mech_eap.git
9 years agonl80211: Use nl80211_drv_msg() helper
Jouni Malinen [Sat, 6 Dec 2014 14:05:54 +0000 (16:05 +0200)]
nl80211: Use nl80211_drv_msg() helper

Use the helper function to replace places that use nlmsg_alloc(),
nl80211_cmd(), and drv->ifindex.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Move nl80211_set_iface_id() next its only remaining user
Jouni Malinen [Sat, 6 Dec 2014 13:17:30 +0000 (15:17 +0200)]
nl80211: Move nl80211_set_iface_id() next its only remaining user

This function was in a bit strange location between struct family_data
and family_handler() definitions.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Use the new nl80211_cmd_msg() helper
Jouni Malinen [Sat, 6 Dec 2014 11:04:29 +0000 (13:04 +0200)]
nl80211: Use the new nl80211_cmd_msg() helper

This removes duplicated code for building nl80211 commands for a BSS.
This commit handles the functions that were already using
nl80211_set_iface_id().

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Add nl80211_*_msg() helpers
Jouni Malinen [Sat, 6 Dec 2014 10:56:05 +0000 (12:56 +0200)]
nl80211: Add nl80211_*_msg() helpers

These new functions can be used to both allocate and build a header for
most nl80211 commands.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Continue getting rid of NLA_PUT* macro use
Jouni Malinen [Fri, 5 Dec 2014 18:33:08 +0000 (20:33 +0200)]
nl80211: Continue getting rid of NLA_PUT* macro use

This gets rid of more NLA_PUT* macro uses in nl80211 to reduce the
number of functions that depend on the hidden behavior of jumping to the
nla_put_failure label.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Get rid of NLA_PUT* macro use in capability checking
Jouni Malinen [Fri, 5 Dec 2014 17:24:38 +0000 (19:24 +0200)]
nl80211: Get rid of NLA_PUT* macro use in capability checking

This gets rid of NLA_PUT* macro use in checking nl80211 capabilities to
reduce the number of functions that depend on the hidden behavior of
jumping to the nla_put_failure label.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoPCSC: Make AID copying easier for static analyzers
Jouni Malinen [Fri, 5 Dec 2014 21:18:56 +0000 (23:18 +0200)]
PCSC: Make AID copying easier for static analyzers

Use a separate pointer and length field instead of trying to copy from a
struct field that has only part of the full buffer available.
(CID 68115)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoMake GTK length validation easier to analyze
Jouni Malinen [Fri, 5 Dec 2014 21:05:11 +0000 (23:05 +0200)]
Make GTK length validation easier to analyze

Bounds checking for gd->gtk_len in wpa_supplicant_check_group_cipher()
was apparently too complex for some static analyzers. Use a local
variable and a more explicit validation step to avoid false report.
(CID 62864)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoFT: Make aes_wrap() call easier to analyze
Jouni Malinen [Fri, 5 Dec 2014 20:59:20 +0000 (22:59 +0200)]
FT: Make aes_wrap() call easier to analyze

Using aes_wrap() to initialize a data structure seemed to be too much
for some static analyzers to understand. Make it obvious that the target
is not just the single struct member. (CID 68111)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoFT: Make aes_unwrap() calls easier to analyze
Jouni Malinen [Fri, 5 Dec 2014 20:52:06 +0000 (22:52 +0200)]
FT: Make aes_unwrap() calls easier to analyze

Using aes_unwrap() to initialize a data structure seemed to be too much
for some static analyzers to understand. Make it obvious that the target
is initialized and that the target is not just the single struct member.
In addition, clean up the design to avoid removal of const with a
typecast. (CID 68112, CID 68134, CID 68135, CID 68136)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoP2P: Split p2p_channels_union() into two functions
Jouni Malinen [Fri, 5 Dec 2014 20:34:27 +0000 (22:34 +0200)]
P2P: Split p2p_channels_union() into two functions

The separate p2p_channels_union_inplace() makes the function easier for
static analyzers to see that the result buffer is always initialized.
(CID 74494)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Optimize FT test cases
Jouni Malinen [Fri, 5 Dec 2014 15:12:30 +0000 (17:12 +0200)]
tests: Optimize FT test cases

Use single channel scan instead of full scan to save time. In addition,
use EAP-GPSK which takes significantly less CPU that EAP-EKE with
default parameters.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: FT_DS with unknown target
Jouni Malinen [Fri, 5 Dec 2014 15:05:46 +0000 (17:05 +0200)]
tests: FT_DS with unknown target

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: TDLS teardown using wildcard address
Jouni Malinen [Fri, 5 Dec 2014 14:56:14 +0000 (16:56 +0200)]
tests: TDLS teardown using wildcard address

