Masashi Honma [Thu, 5 Feb 2015 13:59:59 +0000 (22:59 +0900)]
mesh: Add a monitor event for SAE authentication failure
SAE authentication fails likely with wrong password. This commit adds a
notification of the failure to the upper application (UI) so that the
application can notify suspection of a wrong password to the user. The
control interface monitor even for this is "MESH-SAE-AUTH-FAILURE
addr=<peer>".
Masashi Honma [Wed, 4 Feb 2015 02:26:51 +0000 (11:26 +0900)]
mesh: Fix inactivity timer for 32 bit system
Commit 5a2a6de6a5fec58dcfdb4320e4ec2b69d183a4c1 ('mesh: Make inactivity
timer configurable') has a problem on 32 bit systems. Setting
NL80211_MESHCONF_PLINK_TIMEOUT to 0xffffffff causes expiration of STA in
a minute by NL80211_CMD_DEL_STATION event. this is the kernel rule for
STA expiration:
On a 32 bit system, the right side could overflow and be unexpected
small value if NL80211_MESHCONF_PLINK_TIMEOUT is sufficiently large. STA
expiration occurs by this reason.
This patch solves the problem by disabling the STA expiration
functionality in mac80211. However, old kernel does not support
disabling it. If so, this patch sets mac80211 inactivity timer 60
seconds into future from the wpa_supplicant inactivity timer.
And I mis-understood that mesh_max_inactivity=0 disables inactivity
timer in wpa_supplicant. This commit fixes it also.
Jouni Malinen [Sat, 7 Feb 2015 14:19:53 +0000 (16:19 +0200)]
mesh: Remove duplicated no_auto_peer update
Commit 07cb45ccb2baa6e9627e3d21a285b95d744a6c77 ('mesh: Add no_auto_peer
config option') added a new struct wpa_ssid argument and added an
unnecessary parsing and setting of the value in
wpa_supplicant_ctrl_iface_update_network(). This is not needed since
wpa_config_set() takes care of parsing the parameters.
Jouni Malinen [Sat, 7 Feb 2015 14:17:11 +0000 (16:17 +0200)]
D-Bus: Fix network block type change
It is possible for a network profile to change its type from P2P
persistent group to a normal network and back. The D-Bus interface uses
different types of objects for those, so the object needs to
re-registered in case of type change. This fixes issues in leaving
behind an incorrect type of object and leaking memory when freeing such
a network block that has had its disabled parameter changed.
Jouni Malinen [Sat, 7 Feb 2015 11:02:19 +0000 (13:02 +0200)]
Fix HT40 co-ex scanning issue on hostapd error path
If HT40 co-ex scan fails due to the driver rejecting scan triggers
multiple times, it was possible for the ap_ht40_scan_retry() timeout
being left behind and it getting run after hapd->drv_priv has been
cleared. This would result in NULL pointer dereference in
driver_nl80211_scan.c. Fix this by canceling the timeout when disabling
the interface.
Jouni Malinen [Fri, 6 Feb 2015 23:13:34 +0000 (01:13 +0200)]
Fix Linux packat socket regression work around
Commit e6dd8196e5daf39e4204ef8ecd26dd50fdca6040 ('Work around Linux
packet socket regression') added a mechanism to close the workaround
bridge socket in l2_packet_receive(). However, it did not take into
account the possibility of the l2->rx_callback() closing the l2_packet
socket altogether. This could result in use of freed memory when usin
RSN pre-authentication. Fix this by reordering the calls to clear the
workaround socket before calling the rx_callback.
Jouni Malinen [Fri, 6 Feb 2015 22:10:04 +0000 (00:10 +0200)]
tests: Fix wpas_config_file after implementation change
The new wpa_supplicant configuration writing design (rename instead of
write to original file) did not fail with the symlink-to-self case, so
replace this with the config file being replaced with a directory. In
addition, get rid of unnecessary use of subprocess since run-tests.py is
running as root nowadays.
Vinit Deshpande [Thu, 5 Feb 2015 20:48:02 +0000 (12:48 -0800)]
Don't write to wpa_supplicant.conf directly
There is a chance that wpa_supplicant may get killed during
the time it is writing config file. If this happens, user
information like SSIDs and passwords can be lost forever.
