[wpa_supplicant] cumilative patch from commit a8655be0b
Bug: 369728263
Test: Connect to open, WPA2, WPA3 and OWE
Test: Establish P2P connection
Test: Basic SoftAp tests
Test: Ran above tests on Pixel6
Test: Regression test (TBD)
BYPASS_INCLUSIVE_LANGUAGE_REASON=Merged from open source
a8655be0b Fix documentation for vendor interface command
a803fa9da Include the NAN header file into driver.h to avoid C++ constraints
2d92cae65 nl80211: Check nla_parse_nested() result
ba6b3dc78 AP MLD: Fix link_id validity check for own links
ffc9fa013 Pass CSA parameters by reference instead by value
1527a95ba Add QCA vendor subcommand to trigger Channel Usage Request
c0c877a1f QCA vendor test configuration to add random PMKIDs in RSNE
a6fd2467b PASN: Allow frequency to be set for responder
d5c07aaab P2P2: Parse new attributes
0f854cb35 P2P2: Add PMKSA caches for PASN initiator and responder
8426e5274 PASN: Use allocated memory for RSNXE and allow its contents to be set
d582f8ce9 PASN: PASN Encrypted Data element parsing
58cc67c72 P2P2: Export p2p_build_go_neg_req()
ff97a762b P2P: Debug print details on address mapping errors
27de11ca5 nl80211: Configure capability flag for NAN USD offload
5cb1929da Add QCA vendor feature flags to indicate NAN USD offload support
58f04221f nl80211: NAN USD commands for offloading
456c3a023 P2P2: Do not include WPS IE in GO Negotiation
839b52eaf P2P2: Fragment P2P IE if subelements are too long in GO Negotiation
c958a571a P2P2: GO Negotiation Action frame contents for wrapped case
64bfba98b P2P: Use enum p2p_status_code more consistently for PD
e633b471b P2P2: Refactor GO Negotiation and Invitation processing
b7de417c8 PASN: Define PMKSA helper functions for initiator and responder
cb9b1f8c5 PASN: Optional KEK derivation in PTK
17a891fd5 P2P2: Notify bootstrapping request and completed events
11a573f31 P2P2: Add a new method to P2P_CONNECT control interface command
bde17063d hostapd: Do not indicate a punctured secondary channel in HT operation
809d9d817 macsec_linux: Hardware offload requires Linux headers >= v5.7
0012c4433 DPP: Support for provisioning SAE password identifiers (Configurator)
782c89c35 DPP: Support for provisioning SAE password identifiers (Enrollee)
de40e08f7 nl80211: Pass "global" events to all interfaces
c3ee46bcb AP MLD: Check SAE message length without depending on pointer arithemetic
63df62c6c AP MLD: Work around delayed STA entry addition for SAE confirm
14cb3906a AP MLD: Introduce MLD level control interface socket
61dfd7ae3 AP MLD: Create link based hostapd control sockets
b7963348c Add QCA vendor attribute to disable channel switch initiation
2b7277d3f USD: Move control interface events to notify.c
97c6ef258 QCA vendor interface to set the P2P mode configuration
e33acc217 Add QCA vendor attribute to change P2P GO beacon interval
59299a8a7 P2P2: Add bootstrapping support with PD frames
6aa9ad8f8 P2P2: Refactor provision discovery request/response processing
b4f9742ee P2P2: Process Element container attribute from NAN SDFs
fa389f2a3 P2P2: Parse P2P2 IE
25c6598f3 NAN USD: Add publishChannelList option for Subscriber
bcab29a78 P2P2: Device Identity Key generation and storage in configuration
58ba550c5 FT: Fix writing of ft_prepend_pmkid configuration parameter
5b0112a18 P2P2: Add DIRA attributes to P2P2 IE of NAN SDFs
29f70292e P2P2: Add PCEA and PBMA attributes to P2P2 IE of NAN SDFs
a58b2ba2f P2P2: Allow P2P IE to be added into NAN SDFs
ae221945f P2P2: New element and attribute definitions
633e96931 NAN: Option to offload NAN DE for USD into the driver
d98417218 RSNO: Check that RSNOE/RSNO2E/RSNXOE fit into RSN Override Link KDE
c03edfd5b Allow IE overriding to use maximum element length
d9bb64914 PASN: Add a function to configure noauth variable
8f21cdf9d PASN: Add support to reject PASN auth 1 based on user input
882bd2edd DPP: Do not restrict SAE password length on Enrollee
503e22025 DPP: Do not restrict SAE password length on Configurator
df8c5e22d RSNO: Always enable SNonce cookie and RSN Override elements validation
bbb55af8c RSNO: Skip validating RSN Override elements with MLO when RSN overriding not used
66d8ac8cc RSNO: Do not enforce SNonce cookie and RSN Selection match if RSNO not used
70b8f64fa RSNO: Update RSN overriding capability indication to the driver
5fd3d05a4 More detailed documentation for QCA_NL80211_VENDOR_SUBCMD_GET_FEATURES
fd72d395d QCA vendor interface for indicating supplicant support for RSN overriding
88150522c Use QCA_WLAN_VENDOR_FEATURE_RSN_OVERRIDE_STA only for indicating driver support
8c9b9ccb4 AP MLD: Fix PN/IPN/BIPN for group rekeying
7275b6514 AP MLD: Fix ML STA wpa_group update during rekey
19e12d5e2 Fix GKeyDoneStations tracking for VLAN
43943ea5b nl80211: Add AP_VLAN interface to bridge after interface is up
7e7e43d6b AP MLD: Add links to bridge FDB for FT roaming
015f6a5a0 nl80211: NULL pointer check for link before use
3e2758b19 hostapd: Avoid channel selection across underlying hardware index
15bf093b5 hostapd: Fetch multiple radios information from the driver
c43e1e5a5 Sync with wireless-next.git include/uapi/linux/nl80211.h
c3beaf6b8 nl80211: MLD: Fix is_shared_drv ops logic when num links is one
3e420372e nl80211: Remove unused function argument from is_drv_shared() ops
c6ff28cb6 AP MLD: Handle garbage pointer after MLD interface is deleted
e1bf37022 nl80211: MLO: Process stop AP event on link basis
f519f472e nl80211: Make nl80211_remove_link() non-static
2d290f196 AP MLD: Handle driver events for interface enable/disable
e9984e3db hostapd: Refactor interface enable/disable into separate helper functions
8324947a6 RSNO: Add debug prints for RSN override elements in EAPOL frames
abd7f4795 RSNO: Fix storing RSNE/RSNXE variants to wpa_sm from association event
72ac0ee02 WNM: Extend workaround for broken AP operating class behavior
e33a55d31 nl80211: Sanitize link ID in mlme_event_ch_switch() for AP interface
de2ee083e nl80211: Add ifname and link ID debug prints in mlme_event_ch_switch()
bd8a1f5ff hostapd: Enable HE when EHT is set for channel switch
c6faa8936 AP MLD: Use the cached per STA profile instead of forming a new one
74db2b744 AP MLD: Handle Vendor Specific element inheritance in per STA profile
023d70d6c AP MLD: Add non-inheritance support for per STA profile reporting
b5359d01e AP MLD: Intersect per STA profile with the reporting BSS
abe990afb AP MLD: Ignore elements which are not meant to be included in per STA profile
2042cae9b AP MLD: Generate and keep per STA profiles for each link
8f07e9699 Move mld_link_info structure to hostapd.h header file
5cb6747f9 Add support to switch channel when CAC is in progress
b7f08c28c WNM: Fix potential NULL pointer dereference during assoc response handling
c7e704bdf hostapd: Add Bandwidth Indication subelement support for channel switch
c9d0c6fd7 hostapd: Refactor Channel Switch Wrapper element generation
b592c1586 nl80211: Handle nl80211_cqm_event per BSS
89c31feb3 Relocate the declaration of the hostapd_find_by_sta() function to top
83c4adcda hostapd: Add Max Channel Switch Time element support
9f334fe68 Share usec-to/from-TU conversion macros in a general location
69deac87f AP MLD: Ensure successful addition of link item into list
ca58be3da SAE: Add group 20 in default groups when AP started with SAE-EXT-KEY
666d695bb nl80211: Fix simultaneous scanning failure in case of MLO
fd55dfe16 nl80211: Fix scan request and its related events handling with MLO
23456e480 Avoid sending DEAUTH or DISASSOC packet when using flag tx=0
619ff3d2e build: Add simple compile_commands.json generation
d42cfaa39 Move wpas_trigger_6ghz_scan() up in the file
a66cb0993 Trigger a 6 GHz scan if RNR contains matching short SSID
acd9332c3 Fix success check for triggering 6 GHz scan
d40788a5c P2P: Use specified frequency for group client in P2P_GROUP_ADD command
9c0a6d64d dbus: Emit ScanInProgress6GHz property
b53d7a6a8 Add non-PSC channels to 6 GHz scan request
9e50c12b3 WNM: Scan for BSSID if there are forbidden neighbors
54b25b7c1 WNM: Always parse candidate list
d9d862787 WNM: Consolidate the scanning paths for BTM requests
3b6abe358 WNM: Reject requests with an invalid dialog token
f4a9cb96d MBO: Always accept BTM request with disassociation imminent bit set
adc6ca34a WNM: Move neighbor report test into wnm_is_bss_excluded()
a83231280 WNM: Swap logic in wnm_is_bss_excluded() to allow more checks
582b5eff4 WNM: Remove unused age parameter for neighbor comparison
4bbe004e0 WNM: Split candidate list parsing into a separate function
b791d1f34 WNM: Use os_relatime_add_ms() helper
da1a86afc WNM: Rename wnm_dissoc_timer
ebd18f1ad WNM: Rename wnm_dissoc_addr
93eb3b83c WNM: Store whether disassociation address is an MLD MAC address
63ac001ed WNM: Only trigger selection logic for own scans
bb96540ef Add QCA vendor attribute to skip recently scanned channels
bc43e75b2 MLD STA: Fix destination address for EAPOL frames
69d18ab9f bgscan: Add OWE transition mode SSID to network scan
56e8f8bf3 OWE: Enable roaming between OWE APs
ddfed3f08 OWE: Reduce code duplication in OWE element parsing
1e5416051 hostapd: Fix BSS parameters change count on link removal
21c3a7494 Add Link ID attribute for external ACS vendor command
594296595 Add link ID attribute to ADD_STA_NODE QCA vendor command for AP MLD
e1ab680c9 Add QCA vendor subcommand to request audio transport switch
7e0e69cfe SAE: Send external auth status after sending Authentication frame
be6e4279f RSNO: Verify all RSNE/RSNXE variants in multi-link cases
521374b97 RSNO: Include all RSNE/RSNXE variants in EAPOL-Key message 3/4
6f522baa1 RSNO: Use SNonce cookie to indicate support for RSN overriding
62ca121f9 RSNO: Use the RSN Selection element to indicate which variant was used
524c45215 RSNO: Remove unused override element generation
13648dde9 FILS: Check for potential NULL return
376adfea8 RSNO: Protect wpa_ie_buf3 from reuse explicitly
4adf234cd RSNO: Remove override elements from EAPOL-Key msg 3/4
296104d35 Testing functionality to allow EAPOL-Key Reserved field to be set
2e4c612dd Allow RSNE/RSNXE/RSNOE/RSNO2E/RSNXOE to be replace for testing
bb61f6cb9 RSNO: Support over two octets of RSNXOE capabilities
8b2ddfdbb RSNO: Allow RSNXE to be omitted
Change-Id: Id01978ca4556c871937ebcee51493166a7d595ab
Signed-off-by: Sunil Ravi <sunilravi@google.com>
diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index a5a821b..c8fbb6a 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -493,6 +493,8 @@
#ifdef CONFIG_SAE
struct hostapd_ssid *ssid = &conf->ssid;
struct sae_password_entry *pw;
+ int *groups = conf->sae_groups;
+ int default_groups[] = { 19, 0, 0 };
if ((conf->sae_pwe == SAE_PWE_HUNT_AND_PECK &&
!hostapd_sae_pw_id_in_use(conf) &&
@@ -506,11 +508,18 @@
conf->rsn_override_key_mgmt_2))
return 0; /* PT not needed */
+ if (!groups) {
+ groups = default_groups;
+ if (wpa_key_mgmt_sae_ext_key(conf->wpa_key_mgmt |
+ conf->rsn_override_key_mgmt |
+ conf->rsn_override_key_mgmt_2))
+ default_groups[1] = 20;
+ }
+
sae_deinit_pt(ssid->pt);
ssid->pt = NULL;
if (ssid->wpa_passphrase) {
- ssid->pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
- ssid->ssid_len,
+ ssid->pt = sae_derive_pt(groups, ssid->ssid, ssid->ssid_len,
(const u8 *) ssid->wpa_passphrase,
os_strlen(ssid->wpa_passphrase),
NULL);
@@ -520,8 +529,7 @@
for (pw = conf->sae_passwords; pw; pw = pw->next) {
sae_deinit_pt(pw->pt);
- pw->pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
- ssid->ssid_len,
+ pw->pt = sae_derive_pt(groups, ssid->ssid, ssid->ssid_len,
(const u8 *) pw->password,
os_strlen(pw->password),
pw->identifier);
@@ -966,6 +974,11 @@
#ifdef CONFIG_TESTING_OPTIONS
wpabuf_free(conf->own_ie_override);
+ wpabuf_free(conf->rsne_override);
+ wpabuf_free(conf->rsnoe_override);
+ wpabuf_free(conf->rsno2e_override);
+ wpabuf_free(conf->rsnxe_override);
+ wpabuf_free(conf->rsnxoe_override);
wpabuf_free(conf->sae_commit_override);
wpabuf_free(conf->rsne_override_eapol);
wpabuf_free(conf->rsnxe_override_eapol);
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index 1a4c912..55f3b64 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -396,6 +396,8 @@
int rsn_preauth;
char *rsn_preauth_interfaces;
+ int rsn_override_omit_rsnxe;
+
#ifdef CONFIG_IEEE80211R_AP
/* IEEE 802.11r - Fast BSS Transition */
u8 mobility_domain[MOBILITY_DOMAIN_ID_LEN];
@@ -694,6 +696,11 @@
u8 bss_load_test[5];
u8 bss_load_test_set;
struct wpabuf *own_ie_override;
+ struct wpabuf *rsne_override;
+ struct wpabuf *rsnoe_override;
+ struct wpabuf *rsno2e_override;
+ struct wpabuf *rsnxe_override;
+ struct wpabuf *rsnxoe_override;
int sae_reflection_attack;
int sae_commit_status;
int sae_pk_omit;
@@ -718,6 +725,7 @@
struct wpabuf *eapol_m1_elements;
struct wpabuf *eapol_m3_elements;
bool eapol_m3_no_encrypt;
+ bool eapol_key_reserved_random;
int test_assoc_comeback_type;
struct wpabuf *presp_elements;
diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
index c473491..92dbc16 100644
--- a/src/ap/ap_drv_ops.c
+++ b/src/ap/ap_drv_ops.c
@@ -1250,3 +1250,14 @@
return hapd->driver->set_secure_ranging_ctx(hapd->drv_priv, ¶ms);
}
#endif /* CONFIG_PASN */
+
+
+struct hostapd_multi_hw_info *
+hostapd_get_multi_hw_info(struct hostapd_data *hapd,
+ unsigned int *num_multi_hws)
+{
+ if (!hapd->driver || !hapd->driver->get_multi_hw_info)
+ return NULL;
+
+ return hapd->driver->get_multi_hw_info(hapd->drv_priv, num_multi_hws);
+}
diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
index d7e79c8..6b7f02a 100644
--- a/src/ap/ap_drv_ops.h
+++ b/src/ap/ap_drv_ops.h
@@ -478,4 +478,8 @@
#endif /* CONFIG_IEEE80211BE */
+struct hostapd_multi_hw_info *
+hostapd_get_multi_hw_info(struct hostapd_data *hapd,
+ unsigned int *num_multi_hws);
+
#endif /* AP_DRV_OPS */
diff --git a/src/ap/beacon.c b/src/ap/beacon.c
index f8ce810..2e3d904 100644
--- a/src/ap/beacon.c
+++ b/src/ap/beacon.c
@@ -514,6 +514,35 @@
}
+static u8 * hostapd_eid_max_cs_time(struct hostapd_data *hapd, u8 *eid)
+{
+#ifdef CONFIG_IEEE80211BE
+ u32 switch_time;
+
+ /* Add Max Channel Switch Time element only if this AP is affiliated
+ * with an AP MLD and channel switch is in process. */
+ if (!hapd->conf->mld_ap || !hapd->cs_freq_params.channel)
+ return eid;
+
+ /* Switch time is basically time between CSA count 1 and CSA count
+ * 0 (1 beacon interval) + time for interface restart + time to
+ * send a Beacon frame in the new channel (1 beacon interval).
+ *
+ * TODO: Use dynamic interface restart time. For now, assume 1 sec.