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Disabling WNM keep-alive and hostapd doing client poll
Jouni Malinen [Fri, 5 Dec 2014 14:51:21 +0000 (16:51 +0200)]
tests: Disabling WNM keep-alive and hostapd doing client poll

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: wpa_supplicant ctrl_iface SET operations
Jouni Malinen [Fri, 5 Dec 2014 14:24:21 +0000 (16:24 +0200)]
tests: wpa_supplicant ctrl_iface SET operations

This adds more test coverage for wpa_supplicant SET ctrl_iface command.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: SET disallow_aps in P2P GO mode
Jouni Malinen [Fri, 5 Dec 2014 14:21:10 +0000 (16:21 +0200)]
tests: SET disallow_aps in P2P GO mode

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Optimize WFD connect_cli() calls
Jouni Malinen [Fri, 5 Dec 2014 13:30:46 +0000 (15:30 +0200)]
tests: Optimize WFD connect_cli() calls

There is no need to run full scan in these test cases, so use single
channel scan to save time.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: WFD_SUBELEM_SET/GET with all parameter
Jouni Malinen [Fri, 5 Dec 2014 13:24:08 +0000 (15:24 +0200)]
tests: WFD_SUBELEM_SET/GET with all parameter

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoWFD: Allow WFD_SUBELEM_SET/GET all to be used with full IE buffer
Jouni Malinen [Fri, 5 Dec 2014 13:22:33 +0000 (15:22 +0200)]
WFD: Allow WFD_SUBELEM_SET/GET all to be used with full IE buffer

This extends the previously used WFD_SUBELEM_SET/GET <subelem id> design
to allow special "all" value to be used as an id to indicate that all
WFD subelements are to be set/get. This uses similar interface as was
previously added over D-Bus.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: More coverage for WMM-AC
Jouni Malinen [Fri, 5 Dec 2014 11:39:22 +0000 (13:39 +0200)]
tests: More coverage for WMM-AC

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoWMM-AC: Use DEBUG verbosity for ignoring Action frame messages
Jouni Malinen [Fri, 5 Dec 2014 11:08:29 +0000 (13:08 +0200)]
WMM-AC: Use DEBUG verbosity for ignoring Action frame messages

There is no point in flooding the log with WARNING or ERROR level
messages if WMM-AC related Action frames are ignored in cases where they
were not expected. In addition, WARNING/ERROR should not really be used
in cases an invalid frame is dropped especially if this is not related
to a security setup since external devices could otherwise generate log
entries.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agohostapd: Fix HT40 determination for ACS offload
Jouni Malinen [Thu, 4 Dec 2014 23:08:40 +0000 (01:08 +0200)]
hostapd: Fix HT40 determination for ACS offload

Commit 16689c7cfc99c66aecbf16eb2f4a8bc941cb5d0f ('hostapd: Allow ACS to
be offloaded to the driver') used incorrect operator to determine
whether HT40 was configured. Fix that to mask the ht_capab bit
correctly. (CID 77286)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoHS 2.0: Clarify OSU Provider list length validation
Jouni Malinen [Thu, 4 Dec 2014 22:56:05 +0000 (00:56 +0200)]
HS 2.0: Clarify OSU Provider list length validation

The previous version was somewhat too complex for some static analyzers.
Use local variables for the extracted length fields and explicitly
compare these against the remaining buffer length. (CID 68121)

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Avoid a static analyzer warning on uninitialized emsk_len
Jouni Malinen [Thu, 4 Dec 2014 22:33:31 +0000 (00:33 +0200)]
ERP: Avoid a static analyzer warning on uninitialized emsk_len

This was not really a real issue since bin_clear_free() would not use
the emsk_len argument when emsk is NULL as it would be on the path where
emsk_len has not been initilized. Anyway, it is better to get rid of the
warning.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoeap_example: Get rid of a compiler warning
Jouni Malinen [Thu, 4 Dec 2014 10:38:06 +0000 (12:38 +0200)]
eap_example: Get rid of a compiler warning

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: EAP Re-authentication Protocol (ERP)
Jouni Malinen [Sat, 29 Nov 2014 18:34:43 +0000 (20:34 +0200)]
tests: EAP Re-authentication Protocol (ERP)

This tests RP EAP-Initiate/Re-auth-Start transmission, ERP key
derivation, and EAP-Initiate/Re-auth + EAP-Finish/Re-auth exchange and
rMSK derivation.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add wpa_supplicant ERP_FLUSH ctrl_iface command
Jouni Malinen [Sun, 30 Nov 2014 23:11:29 +0000 (01:11 +0200)]
ERP: Add wpa_supplicant ERP_FLUSH ctrl_iface command

This can be used to flush all the ERP keys.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add support for ERP on EAP peer
Jouni Malinen [Sat, 29 Nov 2014 21:14:40 +0000 (23:14 +0200)]
ERP: Add support for ERP on EAP peer

Derive rRK and rIK on EAP peer if ERP is enabled. The new wpa_supplicant
network configuration parameter erp=1 can now be used to configure the
EAP peer to derive EMSK, rRK, and rIK at the successful completion of an
EAP authentication method. This functionality is not included in the
default build and can be enabled with CONFIG_ERP=y.