This change works around that by writing config to a
temporary file and then renaming the file to the correct name.
Janusz Dziedzic [Fri, 6 Feb 2015 12:11:24 +0000 (13:11 +0100)]
IBSS: Do not enable HT with WEP or TKIP
We should not enable HT if WEP or TKIP is configured.
Without the patch and WEP configuration we will get message:
Association request to the driver failed
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Jouni Malinen [Fri, 6 Feb 2015 16:36:13 +0000 (18:36 +0200)]
ACS: Accept channel if any (rather than all) survey results are valid
Previously, a channel with even a single scan/survey result missing
information was skipped in ACS. This may not be desirable in cases when
multiple scan iterations are used (which is the case by default in
hostapd). Instead, use all channels that provided at least one complete
set of results. Calculate the average interference factor as an average
of the iterations that did provide complete values.
This seems to help with some cases, e.g., when ath9k may not be able to
report the noise floor for all channels from the first scan iteration
immediately after the driver has been loaded, but then returns it for
all other scan iterations.
Jouni Malinen [Fri, 6 Feb 2015 15:59:57 +0000 (17:59 +0200)]
ACS: Allow specific channels to be preferred
The new acs_chan_bias configuration parameter is a space-separated list
of <channel>:<bias> pairs. It can be used to increase (or decrease) the
likelihood of a specific channel to be selected by the ACS algorithm.
The total interference factor for each channel gets multiplied by the
specified bias value before finding the channel with the lowest value.
In other words, values between 0.0 and 1.0 can be used to make a channel
more likely to be picked while values larger than 1.0 make the specified
channel less likely to be picked. This can be used, e.g., to prefer the
commonly used 2.4 GHz band channels 1, 6, and 11 (which is the default
behavior on 2.4 GHz band if no acs_chan_bias parameter is specified).
Jouni Malinen [Thu, 5 Feb 2015 15:57:06 +0000 (17:57 +0200)]
ACS: Use weighted average for 2.4 GHz adjacent channel interference
The interference factors for adjacent 2.4 GHz channels were summed
together without doing any kind of weighted average on them. This
resulted in the channels at the band edges getting undue preference due
to only including interference factors from three channels vs. five for
the channels in the middle of the band.
While it is somewhat unclear whether the design here was supposed to
count overlapping channels together in this way or whether that is
already covered in channel survey results, it is clear that this summing
of three to five values together and then comparing the sum rather than
average of some kind gives too much preference to the channels at the
edges of the band by assuming that there is no interference whatsoever
outside the band.
Use weighted average of the interference factors rather than a sum from
different number of values. For now, the adjacent 2.4 GHz channels get
weight of 0.85 (1.0 for the main channel itself) and the neighboring
channels to those adjacent ones get 0.55 weight. Band-edge channels are
handled in a way that takes average over the channels that were actually
considered instead of assuming zero interference from neighboring bands.
Ilan Peer [Wed, 4 Feb 2015 09:30:34 +0000 (04:30 -0500)]
tests: Modify test_p2p_discovery to use global control interface
1. Modify discovery_stop to use global control interface when calling
P2P_FLUSH.
2. Modify p2p_listen_and_offchannel_tx to use the global control
interface when waiting for P2P PD event.
Ilan Peer [Wed, 4 Feb 2015 09:30:22 +0000 (04:30 -0500)]
tests: Use global_request for SET commands in test_p2p_grpform
When the 'SET' command is used to configure parameters related to P2P
operation use the global control interface and not the per interface one
as otherwise the setting will only have effect on the interface and will
work if a dedicated P2P_DEVICE is used.
Ilan Peer [Wed, 4 Feb 2015 09:30:21 +0000 (04:30 -0500)]
tests: Update group ifname in p2p_go_invite_auth
Once the connection is established need to call group_form_result() on
the invited device, as otherwise the group interface name is not updated
and the connectivity test is done with the main interface instead of the
group interface.