+ */
+ switch_time = USEC_TO_TU(1000 * 1000) + 2 * hapd->iconf->beacon_int;
+
+ *eid++ = WLAN_EID_EXTENSION;
+ *eid++ = 4;
+ *eid++ = WLAN_EID_EXT_MAX_CHANNEL_SWITCH_TIME;
+ WPA_PUT_LE24(eid, switch_time);
+ eid += 3;
+#endif /* CONFIG_IEEE80211BE */
+
+ return eid;
+}
+
+
static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid)
{
u8 op_class, channel;
@@ -676,7 +705,6 @@
bool is_p2p;
/* Generated IEs will be included inside an ML element */
- bool is_ml_sta_info;
struct hostapd_data *mld_ap;
struct mld_info *mld_info;
@@ -698,7 +726,7 @@
#ifdef CONFIG_IEEE80211BE
if (!params)
return;
- ap_sta_free_sta_profile(params->mld_info);
+
os_free(params->mld_info);
params->mld_info = NULL;
#endif /* CONFIG_IEEE80211BE */
@@ -737,17 +765,21 @@
#ifdef CONFIG_IEEE80211BE
if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
+ struct hostapd_data *ml_elem_ap =
+ params->mld_ap ? params->mld_ap : hapd;
+
buflen += hostapd_eid_eht_capab_len(hapd, IEEE80211_MODE_AP);
buflen += 3 + sizeof(struct ieee80211_eht_operation);
if (hapd->iconf->punct_bitmap)
buflen += EHT_OPER_DISABLED_SUBCHAN_BITMAP_SIZE;
- if (!params->is_ml_sta_info && hapd->conf->mld_ap) {
- struct hostapd_data *ml_elem_ap =
- params->mld_ap ? params->mld_ap : hapd;
-
+ if (ml_elem_ap->conf->mld_ap) {
buflen += hostapd_eid_eht_ml_beacon_len(
ml_elem_ap, params->mld_info, !!params->mld_ap);
+
+ /* For Max Channel Switch Time element during channel
+ * switch */
+ buflen += 6;
}
}
#endif /* CONFIG_IEEE80211BE */
@@ -755,9 +787,7 @@
buflen += hostapd_eid_mbssid_len(hapd, WLAN_FC_STYPE_PROBE_RESP, NULL,
params->known_bss,
params->known_bss_len, NULL);
- if (!params->is_ml_sta_info)
- buflen += hostapd_eid_rnr_len(hapd, WLAN_FC_STYPE_PROBE_RESP,
- true);
+ buflen += hostapd_eid_rnr_len(hapd, WLAN_FC_STYPE_PROBE_RESP, true);
buflen += hostapd_mbo_ie_len(hapd);
buflen += hostapd_eid_owe_trans_len(hapd);
buflen += hostapd_eid_dpp_cc_len(hapd);
@@ -778,13 +808,11 @@
epos = pos + len;
- if (!params->is_ml_sta_info) {
- *pos++ = WLAN_EID_SSID;
- *pos++ = hapd->conf->ssid.ssid_len;
- os_memcpy(pos, hapd->conf->ssid.ssid,
- hapd->conf->ssid.ssid_len);
- pos += hapd->conf->ssid.ssid_len;
- }
+ *pos++ = WLAN_EID_SSID;
+ *pos++ = hapd->conf->ssid.ssid_len;
+ os_memcpy(pos, hapd->conf->ssid.ssid,
+ hapd->conf->ssid.ssid_len);
+ pos += hapd->conf->ssid.ssid_len;
/* Supported rates */
pos = hostapd_eid_supp_rates(hapd, pos);
@@ -797,18 +825,13 @@
/* Power Constraint element */
pos = hostapd_eid_pwr_constraint(hapd, pos);
- /*
- * CSA IE
- * TODO: This should be included inside the ML sta profile
- */
- if (!params->is_ml_sta_info) {
- csa_pos = hostapd_eid_csa(hapd, pos);
- if (csa_pos != pos)
- params->csa_pos = csa_pos - 1;
- else
- params->csa_pos = NULL;
- pos = csa_pos;
- }
+ /* CSA element */
+ csa_pos = hostapd_eid_csa(hapd, pos);
+ if (csa_pos != pos)
+ params->csa_pos = csa_pos - 1;
+ else
+ params->csa_pos = NULL;
+ pos = csa_pos;
/* ERP Information element */
pos = hostapd_eid_erp_info(hapd, pos);
@@ -824,18 +847,13 @@
pos = hostapd_eid_rm_enabled_capab(hapd, pos, epos - pos);
pos = hostapd_get_mde(hapd, pos, epos - pos);
- /*
- * eCSA IE
- * TODO: This should be included inside the ML sta profile
- */
- if (!params->is_ml_sta_info) {
- csa_pos = hostapd_eid_ecsa(hapd, pos);
- if (csa_pos != pos)
- params->ecsa_pos = csa_pos - 1;
- else
- params->ecsa_pos = NULL;
- pos = csa_pos;
- }
+ /* eCSA element */
+ csa_pos = hostapd_eid_ecsa(hapd, pos);
+ if (csa_pos != pos)
+ params->ecsa_pos = csa_pos - 1;
+ else
+ params->ecsa_pos = NULL;
+ pos = csa_pos;
pos = hostapd_eid_supported_op_classes(hapd, pos);
pos = hostapd_eid_ht_capabilities(hapd, pos);
@@ -877,12 +895,14 @@
pos = hostapd_eid_txpower_envelope(hapd, pos);
#endif /* CONFIG_IEEE80211AX */
- pos = hostapd_eid_wb_chsw_wrapper(hapd, pos);
+ pos = hostapd_eid_chsw_wrapper(hapd, pos);
- if (!params->is_ml_sta_info)
- pos = hostapd_eid_rnr(hapd, pos, WLAN_FC_STYPE_PROBE_RESP,
- true);
+ pos = hostapd_eid_rnr(hapd, pos, WLAN_FC_STYPE_PROBE_RESP, true);
pos = hostapd_eid_fils_indic(hapd, pos, 0);
+
+ /* Max Channel Switch Time element */
+ pos = hostapd_eid_max_cs_time(hapd, pos);
+
pos = hostapd_get_rsnxe(hapd, pos, epos - pos);
#ifdef CONFIG_IEEE80211AX
@@ -1039,7 +1059,6 @@
const struct ieee80211_mgmt *mgmt,
int mld_id, u16 links)
{
- struct probe_resp_params sta_info_params;
struct hostapd_data *link;
params->mld_ap = NULL;
@@ -1053,10 +1072,7 @@
for_each_mld_link(link, hapd) {
struct mld_link_info *link_info;
- size_t buflen;
u8 mld_link_id = link->mld_link_id;
- u8 *epos;
- u8 buf[EHT_ML_MAX_STA_PROF_LEN];
/*
* Set mld_ap iff the ML probe request explicitly
@@ -1076,49 +1092,12 @@
continue;
link_info = ¶ms->mld_info->links[mld_link_id];
-
- sta_info_params.req = params->req;
- sta_info_params.is_p2p = false;
- sta_info_params.is_ml_sta_info = true;
- sta_info_params.mld_ap = NULL;
- sta_info_params.mld_info = NULL;
-
- buflen = MAX_PROBERESP_LEN;
- buflen += hostapd_probe_resp_elems_len(link, &sta_info_params);
-
- if (buflen > EHT_ML_MAX_STA_PROF_LEN) {
- wpa_printf(MSG_DEBUG,
- "MLD: Not including link %d in ML probe response (%zu bytes is too long)",
- mld_link_id, buflen);
- goto fail;
- }
-
- /*
- * NOTE: This does not properly handle inheritance and
- * various other things.
- */
- link_info->valid = true;
- epos = buf;
-
- /* Capabilities is the only fixed parameter */
- WPA_PUT_LE16(epos, hostapd_own_capab_info(hapd));
- epos += 2;
-
- epos = hostapd_probe_resp_fill_elems(
- link, &sta_info_params, epos,
- EHT_ML_MAX_STA_PROF_LEN - 2);
- link_info->resp_sta_profile_len = epos - buf;
- os_free(link_info->resp_sta_profile);
- link_info->resp_sta_profile = os_memdup(
- buf, link_info->resp_sta_profile_len);
- if (!link_info->resp_sta_profile)
- link_info->resp_sta_profile_len = 0;
- os_memcpy(link_info->local_addr, link->own_addr, ETH_ALEN);
+ os_memcpy(link_info, &hapd->partner_links[mld_link_id],
+ sizeof(hapd->partner_links[mld_link_id]));
wpa_printf(MSG_DEBUG,
- "MLD: ML probe response includes link sta info for %d: %u bytes (estimate %zu)",
- mld_link_id, link_info->resp_sta_profile_len,
- buflen);
+ "MLD: ML probe response includes link STA info for %d: %u bytes",
+ mld_link_id, link_info->resp_sta_profile_len);
}
if (mld_id != -1 && !params->mld_ap) {
@@ -1685,7 +1664,6 @@
params.is_p2p = !!elems.p2p;
params.known_bss = elems.mbssid_known_bss;
params.known_bss_len = elems.mbssid_known_bss_len;
- params.is_ml_sta_info = false;
hostapd_gen_probe_resp(hapd, ¶ms);
@@ -1766,7 +1744,6 @@
params.is_p2p = false;
params.known_bss = NULL;
params.known_bss_len = 0;
- params.is_ml_sta_info = false;
params.mld_ap = NULL;
params.mld_info = NULL;
@@ -1810,7 +1787,6 @@
probe_params.is_p2p = false;
probe_params.known_bss = NULL;
probe_params.known_bss_len = 0;
- probe_params.is_ml_sta_info = false;
probe_params.mld_ap = NULL;
probe_params.mld_info = NULL;
@@ -2188,7 +2164,7 @@
#ifdef NEED_AP_MLME
#define BEACON_HEAD_BUF_SIZE 256
-#define BEACON_TAIL_BUF_SIZE 512
+#define BEACON_TAIL_BUF_SIZE 1500
head = os_zalloc(BEACON_HEAD_BUF_SIZE);
tail_len = BEACON_TAIL_BUF_SIZE;
#ifdef CONFIG_WPS
@@ -2227,8 +2203,13 @@
* long based on the common info and number of per
* station profiles. For now use 256.
*/
- if (hapd->conf->mld_ap)
+ if (hapd->conf->mld_ap) {
tail_len += 256;
+
+ /* for Max Channel Switch Time element during channel
+ * switch */
+ tail_len += 6;
+ }
}
#endif /* CONFIG_IEEE80211BE */
@@ -2372,10 +2353,14 @@
tailpos = hostapd_eid_txpower_envelope(hapd, tailpos);
#endif /* CONFIG_IEEE80211AX */
- tailpos = hostapd_eid_wb_chsw_wrapper(hapd, tailpos);
+ tailpos = hostapd_eid_chsw_wrapper(hapd, tailpos);
tailpos = hostapd_eid_rnr(hapd, tailpos, WLAN_FC_STYPE_BEACON, true);
tailpos = hostapd_eid_fils_indic(hapd, tailpos, 0);
+
+ /* Max Channel Switch Time element */
+ tailpos = hostapd_eid_max_cs_time(hapd, tailpos);
+
tailpos = hostapd_get_rsnxe(hapd, tailpos, tailend - tailpos);
tailpos = hostapd_eid_mbssid_config(hapd, tailpos,
params->mbssid_elem_count);
@@ -2775,12 +2760,438 @@
}
+#ifdef CONFIG_IEEE80211BE
+
+static int hostapd_get_probe_resp_tmpl(struct hostapd_data *hapd,
+ struct probe_resp_params *params,
+ bool is_ml_sta_info)
+{
+ os_memset(params, 0, sizeof(*params));
+ hostapd_gen_probe_resp(hapd, params);
+ if (!params->resp)
+ return -1;
+
+ /* The caller takes care of freeing params->resp. */
+ return 0;
+}
+
+
+static bool is_restricted_eid_in_sta_profile(u8 eid, bool tx_vap)
+{
+ switch (eid) {
+ case WLAN_EID_TIM:
+ case WLAN_EID_BSS_MAX_IDLE_PERIOD:
+ case WLAN_EID_MULTIPLE_BSSID:
+ case WLAN_EID_REDUCED_NEIGHBOR_REPORT:
+ case WLAN_EID_NEIGHBOR_REPORT:
+ return true;
+ case WLAN_EID_SSID:
+ /* SSID is not restricted for non-transmitted BSSID */
+ return tx_vap;
+ default:
+ return false;
+ }
+}
+
+
+static bool is_restricted_ext_eid_in_sta_profile(u8 ext_id)
+{
+ switch (ext_id) {
+ case WLAN_EID_EXT_MULTI_LINK:
+ return true;
+ default:
+ return false;
+ }
+}
+
+
+/* Create the link STA profiles based on inheritance from the reporting
+ * profile.
+ *
+ * NOTE: The same function is used for length calculation as well as filling
+ * data in the given buffer. This avoids risk of not updating the length
+ * function but filling function or vice versa.
+ */
+static size_t hostapd_add_sta_profile(struct ieee80211_mgmt *link_fdata,
+ size_t link_data_len,
+ struct ieee80211_mgmt *own_fdata,
+ size_t own_data_len,
+ u8 *sta_profile, bool tx_vap)
+{
+ const struct element *link_elem;
+ size_t sta_profile_len = 0;
+ const u8 *link_elem_data;
+ u8 link_ele_len;
+ u8 *link_data;
+ const struct element *own_elem;
+ u8 link_eid, own_eid, own_ele_len;
+ const u8 *own_elem_data;
+ u8 *own_data;
+ bool is_ext;
+ bool ie_found;
+ u8 non_inherit_ele_ext_list[256] = { 0 };
+ u8 non_inherit_ele_ext_list_len = 0;
+ u8 non_inherit_ele_list[256] = { 0 };
+ u8 non_inherit_ele_list_len = 0;
+ u8 num_link_elem_vendor_ies = 0, num_own_elem_vendor_ies = 0;
+ bool add_vendor_ies = false, is_identical_vendor_ies = true;
+ /* The bitmap of parsed EIDs. There are 256 EIDs and ext EIDs, so 32
+ * bytes to store the bitmaps. */
+ u8 parsed_eid_bmap[32] = { 0 }, parsed_ext_eid_bmap[32] = { 0 };
+ /* extra len used in the logic includes the element id and len */
+ u8 extra_len = 2;
+
+ /* Include len for capab info */
+ sta_profile_len += sizeof(le16);
+ if (sta_profile) {
+ os_memcpy(sta_profile, &link_fdata->u.probe_resp.capab_info,
+ sizeof(le16));
+ sta_profile += sizeof(le16);
+ }
+
+ own_data = own_fdata->u.probe_resp.variable;
+ link_data = link_fdata->u.probe_resp.variable;
+
+ /* The below logic takes the reporting BSS data and reported BSS data
+ * and performs intersection to build the STA profile of the reported
+ * BSS. Certain elements are not added to the STA profile as
+ * recommended in standard. Matching element information in the
+ * reporting BSS profile are ignored in the STA profile. Remaining
+ * elements pertaining to the STA profile are appended at the end. */
+ for_each_element(own_elem, own_data, own_data_len) {
+ is_ext = false;
+ ie_found = false;
+
+ /* Pick one of own elements and get its EID and length */
+ own_elem_data = own_elem->data;
+ own_ele_len = own_elem->datalen;
+
+ if (own_elem->id == WLAN_EID_EXTENSION) {
+ is_ext = true;
+ own_eid = *(own_elem_data);
+ if (is_restricted_ext_eid_in_sta_profile(own_eid))
+ continue;
+ } else {
+ own_eid = own_elem->id;
+ if (is_restricted_eid_in_sta_profile(own_eid, tx_vap))
+ continue;
+ }
+
+ for_each_element(link_elem, link_data, link_data_len) {
+ /* If the element type mismatches, do not consider
+ * this link element for comparison. */
+ if ((link_elem->id == WLAN_EID_EXTENSION &&
+ !is_ext) ||
+ (is_ext && link_elem->id != WLAN_EID_EXTENSION))
+ continue;
+
+ /* Comparison can be done so get the link element and
+ * its EID and length. */
+ link_elem_data = link_elem->data;
+ link_ele_len = link_elem->datalen;
+
+ if (link_elem->id == WLAN_EID_EXTENSION)
+ link_eid = *(link_elem_data);
+ else
+ link_eid = link_elem->id;
+
+ /* Ignore if EID does not match */
+ if (own_eid != link_eid)
+ continue;
+
+ ie_found = true;
+
+ /* Ignore if the contents is identical. */
+ if (own_ele_len == link_ele_len &&
+ os_memcmp(own_elem->data, link_elem->data,
+ own_ele_len) == 0) {
+ if (own_eid == WLAN_EID_VENDOR_SPECIFIC) {
+ is_identical_vendor_ies = true;
+ num_own_elem_vendor_ies++;
+ }
+ continue;
+ }
+
+ /* No need to include this non-matching Vendor Specific
+ * element explicitly at this point. */
+ if (own_eid == WLAN_EID_VENDOR_SPECIFIC) {
+ is_identical_vendor_ies = false;
+ continue;
+ }
+
+ /* This element is present in the reported profile
+ * as well as present in the reporting profile.
+ * However, there is a mismatch in the contents and
+ * hence, include this in the per STA profile. */
+ sta_profile_len += link_ele_len + extra_len;
+ if (sta_profile) {
+ os_memcpy(sta_profile,
+ link_elem->data - extra_len,
+ link_ele_len + extra_len);
+ sta_profile += link_ele_len + extra_len;
+ }
+
+ /* Update the parsed EIDs bitmap */
+ if (is_ext)
+ parsed_ext_eid_bmap[own_eid / 8] |=
+ BIT(own_eid % 8);
+ else
+ parsed_eid_bmap[own_eid / 8] |=
+ BIT(own_eid % 8);
+ break;
+ }
+
+ /* We found at least one Vendor Specific element in reporting
+ * link which is not same (or present) in the reported link. We
+ * need to include all Vendor Specific elements from the
+ * reported link. */
+ if (!is_identical_vendor_ies)
+ add_vendor_ies = true;
+
+ /* This is a unique element in the reporting profile which is
+ * not present in the reported profile. Update the
+ * non-inheritance list. */
+ if (!ie_found) {
+ u8 idx;
+
+ if (is_ext) {
+ idx = non_inherit_ele_ext_list_len++;
+ non_inherit_ele_ext_list[idx] = own_eid;
+ } else {
+ idx = non_inherit_ele_list_len++;
+ non_inherit_ele_list[idx] = own_eid;
+ }
+ }
+ }
+
+ /* Parse the remaining elements in the reported profile */
+ for_each_element(link_elem, link_data, link_data_len) {
+ link_elem_data = link_elem->data;
+ link_ele_len = link_elem->datalen;
+
+ /* No need to check this Vendor Specific element at this point.
