aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Use BoringSSL to get random bytesHEADreplicant-6.0-0004-transitionreplicant-6.0-0004-rc6replicant-6.0-0004-rc5-transitionreplicant-6.0-0004-rc5replicant-6.0-0004-rc4replicant-6.0-0004-rc3replicant-6.0-0004-rc2replicant-6.0-0004cm-13.0Rich Cannings2019-03-232-0/+8
| | | | | | | Bug: 117508900 Change-Id: I4889513c0671ff2b689f1beca8084d6f149d473d Test: Existing tests pass (cherry picked from commit 29d54b87f121c79d5df87b0b2bcd7a1eb6090c1f)
* WNM: Fix WNM-Sleep Mode Request bounds checkingJouni Malinen2019-02-021-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ieee802_11_rx_wnmsleep_req() might be called for a short frame that has no more payload after the Public Action field, i.e., with len == 0. The bounds checking for the payload length was done only for the information elements while the one octet Dialog Token field was read unconditionally. This could result in reading one octet beyond the end of the received frame data. Depending on driver interface specific mechanism used for fetching the frame, this could result in reading one octet beyond the end of a stack/hash buffer or reading an uninitialized octet from within a buffer. The actual value that was read as the Dialog Token field is not used since the function returns immediately after having read this value when there is no information elements following the field. This issue was initially added in commit d32d94dbf47a ("WNM: Add WNM-Sleep Mode implementation for AP") (with CONFIG_IEEE80211V=y build option) and it remained in place during number of cleanup and fix changes in this area and renaming of the build parameter to CONFIG_WNM=y. The impacted function was not included in any default build without one of the these optional build options being explicitly enabled. CONFIG_WNM=y is still documented as "experimental and not complete implementation" in hostapd/defconfig. In addition, commit 114f2830d2c2 ("WNM: Ignore WNM-Sleep Mode Request in wnm_sleep_mode=0 case") made this function exit before the impact read if WNM-Sleep Mode support was not explicitly enabled in runtime configuration (wnm_sleep_mode=1 in hostapd.conf). Fix this by explicitly checking the frame has enough payload before reading the Dialog Token field. Bug: 111893132 Change-Id: I4b61e22c39d1a5683923eff34e43bb0c509913d4 Merged-In: I4b61e22c39d1a5683923eff34e43bb0c509913d4 Signed-off-by: Jouni Malinen <jouni@codeaurora.org> (cherry picked from commit 7a543744db8ece2376b019040b5668ede68ebd8b) CVE-2018-9589
* TDLS: Ignore incoming TDLS Setup Response retriesreplicant-6.0-0004-rc1replicant-6.0-0003Arik Nemtsov2017-10-191-0/+8
| | | | | | | | | | The Setup Response timer is relatively fast (500 ms) and there are instances where it fires on the responder side after the initiator has already sent out the TDLS Setup Confirm frame. Prevent the processing of this stale TDLS Setup Response frame on the initiator side. Change-Id: I595f41dc803d6707ee8d0ea220f594cce750139a Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
* Clear PMK length and check for this when deriving PTKJouni Malinen2017-10-193-3/+10
| | | | | | | | | | Instead of setting the default PMK length for the cleared PMK, set the length to 0 and explicitly check for this when deriving PTK to avoid unexpected key derivation with an all-zeroes key should it be possible to somehow trigger PTK derivation to happen before PMK derivation. Change-Id: Ifef3b2ca5ee19e6e89df75fef697e7215f926cb1 Signed-off-by: Jouni Malinen <j@w1.fi>
* Add debug prints on PMK configuration in WPA supplicantJouni Malinen2017-10-191-0/+6
| | | | | | | | This makes it easier to understand the cases where PMK gets configured based on information from upper layer call (e.g., a PSK). Change-Id: Ic7cbb18ed37de89d7378503c6b3d0f1da63db4dd Signed-off-by: Jouni Malinen <j@w1.fi>
* WPA: Extra defense against PTK reinstalls in 4-way handshakeMathy Vanhoef2017-10-191-0/+8