If EAP authenticator indicates support for re-authentication protocol,
initiate this with EAP-Initiate/Re-auth and complete protocol when
receiving EAP-Finish/Re-auth.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add support for ERP on EAP server and authenticator
Jouni Malinen [Sat, 29 Nov 2014 19:28:24 +0000 (21:28 +0200)]
ERP: Add support for ERP on EAP server and authenticator

Derive rRK and rIK on EAP server if ERP is enabled and use these keys to
allow EAP re-authentication to be used and to derive rMSK.

The new hostapd configuration parameter eap_server_erp=1 can now be used
to configure the integrated EAP server to derive EMSK, rRK, and rIK at
the successful completion of an EAP authentication method. This
functionality is not included in the default build and can be enabled
with CONFIG_ERP=y.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add TV/TLV parser
Jouni Malinen [Sat, 29 Nov 2014 19:28:24 +0000 (21:28 +0200)]
ERP: Add TV/TLV parser

This is needed for ERP implementation on both the server/authenticator
and peer side.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add HMAC-SHA256 KDF (RFC 5295)
Jouni Malinen [Sat, 29 Nov 2014 19:28:24 +0000 (21:28 +0200)]
ERP: Add HMAC-SHA256 KDF (RFC 5295)

This is needed for ERP key derivation.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add optional EAP-Initiate/Re-auth-Start transmission
Jouni Malinen [Sat, 29 Nov 2014 18:33:09 +0000 (20:33 +0200)]
ERP: Add optional EAP-Initiate/Re-auth-Start transmission

hostapd can now be configured to transmit EAP-Initiate/Re-auth-Start
before EAP-Request/Identity to try to initiate ERP. This is disabled by
default and can be enabled with erp_send_reauth_start=1 and optional
erp_reauth_start_domain=<domain>.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoERP: Add defines for EAP Re-Authentication Protocol
Jouni Malinen [Sat, 29 Nov 2014 18:32:28 +0000 (20:32 +0200)]
ERP: Add defines for EAP Re-Authentication Protocol

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agonl80211: Ignore Connect failure for the previous association
Jithu Jance [Wed, 3 Dec 2014 13:24:40 +0000 (18:54 +0530)]
nl80211: Ignore Connect failure for the previous association

Suppose there are two APs (AP1 & AP2) and user attempted to connect to
AP2 before the previous connection with AP1 could succeed. Now, if the
connection event comes for the older AP with failed status, we should
just ignore it as the wpa_supplicant state has moved to "ASSOCIATING"
with the new AP (AP2).

This is a similar to the case where a disconnection event is ignored for
a case where local disconnect request can cause the extra event to show
up during the next association process following that command.

Signed-off-by: Jithu Jance <jithu@broadcom.com>
9 years agohostapd: Allow ACS to be offloaded to the driver
Peng Xu [Tue, 18 Nov 2014 18:11:09 +0000 (20:11 +0200)]
hostapd: Allow ACS to be offloaded to the driver

Using QCA vendor command, allow ACS function to be offloaded to the
driver. Once channels are selected, hostapd is notified to perform OBSS
operation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoReturn only full network line in list_networks
Dmitry Shmidt [Wed, 3 Dec 2014 19:48:46 +0000 (11:48 -0800)]
Return only full network line in list_networks

It makes more sense to truncate at line boundary especially with the new
LAST_ID parameter.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
9 years agotests: Huge number of network blocks and LIST_NETWORKS LAST_ID
Jouni Malinen [Tue, 2 Dec 2014 21:47:34 +0000 (23:47 +0200)]
tests: Huge number of network blocks and LIST_NETWORKS LAST_ID

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoList all networks despite message limit of 4096 bytes
Vinit Deshpande [Tue, 2 Dec 2014 18:59:29 +0000 (10:59 -0800)]
List all networks despite message limit of 4096 bytes

This change creates 'LIST_NETWORK LAST_ID=x' form to allow
retrieval of all networks saved in the system. Without this form,
only first few (whatever fills in first 4096 bytes) can be
retrieved.

