From d4d57edfc028772b2cb5bb5dfa9ff58fab578b5b Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Fri, 16 Aug 2019 13:44:27 +0800 Subject: [PATCH] hostapd: fix multiple security problems --- package/network/services/hostapd/Config.in | 6 - package/network/services/hostapd/Makefile | 73 +-- .../hostapd/files/hostapd-basic.config | 380 ----------- .../hostapd/files/hostapd-full.config | 8 +- .../hostapd/files/hostapd-mini.config | 8 +- .../network/services/hostapd/files/hostapd.sh | 128 +--- .../services/hostapd/files/multicall.c | 0 .../hostapd/files/wpa_supplicant-basic.config | 598 ------------------ .../hostapd/files/wpa_supplicant-full.config | 29 +- .../hostapd/files/wpa_supplicant-mini.config | 29 +- .../hostapd/files/wpa_supplicant-p2p.config | 29 +- .../services/hostapd/files/wps-hotplug.sh | 59 +- ...e-undesired-logging-of-ACL-rejection.patch | 39 ++ ...-logging-priority-for-handle_auth_cb.patch | 28 + ...thenticated-encrypted-EAPOL-Key-data.patch | 43 ++ ...1-mesh-factor-out-mesh-join-function.patch | 2 +- ...2-mesh-factor-out-rsn-initialization.patch | 0 .../003-mesh-relocate-RSN-init-function.patch | 0 ...ompletion-callback-to-complete-mesh-.patch | 0 ...ountry-setting-to-mesh-configuration.patch | 0 ...rnel-driver-DFS-handler-in-userspace.patch | 4 +- ...annel-attributes-before-running-Mesh.patch | 0 ...ce-type-to-mesh-before-setting-inter.patch | 0 .../009-mesh-set-mesh-center-frequency.patch | 0 ...-mesh-interface-on-dfs-event-handler.patch | 20 +- ...hannels-to-be-selected-if-dfs-is-ena.patch | 16 +- ...-mesh-to-send-channel-switch-request.patch | 25 + ...-do-not-allow-pri-sec-channel-switch.patch | 0 ...ot-allow-scan-result-to-swap-pri-sec.patch | 8 +- ...sh-do-not-use-offchan-mgmt-tx-on-DFS.patch | 6 +- ...-fix-channel-switch-error-during-CAC.patch | 0 ...nterface-context-to-send-DFS-event-m.patch | 0 ...18-mesh-make-forwarding-configurable.patch | 22 +- ...x-crash-with-CONFIG_TAXONOMY-enabled.patch | 23 + ...CHANWIDTH_USE_HT-to-max_oper_chwidth.patch | 4 +- ...ent-use-of-VHT20-config-in-mesh-mode.patch | 8 +- ...mesh-fix-parsing-of-max_oper_chwidth.patch | 45 ++ ...EE80211X-y-build-without-CONFIG_FILS.patch | 33 - ...ix-race-condition-in-mesh-mpm-new-pe.patch | 34 - ...group-initialization-to-earlier-step.patch | 104 +++ ...AP-pwd-Mask-timing-of-PWE-derivation.patch | 247 ++++++++ ...tant-time-operations-for-private-big.patch | 88 +++ ...nctions-for-constant-time-operations.patch | 212 +++++++ ...tant-time-selection-for-crypto_bignu.patch | 55 ++ ...timing-differences-in-PWE-derivation.patch | 242 +++++++ ...anches-in-is_quadratic_residue_blind.patch | 139 ++++ ...-Mask-timing-of-MODP-groups-22-23-24.patch | 113 ++++ ...-const_time-selection-for-PWE-in-FFC.patch | 100 +++ ...-time-operations-in-sae_test_pwd_see.patch | 133 ++++ ...tant-time-and-memory-access-for-find.patch | 319 ++++++++++ ...rm-message-validation-in-error-cases.patch | 52 ++ ...r-Verify-received-scalar-and-element.patch | 53 ++ ...pwd-server-Detect-reflection-attacks.patch | 40 ++ ...t-Verify-received-scalar-and-element.patch | 53 ++ ...k-element-x-y-coordinates-explicitly.patch | 321 ++++++++++ ...erver-Fix-reassembly-buffer-handling.patch | 40 ++ ...-peer-Fix-reassembly-buffer-handling.patch | 40 ++ .../hostapd/patches/100-daemonize_fix.patch | 0 .../hostapd/patches/110-no_eapol_fix.patch | 2 +- ...120-disable_bridge_packet_workaround.patch | 0 .../hostapd/patches/200-multicall.patch | 18 +- .../services/hostapd/patches/300-noscan.patch | 4 +- .../hostapd/patches/301-mesh-noscan.patch | 6 +- .../patches/310-rescan_immediately.patch | 2 +- .../hostapd/patches/320-optional_rfkill.patch | 0 .../patches/330-nl80211_fix_set_freq.patch | 2 +- .../patches/340-reload_freq_change.patch | 8 +- .../341-mesh-ctrl-iface-channel-switch.patch | 39 -- .../patches/350-nl80211_del_beacon_bss.patch | 10 +- .../patches/360-ctrl_iface_reload.patch | 2 +- .../hostapd/patches/370-ap_sta_support.patch | 195 +----- .../patches/380-disable_ctrl_iface_mib.patch | 28 +- .../381-hostapd_cli_UNKNOWN-COMMAND.patch | 0 .../patches/390-wpa_ie_cap_workaround.patch | 4 +- .../400-wps_single_auth_enc_type.patch | 0 .../patches/410-limit_debug_messages.patch | 12 +- .../patches/420-indicate-features.patch | 0 .../patches/430-hostapd_cli_ifdef.patch | 0 .../hostapd/patches/431-wpa_cli_ifdef.patch | 0 .../hostapd/patches/432-missing-typedef.patch | 0 .../hostapd/patches/450-scan_wait.patch | 0 ...dd-new-config-params-to-be-used-with.patch | 8 +- ...