Include p2p_add_cli_chan parameter while cloning the configuration
The dynamically created P2P group interface did not consider the
channels that can be used by the P2P client during the P2P group
formation. Copy the p2p_add_cli_chan parameter while cloning the
configuration to the P2P group interface. This allows the dynamically
created group interface case to form the group in the specific
client-only channels when the device is a P2P client in the group.
If SAE_CONFIG_PK is not defined and sae->pk isn't zero (which is
possible as it is controlled by the commit message status code),
sae_derive_keys() may end up deriving PMK and KCK from an
uninitialized array. Fix that.
Fixes: 6b9e99e571ee ("SAE-PK: Extend SAE functionality for AP validation") Fixes: 20ccf97b3dc1 ("SAE-PK: AP functionality") Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
wpa_supplicant: Remove unfeasible conditions in config parsing
pos can't be NULL in wpa_global_config_parse_str(), so there is no point
checking this, especially when pos was already dereferenced earlier.
Remove the redundant conditions.
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Pooventhiran G [Sun, 18 Oct 2020 15:30:09 +0000 (21:00 +0530)]
OpenSSL: Make openssl_debug_dump_certificate() more robust
SSL_CTX_get0_certificate() returns NULL if no certificate is installed.
While this should not be the case here due to the loop in
openssl_debug_dump_certificate_chains() proceeding only if the
SSL_CTX_set_current_cert() returns success, it is safer to make
openssl_debug_dump_certificate() explicitly check against NULL before
trying to dump details about the certificate.
Signed-off-by: Pooventhiran G <pooventh@codeaurora.org>
Hu Wang [Wed, 29 Jul 2020 03:15:35 +0000 (11:15 +0800)]
P2P: Stop old listen radio work before go to WAIT_PEER_IDLE state
P2P goes to Listen state while waiting for the peer to become ready for
GO Negotiation. If old listen radio work has not been completed, P2P
fails to go to listen state. This could happen in cases where P2P Action
frame transmission reused ongoing p2p-listen radio work.
p2p0: Add radio work 'p2p-listen'@0x
P2P-FIND-STOPPED
p2p0: Starting radio work 'p2p-listen'@0x after 0.010644 second wait
P2P: Use ongoing radio work for Action frame TX
P2P: Use ongoing radio work for Action frame TX
P2P: State CONNECT -> CONNECT
P2P: State CONNECT -> WAIT_PEER_IDLE
P2P: State WAIT_PEER_IDLE -> WAIT_PEER_CONNECT
P2P: Reject start_listen since p2p_listen_work already exists
P2P: Failed to start listen mode
Vamsi Krishna [Thu, 8 Oct 2020 12:17:19 +0000 (17:47 +0530)]
Add QCA interface for driver to report various connect fail reason codes
The connection process fails for several reasons and the status codes
defined in IEEE Std 802.11 do not cover the locally generated reason
codes. Add an attribute to QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO vendor
sub command which can be used by the driver/firmware to report various
additional reason codes for connection failures.
Jouni Malinen [Wed, 14 Oct 2020 19:57:04 +0000 (22:57 +0300)]
build: Fix libeap_peer.a build
The install target at the beginning of src/eap_peer/Makefile was
confusing make about the build rules for libeap_peer.a and overriding of
the install target between src/eap_peer/Makefile and src/lib.rules was
breaking installation of dynamic EAP peer *.so files.
Fix this by lib.rules defining a default for the install target so that
src/*/Makefile can override that and by moving the install target for
eap_peer to the end of the Makefile.
Markus Theil [Tue, 30 Jun 2020 11:53:19 +0000 (13:53 +0200)]
wpa_supplicant: Handle HT40 and mode downgrade in AP mode
Add some missing pieces to the interface configuration of AP/mesh mode
in wpa_supplicant.
- check for secondary channel and HT40 capability
- try to downgrade to IEEE 802.11b if 802.11g is not available
Especially with the HT40 check, this code now performs all settings,
which the deleted/duplicated mesh code did.
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
wpa_supplicant_conf_ap_ht() has to happen before
hostapd_setup_interface() in order for its configuration settings to
have effect on interface configuration.