+ * Just take the count and continue. */
+ if (link_elem->id == WLAN_EID_VENDOR_SPECIFIC) {
+ num_link_elem_vendor_ies++;
+ continue;
+ }
+
+ if (link_elem->id == WLAN_EID_EXTENSION) {
+ link_eid = *(link_elem_data);
+
+ if ((parsed_ext_eid_bmap[link_eid / 8] &
+ BIT(link_eid % 8)) ||
+ is_restricted_ext_eid_in_sta_profile(link_eid))
+ continue;
+ } else {
+ link_eid = link_elem->id;
+
+ if ((parsed_eid_bmap[link_eid / 8] &
+ BIT(link_eid % 8)) ||
+ is_restricted_eid_in_sta_profile(link_eid, tx_vap))
+ continue;
+ }
+
+ sta_profile_len += link_ele_len + extra_len;
+ if (sta_profile) {
+ os_memcpy(sta_profile, link_elem_data - extra_len,
+ link_ele_len + extra_len);
+ sta_profile += link_ele_len + extra_len;
+ }
+ }
+
+ /* Handle Vendor Specific elements
+ * Add all the Vendor Specific elements of the reported link if
+ * a. There is at least one non-matching Vendor Specific element, or
+ * b. The number of Vendor Specific elements in reporting and reported
+ * link is not same. */
+ if (add_vendor_ies ||
+ num_own_elem_vendor_ies != num_link_elem_vendor_ies) {
+ for_each_element(link_elem, link_data, link_data_len) {
+ link_elem_data = link_elem->data;
+ link_ele_len = link_elem->datalen;
+
+ if (link_elem->id != WLAN_EID_VENDOR_SPECIFIC)
+ continue;
+
+ sta_profile_len += link_ele_len + extra_len;
+ if (sta_profile) {
+ os_memcpy(sta_profile,
+ link_elem_data - extra_len,
+ link_ele_len + extra_len);
+ sta_profile += link_ele_len + extra_len;
+ }
+ }
+ }
+
+ /* Handle non-inheritance
+ * Non-Inheritance element:
+ * Element ID Ext: 1 octet
+ * Length: 1 octet
+ * Ext tag number: 1 octet
+ * Length of Elements ID list: 1 octet
+ * Elements ID list: variable
+ * Length of Elements ID Extension list: 1 octet
+ * Elements ID extensions list: variable
+ */
+ if (non_inherit_ele_list_len || non_inherit_ele_ext_list_len)
+ sta_profile_len += 3 + 2 + non_inherit_ele_list_len +
+ non_inherit_ele_ext_list_len;
+
+ if (sta_profile &&
+ (non_inherit_ele_list_len || non_inherit_ele_ext_list_len)) {
+ *sta_profile++ = WLAN_EID_EXTENSION;
+ *sta_profile++ = non_inherit_ele_list_len +
+ non_inherit_ele_ext_list_len + 3;
+ *sta_profile++ = WLAN_EID_EXT_NON_INHERITANCE;
+ *sta_profile++ = non_inherit_ele_list_len;
+ os_memcpy(sta_profile, non_inherit_ele_list,
+ non_inherit_ele_list_len);
+ sta_profile += non_inherit_ele_list_len;
+ *sta_profile++ = non_inherit_ele_ext_list_len;
+ os_memcpy(sta_profile, non_inherit_ele_ext_list,
+ non_inherit_ele_ext_list_len);
+ sta_profile += non_inherit_ele_ext_list_len;
+ }
+
+ return sta_profile_len;
+}
+
+
+static u8 * hostapd_gen_sta_profile(struct ieee80211_mgmt *link_data,
+ size_t link_data_len,
+ struct ieee80211_mgmt *own_data,
+ size_t own_data_len,
+ size_t *sta_profile_len, bool tx_vap)
+{
+ u8 *sta_profile;
+
+ /* Get the length first */
+ *sta_profile_len = hostapd_add_sta_profile(link_data, link_data_len,
+ own_data, own_data_len,
+ NULL, tx_vap);
+ if (!(*sta_profile_len) || *sta_profile_len > EHT_ML_MAX_STA_PROF_LEN)
+ return NULL;
+
+ sta_profile = os_zalloc(*sta_profile_len);
+ if (!sta_profile)
+ return NULL;
+
+ /* Now fill in the data */
+ hostapd_add_sta_profile(link_data, link_data_len, own_data,
+ own_data_len, sta_profile, tx_vap);
+
+ /* The caller takes care of freeing the returned sta_profile */
+ return sta_profile;
+}
+
+
+static void hostapd_gen_per_sta_profiles(struct hostapd_data *hapd)
+{
+ bool tx_vap = hapd == hostapd_mbssid_get_tx_bss(hapd);
+ size_t link_data_len, sta_profile_len;
+ size_t own_data_len;
+ struct probe_resp_params link_params;
+ struct probe_resp_params own_params;
+ struct ieee80211_mgmt *link_data;
+ struct ieee80211_mgmt *own_data;
+ struct mld_link_info *link_info;
+ struct hostapd_data *link_bss;
+ u8 link_id, *sta_profile;
+
+ if (!hapd->conf->mld_ap)
+ return;
+
+ wpa_printf(MSG_DEBUG, "MLD: Generating per STA profiles for MLD %s",
+ hapd->conf->iface);
+
+ wpa_printf(MSG_DEBUG, "MLD: Reporting link %d", hapd->mld_link_id);
+
+ /* Generate a Probe Response template for self */
+ if (hostapd_get_probe_resp_tmpl(hapd, &own_params, false)) {
+ wpa_printf(MSG_ERROR,
+ "MLD: Error in building per STA profiles");
+ return;
+ }
+
+ own_data = own_params.resp;
+ own_data_len = own_params.resp_len;
+
+ /* Consider the length of the variable fields */
+ own_data_len -= offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+
+ for_each_mld_link(link_bss, hapd) {
+ if (link_bss == hapd || !link_bss->started)
+ continue;
+
+ link_id = link_bss->mld_link_id;
+ if (link_id >= MAX_NUM_MLD_LINKS)
+ continue;
+
+ sta_profile = NULL;
+ sta_profile_len = 0;
+
+ /* Generate a Probe Response frame template for partner link */
+ if (hostapd_get_probe_resp_tmpl(link_bss, &link_params, true)) {
+ wpa_printf(MSG_ERROR,
+ "MLD: Could not get link STA probe response template for link %d",
+ link_id);
+ continue;
+ }
+
+ link_data = link_params.resp;
+ link_data_len = link_params.resp_len;
+
+ /* Consider length of the variable fields */
+ link_data_len -= offsetof(struct ieee80211_mgmt,
+ u.probe_resp.variable);
+
+ sta_profile = hostapd_gen_sta_profile(link_data, link_data_len,
+ own_data, own_data_len,
+ &sta_profile_len, tx_vap);
+ if (!sta_profile) {
+ wpa_printf(MSG_ERROR,
+ "MLD: Could not generate link STA profile for link %d",
+ link_id);
+ continue;
+ }
+
+ link_info = &hapd->partner_links[link_id];
+ link_info->valid = true;
+
+ os_free(link_info->resp_sta_profile);
+ link_info->resp_sta_profile_len = sta_profile_len;
+
+ link_info->resp_sta_profile = os_memdup(sta_profile,
+ sta_profile_len);
+ if (!link_info->resp_sta_profile)
+ link_info->resp_sta_profile_len = 0;
+
+ os_memcpy(link_info->local_addr, link_bss->own_addr, ETH_ALEN);
+
+ wpa_printf(MSG_DEBUG,
+ "MLD: Reported link STA info for %d: %u bytes",
+ link_id, link_info->resp_sta_profile_len);
+
+ os_free(sta_profile);
+ os_free(link_params.resp);
+ }
+
+ os_free(own_params.resp);
+}
+
+#endif /* CONFIG_IEEE80211BE */
+
+
int ieee802_11_set_beacon(struct hostapd_data *hapd)
{
struct hostapd_iface *iface = hapd->iface;
int ret;
size_t i, j;
bool is_6g, hapd_mld = false;
+#ifdef CONFIG_IEEE80211BE
+ struct hostapd_data *link_bss;
+#endif /* CONFIG_IEEE80211BE */
ret = __ieee802_11_set_beacon(hapd);
if (ret != 0)
@@ -2821,6 +3232,15 @@
}
}
+#ifdef CONFIG_IEEE80211BE
+ if (!hapd_mld)
+ return 0;
+
+ /* Generate per STA profiles for each affiliated APs */
+ for_each_mld_link(link_bss, hapd)
+ hostapd_gen_per_sta_profiles(link_bss);
+#endif /* CONFIG_IEEE80211BE */
+
return 0;
}
diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
index d4d73de..b93a5d2 100644
--- a/src/ap/ctrl_iface_ap.c
+++ b/src/ap/ctrl_iface_ap.c
@@ -661,15 +661,18 @@
}
#endif /* CONFIG_P2P_MANAGER */
- if (os_strstr(txtaddr, " tx=0"))
- hostapd_drv_sta_remove(hapd, addr);
- else
- hostapd_drv_sta_deauth(hapd, addr, reason);
sta = ap_get_sta(hapd, addr);
- if (sta)
- ap_sta_deauthenticate(hapd, sta, reason);
- else if (addr[0] == 0xff)
- hostapd_free_stas(hapd);
+ if (os_strstr(txtaddr, " tx=0")) {
+ hostapd_drv_sta_remove(hapd, addr);
+ if (sta)
+ ap_free_sta(hapd, sta);
+ } else {
+ hostapd_drv_sta_deauth(hapd, addr, reason);
+ if (sta)
+ ap_sta_deauthenticate(hapd, sta, reason);
+ else if (addr[0] == 0xff)
+ hostapd_free_stas(hapd);
+ }
return 0;
}
@@ -723,15 +726,18 @@
}
#endif /* CONFIG_P2P_MANAGER */
- if (os_strstr(txtaddr, " tx=0"))
- hostapd_drv_sta_remove(hapd, addr);
- else
- hostapd_drv_sta_disassoc(hapd, addr, reason);
sta = ap_get_sta(hapd, addr);
- if (sta)
- ap_sta_disassociate(hapd, sta, reason);
- else if (addr[0] == 0xff)
- hostapd_free_stas(hapd);
+ if (os_strstr(txtaddr, " tx=0")) {
+ hostapd_drv_sta_remove(hapd, addr);
+ if (sta)
+ ap_free_sta(hapd, sta);
+ } else {
+ hostapd_drv_sta_disassoc(hapd, addr, reason);
+ if (sta)
+ ap_sta_disassociate(hapd, sta, reason);
+ else if (addr[0] == 0xff)
+ hostapd_free_stas(hapd);
+ }
return 0;
}
@@ -1137,8 +1143,9 @@
SET_CSA_SETTING_EXT(punct_bitmap);
settings->freq_params.ht_enabled = !!os_strstr(pos, " ht");
settings->freq_params.vht_enabled = !!os_strstr(pos, " vht");
- settings->freq_params.he_enabled = !!os_strstr(pos, " he");
settings->freq_params.eht_enabled = !!os_strstr(pos, " eht");
+ settings->freq_params.he_enabled = !!os_strstr(pos, " he") ||
+ settings->freq_params.eht_enabled;
settings->block_tx = !!os_strstr(pos, " blocktx");
#undef SET_CSA_SETTING
#undef SET_CSA_SETTING_EXT
diff --git a/src/ap/dfs.c b/src/ap/dfs.c
index af9dc16..0cac194 100644
--- a/src/ap/dfs.c
+++ b/src/ap/dfs.c
@@ -253,6 +253,13 @@
for (i = 0; i < mode->num_channels; i++) {
chan = &mode->channels[i];
+ if (!chan_in_current_hw_info(iface->current_hw_info, chan)) {
+ wpa_printf(MSG_DEBUG,
+ "DFS: channel %d (%d) is not under current hardware index",
+ chan->freq, chan->chan);
+ continue;
+ }
+
/* Skip HT40/VHT incompatible channels */
if (iface->conf->ieee80211n &&
iface->conf->secondary_channel &&
diff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c
index 233984f..05adc41 100644
--- a/src/ap/drv_callbacks.c
+++ b/src/ap/drv_callbacks.c
@@ -73,6 +73,8 @@
p = hostapd_eid_assoc_fils_session(sta->wpa_sm, p,
elems.fils_session,
sta->fils_hlp_resp);
+ if (!p)
+ return;
reply_res = hostapd_sta_assoc(hapd, sta->addr,
sta->fils_pending_assoc_is_reassoc,
@@ -248,6 +250,52 @@
#endif /* CONFIG_IEEE80211BE */
+#if defined(HOSTAPD) || defined(CONFIG_IEEE80211BE)
+static struct hostapd_data * hostapd_find_by_sta(struct hostapd_iface *iface,
+ const u8 *src, bool rsn,
+ struct sta_info **sta_ret)
+{
+ struct hostapd_data *hapd;
+ struct sta_info *sta;
+ unsigned int j;
+
+ if (sta_ret)
+ *sta_ret = NULL;
+
+ for (j = 0; j < iface->num_bss; j++) {
+ hapd = iface->bss[j];
+ sta = ap_get_sta(hapd, src);
+ if (sta && (sta->flags & WLAN_STA_ASSOC) &&
+ (!rsn || sta->wpa_sm)) {
+ if (sta_ret)
+ *sta_ret = sta;
+ return hapd;
+ }
+#ifdef CONFIG_IEEE80211BE
+ if (hapd->conf->mld_ap) {
+ struct hostapd_data *p_hapd;
+
+ for_each_mld_link(p_hapd, hapd) {
+ if (p_hapd == hapd)
+ continue;
+
+ sta = ap_get_sta(p_hapd, src);
+ if (sta && (sta->flags & WLAN_STA_ASSOC) &&
+ (!rsn || sta->wpa_sm)) {
+ if (sta_ret)
+ *sta_ret = sta;
+ return p_hapd;
+ }
+ }
+ }
+#endif /* CONFIG_IEEE80211BE */
+ }
+
+ return NULL;
+}
+#endif /* HOSTAPD || CONFIG_IEEE80211BE */
+
+
int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
const u8 *req_ies, size_t req_ies_len,
const u8 *resp_ies, size_t resp_ies_len,
@@ -513,10 +561,8 @@
"Failed to initialize WPA state machine");
return -1;
}
- wpa_auth_set_rsn_override(sta->wpa_sm,
- elems.rsne_override != NULL);
- wpa_auth_set_rsn_override_2(sta->wpa_sm,
- elems.rsne_override_2 != NULL);
+ wpa_auth_set_rsn_selection(sta->wpa_sm, elems.rsn_selection,
+ elems.rsn_selection_len);
#ifdef CONFIG_IEEE80211BE
if (ap_sta_is_mld(hapd, sta)) {
wpa_printf(MSG_DEBUG,
@@ -777,6 +823,9 @@
p = hostapd_eid_assoc_fils_session(sta->wpa_sm, p,
elems.fils_session,
sta->fils_hlp_resp);
+ if (!p)
+ goto fail;
+
wpa_hexdump(MSG_DEBUG, "FILS Assoc Resp BUF (IEs)",
buf, p - buf);
}
@@ -1041,6 +1090,20 @@
void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
{
struct sta_info *sta = ap_get_sta(hapd, addr);
+#ifdef CONFIG_IEEE80211BE
+ struct hostapd_data *orig_hapd = hapd;
+
+ if (!sta && hapd->conf->mld_ap) {
+ hapd = hostapd_find_by_sta(hapd->iface, addr, true, &sta);
+ if (!hapd) {
+ wpa_printf(MSG_DEBUG,
+ "No partner link BSS found for STA " MACSTR
+ " - fallback to received context",
+ MAC2STR(addr));
+ hapd = orig_hapd;
+ }
+ }
+#endif /* CONFIG_IEEE80211BE */
if (!sta || !hapd->conf->disassoc_low_ack || sta->agreed_to_steer)
return;
@@ -1983,50 +2046,6 @@
}
-static struct hostapd_data * hostapd_find_by_sta(struct hostapd_iface *iface,
- const u8 *src, bool rsn,
- struct sta_info **sta_ret)
-{
- struct hostapd_data *hapd;
- struct sta_info *sta;
- unsigned int j;
-
- if (sta_ret)
- *sta_ret = NULL;
-
- for (j = 0; j < iface->num_bss; j++) {
- hapd = iface->bss[j];
- sta = ap_get_sta(hapd, src);
- if (sta && (sta->flags & WLAN_STA_ASSOC) &&
- (!rsn || sta->wpa_sm)) {
- if (sta_ret)
- *sta_ret = sta;
- return hapd;
- }
-#ifdef CONFIG_IEEE80211BE
- if (hapd->conf->mld_ap) {
- struct hostapd_data *p_hapd;
-
- for_each_mld_link(p_hapd, hapd) {
- if (p_hapd == hapd)
- continue;
-
- sta = ap_get_sta(p_hapd, src);
- if (sta && (sta->flags & WLAN_STA_ASSOC) &&
- (!rsn || sta->wpa_sm)) {
- if (sta_ret)
- *sta_ret = sta;
- return p_hapd;
- }
- }
- }
-#endif /* CONFIG_IEEE80211BE */
- }
-
- return NULL;
-}
-
-
static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
const u8 *data, size_t data_len,
enum frame_encryption encrypted,
@@ -2416,6 +2435,88 @@
#endif /* CONFIG_IEEE80211AX */
+static void hostapd_iface_enable(struct hostapd_data *hapd)
+{
+ wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_ENABLED);
+ if (hapd->disabled && hapd->started) {
+ hapd->disabled = 0;
+ /*
+ * Try to re-enable interface if the driver stopped it
+ * when the interface got disabled.