Signed-off-by: Vinit Deshpande <vinitd@google.com>
9 years agoAdd a name for an assigned QCA nl80211 vendor subcmd
Jouni Malinen [Tue, 2 Dec 2014 21:36:12 +0000 (23:36 +0200)]
Add a name for an assigned QCA nl80211 vendor subcmd

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoAllow a BSS entry with all-zeros BSSID to expire
Jouni Malinen [Tue, 2 Dec 2014 17:42:23 +0000 (19:42 +0200)]
Allow a BSS entry with all-zeros BSSID to expire

wpa_bss_in_use() used to determine that a BSS with BSSID of
00:00:00:00:00:00 is in use in almost every case since either
wpa_s->bssid or wpa_s->pending_bssid was likely to be cleared. This
could result in a corner case of a BSS entry remaining in the BSS table
indefinitely if one was added there with a (likely bogus) address of
00:00:00:00:00:00. Fix this by ignore wpa_s->bssid and
wpa_s->pending_bssid if the BSSID in the BSS table entry is
00:00:00:00:00:00.

In theory, that address is a valid BSSID, but it is unlikely to be used
in any production AP, so the potential expiration of a BSS entry with
that address during a connection attempt would not be a concern
(especially when a new scan would be enough to recover from that).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoRename QCA nl80211 vendor subcmds to match AOSP names
Jouni Malinen [Tue, 2 Dec 2014 14:19:25 +0000 (16:19 +0200)]
Rename QCA nl80211 vendor subcmds to match AOSP names

This makes the enum vendor_subcmds definitions more consistent with the
names used in Android.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoatheros: Cleanup atheros_raw_receive to process all management frames
Vivek Natarajan [Mon, 1 Dec 2014 06:02:45 +0000 (11:32 +0530)]
atheros: Cleanup atheros_raw_receive to process all management frames

Signed-off-by: Vivek Natarajan <nataraja@qti.qualcomm.com>
9 years agotests: Make scan_for_auth more robust
Jouni Malinen [Mon, 1 Dec 2014 15:50:58 +0000 (17:50 +0200)]
tests: Make scan_for_auth more robust

It was apparently possible for this test case not to do what it was
supposed to do, i.e., get nl80211 Authenticate command failing due to
cfg80211 BS entry missing. With the external radio work blocking fixed,
this can be cleaned up by explicitly waiting for the scan event. In
addition, a less used channel can be selected to avoid finding other BSS
entries.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoDo not start new radio work on scan completion during ext work
Jouni Malinen [Mon, 1 Dec 2014 15:49:19 +0000 (17:49 +0200)]
Do not start new radio work on scan completion during ext work

Externally triggered scan could result in a new radio work item getting
started even when external radio work was in progress. Delay such start
until the external work is completed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Add a helper function for clearing scan cache
Jouni Malinen [Mon, 1 Dec 2014 10:14:11 +0000 (12:14 +0200)]
tests: Add a helper function for clearing scan cache

This makes it more convenient and consistent to clear the cached scan
results from cfg80211 and wpa_supplicant.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoEAP-PAX: Derive EAP Session-Id
Jouni Malinen [Sun, 30 Nov 2014 23:45:17 +0000 (01:45 +0200)]
EAP-PAX: Derive EAP Session-Id

This adds EAP-PAX server and peer method functions for deriving
Session-Id from Method-Id per RFC 4746 and RFC 5247.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoEAP-TTLS: Add support for deriving EMSK
Jouni Malinen [Sun, 30 Nov 2014 23:27:01 +0000 (01:27 +0200)]
EAP-TTLS: Add support for deriving EMSK

This extends EAP-TTLS server and peer implementations to support EMSK
derivation per RFC 5281.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoEAP-TLS server: Clear temporary buffer during EMSK derivation
Jouni Malinen [Sun, 30 Nov 2014 23:25:52 +0000 (01:25 +0200)]
EAP-TLS server: Clear temporary buffer during EMSK derivation

Now that EMSK derivation is taken into use with ERP, it is better to
make sure the temporary MSK + EMSK buffer does not get left in heap
after use.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoEAP server: Add getSessionId
Jouni Malinen [Sat, 29 Nov 2014 21:46:45 +0000 (23:46 +0200)]
EAP server: Add getSessionId

This extends EAP server implementation to derive Session-Id similarly to
the existing EAP peer implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoEAP peer: Clean up TLS Session-Id derivation function
Jouni Malinen [Sat, 29 Nov 2014 22:22:10 +0000 (00:22 +0200)]
EAP peer: Clean up TLS Session-Id derivation function