| | | | | | | | | | | | Currently, reinstallations of the PTK are prevented by (1) assuring the same TPTK is only set once as the PTK, and (2) that one particular PTK is only installed once. This patch makes it more explicit that point (1) is required to prevent key reinstallations. At the same time, this patch hardens wpa_supplicant such that future changes do not accidentally break this property. Change-Id: Id03f4790d93deb1bc34b1055fb85ec80c5229bcc Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
* Remove all PeerKey functionalityJouni Malinen2017-10-1945-2123/+42
| | | | | | | | | | | | | | | | | | | | | | | | | This was originally added to allow the IEEE 802.11 protocol to be tested, but there are no known fully functional implementations based on this nor any known deployments of PeerKey functionality. Furthermore, PeerKey design in the IEEE Std 802.11-2016 standard has already been marked as obsolete for DLS and it is being considered for complete removal in REVmd. This implementation did not really work, so it could not have been used in practice. For example, key configuration was using incorrect algorithm values (WPA_CIPHER_* instead of WPA_ALG_*) which resulted in mapping to an invalid WPA_ALG_* value for the actual driver operation. As such, the derived key could not have been successfully set for the link. Since there are bugs in this implementation and there does not seem to be any future for the PeerKey design with DLS (TDLS being the future for DLS), the best approach is to simply delete all this code to simplify the EAPOL-Key handling design and to get rid of any potential issues if these code paths were accidentially reachable. Change-Id: I10294a9ef31c46a27416a6063255939dcedc57d5 Signed-off-by: Jouni Malinen <j@w1.fi>
* Add MGMT_TX_STATUS_PROCESS command for testing purposesJouni Malinen2017-10-192-2/+75
| | | | | | | | | This allows ext_mgmt_frame_handling=1 cases with hostapd to process TX status events based on external processing. This is useful for increased test coverage of management frame processing. Change-Id: I056ec2a06334762245dfcb8261b9427e818ef52c Signed-off-by: Jouni Malinen <j@w1.fi>
* FT: Do not allow multiple Reassociation Response framesJouni Malinen2017-10-193-0/+12
| | | | | | | | | | | | | The driver is expected to not report a second association event without the station having explicitly request a new association. As such, this case should not be reachable. However, since reconfiguring the same pairwise or group keys to the driver could result in nonce reuse issues, be extra careful here and do an additional state check to avoid this even if the local driver ends up somehow accepting an unexpected Reassociation Response frame. Change-Id: Ie76301550e96bfcfe252d874f2e83deb0aeb9533 Signed-off-by: Jouni Malinen <j@w1.fi>
* WNM: Ignore WNM-Sleep Mode Response without pending requestJouni Malinen2017-10-191-1/+3
| | | | | | | | | | | | Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep Mode Response if WNM-Sleep Mode has not been used') started ignoring the response when no WNM-Sleep Mode Request had been used during the association. This can be made tighter by clearing the used flag when successfully processing a response. This adds an additional layer of protection against unexpected retransmissions of the response frame. Change-Id: I87ab15f88b604c70512d12426352876ad526ced4 Signed-off-by: Jouni Malinen <j@w1.fi>
* TDLS: Reject TPK-TK reconfigurationJouni Malinen2017-10-191-2/+36
| | | | | | | | | | | | | | | | | | | | Do not try to reconfigure the same TPK-TK to the driver after it has been successfully configured. This is an explicit check to avoid issues related to resetting the TX/RX packet number. There was already a check for this for TPK M2 (retries of that message are ignored completely), so that behavior does not get modified. For TPK M3, the TPK-TK could have been reconfigured, but that was followed by immediate teardown of the link due to an issue in updating the STA entry. Furthermore, for TDLS with any real security (i.e., ignoring open/WEP), the TPK message exchange is protected on the AP path and simple replay attacks are not feasible. As an additional corner case, make sure the local nonce gets updated if the peer uses a very unlikely "random nonce" of all zeros. Change-Id: I84131f30c358f27aaf6277e8957d165bca5102aa Signed-off-by: Jouni Malinen <j@w1.fi>