+ */
+ if (hapd->wpa_auth)
+ wpa_auth_reconfig_group_keys(hapd->wpa_auth);
+ else
+ hostapd_reconfig_encryption(hapd);
+ hapd->reenable_beacon = 1;
+ ieee802_11_set_beacon(hapd);
+#ifdef NEED_AP_MLME
+ } else if (hapd->disabled && hapd->iface->cac_started) {
+ wpa_printf(MSG_DEBUG, "DFS: restarting pending CAC");
+ hostapd_handle_dfs(hapd->iface);
+#endif /* NEED_AP_MLME */
+ }
+}
+
+
+static void hostapd_iface_disable(struct hostapd_data *hapd)
+{
+ hostapd_free_stas(hapd);
+ wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_DISABLED);
+ hapd->disabled = 1;
+}
+
+
+#ifdef CONFIG_IEEE80211BE
+
+static void hostapd_mld_iface_enable(struct hostapd_data *hapd)
+{
+ struct hostapd_data *first_link, *link_bss;
+
+ first_link = hostapd_mld_is_first_bss(hapd) ? hapd :
+ hostapd_mld_get_first_bss(hapd);
+
+ /* Links have been removed. Re-add all links and enable them, but
+ * enable the first link BSS before doing that. */
+ if (hostapd_drv_link_add(first_link, first_link->mld_link_id,
+ first_link->own_addr)) {
+ wpa_printf(MSG_ERROR, "MLD: Failed to re-add link %d in MLD %s",
+ first_link->mld_link_id, first_link->conf->iface);
+ return;
+ }
+
+ hostapd_iface_enable(first_link);
+
+ /* Add other affiliated links */
+ for_each_mld_link(link_bss, first_link) {
+ if (link_bss == first_link)
+ continue;
+
+ if (hostapd_drv_link_add(link_bss, link_bss->mld_link_id,
+ link_bss->own_addr)) {
+ wpa_printf(MSG_ERROR,
+ "MLD: Failed to re-add link %d in MLD %s",
+ link_bss->mld_link_id,
+ link_bss->conf->iface);
+ continue;
+ }
+
+ hostapd_iface_enable(link_bss);
+ }
+}
+
+
+static void hostapd_mld_iface_disable(struct hostapd_data *hapd)
+{
+ struct hostapd_data *link_bss;
+
+ for_each_mld_link(link_bss, hapd)
+ hostapd_iface_disable(link_bss);
+}
+
+#endif /* CONFIG_IEEE80211BE */
+
+
void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
union wpa_event_data *data)
{
@@ -2693,30 +2794,22 @@
break;
#endif /* NEED_AP_MLME */
case EVENT_INTERFACE_ENABLED:
- wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_ENABLED);
- if (hapd->disabled && hapd->started) {
- hapd->disabled = 0;
- /*
- * Try to re-enable interface if the driver stopped it
- * when the interface got disabled.
- */
- if (hapd->wpa_auth)
- wpa_auth_reconfig_group_keys(hapd->wpa_auth);
- else
- hostapd_reconfig_encryption(hapd);
- hapd->reenable_beacon = 1;
- ieee802_11_set_beacon(hapd);
-#ifdef NEED_AP_MLME
- } else if (hapd->disabled && hapd->iface->cac_started) {
- wpa_printf(MSG_DEBUG, "DFS: restarting pending CAC");
- hostapd_handle_dfs(hapd->iface);
-#endif /* NEED_AP_MLME */
+#ifdef CONFIG_IEEE80211BE
+ if (hapd->conf->mld_ap) {
+ hostapd_mld_iface_enable(hapd);
+ break;
}
+#endif /* CONFIG_IEEE80211BE */
+ hostapd_iface_enable(hapd);
break;
case EVENT_INTERFACE_DISABLED:
- hostapd_free_stas(hapd);
- wpa_msg(hapd->msg_ctx, MSG_INFO, INTERFACE_DISABLED);
- hapd->disabled = 1;
+#ifdef CONFIG_IEEE80211BE
+ if (hapd->conf->mld_ap) {
+ hostapd_mld_iface_disable(hapd);
+ break;
+ }
+#endif /* CONFIG_IEEE80211BE */
+ hostapd_iface_disable(hapd);
break;
#ifdef CONFIG_ACS
case EVENT_ACS_CHANNEL_SELECTED:
@@ -2769,6 +2862,13 @@
hostapd_event_color_change(hapd, true);
break;
#endif /* CONFIG_IEEE80211AX */
+#ifdef CONFIG_IEEE80211BE
+ case EVENT_MLD_INTERFACE_FREED:
+ wpa_printf(MSG_DEBUG, "MLD: Interface %s freed",
+ hapd->conf->iface);
+ hostapd_mld_interface_freed(hapd);
+ break;
+#endif /* CONFIG_IEEE80211BE */
default:
wpa_printf(MSG_DEBUG, "Unknown event %d", event);
break;
diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
index a05de03..7d92489 100644
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -400,8 +400,6 @@
#ifdef CONFIG_IEEE80211BE
#ifdef CONFIG_TESTING_OPTIONS
-#define TU_TO_USEC(_val) ((_val) * 1024)
-
static void hostapd_link_remove_timeout_handler(void *eloop_data,
void *user_ctx)
{
@@ -440,6 +438,8 @@
hapd->eht_mld_link_removal_count = count;
hapd->eht_mld_bss_param_change++;
+ if (hapd->eht_mld_bss_param_change == 255)
+ hapd->eht_mld_bss_param_change = 0;
eloop_register_timeout(0, TU_TO_USEC(hapd->iconf->beacon_int),
hostapd_link_remove_timeout_handler,
@@ -620,9 +620,19 @@
static void hostapd_bss_link_deinit(struct hostapd_data *hapd)
{
#ifdef CONFIG_IEEE80211BE
+ int i;
+
if (!hapd->conf || !hapd->conf->mld_ap)
return;
+ /* Free per STA profiles */
+ for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
+ os_free(hapd->partner_links[i].resp_sta_profile);
+ os_memset(&hapd->partner_links[i], 0,
+ sizeof(hapd->partner_links[i]));
+ }
+
+ /* Put all freeing logic above this */
if (!hapd->mld->num_links)
return;
@@ -702,6 +712,9 @@
ap_list_deinit(iface);
sta_track_deinit(iface);
airtime_policy_update_deinit(iface);
+ hostapd_free_multi_hw_info(iface->multi_hw_info);
+ iface->multi_hw_info = NULL;
+ iface->current_hw_info = NULL;
}
@@ -1440,7 +1453,6 @@
if (h_hapd) {
hapd->drv_priv = h_hapd->drv_priv;
hapd->interface_added = h_hapd->interface_added;
- hostapd_mld_add_link(hapd);
wpa_printf(MSG_DEBUG,
"Setup of non first link (%d) BSS of MLD %s",
hapd->mld_link_id, hapd->conf->iface);
@@ -1471,7 +1483,6 @@
hapd->mld_link_id, hapd->conf->iface);
os_memcpy(hapd->mld->mld_addr, hapd->own_addr,
ETH_ALEN);
- hostapd_mld_add_link(hapd);
}
#endif /* CONFIG_IEEE80211BE */
}
@@ -1486,8 +1497,13 @@
MAC2STR(hapd->own_addr));
if (hostapd_drv_link_add(hapd, hapd->mld_link_id,
- hapd->own_addr))
+ hapd->own_addr)) {
+ wpa_printf(MSG_ERROR,
+ "MLD: Failed to add link %d in MLD %s",
+ hapd->mld_link_id, hapd->conf->iface);
return -1;
+ }
+ hostapd_mld_add_link(hapd);
}
#endif /* CONFIG_IEEE80211BE */
@@ -1808,12 +1824,36 @@
}
+static int hostapd_set_ctrl_sock_iface(struct hostapd_data *hapd)
+{
+#ifdef CONFIG_IEEE80211BE
+ int ret;
+
+ if (hapd->conf->mld_ap) {
+ ret = os_snprintf(hapd->ctrl_sock_iface,
+ sizeof(hapd->ctrl_sock_iface), "%s_%s%d",
+ hapd->conf->iface, WPA_CTRL_IFACE_LINK_NAME,
+ hapd->mld_link_id);
+ if (os_snprintf_error(sizeof(hapd->ctrl_sock_iface), ret))
+ return -1;
+ } else {
+ os_strlcpy(hapd->ctrl_sock_iface, hapd->conf->iface,
+ sizeof(hapd->ctrl_sock_iface));
+ }
+#endif /* CONFIG_IEEE80211BE */
+ return 0;
+}
+
+
static int start_ctrl_iface_bss(struct hostapd_data *hapd)
{
if (!hapd->iface->interfaces ||
!hapd->iface->interfaces->ctrl_iface_init)
return 0;
+ if (hostapd_set_ctrl_sock_iface(hapd))
+ return -1;
+
if (hapd->iface->interfaces->ctrl_iface_init(hapd)) {
wpa_printf(MSG_ERROR,
"Failed to setup control interface for %s",
@@ -1834,6 +1874,10 @@
for (i = 0; i < iface->num_bss; i++) {
struct hostapd_data *hapd = iface->bss[i];
+
+ if (hostapd_set_ctrl_sock_iface(hapd))
+ return -1;
+
if (iface->interfaces->ctrl_iface_init(hapd)) {
wpa_printf(MSG_ERROR,
"Failed to setup control interface for %s",
@@ -2492,6 +2536,12 @@
hostapd_hw_mode_txt(iface->conf->hw_mode),
iface->conf->channel, iface->freq);
+ if (hostapd_set_current_hw_info(iface, iface->freq)) {
+ wpa_printf(MSG_ERROR,
+ "Failed to set current hardware info");
+ goto fail;
+ }
+
#ifdef NEED_AP_MLME
/* Handle DFS only if it is not offloaded to the driver */
if (!(iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)) {
@@ -3065,9 +3115,17 @@
os_strlcpy(mld->name, conf->iface, sizeof(conf->iface));
dl_list_init(&mld->links);
+ mld->ctrl_sock = -1;
+ if (hapd->conf->ctrl_interface)
+ mld->ctrl_interface = os_strdup(hapd->conf->ctrl_interface);
wpa_printf(MSG_DEBUG, "AP MLD %s created", mld->name);
+ /* Initialize MLD control interfaces early to allow external monitoring
+ * of link setup operations. */
+ if (interfaces->mld_ctrl_iface_init(mld))
+ goto fail;
+
hapd->mld = mld;
hostapd_mld_ref_inc(mld);
hostapd_bss_alloc_link_id(hapd);
@@ -3127,6 +3185,8 @@
if (!remove && !forced_remove)
continue;
+ interfaces->mld_ctrl_iface_deinit(mld);
+
wpa_printf(MSG_DEBUG, "AP MLD %s: Freed%s", mld->name,
forced_remove ? " (forced)" : "");
os_free(mld);
@@ -3387,8 +3447,10 @@
driver->hapd_deinit(drv_priv);
} else if (hostapd_mld_is_first_bss(iface->bss[0]) &&
driver->is_drv_shared &&
- !driver->is_drv_shared(drv_priv, iface->bss[0])) {
+ !driver->is_drv_shared(drv_priv,
+ iface->bss[0]->mld_link_id)) {
driver->hapd_deinit(drv_priv);
+ hostapd_mld_interface_freed(iface->bss[0]);
} else if (hostapd_if_link_remove(iface->bss[0],
WPA_IF_AP_BSS,
iface->bss[0]->conf->iface,
@@ -4501,6 +4563,42 @@
}
+int hostapd_force_channel_switch(struct hostapd_iface *iface,
+ struct csa_settings *settings)
+{
+ int ret = 0;
+
+ if (!settings->freq_params.channel) {
+ /* Check if the new channel is supported */
+ settings->freq_params.channel = hostapd_hw_get_channel(
+ iface->bss[0], settings->freq_params.freq);
+ if (!settings->freq_params.channel)
+ return -1;
+ }
+
+ ret = hostapd_disable_iface(iface);
+ if (ret) {
+ wpa_printf(MSG_DEBUG, "Failed to disable the interface");
+ return ret;
+ }
+
+ hostapd_chan_switch_config(iface->bss[0], &settings->freq_params);
+ ret = hostapd_change_config_freq(iface->bss[0], iface->conf,
+ &settings->freq_params, NULL);
+ if (ret) {
+ wpa_printf(MSG_DEBUG,
+ "Failed to set the new channel in config");
+ return ret;
+ }
+
+ ret = hostapd_enable_iface(iface);
+ if (ret)
+ wpa_printf(MSG_DEBUG, "Failed to enable the interface");
+
+ return ret;
+}
+
+
void
hostapd_switch_channel_fallback(struct hostapd_iface *iface,
const struct hostapd_freq_params *freq_params)
@@ -4932,6 +5030,18 @@
return mld->fbss;
}
+
+void hostapd_mld_interface_freed(struct hostapd_data *hapd)
+{
+ struct hostapd_data *link_bss = NULL;
+
+ if (!hapd || !hapd->conf->mld_ap)
+ return;
+
+ for_each_mld_link(link_bss, hapd)
+ link_bss->drv_priv = NULL;
+}
+
#endif /* CONFIG_IEEE80211BE */
diff --git a/src/ap/hostapd.h b/src/ap/hostapd.h
index 85122d4..5d91d85 100644
--- a/src/ap/hostapd.h
+++ b/src/ap/hostapd.h
@@ -97,6 +97,8 @@
#ifdef CONFIG_IEEE80211BE
struct hostapd_mld **mld;
size_t mld_count;
+ int (*mld_ctrl_iface_init)(struct hostapd_mld *mld);
+ void (*mld_ctrl_iface_deinit)(struct hostapd_mld *mld);
#endif /* CONFIG_IEEE80211BE */
};
@@ -167,6 +169,21 @@
u8 msg[];
};
+struct mld_link_info {
+ u8 valid:1;
+ u8 nstr_bitmap_len:2;
+ u8 local_addr[ETH_ALEN];
+ u8 peer_addr[ETH_ALEN];
+
+ u8 nstr_bitmap[2];
+
+ u16 capability;
+
+ u16 status;
+ u16 resp_sta_profile_len;
+ u8 *resp_sta_profile;
+};
+
/**
* struct hostapd_data - hostapd per-BSS data structure
*/
@@ -476,6 +493,14 @@
struct hostapd_mld *mld;
struct dl_list link;
u8 mld_link_id;
+
+ /* Cached partner info for ML probe response */
+ struct mld_link_info partner_links[MAX_NUM_MLD_LINKS];
+
+ /* 5 characters for "_link", up to 2 characters for <link ID>, so in
+ * total, additional 7 characters required. */
+ char ctrl_sock_iface[IFNAMSIZ + 7 + 1];
+
#ifdef CONFIG_TESTING_OPTIONS
u8 eht_mld_link_removal_count;
#endif /* CONFIG_TESTING_OPTIONS */
@@ -529,6 +554,10 @@
struct hostapd_data *fbss;
struct dl_list links; /* List head of all affiliated links */
+
+ int ctrl_sock;
+ struct dl_list ctrl_dst;
+ char *ctrl_interface; /* Directory for UNIX domain sockets */
};
#define HOSTAPD_MLD_MAX_REF_COUNT 0xFF
@@ -713,6 +742,10 @@
bool is_no_ir;
bool is_ch_switch_dfs; /* Channel switch from ACS to DFS */
+
+ struct hostapd_multi_hw_info *multi_hw_info;
+ unsigned int num_multi_hws;
+ struct hostapd_multi_hw_info *current_hw_info;
};
/* hostapd.c */
@@ -755,6 +788,8 @@
struct hostapd_freq_params *freq_params);
int hostapd_switch_channel(struct hostapd_data *hapd,
struct csa_settings *settings);
+int hostapd_force_channel_switch(struct hostapd_iface *iface,
+ struct csa_settings *settings);
void
hostapd_switch_channel_fallback(struct hostapd_iface *iface,
const struct hostapd_freq_params *freq_params);
@@ -833,6 +868,7 @@
#ifdef CONFIG_IEEE80211BE
bool hostapd_mld_is_first_bss(struct hostapd_data *hapd);
+void hostapd_mld_interface_freed(struct hostapd_data *hapd);
#define for_each_mld_link(partner, self) \
dl_list_for_each(partner, &self->mld->links, struct hostapd_data, link)
diff --git a/src/ap/hw_features.c b/src/ap/hw_features.c
index c455660..02d6759 100644
--- a/src/ap/hw_features.c
+++ b/src/ap/hw_features.c
@@ -76,12 +76,15 @@
{
struct hostapd_data *hapd = iface->bss[0];
int i, j;
+ unsigned int k;
u16 num_modes, flags;
struct hostapd_hw_modes *modes;
u8 dfs_domain;
enum hostapd_hw_mode mode = HOSTAPD_MODE_IEEE80211ANY;
bool is_6ghz = false;
bool orig_mode_valid = false;
+ struct hostapd_multi_hw_info *multi_hw_info;
+ unsigned int num_multi_hws;
if (hostapd_drv_none(hapd))