-use-new-parameters-during-ibss-join.patch | 4 +- .../patches/463-add-mcast_rate-to-11s.patch | 6 +- .../patches/464-fix-mesh-obss-check.patch | 2 +- .../patches/470-survey_data_fallback.patch | 0 .../patches/500-lto-jobserver-support.patch | 50 -- ...ostapd-Add-Multi-AP-protocol-support.patch | 306 --------- ...dd-Multi-AP-protocol-support-to-supp.patch | 311 --------- .../552-tests-Multi-AP-association.patch | 100 --- .../553-tests-refactor-test_multi_ap.patch | 72 --- ...-reject-backhaul-STA-on-fronhaul-BSS.patch | 106 ---- ...a_ext-add-multi_ap_subelem-parameter.patch | 342 ---------- ...upport-Multi-AP-backhaul-STA-onboard.patch | 217 ------- ...ort-Multi-AP-backhaul-STA-onboarding.patch | 339 ---------- .../558-hostapd-add-README-MULTI-AP.patch | 181 ------ ...dd-WPS-tests-to-multi_ap-hwsim-tests.patch | 182 ------ .../hostapd/patches/600-ubus_support.patch | 137 +--- .../hostapd/patches/700-fix-openssl11.patch | 35 + .../services/hostapd/src/src/ap/ubus.c | 94 +-- .../services/hostapd/src/src/ap/ubus.h | 1 - .../hostapd/src/src/utils/build_features.h | 16 - .../hostapd/src/wpa_supplicant/ubus.c | 265 -------- .../hostapd/src/wpa_supplicant/ubus.h | 53 -- 104 files changed, 2815 insertions(+), 4402 deletions(-) mode change 100755 => 100644 package/network/services/hostapd/Config.in mode change 100755 => 100644 package/network/services/hostapd/Makefile delete mode 100755 package/network/services/hostapd/files/hostapd-basic.config mode change 100755 => 100644 package/network/services/hostapd/files/hostapd-full.config mode change 100755 => 100644 package/network/services/hostapd/files/hostapd-mini.config mode change 100755 => 100644 package/network/services/hostapd/files/hostapd.sh mode change 100755 => 100644 package/network/services/hostapd/files/multicall.c delete mode 100755 package/network/services/hostapd/files/wpa_supplicant-basic.config mode change 100755 => 100644 package/network/services/hostapd/files/wpa_supplicant-full.config mode change 100755 => 100644 package/network/services/hostapd/files/wpa_supplicant-mini.config mode change 100755 => 100644 package/network/services/hostapd/files/wpa_supplicant-p2p.config mode change 100755 => 100644 package/network/services/hostapd/files/wps-hotplug.sh create mode 100644 package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch create mode 100644 package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch create mode 100644 package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch mode change 100755 => 100644 package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch mode change 100755 => 100644 package/network/services/hostapd/patches/002-mesh-factor-out-rsn-initialization.patch mode change 100755 => 100644 package/network/services/hostapd/patches/003-mesh-relocate-RSN-init-function.patch mode change 100755 => 100644 package/network/services/hostapd/patches/004-mesh-use-setup-completion-callback-to-complete-mesh-.patch mode change 100755 => 100644 package/network/services/hostapd/patches/005-mesh-reflect-country-setting-to-mesh-configuration.patch mode change 100755 => 100644 package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch mode change 100755 => 100644 package/network/services/hostapd/patches/007-mesh-apply-channel-attributes-before-running-Mesh.patch mode change 100755 => 100644 package/network/services/hostapd/patches/008-mesh-set-interface-type-to-mesh-before-setting-inter.patch mode change 100755 => 100644 package/network/services/hostapd/patches/009-mesh-set-mesh-center-frequency.patch mode change 100755 => 100644 package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch mode change 