Jouni Malinen [Wed, 4 Feb 2015 18:47:14 +0000 (20:47 +0200)]
tests: Verify SD TX callback processing after P2P find is stopped
These are far from perfect since timing is quite difficult to match for
the case that behaved incorrectly. Anyway, it looks loke
p2p_service_discovery_peer_not_listening was able to hit the error now
and then, so this should be sufficient as a regression test case.
Krishna Vamsi [Wed, 4 Feb 2015 11:47:23 +0000 (17:17 +0530)]
P2P: Fix stopping on search after SD callback
If p2p_find_timeout triggers after starting SD but before getting TX
status for send action, unwanted search could get triggered again when
TX status arrives though p2p_find_timeout moved the state to P2P_IDLE by
then. p2p_continue_find() would then move the state to P2P_SEARCH again.
Do not trigger the find operation from this context if state is
P2P_IDLE to avoid this.
Jouni Malinen [Wed, 4 Feb 2015 00:04:35 +0000 (02:04 +0200)]
OpenSSL: Use SSL_cache_hit() when available
This is going to be required for OpenSSL 1.1.0 which makes the SSL
structure opaque. Older versions starting from OpenSSL 1.0.1 include
this function, so start using it now based on OPENSSL_VERSION_NUMBER.
Jouni Malinen [Tue, 3 Feb 2015 23:58:37 +0000 (01:58 +0200)]
OpenSSL: Use library wrapper functions to access cert store
OpenSSL 0.9.8 and newer includes SSL_CTX_get_cert_store() and
SSL_CTX_set_cert_store() helper functions, so there is no need to
dereference the SSL_CTX pointer to cert ssl_ctx->cert_store. This helps
in working with the future OpenSSL 1.1.0 release that makes the SSL_CTX
structure opaque.
Jouni Malinen [Tue, 3 Feb 2015 14:43:02 +0000 (16:43 +0200)]
tests: Increase grpform_ext_listen coverage
Include actual extended listen period in the test and confirm that the
device was available on a social channel during such period by using
non-social operating channel.
Jouni Malinen [Tue, 3 Feb 2015 14:13:35 +0000 (16:13 +0200)]
P2P: Clean up Listen channel optimization debug prints
Do not claim to change the Listen channel in a debug message when
previously configured channel prevents this. In addition, fix a typo in
another related debug print.
Jouni Malinen [Tue, 3 Feb 2015 10:32:37 +0000 (12:32 +0200)]
Fix hostapd obss_interval documentation
This parameter has been available for more than just testing purposes,
i.e., OBSS scanning has already been used to enable 20-to-40 MHz channel
changes on 2.4 GHz.
Jouni Malinen [Tue, 3 Feb 2015 10:29:37 +0000 (12:29 +0200)]
Fix 20/40 MHz co-ex report processing with obss_interval=0
If OBSS scan interval is not set, the AP must not schedule a timeout to
restore 40 MHz operation immediately after having moved to a 20 MHz
channel based on an unsolicited co-ex report. Fix this by scheduling the
timeout only if obss_interval is non-zero.
Since we do not currently support AP doing OBSS scans after the initial
BSS setup, this means practically that 40-to-20 MHz transition is
allowed, but 20-to-40 MHz is not with obss_interval=0. The latter gets
enabled if obss_interval is set to a non-zero value so that associated
STAs can take care of OBSS scanning.
Jouni Malinen [Mon, 2 Feb 2015 22:33:45 +0000 (00:33 +0200)]
tests: Restore p2ps config_method in dbus_get_set_wps
This test case is modifying the list of enabled config_method values and
needs to restore "p2ps" option that is included by default. Without
this, P2PS executed after dbus_get_set_wps could fail.
Krishna Vamsi [Tue, 30 Dec 2014 12:27:38 +0000 (17:57 +0530)]
P2PS: Do not remove pending interface on p2p_stop_find
The pending interface created during provision discovery should
not be removed on stopping p2p_find. This pending interface has
to be used after completing GO negotiation. Earlier the pending
interface is created just before GO negotiation so there was no
problem.
Krishna Vamsi [Fri, 30 Jan 2015 13:36:01 +0000 (19:06 +0530)]
P2PS: Allow PD retry in SEARCH and LISTEN_ONLY also
p2p_timeout_prov_disc_req is getting triggered in P2P_IDLE,
P2P_SEARCH and P2P_LISTEN_ONLY states. Retry logic should not be
limited to only P2P_IDLE state.
