Add forgotten ampdu_factor into wpa_supplicant.conf

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: IBSS with fixed BSSID

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: HS 2.0 connection using connect API

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Opportunistic key caching with the connect API

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Wildcard SSID with PSK/passphrase

Signed-off-by: Jouni Malinen <j@w1.fi>

Re-enable use of wildcard SSID with passphrase

This used to work, but it looks like the disabled-PSK-network check
ended up rejecting confiurations that configured a wildcard SSID with a
passphrase (instead of PSK).

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: More IBSS WPA-None coverage

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: P2P GO removing persistent client based on invitation result

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: P2P group interface removed due to GO Negotiation failure

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: P2P group idle timeout on GO

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: p2p_find with progressive scan

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: SCAN_INTERVAL setting

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: filter_ssids=1

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Association timeout

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: INTERFACE DISABLED/ENABLED events based on ifdown/up

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Reconnect to the same BSS on inactivity disconnection

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WNM keep-alive

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: auto_interworking=1

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: AP_SCAN 0/2 and externally triggered connection

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: BSS_EXPIRE_COUNT/AGE

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ENABLE/DISABLE_NETWORK

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Radio work canceling during interface removal

Signed-off-by: Jouni Malinen <j@w1.fi>

Fix a debug print to have a space between words

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: EXT PW with no valid PSK found

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: RSN IBSS reconnection

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: autoscan

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: bgscan test cases

Signed-off-by: Jouni Malinen <j@w1.fi>

Add CTRL-EVENT-SIGNAL-CHANGE for bgscan signal update events

This allows external programs to monitor driver signal change events
through wpa_supplicant when bgscan is used.

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: P2P_LISTEN with timeout

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: RADIO_WORK timeout

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: SIGNAL_POLL and PKTCNT_POLL

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WNM_SLEEP with additional parameters

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: HS20_ICON_REQUEST

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: HS20_ANQP_GET

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: P2P_SERVICE_DEL

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface LIST_CREDS

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface SCAN_RESULTS

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface LOG_LEVEL

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface BLACKLIST

Signed-off-by: Jouni Malinen <j@w1.fi>

Fix ctrl_iface BLACKLIST return value

Adding a new entry was returning FAIL on success due to incorrect
assumption of wpa_blacklist_add() returning 0 on success (it returns the
positive blacklist count).

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface BSSID command

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: NFC_REPORT_HANDOVER error cases

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Additional WPS ctrl_iface coverage

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface invalid MAC address

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Increase ctrl_iface SET test coverage

Signed-off-by: Jouni Malinen <j@w1.fi>

P2P: Add NFC_HANDOVER commands to p2p_redir list

These commands can be executed on the P2P interface thus should be
redirected to it when issued to the global control interface.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>

Add reassociate command to dbus doxygen

Signed-off-by: Fionn Cleary <fionn.cleary@streamunlimited.com>

Fix reassociate dbus method

- Reassociate was only working when there was already a connect in
  place, which is not how the REASSOCIATE command from the ctrl
  interface works.

Signed-off-by: Fionn Cleary <fionn.cleary@streamunlimited.com>

wpa_cli: Fix wrong comparison in wpa_cli_cmd_interface

Signed-off-by: Daichi Ueura <daichi.ueura@gmail.com>

nl80211: Handle multiple interface combinations for P2P

The first combination may allow single-channel concurrency for
P2P + managed, but there may be others that allow multi-channel
concurrency. Parse all of them to find the maximum number of channels.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

HS 2.0 SPP server: Fix aaa_trust_root_cert_url example to use DER

The trust roots in the PPS MO point to a DER encoded X.509 certificate.

Signed-off-by: Jouni Malinen <j@w1.fi>

P2P: Add retry mechanism for GO Negotiation Confirmation

wpa_supplicant now retries for P2P_GO_NEG_CNF_MAX_RETRY_COUNT times if
it doesn't receive acknowledgement for GO Negotiation Confirmation
frame. Currently, P2P_GO_NEG_CNF_MAX_RETRY_COUNT is set to 1.