100755 => 100644 package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch create mode 100644 package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch mode change 100755 => 100644 package/network/services/hostapd/patches/013-mesh-do-not-allow-pri-sec-channel-switch.patch mode change 100755 => 100644 package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch mode change 100755 => 100644 package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch mode change 100755 => 100644 package/network/services/hostapd/patches/016-mesh-fix-channel-switch-error-during-CAC.patch mode change 100755 => 100644 package/network/services/hostapd/patches/017-mesh-use-right-interface-context-to-send-DFS-event-m.patch mode change 100755 => 100644 package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch create mode 100644 package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch mode change 100755 => 100644 package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch mode change 100755 => 100644 package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch create mode 100644 package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch delete mode 100755 package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch delete mode 100755 package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch create mode 100644 package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch create mode 100644 package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch create mode 100644 package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch create mode 100644 package/network/services/hostapd/patches/061-0002-Add-helper-functions-for-constant-time-operations.patch create mode 100644 package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch create mode 100644 package/network/services/hostapd/patches/061-0005-SAE-Minimize-timing-differences-in-PWE-derivation.patch create mode 100644 package/network/services/hostapd/patches/061-0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch create mode 100644 package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch create mode 100644 package/network/services/hostapd/patches/061-0008-SAE-Use-const_time-selection-for-PWE-in-FFC.patch create mode 100644 package/network/services/hostapd/patches/061-0009-SAE-Use-constant-time-operations-in-sae_test_pwd_see.patch create mode 100644 package/network/services/hostapd/patches/062-0004-EAP-pwd-Use-constant-time-and-memory-access-for-find.patch create mode 100644 package/network/services/hostapd/patches/063-0010-SAE-Fix-confirm-message-validation-in-error-cases.patch create mode 100644 package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch create mode 100644 package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch create mode 100644 package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch create mode 100644 package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch create mode 100644 package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch create mode 100644 package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch mode change 100755 => 100644 package/network/services/hostapd/patches/100-daemonize_fix.patch mode change 100755 => 100644 package/network/services/hostapd/patches/110-no_eapol_fix.patch mode change 100755 => 100644 package/network/services/hostapd/patches/120-disable_bridge_packet_workaround.patch mode change 100755 => 100644 package/network/services/hostapd/patches/200-multicall.patch mode change 100755 => 100644 package/network/services/hostapd/patches/300-noscan.patch mode change 100755 => 100644 package/network/services/hostapd/patches/301-mesh-noscan.patch mode change 100755 => 100644 package/network/services/hostapd/patches/310-rescan_immediately.patch mode change 100755 => 100644 package/network/services/hostapd/patches/320-optional_rfkill.patch mode change 100755 => 100644 package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch mode change 100755 => 100644 package/network/services/hostapd/patches/340-reload_freq_change.patch delete mode 