Disable primary and secondary channel switch because of missing tie
breaking rule/frames in mesh networks. A rather long comment about
this issue is placed in mesh.c in the corresponding place.
I was not able to reproduce the memory corruption during
mesh_secure_ocv_mix_legacy, which lead to a revert of a similar patch in
the past.
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Markus Theil [Tue, 30 Jun 2020 11:53:17 +0000 (13:53 +0200)]
HE/VHT: Fix frequency setup with HE enabled
Some places in the code base were not using the wrappers like
hostapd_set_oper_centr_freq_seg0_idx and friends. This could lead to
errors, for example when joining 80 MHz mesh networks. Fix this, by
enforcing usage of these wrappers.
wpa_supplicant_conf_ap_ht() now checks for HE capability before dealing
with VHT in order for these wrappers to work, as they first check HE
support in the config.
While doing these changes, I've noticed that the extra channel setup
code for mesh networks in wpa_supplicant/mesh.c should not be necessary
anymore and dropped it. wpa_supplicant_conf_ap_ht() should handle this
setup already.
Acked-by: John Crispin <john@phrozen.org> Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Jouni Malinen [Tue, 13 Oct 2020 17:29:27 +0000 (20:29 +0300)]
DPP2: Copy received ppKey into wpa_supplicant network profile
Store the received privacy protection key from Connector into
wpa_supplicant network profile and indicate it through the control
interface similarly to C-sign-key.
Jouni Malinen [Tue, 13 Oct 2020 16:59:29 +0000 (19:59 +0300)]
DPP2: Generate a privacy protection key for Configurator
Generate a new key for Configurator. This is either generated
automatically for the specified curve or provided from external source
with the new ppkey=<val> argument similarly to the way c-sign-key was
previously generated.
Johannes Berg [Mon, 12 Oct 2020 09:30:53 +0000 (11:30 +0200)]
build: Rebuild libs all the time
When files change that go into a static library such as libutils.a, then
libutils.a doesn't get rebuilt from, e.g., wlantest because the
top-level Makefile just calls the library make if the library doesn't
exist yet.
Change that by making the library depend on a phony target (cannot make
it itself phony due to the pattern) so that the build will always
recurse into the library build, and check there if the library needs to
be rebuilt.
While at it, remove the (actually unnecessary) mkdir so it doesn't get
done each and every time you do 'make'.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Johannes Berg [Sun, 11 Oct 2020 19:24:34 +0000 (21:24 +0200)]
build: Fix dependency file inclusion
The objs.mk include changes for archive files broke things
completely and none of the dependency files (*.d) ever got
included, as the expansion there ended up empty.
Clearly, my mistake, I should've tested that better. As we
don't need the %.a files in the list there use filter-out
to remove them, rather than what I had lazily wanted to do,
which was trying to read %.d files for them. The filter-out
actually works, and avoids looking up files that can never
exist in the first place.
Fixes: 87098d3324e0 ("build: Put archive files into build/ folder too") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Jimmy Chen [Wed, 26 Aug 2020 10:55:45 +0000 (18:55 +0800)]
P2P: Set ap_configured_cb during group reform process
We found that if REMOVE-AND-REFORM occurs before a group is started,
it would not send out GROUP-STARTED-EVENT after AP is enabled.
In the remove-and-reform process, ap_configured_cb is cleared. If a
group is not started, p2p_go_configured() will not be called after
completing AP setup. Fix this by preserving the callback parameters.
Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
Jimmy Chen [Wed, 2 Sep 2020 08:50:11 +0000 (16:50 +0800)]
P2P: Fallback to GO negotiation after running out of GO scan attempts
We found a problem that p2p_fallback_to_go_neg is not handled correctly
after running out of GO scan attempts. When autojoin is enabled and a
group is found in old scan results, supplicant would try to scan the
group several times. If the group is still not found, it reports group
formation failure while p2p_fallback_to_go_neg is enabled already.
If p2p_fallback_to_go_neg is enabled, it should fallback to GO
negotiation, but not report group formation failure after running out of
GO scan attempts.
Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
projects / thirdparty / hostap.git / log