return -1;
@@ -168,6 +171,25 @@
__func__);
}
+ multi_hw_info = hostapd_get_multi_hw_info(hapd, &num_multi_hws);
+ if (!multi_hw_info)
+ return 0;
+
+ hostapd_free_multi_hw_info(iface->multi_hw_info);
+ iface->multi_hw_info = multi_hw_info;
+ iface->num_multi_hws = num_multi_hws;
+
+ wpa_printf(MSG_DEBUG, "Multiple underlying hardwares info:");
+
+ for (k = 0; k < num_multi_hws; k++) {
+ struct hostapd_multi_hw_info *hw_info = &multi_hw_info[k];
+
+ wpa_printf(MSG_DEBUG,
+ " %d. hw_idx=%u, frequency range: %d-%d MHz",
+ k + 1, hw_info->hw_idx, hw_info->start_freq,
+ hw_info->end_freq);
+ }
+
return 0;
}
@@ -1391,3 +1413,34 @@
}
return 0;
}
+
+
+void hostapd_free_multi_hw_info(struct hostapd_multi_hw_info *multi_hw_info)
+{
+ os_free(multi_hw_info);
+}
+
+
+int hostapd_set_current_hw_info(struct hostapd_iface *iface, int oper_freq)
+{
+ struct hostapd_multi_hw_info *hw_info;
+ unsigned int i;
+
+ if (!iface->num_multi_hws)
+ return 0;
+
+ for (i = 0; i < iface->num_multi_hws; i++) {
+ hw_info = &iface->multi_hw_info[i];
+
+ if (hw_info->start_freq <= oper_freq &&
+ hw_info->end_freq >= oper_freq) {
+ iface->current_hw_info = hw_info;
+ wpa_printf(MSG_DEBUG,
+ "Mode: Selected underlying hardware: hw_idx=%u",
+ iface->current_hw_info->hw_idx);
+ return 0;
+ }
+ }
+
+ return -1;
+}
diff --git a/src/ap/hw_features.h b/src/ap/hw_features.h
index c682c6d..73663d0 100644
--- a/src/ap/hw_features.h
+++ b/src/ap/hw_features.h
@@ -30,6 +30,8 @@
int hostapd_hw_skip_mode(struct hostapd_iface *iface,
struct hostapd_hw_modes *mode);
int hostapd_determine_mode(struct hostapd_iface *iface);
+void hostapd_free_multi_hw_info(struct hostapd_multi_hw_info *multi_hw_info);
+int hostapd_set_current_hw_info(struct hostapd_iface *iface, int oper_freq);
#else /* NEED_AP_MLME */
static inline void
hostapd_free_hw_features(struct hostapd_hw_modes *hw_features,
@@ -103,6 +105,16 @@
return 0;
}
+static inline
+void hostapd_free_multi_hw_info(struct hostapd_multi_hw_info *multi_hw_info)
+{
+}
+
+static inline int hostapd_set_current_hw_info(struct hostapd_iface *iface,
+ u32 oper_freq)
+{
+ return 0;
+}
#endif /* NEED_AP_MLME */
#endif /* HW_FEATURES_H */
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 1cd76ca..d4552f2 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -1173,16 +1173,23 @@
static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
{
struct sae_data *sae = sta->sae;
- int i, *groups = hapd->conf->sae_groups;
- int default_groups[] = { 19, 0 };
+ struct hostapd_bss_config *conf = hapd->conf;
+ int i, *groups = conf->sae_groups;
+ int default_groups[] = { 19, 0, 0 };
if (sae->state != SAE_COMMITTED)
return;
wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
- if (!groups)
+ if (!groups) {
groups = default_groups;
+ if (wpa_key_mgmt_sae_ext_key(conf->wpa_key_mgmt |
+ conf->rsn_override_key_mgmt |
+ conf->rsn_override_key_mgmt_2))
+ default_groups[1] = 20;
+ }
+
for (i = 0; groups[i] > 0; i++) {
if (sae->group == groups[i])
break;
@@ -1247,12 +1254,18 @@
static int sae_is_group_enabled(struct hostapd_data *hapd, int group)
{
- int *groups = hapd->conf->sae_groups;
- int default_groups[] = { 19, 0 };
+ struct hostapd_bss_config *conf = hapd->conf;
+ int *groups = conf->sae_groups;
+ int default_groups[] = { 19, 0, 0 };
int i;
- if (!groups)
+ if (!groups) {
groups = default_groups;
+ if (wpa_key_mgmt_sae_ext_key(conf->wpa_key_mgmt |
+ conf->rsn_override_key_mgmt |
+ conf->rsn_override_key_mgmt_2))
+ default_groups[1] = 20;
+ }
for (i = 0; groups[i] > 0; i++) {
if (groups[i] == group)
@@ -1309,14 +1322,20 @@
{
int resp = WLAN_STATUS_SUCCESS;
struct wpabuf *data = NULL;
- int *groups = hapd->conf->sae_groups;
- int default_groups[] = { 19, 0 };
+ struct hostapd_bss_config *conf = hapd->conf;
+ int *groups = conf->sae_groups;
+ int default_groups[] = { 19, 0, 0 };
const u8 *pos, *end;
int sta_removed = 0;
bool success_status;
- if (!groups)
+ if (!groups) {
groups = default_groups;
+ if (wpa_key_mgmt_sae_ext_key(conf->wpa_key_mgmt |
+ conf->rsn_override_key_mgmt |
+ conf->rsn_override_key_mgmt_2))
+ default_groups[1] = 20;
+ }
#ifdef CONFIG_TESTING_OPTIONS
if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
@@ -1609,12 +1628,12 @@
!data && end - pos >= 2)
data = wpabuf_alloc_copy(pos, 2);
- sae_sme_send_external_auth_status(hapd, sta, resp);
send_auth_reply(hapd, sta, sta->addr,
WLAN_AUTH_SAE,
auth_transaction, resp,
data ? wpabuf_head(data) : (u8 *) "",
data ? wpabuf_len(data) : 0, "auth-sae");
+ sae_sme_send_external_auth_status(hapd, sta, resp);
if (sta->sae && sta->sae->tmp && sta->sae->tmp->pw_id &&
resp == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER &&
auth_transaction == 1) {
@@ -1935,6 +1954,8 @@
goto fail;
}
+ wpa_auth_set_rsn_selection(sta->wpa_sm, elems.rsn_selection,
+ elems.rsn_selection_len);
res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
hapd->iface->freq,
elems.rsn_ie - 2, elems.rsn_ie_len + 2,
@@ -1945,9 +1966,6 @@
if (resp != WLAN_STATUS_SUCCESS)
goto fail;
- wpa_auth_set_rsn_override(sta->wpa_sm, elems.rsne_override != NULL);
- wpa_auth_set_rsn_override_2(sta->wpa_sm, elems.rsne_override_2 != NULL);
-
if (!elems.fils_nonce) {
wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
@@ -2463,7 +2481,8 @@
wpabuf_head(pasn->secret),
wpabuf_len(pasn->secret),
pasn_get_ptk(sta->pasn), pasn_get_akmp(sta->pasn),
- pasn_get_cipher(sta->pasn), sta->pasn->kdk_len);
+ pasn_get_cipher(sta->pasn), sta->pasn->kdk_len,
+ sta->pasn->kek_len);
if (ret) {
wpa_printf(MSG_DEBUG, "PASN: FILS: Failed to derive PTK");
goto fail;
@@ -2832,7 +2851,7 @@
hapd_pasn_update_params(hapd, sta, mgmt, len);
if (handle_auth_pasn_1(sta->pasn, hapd->own_addr,
- sta->addr, mgmt, len) < 0)
+ sta->addr, mgmt, len, false) < 0)
ap_free_sta(hapd, sta);
} else if (trans_seq == 3) {
if (!sta->pasn) {
@@ -4134,10 +4153,8 @@
#endif /* CONFIG_IEEE80211BE */
wpa_auth_set_auth_alg(sta->wpa_sm, sta->auth_alg);
- wpa_auth_set_rsn_override(sta->wpa_sm,
- elems->rsne_override != NULL);
- wpa_auth_set_rsn_override_2(sta->wpa_sm,
- elems->rsne_override_2 != NULL);
+ wpa_auth_set_rsn_selection(sta->wpa_sm, elems->rsn_selection,
+ elems->rsn_selection_len);
res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
hapd->iface->freq,
wpa_ie, wpa_ie_len,
@@ -4998,7 +5015,8 @@
#endif /* CONFIG_IEEE80211AX */
p = hostapd_eid_ext_capab(hapd, p, false);
- p = hostapd_eid_bss_max_idle_period(hapd, p, sta->max_idle_period);
+ p = hostapd_eid_bss_max_idle_period(hapd, p,
+ sta ? sta->max_idle_period : 0);
if (sta && sta->qos_map_enabled)
p = hostapd_eid_qos_map_set(hapd, p);
@@ -7230,16 +7248,11 @@
}
-u8 * hostapd_eid_wb_chsw_wrapper(struct hostapd_data *hapd, u8 *eid)
+/* Wide Bandwidth Channel Switch subelement */
+static u8 * hostapd_eid_wb_channel_switch(struct hostapd_data *hapd, u8 *eid,
+ u8 chan1, u8 chan2)
{
- u8 bw, chan1 = 0, chan2 = 0;
- int freq1;
-
- if (!hapd->cs_freq_params.channel ||
- (!hapd->cs_freq_params.vht_enabled &&
- !hapd->cs_freq_params.he_enabled &&
- !hapd->cs_freq_params.eht_enabled))
- return eid;
+ u8 bw;
/* bandwidth: 0: 40, 1: 80, 160, 80+80, 4: 320 as per
* IEEE P802.11-REVme/D4.0, 9.4.2.159 and Table 9-314. */
@@ -7261,20 +7274,6 @@
return eid;
}
- freq1 = hapd->cs_freq_params.center_freq1 ?
- hapd->cs_freq_params.center_freq1 :
- hapd->cs_freq_params.freq;
- if (ieee80211_freq_to_chan(freq1, &chan1) !=
- HOSTAPD_MODE_IEEE80211A)
- return eid;
-
- if (hapd->cs_freq_params.center_freq2 &&
- ieee80211_freq_to_chan(hapd->cs_freq_params.center_freq2,
- &chan2) != HOSTAPD_MODE_IEEE80211A)
- return eid;
-
- *eid++ = WLAN_EID_CHANNEL_SWITCH_WRAPPER;
- *eid++ = 5; /* Length of Channel Switch Wrapper */
*eid++ = WLAN_EID_WIDE_BW_CHSWITCH;
*eid++ = 3; /* Length of Wide Bandwidth Channel Switch element */
*eid++ = bw; /* New Channel Width */
@@ -7300,6 +7299,118 @@
}
+#ifdef CONFIG_IEEE80211BE
+/* Bandwidth Indication element that is also used as the Bandwidth Indication
+ * For Channel Switch subelement within a Channel Switch Wrapper element. */
+static u8 * hostapd_eid_bw_indication(struct hostapd_data *hapd, u8 *eid,
+ u8 chan1, u8 chan2)
+{
+ u16 punct_bitmap = hostapd_get_punct_bitmap(hapd);
+ struct ieee80211_bw_ind_element *bw_ind_elem;
+ size_t elen = 3;
+
+ if (hapd->cs_freq_params.bandwidth <= 160 && !punct_bitmap)
+ return eid;
+
+ if (punct_bitmap)
+ elen += EHT_OPER_DISABLED_SUBCHAN_BITMAP_SIZE;
+
+ *eid++ = WLAN_EID_EXTENSION;
+ *eid++ = 1 + elen;
+ *eid++ = WLAN_EID_EXT_BANDWIDTH_INDICATION;
+
+ bw_ind_elem = (struct ieee80211_bw_ind_element *) eid;
+ os_memset(bw_ind_elem, 0, sizeof(struct ieee80211_bw_ind_element));
+
+ switch (hapd->cs_freq_params.bandwidth) {
+ case 320:
+ bw_ind_elem->bw_ind_info.control |= BW_IND_CHANNEL_WIDTH_320MHZ;
+ chan2 = chan1;
+ if (hapd->cs_freq_params.channel < chan1)
+ chan1 -= 16;
+ else
+ chan1 += 16;
+ break;
+ case 160:
+ bw_ind_elem->bw_ind_info.control |= BW_IND_CHANNEL_WIDTH_160MHZ;
+ chan2 = chan1;
+ if (hapd->cs_freq_params.channel < chan1)
+ chan1 -= 8;
+ else
+ chan1 += 8;
+ break;
+ case 80:
+ bw_ind_elem->bw_ind_info.control |= BW_IND_CHANNEL_WIDTH_80MHZ;
+ break;
+ case 40:
+ if (hapd->cs_freq_params.sec_channel_offset == 1)
+ bw_ind_elem->bw_ind_info.control |=
+ BW_IND_CHANNEL_WIDTH_40MHZ;
+ else
+ bw_ind_elem->bw_ind_info.control |=
+ BW_IND_CHANNEL_WIDTH_20MHZ;
+ break;
+ default:
+ bw_ind_elem->bw_ind_info.control |= BW_IND_CHANNEL_WIDTH_20MHZ;
+ break;
+ }
+
+ bw_ind_elem->bw_ind_info.ccfs0 = chan1;
+ bw_ind_elem->bw_ind_info.ccfs1 = chan2;
+
+ if (punct_bitmap) {
+ bw_ind_elem->bw_ind_params |=
+ BW_IND_PARAMETER_DISABLED_SUBCHAN_BITMAP_PRESENT;
+ bw_ind_elem->bw_ind_info.disabled_chan_bitmap =
+ host_to_le16(punct_bitmap);
+ }
+
+ return eid + elen;
+}
+#endif /* CONFIG_IEEE80211BE */
+
+
+u8 * hostapd_eid_chsw_wrapper(struct hostapd_data *hapd, u8 *eid)
+{
+ u8 chan1 = 0, chan2 = 0;
+ u8 *eid_len_offset;
+ int freq1;
+
+ if (!hapd->cs_freq_params.channel ||
+ (!hapd->cs_freq_params.vht_enabled &&
+ !hapd->cs_freq_params.he_enabled &&
+ !hapd->cs_freq_params.eht_enabled))
+ return eid;
+
+ freq1 = hapd->cs_freq_params.center_freq1 ?
+ hapd->cs_freq_params.center_freq1 :
+ hapd->cs_freq_params.freq;
+ if (ieee80211_freq_to_chan(freq1, &chan1) !=
+ HOSTAPD_MODE_IEEE80211A)
+ return eid;
+
+ if (hapd->cs_freq_params.center_freq2 &&
+ ieee80211_freq_to_chan(hapd->cs_freq_params.center_freq2,
+ &chan2) != HOSTAPD_MODE_IEEE80211A)
+ return eid;
+
+ *eid++ = WLAN_EID_CHANNEL_SWITCH_WRAPPER;
+ eid_len_offset = eid++; /* Length of Channel Switch Wrapper element */
+
+ eid = hostapd_eid_wb_channel_switch(hapd, eid, chan1, chan2);
+
+#ifdef CONFIG_IEEE80211BE
+ if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
+ /* Bandwidth Indication For Channel Switch subelement */
+ eid = hostapd_eid_bw_indication(hapd, eid, chan1, chan2);
+ }
+#endif /* CONFIG_IEEE80211BE */
+
+ *eid_len_offset = (eid - eid_len_offset) - 1;
+ return eid;
+}
+
+
static size_t hostapd_eid_nr_db_len(struct hostapd_data *hapd,
size_t *current_len)
{
diff --git a/src/ap/ieee802_11.h b/src/ap/ieee802_11.h
index dd4995f..abf48ab 100644
--- a/src/ap/ieee802_11.h
+++ b/src/ap/ieee802_11.h
@@ -63,7 +63,7 @@
u8 * hostapd_eid_vht_capabilities(struct hostapd_data *hapd, u8 *eid, u32 nsts);
u8 * hostapd_eid_vht_operation(struct hostapd_data *hapd, u8 *eid);
u8 * hostapd_eid_vendor_vht(struct hostapd_data *hapd, u8 *eid);
-u8 * hostapd_eid_wb_chsw_wrapper(struct hostapd_data *hapd, u8 *eid);
+u8 * hostapd_eid_chsw_wrapper(struct hostapd_data *hapd, u8 *eid);
u8 * hostapd_eid_txpower_envelope(struct hostapd_data *hapd, u8 *eid);
u8 * hostapd_eid_he_capab(struct hostapd_data *hapd, u8 *eid,
enum ieee80211_op_mode opmode);
diff --git a/src/ap/ieee802_11_eht.c b/src/ap/ieee802_11_eht.c
index afb2e16..aea69ab 100644
--- a/src/ap/ieee802_11_eht.c
+++ b/src/ap/ieee802_11_eht.c
@@ -871,6 +871,8 @@
wpa_printf(MSG_DEBUG, "EHT: SAE scalar length is %zu", prime_len);
+ if (len - 2 < prime_len * (ec ? 3 : 2))
+ goto truncated;
/* scalar */
pos += prime_len;
@@ -882,6 +884,7 @@
}
if (pos - mgmt->u.auth.variable > (int) len) {
+ truncated:
wpa_printf(MSG_DEBUG,
"EHT: Too short SAE commit Authentication frame");
return NULL;
@@ -905,16 +908,38 @@
return pos;
/* send confirm integer */
+ if (len < 2)
+ goto truncated;
pos += 2;
/*
* At this stage we should already have an MLD station and actually SA
- * will be replaced with the MLD MAC address by the driver.