* Fix PTK rekeying to generate a new ANonceJouni Malinen2017-10-191-3/+21
| | | | | | | | | | | | | | The Authenticator state machine path for PTK rekeying ended up bypassing the AUTHENTICATION2 state where a new ANonce is generated when going directly to the PTKSTART state since there is no need to try to determine the PMK again in such a case. This is far from ideal since the new PTK would depend on a new nonce only from the supplicant. Fix this by generating a new ANonce when moving to the PTKSTART state for the purpose of starting new 4-way handshake to rekey PTK. Change-Id: I7887f36a0f9e7710bc40fbe5014ea8867d7f5f72 Signed-off-by: Jouni Malinen <j@w1.fi>
* Prevent installation of an all-zero TKMathy Vanhoef2017-10-193-4/+3
| | | | | | | | | | | | | | | Properly track whether a PTK has already been installed to the driver and the TK part cleared from memory. This prevents an attacker from trying to trick the client into installing an all-zero TK. This fixes the earlier fix in commit ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the driver in EAPOL-Key 3/4 retry case') which did not take into account possibility of an extra message 1/4 showing up between retries of message 3/4. Change-Id: I6b5f6f2a1c0495575eb5a1576462768ddc89f09c Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
* Extend protection of GTK/IGTK reinstallation of WNM-Sleep Mode casesJouni Malinen2017-10-192-15/+40
| | | | | | | | | | | This extends the protection to track last configured GTK/IGTK value separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a corner case where these two different mechanisms may get used when the GTK/IGTK has changed and tracking a single value is not sufficient to detect a possible key reconfiguration. Change-Id: I6c377809a8590e7a6f2c1c87017d666b82602ad4 Signed-off-by: Jouni Malinen <j@w1.fi>
* Prevent reinstallation of an already in-use group keyMathy Vanhoef2017-10-193-44/+87
| | | | | | | | | | | Track the current GTK and IGTK that is in use and when receiving a (possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do not install the given key if it is already in use. This prevents an attacker from trying to trick the client into resetting or lowering the sequence counter associated to the group key. Change-Id: Ib0565e90e62115cc91ac36be3dae3b064e1baa1e Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
* hostapd: Avoid key reinstallation in FT handshakeMathy Vanhoef2017-10-194-0/+20
| | | | | | | | | | | | | | | | | | | Do not reinstall TK to the driver during Reassociation Response frame processing if the first attempt of setting the TK succeeded. This avoids issues related to clearing the TX/RX PN that could result in reusing same PN values for transmitted frames (e.g., due to CCM nonce reuse and also hitting replay protection on the receiver) and accepting replayed frames on RX side. This issue was introduced by the commit 0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in authenticator') which allowed wpa_ft_install_ptk() to be called multiple times with the same PTK. While the second configuration attempt is needed with some drivers, it must be done only if the first attempt failed. Change-Id: I45909184ad3dc8f3f608ce99ee853f3551323458 Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
* Set EAPOL-Key Key Length field to 0 for group message 1/2 in RSNJouni Malinen2017-10-191-2/+4
| | | | | | | | | | | | P802.11i/D3.0 described the Key Length as having value 16 for the group key handshake. However, this was changed to 0 in the published IEEE Std 802.11i-2004 amendment (and still remains 0 in the current standard IEEE Std 802.11-2016). We need to maintain the non-zero value for WPA (v1) cases, but the RSN case can be changed to 0 to be closer to the current standard. Change-Id: I96d654977f7e801a8993d017dad7465cc4aba758 Signed-off-by: Jouni Malinen <j@w1.fi>