The comment about library not supporting Session-Id derivation was not
accurate and there is no need to check for master key that is not used
as part of derivation.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: AddressSanitizer (ASan) build options
Jouni Malinen [Sun, 30 Nov 2014 13:52:28 +0000 (15:52 +0200)]
tests: AddressSanitizer (ASan) build options

Add example build options that can be used to enable ASan for hwsim test
cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoWPS: Fix current_ssid clearing on duplicate network removal
Jouni Malinen [Sun, 30 Nov 2014 13:48:37 +0000 (15:48 +0200)]
WPS: Fix current_ssid clearing on duplicate network removal

It was possible for the current network profile to be deleted when
merging duplicated WPS credentials. However, this did not clear
wpa_s->current_ssid and it was possible for something else to end up
dereferencing that pointer to now freed memory. This could be hit, e.g.,
with ap_wps_mixed_cred. Fix this by clearing current_ssid also in this
code path similarly to other cases of network block getting removed.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agomesh: Skip fast-association when using connect_without_scan
Jouni Malinen [Sun, 30 Nov 2014 13:47:07 +0000 (15:47 +0200)]
mesh: Skip fast-association when using connect_without_scan

The mesh group addition was designed to use wpa_s->connect_without_scan
to skip a scan. That path was skipped if wpa_supplicant_fast_associate()
allowed previous scan results to be used. This could result in undesired
double-initialization attempt for the mesh interface. Avoid this by not
using wpa_supplicant_fast_associate() when wpa_s->connect_without_scan
is set.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agomesh: Check for initialization failures
Jouni Malinen [Sun, 30 Nov 2014 13:46:09 +0000 (15:46 +0200)]
mesh: Check for initialization failures

It is possible that these location ended up getting called before mesh
startup operations had been completed and that could result in
dereferencing NULL pointers. Address those error cases by verifying that
the needed parameters are available before using them.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Stop connection at the end of monitor_iface_unknown_sta
Jouni Malinen [Sun, 30 Nov 2014 13:44:37 +0000 (15:44 +0200)]
tests: Stop connection at the end of monitor_iface_unknown_sta

Do not leave the station trying to connect at the end of the test case
since that can have an effect to the following test case. Such sequences
should be tested in test cases that are specifically designed for that
rather than randomly between test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoIgnore auth/assoc timeout events in mesh configuration
Jouni Malinen [Sun, 30 Nov 2014 13:42:26 +0000 (15:42 +0200)]
Ignore auth/assoc timeout events in mesh configuration

It was possible for auth/assoc timeout/failure event from the driver to
result in unexpected processing during mesh group setup if that
operation was started before the previously started driver operation to
association/connect had completed. Since those events cannot happen in
mesh cases, ignore them to avoid issues due to this corner case.

For example, monitor_iface_unknown_sta followed by wpas_mesh_secure test
case resulted in failure without this change.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoFix omac1_aes_128_vector() not to read beyond addr/len array
Jouni Malinen [Sun, 30 Nov 2014 13:39:34 +0000 (15:39 +0200)]
Fix omac1_aes_128_vector() not to read beyond addr/len array

Previously, it was possible for the loop through the data components to
increment addr/len index at the last position beyond the declared size.
This resulted in reading beyond those arrays. The read values were not
used and as such, this was unlikely to cause noticeable issues, but
anyway, memory checkers can detect this and the correct behavior is to
stop increments before going beyond the arrays since no more bytes will
be processed after this anyway.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agomesh: Avoid a false maybe-uninitialized compiler warning
Jouni Malinen [Sun, 30 Nov 2014 13:37:55 +0000 (15:37 +0200)]
mesh: Avoid a false maybe-uninitialized compiler warning

An earlier check of the action_field value above the switch statement
already took care of all other possible cases, but that was apparently
too difficult for the compiler to notice. Bring back the default case to
avoid incorrect warnings about the event variable being maybe
uninitialized.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Increase WEXT coverage
Jouni Malinen [Sat, 29 Nov 2014 14:46:43 +0000 (16:46 +0200)]
tests: Increase WEXT coverage

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Simplify Michael MIC test file writing
Jouni Malinen [Sat, 29 Nov 2014 13:44:57 +0000 (15:44 +0200)]
tests: Simplify Michael MIC test file writing

Since run-tests.py is now required to run as root, there is no need to
use the somewhat awkward "sudo tee" construction; instead, just write
directly to the file.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Make go_neg_with_bss_on_disallowed_chan more robust
Jouni Malinen [Sat, 29 Nov 2014 13:22:43 +0000 (15:22 +0200)]
tests: Make go_neg_with_bss_on_disallowed_chan more robust