+ * will be replaced with the MLD MAC address by the driver. However,
+ * there is at least a theoretical race condition in a case where the
+ * peer sends the SAE confirm message quickly enough for the driver
+ * translation mechanism to not be available to update the SAE confirm
+ * message addresses. Work around that by searching for the STA entry
+ * using the link address of the non-AP MLD if no match is found based
+ * on the MLD MAC address.
*/
sta = ap_get_sta(hapd, mgmt->sa);
if (!sta) {
wpa_printf(MSG_DEBUG, "SAE: No MLD STA for SAE confirm");
- return NULL;
+ for (sta = hapd->sta_list; sta; sta = sta->next) {
+ int link_id = hapd->mld_link_id;
+
+ if (!sta->mld_info.mld_sta ||
+ sta->mld_info.links[link_id].valid ||
+ !ether_addr_equal(
+ mgmt->sa,
+ sta->mld_info.links[link_id].peer_addr))
+ continue;
+ wpa_printf(MSG_DEBUG,
+ "SAE: Found MLD STA for SAE confirm based on link address");
+ break;
+ }
+ if (!sta)
+ return NULL;
}
if (!sta->sae || sta->sae->state < SAE_COMMITTED || !sta->sae->tmp) {
@@ -929,9 +954,12 @@
wpa_printf(MSG_DEBUG, "SAE: confirm: kck_len=%zu",
sta->sae->tmp->kck_len);
+ if (len - 2 < sta->sae->tmp->kck_len)
+ goto truncated;
pos += sta->sae->tmp->kck_len;
if (pos - mgmt->u.auth.variable > (int) len) {
+ truncated:
wpa_printf(MSG_DEBUG,
"EHT: Too short SAE confirm Authentication frame");
return NULL;
diff --git a/src/ap/ieee802_11_ht.c b/src/ap/ieee802_11_ht.c
index f90f125..4c39e40 100644
--- a/src/ap/ieee802_11_ht.c
+++ b/src/ap/ieee802_11_ht.c
@@ -79,6 +79,51 @@
}
+static void set_ht_param(struct hostapd_data *hapd,
+ struct ieee80211_ht_operation *oper)
+{
+ int secondary_channel = hapd->iconf->secondary_channel;
+#ifdef CONFIG_IEEE80211BE
+ enum oper_chan_width chwidth = hostapd_get_oper_chwidth(hapd->iconf);
+ u16 bw = 0, punct_bitmap = hostapd_get_punct_bitmap(hapd);
+ u8 offset, chan_bit_pos;
+
+ switch (chwidth) {
+ case CONF_OPER_CHWIDTH_80MHZ:
+ bw = 80;
+ offset = 6;
+ break;
+ case CONF_OPER_CHWIDTH_160MHZ:
+ bw = 160;
+ offset = 14;
+ break;
+ case CONF_OPER_CHWIDTH_320MHZ:
+ bw = 320;
+ offset = 30;
+ break;
+ default:
+ goto no_update;
+ }
+
+ chan_bit_pos = (hapd->iconf->channel -
+ hostapd_get_oper_centr_freq_seg0_idx(hapd->iconf) +
+ offset) / 4;
+ /* Check if secondary channel is punctured */
+ if (bw >= 80 && punct_bitmap && secondary_channel &&
+ (punct_bitmap & BIT(chan_bit_pos + secondary_channel)))
+ return; /* Do not indicate punctured secondary channel for HT */
+no_update:
+#endif /* CONFIG_IEEE80211BE */
+
+ if (secondary_channel == 1)
+ oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
+ HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
+ if (secondary_channel == -1)
+ oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
+ HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
+}
+
+
u8 * hostapd_eid_ht_operation(struct hostapd_data *hapd, u8 *eid)
{
struct ieee80211_ht_operation *oper;
@@ -96,12 +141,7 @@
oper->primary_chan = hapd->iconf->channel;
oper->operation_mode = host_to_le16(hapd->iface->ht_op_mode);
- if (hapd->iconf->secondary_channel == 1)
- oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE |
- HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
- if (hapd->iconf->secondary_channel == -1)
- oper->ht_param |= HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW |
- HT_INFO_HT_PARAM_STA_CHNL_WIDTH;
+ set_ht_param(hapd, oper);
pos += sizeof(*oper);
diff --git a/src/ap/nan_usd_ap.c b/src/ap/nan_usd_ap.c
index 52a967a..570abfc 100644
--- a/src/ap/nan_usd_ap.c
+++ b/src/ap/nan_usd_ap.c
@@ -158,7 +158,7 @@
cb.subscribe_terminated = hostapd_nan_de_subscribe_terminated;
cb.receive = hostapd_nan_de_receive;
- hapd->nan_de = nan_de_init(hapd->own_addr, true, &cb);
+ hapd->nan_de = nan_de_init(hapd->own_addr, false, true, &cb);
if (!hapd->nan_de)
return -1;
return 0;
@@ -192,7 +192,7 @@
int hostapd_nan_usd_publish(struct hostapd_data *hapd, const char *service_name,
enum nan_service_protocol_type srv_proto_type,
const struct wpabuf *ssi,
- struct nan_publish_params *params)
+ struct nan_publish_params *params, bool p2p)
{
int publish_id;
struct wpabuf *elems = NULL;
@@ -201,7 +201,7 @@
return -1;
publish_id = nan_de_publish(hapd->nan_de, service_name, srv_proto_type,
- ssi, elems, params);
+ ssi, elems, params, p2p);
wpabuf_free(elems);
return publish_id;
}
@@ -231,7 +231,7 @@
const char *service_name,
enum nan_service_protocol_type srv_proto_type,
const struct wpabuf *ssi,
- struct nan_subscribe_params *params)
+ struct nan_subscribe_params *params, bool p2p)
{
int subscribe_id;
struct wpabuf *elems = NULL;
@@ -240,7 +240,7 @@
return -1;
subscribe_id = nan_de_subscribe(hapd->nan_de, service_name,
- srv_proto_type, ssi, elems, params);
+ srv_proto_type, ssi, elems, params, p2p);
wpabuf_free(elems);
return subscribe_id;
}
diff --git a/src/ap/nan_usd_ap.h b/src/ap/nan_usd_ap.h
index 58ff5fc..0571643 100644
--- a/src/ap/nan_usd_ap.h
+++ b/src/ap/nan_usd_ap.h
@@ -21,7 +21,7 @@
int hostapd_nan_usd_publish(struct hostapd_data *hapd, const char *service_name,
enum nan_service_protocol_type srv_proto_type,
const struct wpabuf *ssi,
- struct nan_publish_params *params);
+ struct nan_publish_params *params, bool p2p);
void hostapd_nan_usd_cancel_publish(struct hostapd_data *hapd, int publish_id);
int hostapd_nan_usd_update_publish(struct hostapd_data *hapd, int publish_id,
const struct wpabuf *ssi);
@@ -29,7 +29,7 @@
const char *service_name,
enum nan_service_protocol_type srv_proto_type,
const struct wpabuf *ssi,
- struct nan_subscribe_params *params);
+ struct nan_subscribe_params *params, bool p2p);
void hostapd_nan_usd_cancel_subscribe(struct hostapd_data *hapd,
int subscribe_id);
int hostapd_nan_usd_transmit(struct hostapd_data *hapd, int handle,
diff --git a/src/ap/sta_info.h b/src/ap/sta_info.h
index 8462935..5b01c1e 100644
--- a/src/ap/sta_info.h
+++ b/src/ap/sta_info.h
@@ -81,20 +81,7 @@
u16 mld_capa;
} common_info;
- struct mld_link_info {
- u8 valid:1;
- u8 nstr_bitmap_len:2;
- u8 local_addr[ETH_ALEN];
- u8 peer_addr[ETH_ALEN];
-
- u8 nstr_bitmap[2];
-
- u16 capability;
-
- u16 status;
- u16 resp_sta_profile_len;
- u8 *resp_sta_profile;
- } links[MAX_NUM_MLD_LINKS];
+ struct mld_link_info links[MAX_NUM_MLD_LINKS];
};
struct sta_info {
diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index bbf41d3..3af3404 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -112,10 +112,7 @@
int link_id;
#endif /* CONFIG_IEEE80211BE */
- if (!sm->wpa_auth)
- return;
-
- sm->wpa_auth->group->GKeyDoneStations--;
+ sm->group->GKeyDoneStations--;
sm->GUpdateStationKeys = false;
#ifdef CONFIG_IEEE80211BE
@@ -889,9 +886,6 @@
os_free(wpa_auth->wpa_ie);
- os_free(wpa_auth->rsne_override);
- os_free(wpa_auth->rsne_override_2);
- os_free(wpa_auth->rsnxe_override);
group = wpa_auth->group;
while (group) {
@@ -1053,6 +1047,7 @@
os_free(sm->last_rx_eapol_key);
os_free(sm->wpa_ie);
os_free(sm->rsnxe);
+ os_free(sm->rsn_selection);
#ifdef CONFIG_IEEE80211BE
for_each_sm_auth(sm, link_id) {
wpa_group_put(sm->mld_links[link_id].wpa_auth,
@@ -1893,7 +1888,8 @@
sm->EAPOLKeyReceived = true;
sm->EAPOLKeyPairwise = !!(key_info & WPA_KEY_INFO_KEY_TYPE);
sm->EAPOLKeyRequest = !!(key_info & WPA_KEY_INFO_REQUEST);
- os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN);
+ if (msg == PAIRWISE_2)
+ os_memcpy(sm->SNonce, key->key_nonce, WPA_NONCE_LEN);
wpa_sm_step(sm);
out:
@@ -2071,6 +2067,11 @@
if (key_rsc)
os_memcpy(key->key_rsc, key_rsc, WPA_KEY_RSC_LEN);
+#ifdef CONFIG_TESTING_OPTIONS
+ if (conf->eapol_key_reserved_random)
+ random_get_bytes(key->key_id, sizeof(key->key_id));
+#endif /* CONFIG_TESTING_OPTIONS */
+
if (kde && !encr) {
os_memcpy(key_data, kde, kde_len);
WPA_PUT_BE16(key_mic + mic_len, kde_len);
@@ -3926,6 +3927,34 @@
goto out;
}
#endif /* CONFIG_IEEE80211R_AP */
+
+ /* Verify RSN Selection element for RSN overriding */
+ if ((wpa_auth->conf.rsn_override_key_mgmt ||
+ wpa_auth->conf.rsn_override_key_mgmt_2) &&
+ ((rsn_is_snonce_cookie(sm->SNonce) && !kde.rsn_selection) ||
+ (!rsn_is_snonce_cookie(sm->SNonce) && kde.rsn_selection) ||
+ (sm->rsn_selection && !kde.rsn_selection) ||
+ (!sm->rsn_selection && kde.rsn_selection) ||
+ (sm->rsn_selection && kde.rsn_selection &&
+ (sm->rsn_selection_len != kde.rsn_selection_len ||
+ os_memcmp(sm->rsn_selection, kde.rsn_selection,
+ sm->rsn_selection_len) != 0)))) {
+ wpa_auth_logger(wpa_auth, wpa_auth_get_spa(sm), LOGGER_INFO,
+ "RSN Selection element from (Re)AssocReq did not match the one in EAPOL-Key msg 2/4");
+ wpa_printf(MSG_DEBUG,
+ "SNonce cookie for RSN overriding %sused",
+ rsn_is_snonce_cookie(sm->SNonce) ? "" : "not ");
+ wpa_hexdump(MSG_DEBUG, "RSN Selection in AssocReq",
+ sm->rsn_selection, sm->rsn_selection_len);
+ wpa_hexdump(MSG_DEBUG, "RSN Selection in EAPOL-Key msg 2/4",
+ kde.rsn_selection, kde.rsn_selection_len);
+ /* MLME-DEAUTHENTICATE.request */
+ wpa_sta_disconnect(wpa_auth, sm->addr,
+ WLAN_REASON_PREV_AUTH_NOT_VALID);
+ goto out;
+
+ }
+
#ifdef CONFIG_P2P
if (kde.ip_addr_req && kde.ip_addr_req[0] &&
wpa_auth->ip_pool && WPA_GET_BE32(sm->ip_addr) == 0) {
@@ -4189,7 +4218,8 @@
void wpa_auth_ml_get_key_info(struct wpa_authenticator *a,
struct wpa_auth_ml_link_key_info *info,
- bool mgmt_frame_prot, bool beacon_prot)
+ bool mgmt_frame_prot, bool beacon_prot,
+ bool rekey)
{
struct wpa_group *gsm = a->group;
u8 rsc[WPA_KEY_RSC_LEN];
@@ -4202,7 +4232,7 @@
info->gtk = gsm->GTK[gsm->GN - 1];
info->gtk_len = gsm->GTK_len;
- if (wpa_auth_get_seqnum(a, NULL, gsm->GN, rsc) < 0)
+ if (rekey || wpa_auth_get_seqnum(a, NULL, gsm->GN, rsc) < 0)
os_memset(info->pn, 0, sizeof(info->pn));
else
os_memcpy(info->pn, rsc, sizeof(info->pn));
@@ -4214,7 +4244,7 @@
info->igtk = gsm->IGTK[gsm->GN_igtk - 4];
info->igtk_len = wpa_cipher_key_len(a->conf.group_mgmt_cipher);
- if (wpa_auth_get_seqnum(a, NULL, gsm->GN_igtk, rsc) < 0)
+ if (rekey || wpa_auth_get_seqnum(a, NULL, gsm->GN_igtk, rsc) < 0)
os_memset(info->ipn, 0, sizeof(info->ipn));
else
os_memcpy(info->ipn, rsc, sizeof(info->ipn));
@@ -4230,7 +4260,7 @@
info->bigtkidx = gsm->GN_bigtk;
info->bigtk = gsm->BIGTK[gsm->GN_bigtk - 6];
- if (wpa_auth_get_seqnum(a, NULL, gsm->GN_bigtk, rsc) < 0)
+ if (rekey || wpa_auth_get_seqnum(a, NULL, gsm->GN_bigtk, rsc) < 0)
os_memset(info->bipn, 0, sizeof(info->bipn));
else
os_memcpy(info->bipn, rsc, sizeof(info->bipn));
@@ -4238,12 +4268,13 @@
static void wpa_auth_get_ml_key_info(struct wpa_authenticator *wpa_auth,
- struct wpa_auth_ml_key_info *info)
+ struct wpa_auth_ml_key_info *info,
+ bool rekey)
{
if (!wpa_auth->cb->get_ml_key_info)
return;
- wpa_auth->cb->get_ml_key_info(wpa_auth->cb_ctx, info);
+ wpa_auth->cb->get_ml_key_info(wpa_auth->cb_ctx, info, rekey);
}
@@ -4300,6 +4331,7 @@
struct wpa_auth_ml_key_info ml_key_info;
unsigned int i, link_id;
u8 *start = pos;
+ bool rekey = sm->wpa_ptk_group_state == WPA_PTK_GROUP_REKEYNEGOTIATING;
/* First fetch the key information from all the authenticators */
os_memset(&ml_key_info, 0, sizeof(ml_key_info));
@@ -4319,7 +4351,7 @@
ml_key_info.links[i++].link_id = link_id;
}
- wpa_auth_get_ml_key_info(sm->wpa_auth, &ml_key_info);
+ wpa_auth_get_ml_key_info(sm->wpa_auth, &ml_key_info, rekey);
/* Add MLO GTK KDEs */
for (i = 0, link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
@@ -4458,34 +4490,47 @@
/* For the MAC Address KDE */
kde_len = 2 + RSN_SELECTOR_LEN + ETH_ALEN;
- /* MLO Link KDE for each link */
+ /* MLO Link KDE and RSN Override Link KDE for each link */
for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
struct wpa_authenticator *wpa_auth;
- const u8 *ie, *ieo;
+ const u8 *ie;
wpa_auth = wpa_get_link_auth(sm->wpa_auth, link_id);
if (!wpa_auth)
continue;
+ /* MLO Link KDE */
kde_len += 2 + RSN_SELECTOR_LEN + 1 + ETH_ALEN;
+
ie = get_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
WLAN_EID_RSN);
- ieo = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
- sm->rsn_override_2 ?
- RSNE_OVERRIDE_2_IE_VENDOR_TYPE :
- RSNE_OVERRIDE_IE_VENDOR_TYPE);
- if ((sm->rsn_override || sm->rsn_override_2) && ieo)
- kde_len += 2 + ieo[1 - 4];
- else
+ if (ie)
kde_len += 2 + ie[1];
ie = get_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
WLAN_EID_RSNX);
- ieo = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
- RSNXE_OVERRIDE_IE_VENDOR_TYPE);
- if ((sm->rsn_override || sm->rsn_override_2) && ieo)
- kde_len += 2 + ieo[1] - 4;
- else if (ie)
+ if (ie)
+ kde_len += 2 + ie[1];
+
+ if (!rsn_is_snonce_cookie(sm->SNonce))
+ continue;
+
+ /* RSN Override Link KDE */
+ kde_len += 2 + RSN_SELECTOR_LEN + 1;
+
+ ie = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNE_OVERRIDE_IE_VENDOR_TYPE);
+ if (ie)
+ kde_len += 2 + ie[1];
+
+ ie = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNE_OVERRIDE_2_IE_VENDOR_TYPE);
+ if (ie)
+ kde_len += 2 + ie[1];
+
+ ie = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNXE_OVERRIDE_IE_VENDOR_TYPE);
+ if (ie)
kde_len += 2 + ie[1];
}
@@ -4511,8 +4556,9 @@
for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
struct wpa_authenticator *wpa_auth;
- const u8 *rsne, *rsnxe, *rsneo, *rsnxeo;
- size_t rsne_len, rsnxe_len;
+ const u8 *rsne, *rsnxe, *rsnoe, *rsno2e, *rsnxoe;
+ size_t rsne_len, rsnxe_len, rsnoe_len, rsno2e_len, rsnxoe_len;
+ size_t kde_len;
wpa_auth = wpa_get_link_auth(sm->wpa_auth, link_id);
if (!wpa_auth)
@@ -4521,30 +4567,17 @@
rsne = get_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
WLAN_EID_RSN);
rsne_len = rsne ? 2 + rsne[1] : 0;
- rsneo = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
- sm->rsn_override_2 ?