* Merge branch 'wlan-service.lnx.1.0-rel.1.0' of ↵replicant-6.0-0002replicant-6.0-0001Steve Kondik2016-08-1516-14/+255
|\ | | | | | | | | | | git://codeaurora.org/platform/external/wpa_supplicant_8 into cm-13.0 Change-Id: I110d3aa8efe7861b7a5b0dd570bfe5b0ec88e6be
| * Promotion of wlan-service.lnx.1.0-00065.Linux Build Service Account2016-07-196-0/+52
| |\ | | | | | | | | | | | | | | | | | | | | | | | | CRs Change ID Subject -------------------------------------------------------------------------------------------------------------- 1003412 I033aced040c894f4dc4791c4e5081135976ebd0c Add assocresp_elements parameter for hostapd Change-Id: I5812f488605aead5802f58aa380483e646f557cd CRs-Fixed: 1003412
| | * Merge "Add assocresp_elements parameter for hostapd" into ↵Service qcabuildsw2016-07-136-0/+52
| | |\ | | | | | | | | | | | | wlan-service.lnx.1.0-dev.1.0
| | | * Add assocresp_elements parameter for hostapdBala Krishna Bhamidipati2016-07-056-0/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new parameter allows hostapd to add Vendor Specific elements into (Re)Association Response frames similarly to the way vendor_elements parameter can be used for Beacon and Probe Response frames. Git-commit: a9112270615dd68d422623ebc26c21a6887a2a11 Git-repo : git://w1.fi/srv/git/hostap.git Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Change-Id: I033aced040c894f4dc4791c4e5081135976ebd0c CRs-Fixed: 1003412
| * | | Promotion of wlan-service.lnx.1.0-00061.Linux Build Service Account2016-07-083-0/+117
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CRs Change ID Subject -------------------------------------------------------------------------------------------------------------- 979946 Ib3e11ee78cbe8e4d875d6c43dc2ec5539043fdb1 hostapd: Add Transmit Power Envelope IE when VHT is enab Change-Id: Idae67eff1883977e326d8f4a8d85993bf93d3d9a CRs-Fixed: 979946
| | * | hostapd: Add Transmit Power Envelope IE when VHT is enabledRajkumar Manoharan2016-07-083-0/+117
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add Transmit Power Envelope element defined in IEEE P802.11-REVmc/D4.3, 8.4.2.161. Git-commit: 3c417499e71b0c7f2dfae69fb1b67eb31e467ba6 Git-repo : git://w1.fi/srv/git/hostap.git CRs-Fixed: 979946 Change-Id: Ib3e11ee78cbe8e4d875d6c43dc2ec5539043fdb1 Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
| * | Promotion of wlan-service.lnx.1.0-00060.Linux Build Service Account2016-07-011-0/+2
| |\| | | | | | | | | | | | | | | | | | | | | | | | | CRs Change ID Subject -------------------------------------------------------------------------------------------------------------- 1002261 Ic045516f31520fbe8ba068c88fe247df1746f29a P2P: Continue p2p_find after sending non-success Invitat Change-Id: Ifebd671c03e9ebbd00a6be7c5fc1f30673743cf7 CRs-Fixed: 1002261
| | * P2P: Continue p2p_find after sending non-success Invitation ResponseJouni Malinen2016-07-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was previously handled for the case where the non-success Invitation Response frame was sent out during the Listen phase. However, in the case the Action frame TX ended up getting scheduled when the Search phase scan had already started (e.g., due to the driver reporting Invitation Request RX late enough for the Listen-to-Search transition having already started), the postponed Action frame TX status processing did not cover the specific case of non-success Invitation Response. This could result in the p2p_find operation getting stopped (stuck in SEARCH state) unexpectedly Fix this by calling p2p_check_after_scan_tx_continuation() from Invitation Response TX callback handler if the invitation was rejected. CRs-Fixed: 1002261 Git-commit: 3433721c5f9073c0d45c1109b825f1dcbabbf517 Git-repo : git://w1.fi/srv/git/hostap.git Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Change-Id: Ic045516f31520fbe8ba068c88fe247df1746f29a
| * | Promotion of wlan-service.lnx.1.0-00058.Linux Build Service Account2016-06-246-12/+92