Clear scan results to avoid PBC overlap issues caused by earlier test
cases. For example, go_neg_with_bss_connected followed by
go_neg_with_bss_on_disallowed_chan resulted in failure before this
change.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Monitor interface with hostapd
Jouni Malinen [Sat, 29 Nov 2014 11:33:08 +0000 (13:33 +0200)]
tests: Monitor interface with hostapd

This increases testing coverage for nl80211 AP mode with monitor
interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoClear WLAN_STA_ASSOC_REQ_OK on AP-initiated deauthentication
Jouni Malinen [Sat, 29 Nov 2014 11:31:54 +0000 (13:31 +0200)]
Clear WLAN_STA_ASSOC_REQ_OK on AP-initiated deauthentication

This flag was left in the STA entry for the short duration after the STA
gets deauthenticated. If the STA sends a Class 2 or 3 frame during that
short time, the AP would not have replied with Deauthentication frame
indicating no association is present.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoAdd hostapd driver_params config parameter
Jouni Malinen [Sat, 29 Nov 2014 11:24:42 +0000 (13:24 +0200)]
Add hostapd driver_params config parameter

This is mainly for development testing purposes to allow driver_nl80211
behavior to be modified.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agoRemove forgotten driver_test.c variables
Jouni Malinen [Sat, 29 Nov 2014 10:49:55 +0000 (12:49 +0200)]
Remove forgotten driver_test.c variables

hostapd was still providing couple of parameters that were used only in
the already removed driver_test.c framework.

Signed-off-by: Jouni Malinen <j@w1.fi>
9 years agotests: Increase retry limit and timeout for wpas_mesh_open_no_auto
Jouni Malinen [Fri, 28 Nov 2014 16:23:11 +0000 (18:23 +0200)]
tests: Increase retry limit and timeout for wpas_mesh_open_no_auto

This test case was failing every now and then due to dev1
(no_auto_peer=1) not receiving the new-peer-candidate event in time
before dev0 has already stopped retries on mesh peering open message.
This sounds somewhat expected with the default 4 * 40 ms = 160 ms
retries and 1000 TU beacon interval. Use maximum timeout 16 * 255 ms =
4080 ms to make this test case less likely to fail.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: P2P invitation resend on no-common-channels
Jouni Malinen [Fri, 28 Nov 2014 15:47:09 +0000 (17:47 +0200)]
tests: P2P invitation resend on no-common-channels

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Re-enable wext_open
Jouni Malinen [Fri, 28 Nov 2014 15:27:44 +0000 (17:27 +0200)]
tests: Re-enable wext_open

driver_wext.c is again able to configure open network, so re-enable the
test case for it.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agowext: Fix non-WPA/WPA2 connection with extra IEs
Jouni Malinen [Fri, 28 Nov 2014 15:21:51 +0000 (17:21 +0200)]
wext: Fix non-WPA/WPA2 connection with extra IEs

The associate() handler was not prepared for params->wpa_ie containing
some other IEs than WPA/RSN IE and ended up configuring security policy
incorrectly for open networks if such IEs were present. Fix this by
using wpa_proto parameter instead of IEs to determine security policy
for driver configuration.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Allow wext in configuration
Johannes Berg [Fri, 28 Nov 2014 08:32:33 +0000 (09:32 +0100)]
tests: Allow wext in configuration

Both the wpa_supplicant and kernel configuration need wext to
run the wext testcase, enable those in the default/example
configurations.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
9 years agowext: Add very basic status command support
Johannes Berg [Fri, 28 Nov 2014 08:32:32 +0000 (09:32 +0100)]
wext: Add very basic status command support

Just to make the test framework happy, it uses the driver
status command to obtain the interface MAC address.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
9 years agotests: Optimize autogo test cases by removing unnecessary scans
Jouni Malinen [Fri, 28 Nov 2014 14:54:31 +0000 (16:54 +0200)]
tests: Optimize autogo test cases by removing unnecessary scans

Keep full channel scans in autogo for test coverage, but use single
channel scan in all other autogo* test cases to remove unnecessary
waiting that does not add any test coverage. This removes more than one
minute from the total test execution time.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Optimize ap_open_unexpected_assoc_event
Jouni Malinen [Fri, 28 Nov 2014 14:28:36 +0000 (16:28 +0200)]
tests: Optimize ap_open_unexpected_assoc_event

Replace fixed sleep with waiting for a disconnection event. In addition,
remove unnecessary use of sudo.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Hide unnecessary wlantest_cli output
Jouni Malinen [Fri, 28 Nov 2014 14:19:58 +0000 (16:19 +0200)]
tests: Hide unnecessary wlantest_cli output