Krishna Vamsi [Fri, 17 Oct 2014 11:44:48 +0000 (17:14 +0530)]
P2PS: Send P2P_FIND_STOPPED event during P2P SD also
During service discovery if P2P_FIND times out, P2P_FIND_STOPPED event
is sent to upper layers to allow follow up P2P_FIND commands. This needs
to be done also in case an SD was in progress during the find operation.
Krishna Vamsi [Wed, 10 Dec 2014 11:29:29 +0000 (16:59 +0530)]
P2PS: Callback to create pending group after sending PD Response
This introduces a P2P module callback function that will be used to
create the pending P2PS group after sending PD Response and receiving
ACK status for it.
Krishna Vamsi [Wed, 10 Dec 2014 14:25:18 +0000 (19:55 +0530)]
P2PS: Process P2PS provisioning commands
This extends wpas_p2p_prov_disc() implementation to accept P2PS
parameters. None of the callers are yet using this functionality; the
following commit introduces a user.
Krishna Vamsi [Wed, 10 Dec 2014 08:38:56 +0000 (14:08 +0530)]
P2PS: Add P2PS attributes into PD Request if requested
This adds a data structure for storing P2PS PD information and code to
add the related attributes into PD Request. The actual operation to
trigger this behavior will be added in a separate commit.
Krishna Vamsi [Tue, 9 Dec 2014 15:12:27 +0000 (20:42 +0530)]
P2PS: Add support to send ASP service requests
This extends the P2P_SERV_DISC_REQ control interface command with a new
"asp" service type. This takes service id, service string, and optional
service info as arguments.
It was possible for a Action frame sequence completion to stop an
ongoing offchannel remain-on-channel operation unexpectedly in cases
where TX operation was offloaded to the driver and such an operation
happened to occur during a previously started remain-on-channel (e.g.,
for P2P listen state).
Jouni Malinen [Mon, 2 Feb 2015 11:32:06 +0000 (13:32 +0200)]
P2P: Ignore remain-on-channel callback event if not waiting for one
It was possible for the previously requested remain-on-channel for P2P
listen state to get canceled before having received driver event
indicating start of that remain-on-channel operation. In such a case,
the event was able to trigger P2P module to start processing listen
timeout even though there was not supposed to be a following listen
operation anymore. Skip the driver event if we are not waiting for a new
listen state.
Sreenath S [Thu, 10 Apr 2014 10:46:45 +0000 (16:16 +0530)]
HS 2.0R2: Add password to DB in case of machine managed subscription
Add password and machine_managed flag to database in case of machine
managed subscription to fix EAP-TTLS connection failure to production
AP. In case of user managed subscription, the entered password is added
to DB from the PHP script. However in machine managed subscription,
machine generated password is added only in SOAP messages and PPS MO. So
connection to production will fail as the generated password is not
present in the database used by AAA server.
Improve BSS selection with default noise floor values
When noise floor measurements are not available, compute SNR
using default values for the noise floor. This helps steer us
towards 5 GHz BSSes in high signal strength environments.
In more detail...
Existing code prefers a 5 GHz BSS when the 5 GHz BSS's signal
strength is "close" to that of the 2.4 GHz BSS, or when both SNRs
are large. However, the mwifiex driver does not provide noise
floor measurements, so we can't compute SNRs.
Because mwifiex doesn't provide NF measurements, the "large SNR"
code wasn't effective. By using default values for the noise floor,
we can again compute SNRs, and decide that the SNR is high enough
that we shouldn't worry about the exact difference in SNR.
The default noise floor values (one for 2.4 GHz, and one for 5 GHz)
were chosen by measurement in a noisy environment, so they should be
conservative.
Note that while this patch is motivated by mwifiex, it affects
ath9k as well. Although ath9k provides noise floor measurements
in general, it will sometimes fail to provide a measurement for
one or more specific channels.
As a result of this patch, we'll always compare BSSes based on SNR
(either measured or estimated), rather than sometimes comparing
based on signal strength. ("Always" assumes that the
WPA_SCAN_LEVEL_DBM flag is set. It is for mwifiex and ath9k.)