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CRs Change ID Subject -------------------------------------------------------------------------------------------------------------- 1007548 I35e8483bdda5c391b95da42c2f577d5e9217f2e2 Remove newlines from wpa_supplicant config network outpu 1007548 Ibb1eeb6b727c27ecc4a2efce57f5394e98051061 Reject SET commands with newline characters in the strin 1007548 Ifa826eb7de2cba5458e8bb31dca3259cb37b4005 Reject psk parameter set with invalid passphrase charact 1007548 I2b439a72af08a744ce5bf74a05b2cac817fe5b05 WPS: Reject a Credential with invalid passphrase 1031991 I2934fbf676c803059e62ba2436c1181efb05a294 hostapd: Skip hostapd ACL check for drivers supporting A 1032710 Ibd9e3dc79cb1a7650b3adc55afdc95818a2e011b eap_proxy: postpone qmi init until demonize 1007548 Ib8222446297317f4e57bdb49597fdf6d19554886 Reject SET_CRED commands with newline characters in the Change-Id: I7955e55240d97be6022ffad8c2229b5896d9a33a CRs-Fixed: 1031991, 1007548, 1032710
| | * Merge "eap_proxy: postpone qmi init until demonize" into ↵Service qcabuildsw2016-06-241-7/+15
| | |\ | | | | | | | | | | | | wlan-service.lnx.1.0-dev.1.0
| | | * eap_proxy: postpone qmi init until demonizeBala Krishna Bhamidipati2016-06-231-7/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Parent thread exits when daemonize. This will cause child threads to die and eap_proxy_post_init is not executed To fix this, child thread should be created after demonize Change-Id: Ibd9e3dc79cb1a7650b3adc55afdc95818a2e011b CRs-Fixed: 1032710
| | * | Merge "Reject SET commands with newline characters in the string values" ↵Service qcabuildsw2016-06-241-0/+6
| | |\ \ | | | | | | | | | | | | | | | into wlan-service.lnx.1.0-dev.1.0
| | | * | Reject SET commands with newline characters in the string valuesJouni Malinen2016-05-301-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Many of the global configuration parameters are written as strings without filtering and if there is an embedded newline character in the value, unexpected configuration file data might be written. This fixes an issue where wpa_supplicant could have updated the configuration file global parameter with arbitrary data from the control interface or D-Bus interface. While those interfaces are supposed to be accessible only for trusted users/applications, it may be possible that an untrusted user has access to a management software component that does not validate the value of a parameter before passing it to wpa_supplicant. This could allow such an untrusted user to inject almost arbitrary data into the configuration file. Such configuration file could result in wpa_supplicant trying to load a library (e.g., opensc_engine_path, pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user controlled location when starting again. This would allow code from that library to be executed under the wpa_supplicant process privileges Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Git-commit: 2a3f56502b52375c3bf113cf92adfa99bad6b488 Git-repo: git://w1.fi/srv/git/hostap.git Change-Id: Ibb1eeb6b727c27ecc4a2efce57f5394e98051061 CRs-fixed: 1007548
| | * | | Merge "Reject SET_CRED commands with newline characters in the string ↵Service qcabuildsw2016-06-241-1/+8
| | |\| | | | | | | | | | | | | | | | | values" into wlan-service.lnx.1.0-dev.1.0
| | | * | Reject SET_CRED commands with newline characters in the string valuesJouni Malinen2016-05-301-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the cred block parameters are written as strings without filtering and if there is an embedded newline character in the value, unexpected configuration file data might be written. This fixes an issue where wpa_supplicant could have updated the configuration file cred parameter with arbitrary data from the control interface or D-Bus interface. While those interfaces are supposed to be accessible only for trusted users/applications, it may be possible that an untrusted user has access to a management software component that does not validate the credential value before passing it to wpa_supplicant. This could allow such an untrusted user to inject almost arbitrary data into the configuration file. Such configuration file could result in wpa_supplicant trying to load a library (e.g., opensc_engine_path, pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user controlled location when starting again. This would allow code from that library to be executed under the wpa_supplicant process privileges Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Git-commit: b166cd84a77a6717be9600bf95378a0055d6f5a5 Git-repo: git://w1.fi/srv/git/hostap.git Change-Id: Ib8222446297317f4e57bdb49597fdf6d19554886 CRs-fixed: 1007548