Unnecessary and confusing "OK" output from wlantest_cli got sent to
stdout.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Move hessid and access_network_type reset to test case
Jouni Malinen [Fri, 28 Nov 2014 14:16:24 +0000 (16:16 +0200)]
tests: Move hessid and access_network_type reset to test case

This removes unnecessary reset() steps from between every test case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Move external_sim reset to test cases that change this
Jouni Malinen [Fri, 28 Nov 2014 14:13:06 +0000 (16:13 +0200)]
tests: Move external_sim reset to test cases that change this

This removes unnecessary reset() step from between every test case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make go_neg_forced_freq_diff_than_bss_freq more robust
Jouni Malinen [Fri, 28 Nov 2014 14:00:24 +0000 (16:00 +0200)]
tests: Make go_neg_forced_freq_diff_than_bss_freq more robust

It was possible for this test case to fail due to PBC overlap that was
detected based on previous test case having used PBC. Make that false
positive less likely to happen by explicitly clearing the scan cache on
the device.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Fix p2p_channel_random_social_with_op_class_change cleanup
Jouni Malinen [Fri, 28 Nov 2014 13:54:08 +0000 (15:54 +0200)]
tests: Fix p2p_channel_random_social_with_op_class_change cleanup

p2p_oper_reg_class and p2p_oper_channel need to be restored to 0, not an
arbitrary 2.4 GHz channel to avoid issues for following test cases. For
example, p2p_channel_random_social_with_op_class_change followed by
p2p_autogo_pref_chan_not_in_regulatory ended up with the latter test
case failing.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agomesh: Add more debug information to MPM Action frame processing
Jouni Malinen [Fri, 28 Nov 2014 13:44:54 +0000 (15:44 +0200)]
mesh: Add more debug information to MPM Action frame processing

This makes it easier to figure out why a peering message is dropped.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Remove duplicated connectivity test from mesh
Jouni Malinen [Fri, 28 Nov 2014 13:12:07 +0000 (15:12 +0200)]
tests: Remove duplicated connectivity test from mesh

hwsim_utils.test_connectivity() is already bidirectional test, so there
is no need to run it twice with the devices swapped for the second
iteration.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make hidden SSID test cases more robust
Jouni Malinen [Fri, 28 Nov 2014 11:40:34 +0000 (13:40 +0200)]
tests: Make hidden SSID test cases more robust

Clear wpa_supplicant and cfg80211 scan results at the end of hidden SSID
test cases to avoid potential issues for following test cases. For
example, ap_hs20_session_info could fail if executed immediately after
ssid_hidden due to the AP configuration change from open to RSN was not
noticed.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: proxyarp with DHCP snooping
Jouni Malinen [Fri, 28 Nov 2014 20:36:10 +0000 (22:36 +0200)]
tests: proxyarp with DHCP snooping

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: ProxyARP with DGAF disabled and multicast-to-unicast conversion
Jouni Malinen [Fri, 28 Nov 2014 17:50:24 +0000 (19:50 +0200)]
tests: ProxyARP with DGAF disabled and multicast-to-unicast conversion

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Do not limit NDISC snoop packet size to 150
Jouni Malinen [Fri, 28 Nov 2014 20:39:55 +0000 (22:39 +0200)]
proxyarp: Do not limit NDISC snoop packet size to 150

The RA, NS, and NA packets may be longer, so do not arbitrarily limit
the packet socket capture size to 150 bytes in the socket filter.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Validate IPv4 header total length value in dhcp_snoop
Jouni Malinen [Fri, 28 Nov 2014 20:31:38 +0000 (22:31 +0200)]
proxyarp: Validate IPv4 header total length value in dhcp_snoop

This field needs to be validated in addition to validating the total
length of the received frame to avoid reading beyond the frame buffer.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Relax frame length limit for RA and NA
Jouni Malinen [Fri, 28 Nov 2014 17:44:58 +0000 (19:44 +0200)]
proxyarp: Relax frame length limit for RA and NA

Only the NS frames should be checked to be long enough to cover all the
fields used in the NS data structure. This allows shorter RA and NA
frames to be processed for multicast-to-unicast rules.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Fix x_snoop multicast-to-unicast debug print
Jouni Malinen [Fri, 28 Nov 2014 17:43:58 +0000 (19:43 +0200)]
proxyarp: Fix x_snoop multicast-to-unicast debug print

l2_packet_send() returns >= 0 on success, i.e., non-zero value does not
mean failure. Fix this debug print to show up only on negative return
values.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Add debug log entry on multicast-to-unicast conversion
Jouni Malinen [Fri, 28 Nov 2014 17:27:07 +0000 (19:27 +0200)]
proxyarp: Add debug log entry on multicast-to-unicast conversion