While there:
- fix a whitespace issue (spaces -> tab)
- clean up existing comments
- update dump_scan_res to indicate whether the noise floor is
measured, or default
Jouni Malinen [Sun, 1 Feb 2015 17:22:54 +0000 (19:22 +0200)]
Add an option allow canned EAP-Success for wired IEEE 802.1X
For wired IEEE 802.1X authentication, phase1="allow_canned_success=1"
can now be used to configure a mode that allows EAP-Success (and
EAP-Failure) without going through authentication step. Some switches
use such sequence when forcing the port to be authorized/unauthorized or
as a fallback option if the authentication server is unreachable. By
default, wpa_supplicant discards such frames to protect against
potential attacks by rogue devices, but this option can be used to
disable that protection for cases where the server/authenticator does
not need to be authenticated.
When enabled, this mode allows EAP-Success/EAP-Failure as an immediate
response to EAPOL-Start (or even without EAPOL-Start) and EAP-Success is
also allowed immediately after EAP-Identity exchange (fallback case for
authenticator not being able to connect to authentication server).
Jouni Malinen [Sun, 1 Feb 2015 15:45:19 +0000 (17:45 +0200)]
EAP-MSCHAPv2 peer: Add option to disable password retry query
wpa_supplicant used to request user to re-enter username/password if the
server indicated that EAP-MSCHAPv2 (e.g., in PEAP Phase 2)
authentication failed (E=691), but retry is allowed (R=1). This is a
reasonable default behavior, but there may be cases where it is more
convenient to close the authentication session immediately rather than
wait for user to do something.
Add a new "mschapv2_retry=0" option to the phase2 field to allow the
retry behavior to be disabled. This will make wpa_supplicant abort
authentication attempt on E=691 regardless of whether the server allows
retry.
Roger Zanoni [Tue, 25 Feb 2014 19:06:08 +0000 (15:06 -0400)]
Add a variable to handle extra CFLAGS values
Some packages don't install its headers in the default directory
(e.g.: In Arch Linux libiberty and libn13 includes are installed)
in their own subdirectory under /usr/include) and the build fails
trying to find the headers.
This patch will allow passing extra CFLAGS values without discarding
the assignments made in the Makefile. The CFLAGS values in the Makefile
are ignored, if defined directly in the make command line.
Signed-off-by: Roger Zanoni <roger.zanoni@openbossa.org>
Jouni Malinen [Sat, 31 Jan 2015 16:06:06 +0000 (18:06 +0200)]
tests: Make *_key_lifetime_in_memory more robust
It was possible for the GTK-found-in-memory case to be triggered due to
a retransmission of EAPOL-Key msg 3/4 especially when running test cases
under heavy load (i.e., timeout on hostapd due to not receiving the 4/4
response quickly enough). Make this false failure report less likely by
waiting a bit longer after the connection has been completed before
fetching the process memory.
Jouni Malinen [Sat, 31 Jan 2015 15:21:58 +0000 (17:21 +0200)]
Work around Linux packet socket regression
Linux kernel commit 576eb62598f10c8c7fd75703fe89010cdcfff596 ('bridge:
respect RFC2863 operational state') from 2012 introduced a regression
for using wpa_supplicant with EAPOL frames and a station interface in a
bridge. Since it does not look like this regression is going to get
fixed any time soon (it is already two years from that commit and over
1.5 from a discussion pointing out the regression), add a workaround in
wpa_supplicant to avoid this issue.
The wpa_supplicant workaround uses a secondary packet socket to capture
all frames (ETH_P_ALL) from the netdev that is in a bridge. This is
needed to avoid the kernel regression. However, this comes at the price
of more CPU load. Some of this is avoided with use of Linux socket
filter, but still, this is less efficient than a packet socket bound to
the specific EAPOL ethertype. The workaround gets disabled
automatically, if the main packet socket interface on the bridge
interface turns out to be working for RX (e.g., due to an old kernel
version being used or a new kernel version having a fix for the
regression). In addition, this workaround is only taken into use for the
special case of running wpa_supplicant with an interface in a bridge.
projects / thirdparty / hostap.git / log