| | * | | Merge "Remove newlines from wpa_supplicant config network output" into ↵Service qcabuildsw2016-06-243-2/+25
| | |\| | | | | | | | | | | | | | | | | wlan-service.lnx.1.0-dev.1.0
| | | * | Remove newlines from wpa_supplicant config network outputPaul Stewart2016-05-303-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Spurious newlines output while writing the config file can corrupt the wpa_supplicant configuration. Avoid writing these for the network block parameters. This is a generic filter that cover cases that may not have been explicitly addressed with a more specific commit to avoid control characters in the psk parameter. Signed-off-by: Paul Stewart <pstew@google.com> Git-commit: 0fe5a234240a108b294a87174ad197f6b5cb38e9 Git-repo: git://w1.fi/srv/git/hostap.git Change-Id: I35e8483bdda5c391b95da42c2f577d5e9217f2e2 CRs-fixed: 1007548
| | * | | Merge "Reject psk parameter set with invalid passphrase character" into ↵Service qcabuildsw2016-06-241-0/+6
| | |\| | | | | | | | | | | | | | | | | wlan-service.lnx.1.0-dev.1.0
| | | * | Reject psk parameter set with invalid passphrase characterJouni Malinen2016-05-301-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WPA/WPA2-Personal passphrase is not allowed to include control characters. Reject a passphrase configuration attempt if that passphrase includes an invalid passphrase. This fixes an issue where wpa_supplicant could have updated the configuration file psk parameter with arbitrary data from the control interface or D-Bus interface. While those interfaces are supposed to be accessible only for trusted users/applications, it may be possible that an untrusted user has access to a management software component that does not validate the passphrase value before passing it to wpa_supplicant. This could allow such an untrusted user to inject up to 63 characters of almost arbitrary data into the configuration file. Such configuration file could result in wpa_supplicant trying to load a library (e.g., opensc_engine_path, pkcs11_engine_path, pkcs11_module_path, load_dynamic_eap) from user controlled location when starting again. This would allow code from that library to be executed under the wpa_supplicant process privileges. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Git-commit: 73e4abb24a936014727924d8b0b2965edfc117dd Git-repo: git://w1.fi/srv/git/hostap.git Change-Id: Ifa826eb7de2cba5458e8bb31dca3259cb37b4005 CRs-fixed: 1007548
| | * | | Merge "WPS: Reject a Credential with invalid passphrase" into ↵Service qcabuildsw2016-06-243-0/+23
| | |\| | | | | |/ | | |/| | | | | wlan-service.lnx.1.0-dev.1.0
| | | * WPS: Reject a Credential with invalid passphraseJouni Malinen2016-05-303-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WPA/WPA2-Personal passphrase is not allowed to include control characters. Reject a Credential received from a WPS Registrar both as STA (Credential) and AP (AP Settings) if the credential is for WPAPSK or WPA2PSK authentication type and includes an invalid passphrase. This fixes an issue where hostapd or wpa_supplicant could have updated the configuration file PSK/passphrase parameter with arbitrary data from an external device (Registrar) that may not be fully trusted. Should such data include a newline character, the resulting configuration file could become invalid and fail to be parsed. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Git-commit: ecbb0b3dc122b0d290987cf9c84010bbe53e1022 Git-repo: git://w1.fi/srv/git/hostap.git Change-Id: I2b439a72af08a744ce5bf74a05b2cac817fe5b05 CRs-fixed: 1007548