This makes it easier to debug operations. The debug message is marked
EXCESSIVE, though, to avoid filling the logs with too much information
in default debugging cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoAdd DATA_TEST_FRAME for testing Data frame processing on AP side
Jouni Malinen [Fri, 28 Nov 2014 17:26:11 +0000 (19:26 +0200)]
Add DATA_TEST_FRAME for testing Data frame processing on AP side

The new hostapd control interface command can be used in automated
testing to verify how AP processes Data frames with arbitrary contents.
This is enabled only in builds with CONFIG_TESTING_OPTIONS=y.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoproxyarp: Try multicast-to-unicast conversion only for authorized STAs
Jouni Malinen [Fri, 28 Nov 2014 16:36:40 +0000 (18:36 +0200)]
proxyarp: Try multicast-to-unicast conversion only for authorized STAs

There is no point in trying to send the unicast converted version to a
STA that is not in authorized state since the driver would be expected
to drop normal TX Data frames in such state.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Convert proxyarp tests to use DATA_TEST_FRAME
Jouni Malinen [Thu, 27 Nov 2014 21:53:22 +0000 (23:53 +0200)]
tests: Convert proxyarp tests to use DATA_TEST_FRAME

This is more robust and extensible than configuring IPv6 addresses on
the interfaces and trying to use ping6 or some other external tools to
generate suitable IPv6 frames.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agoAdd DATA_TEST_FRAME for testing Data frame processing
Jouni Malinen [Thu, 27 Nov 2014 21:51:46 +0000 (23:51 +0200)]
Add DATA_TEST_FRAME for testing Data frame processing

The new wpa_supplicant control interface command can be used in
automated testing to verify how AP processes Data frames with arbitrary
contents. This is enabled only in builds with CONFIG_TESTING_OPTIONS=y.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make p2p_messages tests more robust under load
Jouni Malinen [Thu, 27 Nov 2014 19:44:01 +0000 (21:44 +0200)]
tests: Make p2p_messages tests more robust under load

The 50 ms wait time for Action frame response was not sufficient when
the tests are run under heavy load (e.g., multiple VMs in parallel).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make p2p_msg_invitation_req_to_go more robust
Jouni Malinen [Thu, 27 Nov 2014 19:22:31 +0000 (21:22 +0200)]
tests: Make p2p_msg_invitation_req_to_go more robust

Wait for GO to start before sending invitation frames in the protocol
test. Without this, it was possible to hit the 5 second timeout on
management frame RX under load.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make go_neg_with_bss_connected more robust
Jouni Malinen [Thu, 27 Nov 2014 19:06:18 +0000 (21:06 +0200)]
tests: Make go_neg_with_bss_connected more robust

It was possible for this test case to fail due to PBC overlap that was
detected based on previous test case having used PBC. Make that false
positive less likely to happen by explicitly clearing the scan cache on
the devices.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Make ap_wps_reg_config_tkip failure log more helpful
Jouni Malinen [Thu, 27 Nov 2014 18:33:35 +0000 (20:33 +0200)]
tests: Make ap_wps_reg_config_tkip failure log more helpful

The "Not fully connected" report did not clearly identify what went
wrong, so make this more verbose in hope of being able to determine what
happened should this test case fail again.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Increase WPS connection timeout to make tests more robust
Jouni Malinen [Thu, 27 Nov 2014 18:30:07 +0000 (20:30 +0200)]
tests: Increase WPS connection timeout to make tests more robust

It was possible to hit the 10 second timeout in some test cases under
heavy load (e.g., with large number of VMs running tests in parallel).
These timeouts are not really indicating any real error, so make them
less likely to show up in reports by increasing the connection timeout
to 30 seconds.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
9 years agotests: Ignore status responses without =
Johannes Berg [Thu, 27 Nov 2014 17:42:54 +0000 (18:42 +0100)]
tests: Ignore status responses without =

There are valid status (and possibly status-driver) responses
that don't have a name=value format, ignore those in the test
framework parser.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
9 years agotests: Optimize run-tests.py --prefill-tests startup time
Jouni Malinen [Thu, 27 Nov 2014 18:08:15 +0000 (20:08 +0200)]
tests: Optimize run-tests.py --prefill-tests startup time

It took significant part of the startup latency to prefill the database
with test cases due to the SQL COMMIT operation between each added row.
Move COMMIT to outside the loop to speed startup significantly.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>