- RSNE_OVERRIDE_2_IE_VENDOR_TYPE :
- RSNE_OVERRIDE_IE_VENDOR_TYPE);
- if ((sm->rsn_override || sm->rsn_override_2) && rsneo)
- rsne_len = 2 + rsneo[1] - 4;
- else
- rsneo = NULL;
rsnxe = get_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
WLAN_EID_RSNX);
rsnxe_len = rsnxe ? 2 + rsnxe[1] : 0;
- rsnxeo = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
- RSNXE_OVERRIDE_IE_VENDOR_TYPE);
- if ((sm->rsn_override || sm->rsn_override_2) && rsnxeo)
- rsnxe_len = 2 + rsnxeo[1] - 4;
- else
- rsnxeo = NULL;
wpa_printf(MSG_DEBUG,
"RSN: MLO Link: link=%u, len=%zu", link_id,
RSN_SELECTOR_LEN + 1 + ETH_ALEN +
rsne_len + rsnxe_len);
+ /* MLO Link KDE */
*pos++ = WLAN_EID_VENDOR_SPECIFIC;
*pos++ = RSN_SELECTOR_LEN + 1 + ETH_ALEN +
rsne_len + rsnxe_len;
@@ -4564,31 +4597,71 @@
pos += ETH_ALEN;
if (rsne_len) {
- if (rsneo) {
- *pos++ = WLAN_EID_RSN;
- *pos++ = rsneo[1] - 4;
- os_memcpy(pos, &rsneo[2 + 4], rsneo[1] - 4);
- pos += rsneo[1] - 4;
- } else {
- os_memcpy(pos, rsne, rsne_len);
- pos += rsne_len;
- }
+ os_memcpy(pos, rsne, rsne_len);
+ pos += rsne_len;
}
if (rsnxe_len) {
- if (rsnxeo) {
- *pos++ = WLAN_EID_RSNX;
- *pos++ = rsnxeo[1] - 4;
- os_memcpy(pos, &rsnxeo[2 + 4], rsnxeo[1] - 4);
- pos += rsnxeo[1] - 4;
- } else {
- os_memcpy(pos, rsnxe, rsnxe_len);
- pos += rsnxe_len;
- }
+ os_memcpy(pos, rsnxe, rsnxe_len);
+ pos += rsnxe_len;
+ }
+
+ if (!rsn_is_snonce_cookie(sm->SNonce))
+ continue;
+
+ rsnoe = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNE_OVERRIDE_IE_VENDOR_TYPE);
+ rsnoe_len = rsnoe ? 2 + rsnoe[1] : 0;
+
+ rsno2e = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNE_OVERRIDE_2_IE_VENDOR_TYPE);
+ rsno2e_len = rsno2e ? 2 + rsno2e[1] : 0;
+
+ rsnxoe = get_vendor_ie(wpa_auth->wpa_ie, wpa_auth->wpa_ie_len,
+ RSNXE_OVERRIDE_IE_VENDOR_TYPE);
+ rsnxoe_len = rsnxoe ? 2 + rsnxoe[1] : 0;
+
+ wpa_printf(MSG_DEBUG,
+ "RSN: RSN Override Link KDE: link=%u, len=%zu",
+ link_id, RSN_SELECTOR_LEN + rsnoe_len + rsno2e_len +
+ rsnxoe_len);
+
+ /* RSN Override Link KDE */
+ *pos++ = WLAN_EID_VENDOR_SPECIFIC;
+ kde_len = RSN_SELECTOR_LEN + 1 + rsnoe_len + rsno2e_len +
+ rsnxoe_len;
+ if (kde_len > 255) {
+ wpa_printf(MSG_ERROR,
+ "RSN: RSNOE/RSNO2E/RSNXOE too long (KDE length %zu) to fit in RSN Override Link KDE for link %u",
+ kde_len, link_id);
+ return NULL;
+ }
+ *pos++ = kde_len;
+
+ RSN_SELECTOR_PUT(pos, WFA_KEY_DATA_RSN_OVERRIDE_LINK);
+ pos += RSN_SELECTOR_LEN;
+
+ *pos++ = link_id;
+
+ if (rsnoe_len) {
+ os_memcpy(pos, rsnoe, rsnoe_len);
+ pos += rsnoe_len;
+ }
+
+ if (rsno2e_len) {
+ os_memcpy(pos, rsno2e, rsno2e_len);
+ pos += rsno2e_len;
+ }
+
+ if (rsnxoe_len) {
+ os_memcpy(pos, rsnxoe, rsnxoe_len);
+ pos += rsnxoe_len;
}
}
- wpa_printf(MSG_DEBUG, "RSN: MLO Link KDE len = %ld", pos - start);
+ wpa_printf(MSG_DEBUG,
+ "RSN: MLO Link KDEs and RSN Override Link KDEs len = %ld",
+ pos - start);
pos = wpa_auth_ml_group_kdes(sm, pos);
#endif /* CONFIG_IEEE80211BE */
@@ -4644,77 +4717,36 @@
wpa_ie = wpa_ie + wpa_ie[1] + 2;
wpa_ie_len = wpa_ie[1] + 2;
}
- if ((sm->rsn_override &&
- get_vendor_ie(wpa_ie, wpa_ie_len, RSNE_OVERRIDE_IE_VENDOR_TYPE)) ||
- (sm->rsn_override_2 &&
- get_vendor_ie(wpa_ie, wpa_ie_len,
- RSNE_OVERRIDE_2_IE_VENDOR_TYPE))) {
- const u8 *mde, *fte, *tie, *tie2 = NULL;
- const u8 *override_rsne = NULL, *override_rsnxe = NULL;
- const struct element *elem;
+ if ((conf->rsn_override_key_mgmt || conf->rsn_override_key_mgmt_2) &&
+ !rsn_is_snonce_cookie(sm->SNonce)) {
+ u8 *ie;
+ size_t ie_len;
+ u32 ids[] = {
+ RSNE_OVERRIDE_IE_VENDOR_TYPE,
+ RSNE_OVERRIDE_2_IE_VENDOR_TYPE,
+ RSNXE_OVERRIDE_IE_VENDOR_TYPE,
+ 0
+ };
+ int i;
wpa_printf(MSG_DEBUG,
- "RSN: Use RSNE/RSNXE override element contents");
- mde = get_ie(wpa_ie, wpa_ie_len, WLAN_EID_MOBILITY_DOMAIN);
- fte = get_ie(wpa_ie, wpa_ie_len, WLAN_EID_FAST_BSS_TRANSITION);
- tie = get_ie(wpa_ie, wpa_ie_len, WLAN_EID_TIMEOUT_INTERVAL);
- if (tie) {
- const u8 *next = tie + 2 + tie[1];
-
- tie2 = get_ie(next, wpa_ie + wpa_ie_len - next,
- WLAN_EID_TIMEOUT_INTERVAL);
- }
- for_each_element_id(elem, WLAN_EID_VENDOR_SPECIFIC,
- wpa_ie, wpa_ie_len) {
- if (elem->datalen >= 4) {
- if (WPA_GET_BE32(elem->data) ==
- (sm->rsn_override_2 ?
- RSNE_OVERRIDE_2_IE_VENDOR_TYPE :
- RSNE_OVERRIDE_IE_VENDOR_TYPE))
- override_rsne = &elem->id;
- if (WPA_GET_BE32(elem->data) ==
- RSNXE_OVERRIDE_IE_VENDOR_TYPE)
- override_rsnxe = &elem->id;
- }
- }
+ "RSN: Remove RSNE/RSNXE override elements");
wpa_hexdump(MSG_DEBUG, "EAPOL-Key msg 3/4 IEs before edits",
wpa_ie, wpa_ie_len);
- wpa_ie_buf3 = os_malloc(wpa_ie_len);
+ wpa_ie_buf3 = os_memdup(wpa_ie, wpa_ie_len);
if (!wpa_ie_buf3)
goto done;
- pos = wpa_ie_buf3;
- if (override_rsne) {
- *pos++ = WLAN_EID_RSN;
- *pos++ = override_rsne[1] - 4;
- os_memcpy(pos, &override_rsne[2 + 4],
- override_rsne[1] - 4);
- pos += override_rsne[1] - 4;
- }
- if (mde) {
- os_memcpy(pos, mde, 2 + mde[1]);
- pos += 2 + mde[1];
- }
- if (fte) {
- os_memcpy(pos, fte, 2 + fte[1]);
- pos += 2 + fte[1];
- }
- if (tie) {
- os_memcpy(pos, tie, 2 + tie[1]);
- pos += 2 + tie[1];
- }
- if (tie2) {
- os_memcpy(pos, tie2, 2 + tie2[1]);
- pos += 2 + tie2[1];
- }
- if (override_rsnxe) {
- *pos++ = WLAN_EID_RSNX;
- *pos++ = override_rsnxe[1] - 4;
- os_memcpy(pos, &override_rsnxe[2 + 4],
- override_rsnxe[1] - 4);
- pos += override_rsnxe[1] - 4;
- }
wpa_ie = wpa_ie_buf3;
- wpa_ie_len = pos - wpa_ie_buf3;
+
+ for (i = 0; ids[i]; i++) {
+ ie = (u8 *) get_vendor_ie(wpa_ie, wpa_ie_len, ids[i]);
+ if (ie) {
+ ie_len = 2 + ie[1];
+ os_memmove(ie, ie + ie_len,
+ wpa_ie_len - (ie + ie_len - wpa_ie));
+ wpa_ie_len -= ie_len;
+ }
+ }
wpa_hexdump(MSG_DEBUG, "EAPOL-Key msg 3/4 IEs after edits",
wpa_ie, wpa_ie_len);
}
@@ -4957,6 +4989,10 @@
#endif /* CONFIG_DPP2 */
pos = wpa_auth_ml_kdes(sm, pos);
+ if (!pos) {
+ wpa_printf(MSG_ERROR, "RSN: Failed to add MLO KDEs");
+ goto done;
+ }
if (sm->ssid_protection) {
*pos++ = WLAN_EID_SSID;
@@ -5601,11 +5637,38 @@
static int wpa_group_update_sta(struct wpa_state_machine *sm, void *ctx)
{
- if (ctx != NULL && ctx != sm->group)
+ struct wpa_authenticator *wpa_auth = sm->wpa_auth;
+ struct wpa_group *group = sm->group;
+#ifdef CONFIG_IEEE80211BE
+ int link_id;
+
+ for (link_id = 0; link_id < MAX_NUM_MLD_LINKS; link_id++) {
+ if (!sm->mld_links[link_id].valid)
+ continue;
+ if (sm->mld_links[link_id].wpa_auth &&
+ sm->mld_links[link_id].wpa_auth->group == ctx) {
+ group = sm->mld_links[link_id].wpa_auth->group;
+ wpa_auth = sm->mld_links[link_id].wpa_auth;
+ break;
+ }
+ }
+#endif /* CONFIG_IEEE80211BE */
+
+ if (ctx && ctx != group)
return 0;
+#ifdef CONFIG_IEEE80211BE
+ /* For ML STA, run rekey on the association link and send G1 with keys
+ * for all links. This is based on assumption that MLD level
+ * Authenticator updates group keys on all affiliated links in one shot
+ * and not independently or concurrently for separate links. */
+ if (sm->mld_assoc_link_id >= 0 &&
+ sm->mld_assoc_link_id != wpa_auth->link_id)
+ return 0;
+#endif /* CONFIG_IEEE80211BE */
+
if (sm->wpa_ptk_state != WPA_PTK_PTKINITDONE) {
- wpa_auth_logger(sm->wpa_auth, wpa_auth_get_spa(sm),
+ wpa_auth_logger(wpa_auth, wpa_auth_get_spa(sm),
LOGGER_DEBUG,
"Not in PTKINITDONE; skip Group Key update");
sm->GUpdateStationKeys = false;
@@ -5617,7 +5680,7 @@
* Since we clear the GKeyDoneStations before the loop, the
* station needs to be counted here anyway.