| | * | hostapd: Skip hostapd ACL check for drivers supporting ACL offloadSunil Dutt2016-06-201-2/+9
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 0603bcb7fe8babf183362518238c142afe8e2036 ('hostapd: Process MAC ACLs on a station association event (SME in driver)') processes MAC ACL on a station association event for drivers which use AP SME offload but does not consider the scenario where the drivers offload ACL. This can result in station disconnection, though the driver accepts the connection. Address this by avoiding the hostapd ACL check for the drivers offloading MAC ACL. CRs-Fixed: 1031991 Git-commit: bb4e19e3f4c9d1973279b3b768bc0539ee7cb962 Git-repo : git://w1.fi/srv/git/hostap.git Change-Id: I2934fbf676c803059e62ba2436c1181efb05a294 Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
* | | wpa_supplicant: Remove unnecessary QMI linkageSteve Kondik2016-08-081-1/+0
| | | | | | | | | | | | | | | | | | | | | * The QMI libraries are linked with the intermediate lib, we don't need to link them directly to the executable. Change-Id: Ifedf5c480af6b5f0309cd36da719e98ae3a69750
* | | Merge remote-tracking branch 'remotes/android-6.0.1_r52' into HEADJessica Wagantall2016-07-071-2/+12
|\ \ \ | | | | | | | | | | | | | | | | | | | | Ticket: CYNGNOS-3020 Change-Id: Id6463c0079b8456594f7661c39b41810291fb40b
| * | | Guard against return value already being nullPaul Stewart2016-03-251-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If there is no retrieved parameter, we should not de-reference null Bug: 27748546 Change-Id: I8e6ceba26ab7d73ab365b72c0bfdcdb0a36a59a7
| * | | Remove newlines from config outputPaul Stewart2016-03-251-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Spurious newlines output while writing the config file can corrupt the wpa_supplicant configuration. Avoid writing these. Bug: 27371366 Change-Id: I3bb99b8c46dba1c81cbccc76ed0cd01abc3ccef9
| * | | WNM: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in useJouni Malinen2015-12-011-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WNM Sleep Mode Response frame is used to update GTK/IGTK only if PMF is enabled. Verify that PMF is in use before using this field on station side to avoid accepting unauthenticated key updates. Bug: 25266660 Change-Id: Ib4b80f9c9e4aa5ea0b827c5202809c9660ad9b39 Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
* | | | wpa_supplicant: Cross-branch compilation fixeswpa-rebaseSteve Kondik2016-07-012-11/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Not all branches support the new QMI invocations, so add self-detection to deal with this. Change-Id: Iff2c060505727cefab62715baaf82394257122ce
* | | | wpa_supplicant_conf: Let devices provide their own templateRicardo Cerqueira2016-07-011-1/+1
| | | | | | | | | | | | | | | | Change-Id: I3a7806e0b4f407b8de646ed172cde37152d2f158
* | | | Fix dependenciesSteve Kondik2016-07-011-1/+1
| | | | | | | | | | | | | | | | Change-Id: I86c5e41e4d6987e432cb2f129ad585149228b04a
* | | | eap_proxy: Fix compilation warningSteve Kondik2016-07-011-4/+4
| | | | | | | | | | | | | | | | Change-Id: I1e0259aad8516c8eacf50de6313a558f01032ae4
* | | | wpa_supplicant: Force the p2p channels to reuse frequencies used by STADiogo Ferreira2016-07-014-1/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the mediatek platform the performance of p2p connections will degrade significantly if different frequences are used for STA and P2P. Change-Id: I8bd7e4a3f10177c99d273eccb88c8590fcbe3d34
* | | | eap: Don't force reassociation when getting the identity and handshakes are ↵Ricardo Cerqueira2016-07-011-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in progress This creates a race-condition between credentials management and association, often kicking the connection state into a loop. This does not apply if the EAP connection is proxied. Change-Id: Ie43612c6112438dbdacad2a0f585c11674f5b53d
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-23 13:21:28 +0000