While this is not strictly speaking following the P2P specification,
this can improve robustness of GO Negotiation in environments with
interference and also with peer devices that do not behave properly
(e.g., by not remaining awake on the negotiation channel through the
full GO Negotiation).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

P2P: Mark the scan in p2p_in_invitation as p2p_probe

Mark the scan performed by the P2P Client in search of the GO
during the persistant reinvocation as a p2p_probe to avoid
unnecessary use of 802.11b rates.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

nl80211: Use LEAVE_IBSS with driver-based-SME

NL80211_CMD_LEAVE_IBSS was used only with wpa_supplicant-based SME.
Extend this to drivers that implement SME internally.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

Android: Add qca-vendor.h to be exported

Add qca-vendor.h along with wpa_ctrl.h to be exported to
common staged location.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

OpenSSL: Detect and prevent TLS heartbeat attack

Some OpenSSL versions have vulnerability in TLS heartbeat request
processing. Check the processed message to determine if the attack has
been used and if so, do not send the response to the peer. This does not
prevent the buffer read overflow within OpenSSL, but this prevents the
attacker from receiving the information.

This change is an additional layer of protection if some yet to be
identified paths were to expose this OpenSSL vulnerability. However, the
way OpenSSL is used for EAP-TLS/TTLS/PEAP/FAST in hostapd/wpa_supplicant
was already rejecting the messages before the response goes out and as
such, this additional change is unlikely to be needed to avoid the
issue.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

tests: WNM BSS TM Req with neighbor report subelements

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

WNM: Remove unnecessary present flag

The structures are all allocated, so the pointer can be compared to NULL
to determine whether the subelement was present.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

WNM: Fix neighbor report subelement formats

Number of of subelements were using incorrect format definition.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

WNM: Fix neighbor report subelement parser to not leak memory

If a subelement is unexpectedly included multiple times, the parser must
not re-allocate memory for the entry without first freeing the old
allocation.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

WNM: Fix neighbor report subelement parser

Only the Neighbor Report element should be included here, so verify that
the element id matches. In addition, verify that each subelement has
valid length before using the data.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

Document and rename HT Capability/Operation fields

This makes the definitions match the terminology used in IEEE Std
802.11-2012 and makes it easier to understand how the HT Operation
element subfields are used.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

tests: Remove [PSMP] parameter

This is not used anymore.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

Remove PSMP option from ht_capab

This was used to fill in the "PSMP support" subfield that was defined
during P802.11n development. However, this subfield was marked reserved
in the published IEEE Std 802.11n-2009 and it is not supported by
current drivers that use hostapd for SME either. As such, there is not
much point in maintaining this field as ht_capab parameter within
hostapd either.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

nl80211: Add QCA vendor subcmd for NAN

QCA vendor extension is used for NAN functionality. This defines the
subcommand and attribute to address this.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

Fix CONFIG_AP=y build without CONFIG_P2P=y

Commit ca9bc5b5666a08c741ddd21c451ecb92aa33a11a used P2P functionality
from ap.c without proper ifdef CONFIG_P2P.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

P2P: Clear p2p_in_invitation on cancel

Commit 41d5ce9e0b7b37dd84fbf3c1aa5ed571c32321d4 added scan optimizations
for P2P invitation cases. However, it left a path where the invitation
state was not cleared and as such, introduced potential issues for
following scans that ended up getting incorrectly optimized for a single
channel regardless of parameters. Fix this by clearing p2p_in_invitation
more carefully, especially on p2p_cancel command.