*/
- wpa_auth_logger(sm->wpa_auth, wpa_auth_get_spa(sm),
+ wpa_auth_logger(wpa_auth, wpa_auth_get_spa(sm),
LOGGER_DEBUG,
"GUpdateStationKeys was already set when marking station for GTK rekeying");
}
@@ -5627,6 +5690,11 @@
return 0;
sm->group->GKeyDoneStations++;
+#ifdef CONFIG_IEEE80211BE
+ for_each_sm_auth(sm, link_id)
+ sm->mld_links[link_id].wpa_auth->group->GKeyDoneStations++;
+#endif /* CONFIG_IEEE80211BE */
+
sm->GUpdateStationKeys = true;
wpa_sm_step(sm);
@@ -6939,17 +7007,27 @@
}
-void wpa_auth_set_rsn_override(struct wpa_state_machine *sm, bool val)
+void wpa_auth_set_rsn_selection(struct wpa_state_machine *sm, const u8 *ie,
+ size_t len)
{
- if (sm)
- sm->rsn_override = val;
-}
-
-
-void wpa_auth_set_rsn_override_2(struct wpa_state_machine *sm, bool val)
-{
- if (sm)
- sm->rsn_override_2 = val;
+ if (!sm)
+ return;
+ os_free(sm->rsn_selection);
+ sm->rsn_selection = NULL;
+ sm->rsn_selection_len = 0;
+ sm->rsn_override = false;
+ sm->rsn_override_2 = false;
+ if (ie) {
+ if (len >= 1) {
+ if (ie[0] == RSN_SELECTION_RSNE_OVERRIDE)
+ sm->rsn_override = true;
+ else if (ie[0] == RSN_SELECTION_RSNE_OVERRIDE_2)
+ sm->rsn_override_2 = true;
+ }
+ sm->rsn_selection = os_memdup(ie, len);
+ if (sm->rsn_selection)
+ sm->rsn_selection_len = len;
+ }
}
diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
index 86cb4e8..0b692ad 100644
--- a/src/ap/wpa_auth.h
+++ b/src/ap/wpa_auth.h
@@ -17,7 +17,7 @@
struct vlan_description;
struct mld_info;
-#define MAX_OWN_IE_OVERRIDE 256
+#define MAX_OWN_IE_OVERRIDE 257
#ifdef _MSC_VER
#pragma pack(push, 1)
@@ -230,6 +230,21 @@
double corrupt_gtk_rekey_mic_probability;
u8 own_ie_override[MAX_OWN_IE_OVERRIDE];
size_t own_ie_override_len;
+ bool rsne_override_set;
+ u8 rsne_override[MAX_OWN_IE_OVERRIDE];
+ size_t rsne_override_len;
+ bool rsnoe_override_set;
+ u8 rsnoe_override[MAX_OWN_IE_OVERRIDE];
+ size_t rsnoe_override_len;
+ bool rsno2e_override_set;
+ u8 rsno2e_override[MAX_OWN_IE_OVERRIDE];
+ size_t rsno2e_override_len;
+ bool rsnxe_override_set;
+ u8 rsnxe_override[MAX_OWN_IE_OVERRIDE];
+ size_t rsnxe_override_len;
+ bool rsnxoe_override_set;
+ u8 rsnxoe_override[MAX_OWN_IE_OVERRIDE];
+ size_t rsnxoe_override_len;
u8 rsne_override_eapol[MAX_OWN_IE_OVERRIDE];
size_t rsne_override_eapol_len;
u8 rsnxe_override_eapol[MAX_OWN_IE_OVERRIDE];
@@ -253,6 +268,7 @@
struct wpabuf *eapol_m1_elements;
struct wpabuf *eapol_m3_elements;
bool eapol_m3_no_encrypt;
+ bool eapol_key_reserved_random;
#endif /* CONFIG_TESTING_OPTIONS */
unsigned int oci_freq_override_eapol_m3;
unsigned int oci_freq_override_eapol_g1;
@@ -303,6 +319,8 @@
#endif /* CONFIG_IEEE80211BE */
bool ssid_protection;
+
+ int rsn_override_omit_rsnxe;
};
typedef enum {
@@ -408,7 +426,8 @@
size_t ltf_keyseed_len);
#endif /* CONFIG_PASN */
#ifdef CONFIG_IEEE80211BE
- int (*get_ml_key_info)(void *ctx, struct wpa_auth_ml_key_info *info);
+ int (*get_ml_key_info)(void *ctx, struct wpa_auth_ml_key_info *info,
+ bool rekey);
#endif /* CONFIG_IEEE80211BE */
int (*get_drv_flags)(void *ctx, u64 *drv_flags, u64 *drv_flags2);
};
@@ -613,8 +632,8 @@
bool wpa_auth_write_fd_rsn_info(struct wpa_authenticator *wpa_auth,
u8 *fd_rsn_info);
void wpa_auth_set_auth_alg(struct wpa_state_machine *sm, u16 auth_alg);
-void wpa_auth_set_rsn_override(struct wpa_state_machine *sm, bool val);
-void wpa_auth_set_rsn_override_2(struct wpa_state_machine *sm, bool val);
+void wpa_auth_set_rsn_selection(struct wpa_state_machine *sm, const u8 *ie,
+ size_t len);
void wpa_auth_set_dpp_z(struct wpa_state_machine *sm, const struct wpabuf *z);
void wpa_auth_set_ssid_protection(struct wpa_state_machine *sm, bool val);
void wpa_auth_set_transition_disable(struct wpa_authenticator *wpa_auth,
@@ -658,7 +677,8 @@
u8 mld_assoc_link_id, struct mld_info *info);
void wpa_auth_ml_get_key_info(struct wpa_authenticator *a,
struct wpa_auth_ml_link_key_info *info,
- bool mgmt_frame_prot, bool beacon_prot);
+ bool mgmt_frame_prot, bool beacon_prot,
+ bool rekey);
void wpa_release_link_auth_ref(struct wpa_state_machine *sm,
int release_link_id);
diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index e88644f..2323a59 100644
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -132,6 +132,46 @@
wpabuf_head(conf->own_ie_override),
wconf->own_ie_override_len);
}
+ if (conf->rsne_override &&
+ wpabuf_len(conf->rsne_override) <= MAX_OWN_IE_OVERRIDE) {
+ wconf->rsne_override_len = wpabuf_len(conf->rsne_override);
+ os_memcpy(wconf->rsne_override,
+ wpabuf_head(conf->rsne_override),
+ wconf->rsne_override_len);
+ wconf->rsne_override_set = true;
+ }
+ if (conf->rsnoe_override &&
+ wpabuf_len(conf->rsnoe_override) <= MAX_OWN_IE_OVERRIDE) {
+ wconf->rsnoe_override_len = wpabuf_len(conf->rsnoe_override);
+ os_memcpy(wconf->rsnoe_override,
+ wpabuf_head(conf->rsnoe_override),
+ wconf->rsnoe_override_len);
+ wconf->rsnoe_override_set = true;
+ }
+ if (conf->rsno2e_override &&
+ wpabuf_len(conf->rsno2e_override) <= MAX_OWN_IE_OVERRIDE) {
+ wconf->rsno2e_override_len = wpabuf_len(conf->rsno2e_override);
+ os_memcpy(wconf->rsno2e_override,
+ wpabuf_head(conf->rsno2e_override),
+ wconf->rsno2e_override_len);
+ wconf->rsno2e_override_set = true;
+ }
+ if (conf->rsnxe_override &&
+ wpabuf_len(conf->rsnxe_override) <= MAX_OWN_IE_OVERRIDE) {
+ wconf->rsnxe_override_len = wpabuf_len(conf->rsnxe_override);
+ os_memcpy(wconf->rsnxe_override,
+ wpabuf_head(conf->rsnxe_override),
+ wconf->rsnxe_override_len);
+ wconf->rsnxe_override_set = true;
+ }
+ if (conf->rsnxoe_override &&
+ wpabuf_len(conf->rsnxoe_override) <= MAX_OWN_IE_OVERRIDE) {
+ wconf->rsnxoe_override_len = wpabuf_len(conf->rsnxoe_override);
+ os_memcpy(wconf->rsnxoe_override,
+ wpabuf_head(conf->rsnxoe_override),
+ wconf->rsnxoe_override_len);
+ wconf->rsnxoe_override_set = true;
+ }
if (conf->rsne_override_eapol &&
wpabuf_len(conf->rsne_override_eapol) <= MAX_OWN_IE_OVERRIDE) {
wconf->rsne_override_eapol_set = 1;
@@ -199,6 +239,7 @@
if (conf->eapol_m3_elements)
wconf->eapol_m3_elements = wpabuf_dup(conf->eapol_m3_elements);
wconf->eapol_m3_no_encrypt = conf->eapol_m3_no_encrypt;
+ wconf->eapol_key_reserved_random = conf->eapol_key_reserved_random;
#endif /* CONFIG_TESTING_OPTIONS */
#ifdef CONFIG_P2P
os_memcpy(wconf->ip_addr_go, conf->ip_addr_go, 4);
@@ -237,6 +278,8 @@
wconf->no_disconnect_on_group_keyerror =
conf->bss_max_idle && conf->ap_max_inactivity &&
conf->no_disconnect_on_group_keyerror;
+
+ wconf->rsn_override_omit_rsnxe = conf->rsn_override_omit_rsnxe;
}
@@ -1547,7 +1590,8 @@
#ifdef CONFIG_IEEE80211BE
static int hostapd_wpa_auth_get_ml_key_info(void *ctx,
- struct wpa_auth_ml_key_info *info)
+ struct wpa_auth_ml_key_info *info,
+ bool rekey)
{
struct hostapd_data *hapd = ctx;
unsigned int i;
@@ -1571,7 +1615,8 @@
wpa_auth_ml_get_key_info(hapd->wpa_auth,
&info->links[i],
info->mgmt_frame_prot,
- info->beacon_prot);
+ info->beacon_prot,
+ rekey);
continue;
}
@@ -1582,7 +1627,8 @@
wpa_auth_ml_get_key_info(bss->wpa_auth,
&info->links[i],
info->mgmt_frame_prot,
- info->beacon_prot);
+ info->beacon_prot,
+ rekey);
link_bss_found = true;
break;
}
diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
index 29988c2..cb902e4 100644
--- a/src/ap/wpa_auth_i.h
+++ b/src/ap/wpa_auth_i.h
@@ -111,6 +111,8 @@
size_t wpa_ie_len;
u8 *rsnxe;
size_t rsnxe_len;
+ u8 *rsn_selection;
+ size_t rsn_selection_len;
enum {
WPA_VERSION_NO_WPA = 0 /* WPA not used */,
@@ -251,9 +253,6 @@
u8 *wpa_ie;
size_t wpa_ie_len;
- u8 *rsne_override; /* RSNE with overridden payload */
- u8 *rsne_override_2; /* RSNE with overridden (2) payload */
- u8 *rsnxe_override; /* RSNXE with overridden payload */
u8 addr[ETH_ALEN];
diff --git a/src/ap/wpa_auth_ie.c b/src/ap/wpa_auth_ie.c
index f4f9cc8..43d9c1d 100644
--- a/src/ap/wpa_auth_ie.c
+++ b/src/ap/wpa_auth_ie.c
@@ -547,15 +547,20 @@
size_t len)
{
u8 *pos = buf;
- u16 capab;
+ u32 capab, tmp;
size_t flen;
capab = rsnxe_capab(conf, conf->rsn_override_key_mgmt |
conf->rsn_override_key_mgmt_2);
- flen = (capab & 0xff00) ? 2 : 1;
if (!capab)
return 0; /* no supported extended RSN capabilities */
+ tmp = capab;
+ flen = 0;
+ while (tmp) {
+ flen++;
+ tmp >>= 8;
+ }
if (len < 2 + flen)
return -1;
capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
@@ -565,10 +570,10 @@
WPA_PUT_BE32(pos, RSNXE_OVERRIDE_IE_VENDOR_TYPE);
pos += 4;
- *pos++ = capab & 0x00ff;
- capab >>= 8;
- if (capab)
- *pos++ = capab;
+ while (capab) {
+ *pos++ = capab & 0xff;
+ capab >>= 8;
+ }
return pos - buf;
}
@@ -627,7 +632,7 @@
int wpa_auth_gen_wpa_ie(struct wpa_authenticator *wpa_auth)
{
- u8 *pos, buf[256];
+ u8 *pos, buf[1500];
int res;
#ifdef CONFIG_TESTING_OPTIONS
@@ -653,17 +658,54 @@
pos = wpa_write_osen(&wpa_auth->conf, pos);
}
if (wpa_auth->conf.wpa & WPA_PROTO_RSN) {
+#ifdef CONFIG_TESTING_OPTIONS
+ if (wpa_auth->conf.rsne_override_set) {
+ wpa_hexdump(MSG_DEBUG,
+ "RSN: Forced own RSNE for testing",
+ wpa_auth->conf.rsne_override,
+ wpa_auth->conf.rsne_override_len);
+ if (sizeof(buf) - (pos - buf) <
+ wpa_auth->conf.rsne_override_len)
+ return -1;
+ os_memcpy(pos, wpa_auth->conf.rsne_override,
+ wpa_auth->conf.rsne_override_len);
+ pos += wpa_auth->conf.rsne_override_len;
+ goto rsnxe;
+ }
+#endif /* CONFIG_TESTING_OPTIONS */
res = wpa_write_rsn_ie(&wpa_auth->conf,
pos, buf + sizeof(buf) - pos, NULL);
if (res < 0)
return res;
pos += res;
- res = wpa_write_rsnxe(&wpa_auth->conf, pos,
- buf + sizeof(buf) - pos);
+#ifdef CONFIG_TESTING_OPTIONS
+ rsnxe:
+ if (wpa_auth->conf.rsnxe_override_set) {
+ wpa_hexdump(MSG_DEBUG,
+ "RSN: Forced own RSNXE for testing",
+ wpa_auth->conf.rsnxe_override,
+ wpa_auth->conf.rsnxe_override_len);
+ if (sizeof(buf) - (pos - buf) <
+ wpa_auth->conf.rsnxe_override_len)
+ return -1;
+ os_memcpy(pos, wpa_auth->conf.rsnxe_override,
+ wpa_auth->conf.rsnxe_override_len);
+ pos += wpa_auth->conf.rsnxe_override_len;
+ goto fte;
+ }
+#endif /* CONFIG_TESTING_OPTIONS */
+ if (wpa_auth->conf.rsn_override_omit_rsnxe)
+ res = 0;
+ else
+ res = wpa_write_rsnxe(&wpa_auth->conf, pos,
+ buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
+#ifdef CONFIG_TESTING_OPTIONS
+fte:
+#endif /* CONFIG_TESTING_OPTIONS */
#ifdef CONFIG_IEEE80211R_AP
if (wpa_key_mgmt_ft(wpa_auth->conf.wpa_key_mgmt)) {
res = wpa_write_mdie(&wpa_auth->conf, pos,
@@ -682,30 +724,85 @@
}
if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
wpa_auth->conf.rsn_override_key_mgmt) {
+#ifdef CONFIG_TESTING_OPTIONS
+ if (wpa_auth->conf.rsnoe_override_set) {
+ wpa_hexdump(MSG_DEBUG,
+ "RSN: Forced own RSNOE for testing",
+ wpa_auth->conf.rsnoe_override,
+ wpa_auth->conf.rsnoe_override_len);
+ if (sizeof(buf) - (pos - buf) <
+ wpa_auth->conf.rsnoe_override_len)
+ return -1;
+ os_memcpy(pos, wpa_auth->conf.rsnoe_override,
+ wpa_auth->conf.rsnoe_override_len);
+ pos += wpa_auth->conf.rsnoe_override_len;
+ goto rsno2e;
+ }
+#endif /* CONFIG_TESTING_OPTIONS */
res = wpa_write_rsne_override(&wpa_auth->conf,
pos, buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
+#ifdef CONFIG_TESTING_OPTIONS
+rsno2e:
+#endif /* CONFIG_TESTING_OPTIONS */
if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
wpa_auth->conf.rsn_override_key_mgmt_2) {
+#ifdef CONFIG_TESTING_OPTIONS
+ if (wpa_auth->conf.rsno2e_override_set) {
+ wpa_hexdump(MSG_DEBUG,
+ "RSN: Forced own RSNO2E for testing",
+ wpa_auth->conf.rsno2e_override,
+ wpa_auth->conf.rsno2e_override_len);
+ if (sizeof(buf) - (pos - buf) <
+ wpa_auth->conf.rsno2e_override_len)
+ return -1;
+ os_memcpy(pos, wpa_auth->conf.rsno2e_override,
+ wpa_auth->conf.rsno2e_override_len);
+ pos += wpa_auth->conf.rsno2e_override_len;
+ goto rsnxoe;
+ }
+#endif /* CONFIG_TESTING_OPTIONS */
res = wpa_write_rsne_override_2(&wpa_auth->conf, pos,
buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
+#ifdef CONFIG_TESTING_OPTIONS
+rsnxoe:
+#endif /* CONFIG_TESTING_OPTIONS */
if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
(wpa_auth->conf.rsn_override_key_mgmt ||
wpa_auth->conf.rsn_override_key_mgmt_2)) {
+#ifdef CONFIG_TESTING_OPTIONS
+ if (wpa_auth->conf.rsnxoe_override_set) {
+ wpa_hexdump(MSG_DEBUG,
+ "RSN: Forced own RSNXOE for testing",
+ wpa_auth->conf.rsnxoe_override,
+ wpa_auth->conf.rsnxoe_override_len);
+ if (sizeof(buf) - (pos - buf) <
+ wpa_auth->conf.rsnxoe_override_len)
+ return -1;
+ os_memcpy(pos, wpa_auth->conf.rsnxoe_override,
+ wpa_auth->conf.rsnxoe_override_len);
+ pos += wpa_auth->conf.rsnxoe_override_len;
+ goto done;
+ }
+#endif /* CONFIG_TESTING_OPTIONS */
res = wpa_write_rsnxe_override(&wpa_auth->conf, pos,
buf + sizeof(buf) - pos);
if (res < 0)
return res;
pos += res;
}
+#ifdef CONFIG_TESTING_OPTIONS
+done:
+#endif /* CONFIG_TESTING_OPTIONS */
+ wpa_hexdump(MSG_DEBUG, "RSN: Own IEs", buf, pos - buf);
os_free(wpa_auth->wpa_ie);
wpa_auth->wpa_ie = os_malloc(pos - buf);
if (wpa_auth->wpa_ie == NULL)
@@ -713,59 +810,6 @@
os_memcpy(wpa_auth->wpa_ie, buf, pos - buf);
wpa_auth->wpa_ie_len = pos - buf;
- if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
- wpa_auth->conf.rsn_override_key_mgmt) {
- res = wpa_write_rsne_override(&wpa_auth->conf, buf,
- sizeof(buf));
- if (res < 0)
- return res;
- os_free(wpa_auth->rsne_override);
- wpa_auth->rsne_override = os_malloc(res - 4);
- if (!wpa_auth->rsne_override)
- return -1;
- pos = wpa_auth->rsne_override;
- *pos++ = WLAN_EID_RSN;
- *pos++ = res - 2 - 4;
- os_memcpy(pos, &buf[2 + 4], res - 2 - 4);
- }
-
- if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
- wpa_auth->conf.rsn_override_key_mgmt_2) {
- res = wpa_write_rsne_override_2(&wpa_auth->conf, buf,
- sizeof(buf));
- if (res < 0)
- return res;
- os_free(wpa_auth->rsne_override_2);
- wpa_auth->rsne_override_2 = os_malloc(res - 4);
- if (!wpa_auth->rsne_override_2)
- return -1;
- pos = wpa_auth->rsne_override_2;
- *pos++ = WLAN_EID_RSN;
- *pos++ = res - 2 - 4;
- os_memcpy(pos, &buf[2 + 4], res - 2 - 4);
- }
-
- if ((wpa_auth->conf.wpa & WPA_PROTO_RSN) &&
- (wpa_auth->conf.rsn_override_key_mgmt ||
- wpa_auth->conf.rsn_override_key_mgmt_2)) {
- res = wpa_write_rsnxe_override(&wpa_auth->conf, buf,
- sizeof(buf));
- if (res < 0)
- return res;
- os_free(wpa_auth->rsnxe_override);
- if (res == 0) {
- wpa_auth->rsnxe_override = NULL;
- return 0;
- }
- wpa_auth->rsnxe_override = os_malloc(res - 4);
- if (!wpa_auth->rsnxe_override)
- return -1;
- pos = wpa_auth->rsnxe_override;
- *pos++ = WLAN_EID_RSNX;
- *pos++ = res - 2 - 4;
- os_memcpy(pos, &buf[2 + 4], res - 2 - 4);
- }
-
return 0;
}
@@ -970,9 +1014,13 @@
return WPA_INVALID_GROUP;
}
- key_mgmt = data.key_mgmt & (wpa_auth->conf.wpa_key_mgmt |
- wpa_auth->conf.rsn_override_key_mgmt |
- wpa_auth->conf.rsn_override_key_mgmt_2);
+ if (sm->rsn_override_2)
+ key_mgmt = data.key_mgmt &
+ wpa_auth->conf.rsn_override_key_mgmt_2;
+ else if (sm->rsn_override)
+ key_mgmt = data.key_mgmt & wpa_auth->conf.rsn_override_key_mgmt;
+ else
+ key_mgmt = data.key_mgmt & wpa_auth->conf.wpa_key_mgmt;
if (!key_mgmt) {
wpa_printf(MSG_DEBUG, "Invalid WPA key mgmt (0x%x) from "
MACSTR, data.key_mgmt, MAC2STR(sm->addr));
@@ -1041,11 +1089,14 @@
else
sm->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
- if (version == WPA_PROTO_RSN)
+ if (version == WPA_PROTO_RSN && sm->rsn_override_2)
ciphers = data.pairwise_cipher &
- (wpa_auth->conf.rsn_pairwise |
- wpa_auth->conf.rsn_override_pairwise |
- wpa_auth->conf.rsn_override_pairwise_2);
+ wpa_auth->conf.rsn_override_pairwise_2;
+ else if (version == WPA_PROTO_RSN && sm->rsn_override)
+ ciphers = data.pairwise_cipher &
+ wpa_auth->conf.rsn_override_pairwise;
+ else if (version == WPA_PROTO_RSN)
+ ciphers = data.pairwise_cipher & wpa_auth->conf.rsn_pairwise;
else
ciphers = data.pairwise_cipher & wpa_auth->conf.wpa_pairwise;
if (!ciphers) {