p2p_cancel is now also run from the FLUSH command to avoid issues with
hwsim test cases (e.g., persistent_group_per_sta_psk followed by
ap_open_tdls resulted in an error due to p2p_in_invitation remaining set
after FLUSH).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

tests: BSS Transition Management Request protocol tests

Signed-off-by: Jouni Malinen <j@w1.fi>

WNM: Fix deinit path to clean neighbor report count

wnm_deallocate_memory() left wnm_num_neighbor_report set while freeing
the allocated buffer of neighbor reports. If this function was called
twice in a row without having went through new neighbor report parsing,
invalid pointers could have been freed resulted in segfault.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

tests: Verify STATUS-WPS passphrase on GO

Signed-off-by: Jouni Malinen <j@w1.fi>

WPS NFC: Remove NFC_RX_HANDOVER_SEL

The newer NFC_REPORT_HANDOVER command is more general version that
handles the cases where NFC_RX_HANDOVER_SEL could potentially have been
used. In addition, with the new WPS NFC design, it is important to
receive the handover request message that was used in the handover in
addition to the select message, so the NFC_RX_HANDOVER_SEL command on
its own would not be sufficient for this.

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS_CHECK_PIN with invalid PIN length

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Use random WPS PIN

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Verify random WPS PIN generation

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: GO selecting specific peer to join using PBC

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: wpa_supplicant GET_CAPABILITY

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: SET uapsd

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: SET pno freq parameter

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: SET blob

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: disallow_aps

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: wpa_supplicant bssid_filter

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: ctrl_iface LEVEL command

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS operations on channel 14 and on 5 GHz band

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS parameter update using SET

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS fragmentation when using PIN and WPS_REG

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Add option for running test cases that take a long time

run-tests.py now takes an optional --long parameter that can be used to
enable running of test cases that take a long time (multiple minutes).
By default, such test cases are skipped to avoid making the normal test
run take excessive amounts of time.

As an initial long test case, verify WPS PBC walk time expiration (two
minutes).

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS-M2D or WPS-FAIL while trying to join a group

Signed-off-by: Jouni Malinen <j@w1.fi>

WPS: Remove unused WEP related functionality

Now that WPS 2.0 support is enabled unconditionally, WEP and Shared auth
type are not allowed. This made some of the older code unused and that
can now be removed to clean up the implementation. There is still one
place where WEP is allowed for testing purposes: wpa_supplicant as
Registrar trying to configure an AP to use WEP. That is now only allowed
in CONFIG_TESTING_OPTIONS=y builds, though.

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS cred event for external use

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPS operation with other networks already configured

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Increase Wi-Fi Display testing coverage

Add more subelements, WSD, and disabling of Wi-Fi Display.

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: Increas EAP-pwd fragmentation coverage

Verify fragmentation of additional message types.

Signed-off-by: Jouni Malinen <j@w1.fi>

EAP-pwd peer: Fix fragmentation of PWD-Confirm-Resp

This is somewhat of a corner case since there is no real point in using
so short a fragmentation threshold that it would result in this message
getting fragmented. Anyway, it is better be complete and support this
case as well.

Signed-off-by: Jouni Malinen <j@w1.fi>

EAP-pwd: Fix memory leak on error path with fragmentation

If fragmentation is used, the temporary inbuf/outbuf could have been
leaked in error cases (e.g., reaching maximum number of roundtrips).

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPA2-PSK AP with PMF association comeback (using DROP_SA)

Signed-off-by: Jouni Malinen <j@w1.fi>

Move DROP_SA command to be within ifdef CONFIG_TESTING_OPTIONS

This is a test command and has no use in production builds.

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: wpa_supplicant MIB command output for WPA/WPA2 information

Signed-off-by: Jouni Malinen <j@w1.fi>

tests: WPA (v1) with CCMP

Signed-off-by: Jouni Malinen <j@w1.fi>

Remove used KDE addition code from EAPOL-Key msg 4/4

EAPOL-Key msg 4/4 has no specified KDE use, so remove the unused code to
simplify the implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>

WNM: Fix regression in Sleep Mode exit key data parsing

Commit dbfb8e82ff69e6c7969b7cd23e53fd39b3e896e7 changed the Action frame
RX payload pointer design to point to a different field. WNM Sleep Mode
Response handler updated one of the uses to accommodate this change, but
that commit missed another use for key data length. This resulted in GTK
and IGTK being ignored in many cases when waking up from WNM Sleep Mode
with PMF enabled.

Signed-off-by: Jouni Malinen <j@w1.fi>