100755 package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch mode change 100755 => 100644 package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch mode change 100755 => 100644 package/network/services/hostapd/patches/360-ctrl_iface_reload.patch mode change 100755 => 100644 package/network/services/hostapd/patches/370-ap_sta_support.patch mode change 100755 => 100644 package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch mode change 100755 => 100644 package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch mode change 100755 => 100644 package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch mode change 100755 => 100644 package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch mode change 100755 => 100644 package/network/services/hostapd/patches/410-limit_debug_messages.patch mode change 100755 => 100644 package/network/services/hostapd/patches/420-indicate-features.patch mode change 100755 => 100644 package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch mode change 100755 => 100644 package/network/services/hostapd/patches/431-wpa_cli_ifdef.patch mode change 100755 => 100644 package/network/services/hostapd/patches/432-missing-typedef.patch mode change 100755 => 100644 package/network/services/hostapd/patches/450-scan_wait.patch mode change 100755 => 100644 package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch mode change 100755 => 100644 package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch mode change 100755 => 100644 package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch mode change 100755 => 100644 package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch mode change 100755 => 100644 package/network/services/hostapd/patches/470-survey_data_fallback.patch delete mode 100755 package/network/services/hostapd/patches/500-lto-jobserver-support.patch delete mode 100755 package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch delete mode 100755 package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch delete mode 100755 package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch delete mode 100755 package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch delete mode 100755 package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch delete mode 100755 package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch delete mode 100755 package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch delete mode 100755 package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch delete mode 100755 package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch delete mode 100755 package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch mode change 100755 => 100644 package/network/services/hostapd/patches/600-ubus_support.patch create mode 100644 package/network/services/hostapd/patches/700-fix-openssl11.patch mode change 100755 => 100644 package/network/services/hostapd/src/src/ap/ubus.c mode change 100755 => 100644 package/network/services/hostapd/src/src/ap/ubus.h mode change 100755 => 100644 package/network/services/hostapd/src/src/utils/build_features.h delete mode 100755 package/network/services/hostapd/src/wpa_supplicant/ubus.c delete mode 100755 package/network/services/hostapd/src/wpa_supplicant/ubus.h diff --git a/package/network/services/hostapd/Config.in b/package/network/services/hostapd/Config.in old mode 100755 new mode 100644 index 578fba839c..222cfb7f13 --- a/package/network/services/hostapd/Config.in +++ b/package/network/services/hostapd/Config.in @@ -6,13 +6,11 @@ config WPA_SUPPLICANT_NO_TIMESTAMP_CHECK PACKAGE_wpa-supplicant-wolfssl || \ PACKAGE_wpa-supplicant-mesh-openssl || \ PACKAGE_wpa-supplicant-mesh-wolfssl || \ - PACKAGE_wpa-supplicant-basic || \ PACKAGE_wpa-supplicant-mini || \ PACKAGE_wpa-supplicant-p2p || \ PACKAGE_wpad || \ PACKAGE_wpad-openssl || \ PACKAGE_wpad-wolfssl || \ - PACKAGE_wpad-basic || \ PACKAGE_wpad-mini || \ PACKAGE_wpad-mesh-openssl || \ PACKAGE_wpad-mesh-wolfssl @@ -28,13 +26,11 @@ config WPA_RFKILL_SUPPORT PACKAGE_wpa-supplicant-wolfssl || \ PACKAGE_wpa-supplicant-mesh-openssl || \ PACKAGE_wpa-supplicant-mesh-wolfssl || \ - PACKAGE_wpa-supplicant-basic || \ PACKAGE_wpa-supplicant-mini || \ PACKAGE_wpa-supplicant-p2p || \ PACKAGE_wpad || \ PACKAGE_wpad-openssl || \ PACKAGE_wpad-wolfssl || \ - PACKAGE_wpad-basic || \ PACKAGE_wpad-mini || \ PACKAGE_wpad-mesh-openssl || \ PACKAGE_wpad-mesh-wolfssl @@ -47,13 +43,11 @@ config WPA_MSG_MIN_PRIORITY PACKAGE_wpa-supplicant-wolfssl || \ PACKAGE_wpa-supplicant-mesh-openssl || \ PACKAGE_wpa-supplicant-mesh-wolfssl || \ - PACKAGE_wpa-supplicant-basic || \ PACKAGE_wpa-supplicant-mini || \ PACKAGE_wpa-supplicant-p2p || \ PACKAGE_wpad || \ PACKAGE_wpad-openssl || \ PACKAGE_wpad-wolfssl || \ - PACKAGE_wpad-basic || \ PACKAGE_wpad-mini || \ PACKAGE_wpad-mesh-openssl || \ PACKAGE_wpad-mesh-wolfssl diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile old mode 100755 new mode 100644 index f531e660ff..b548ecdf1b --- a/package/network/services/hostapd/Makefile +++ b/package/network/services/hostapd/Makefile @@ -7,13 +7,13 @@ include $(TOPDIR)/rules.mk PKG_NAME:=hostapd -PKG_RELEASE:=2 +PKG_RELEASE:=6 PKG_SOURCE_URL:=http://w1.fi/hostap.git PKG_SOURCE_PROTO:=git -PKG_SOURCE_DATE:=2018-12-02 -PKG_SOURCE_VERSION:=c2c6c01bb8b6fafc2074b46a53c4eab2c145ac6f -PKG_MIRROR_HASH:=d381123fe42059b553d96122a03c35e7d1709153c3aaf10fa4e74fe59be243dd +PKG_SOURCE_DATE:=2018-05-21 +PKG_SOURCE_VERSION:=62566bc23d041e88f8e35933d5fd8c2fd0f7cf2a +PKG_MIRROR_HASH:=f234b24f9471ae9cb34460feec6d6614641691544101535673595272c91448eb PKG_MAINTAINER:=Felix Fietkau PKG_LICENSE:=BSD-3-Clause @@ -26,7 +26,6 @@ PKG_CONFIG_DEPENDS:= \ CONFIG_PACKAGE_kmod-ath9k \ CONFIG_PACKAGE_kmod-cfg80211 \ CONFIG_PACKAGE_hostapd \ - CONFIG_PACKAGE_hostapd-basic \ CONFIG_PACKAGE_hostapd-mini \ CONFIG_WPA_RFKILL_SUPPORT \ CONFIG_DRIVER_WEXT_SUPPORT \ @@ -96,17 +95,13 @@ ifeq ($(LOCAL_VARIANT),full) DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT) endif -ifeq ($(LOCAL_VARIANT),basic) - DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT) -endif - ifeq ($(LOCAL_VARIANT),full) ifeq ($(SSL_VARIANT),openssl) - DRIVER_MAKEOPTS += CONFIG_TLS=openssl CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y + DRIVER_MAKEOPTS += CONFIG_TLS=openssl TARGET_LDFLAGS += -lcrypto -lssl endif ifeq ($(SSL_VARIANT),wolfssl) - DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1 CONFIG_SAE=y CONFIG_OWE=y CONFIG_SUITEB192=y + DRIVER_MAKEOPTS += CONFIG_TLS=wolfssl CONFIG_WPS_NFC=1 TARGET_LDFLAGS += -lwolfssl endif endif @@ -181,16 +176,6 @@ endef Package/hostapd-wolfssl/description = $(Package/hostapd/description) -define Package/hostapd-basic -$(call Package/hostapd/Default,$(1)) - TITLE+= (WPA-PSK, 11r and 11w) - VARIANT:=basic -endef - -define Package/hostapd-basic/description - This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support. -endef - define Package/hostapd-mini $(call Package/hostapd/Default,$(1)) TITLE+= (WPA-PSK only) @@ -243,16 +228,6 @@ endef Package/wpad-wolfssl/description = $(Package/wpad/description) -define Package/wpad-basic -$(call Package/wpad/Default,$(1)) - TITLE+= (WPA-PSK, 11r and 11w) - VARIANT:=wpad-basic -endef - -define Package/wpad-basic/description - This package contains a basic IEEE 802.1x/WPA Authenticator and Supplicant with WPA-PSK, 802.11r and 802.11w support. -endef - define Package/wpad-mini $(call Package/wpad/Default,$(1)) TITLE+= (WPA-PSK only) @@ -296,7 +271,7 @@ define Package/wpa-supplicant/Default CATEGORY:=Network TITLE:=WPA Supplicant URL:=http://hostap.epitest.fi/wpa_supplicant/ - DEPENDS:=$(DRV_DEPENDS) +hostapd-common +libubus + DEPENDS:=$(DRV_DEPENDS) PROVIDES:=wpa-supplicant CONFLICTS:=$(SUPPLICANT_PROVIDERS) SUPPLICANT_PROVIDERS+=$(1) @@ -349,12 +324,6 @@ $(call Package/wpa-supplicant-mesh/Default,$(1)) DEPENDS+=+libwolfssl endef -define Package/wpa-supplicant-basic -$(call Package/wpa-supplicant/Default,$(1)) - TITLE+= (with 11r and 11w) - VARIANT:=supplicant-basic -endef - define Package/wpa-supplicant-mini $(call Package/wpa-supplicant/Default,$(1)) TITLE+= (minimal version) @@ -393,7 +362,7 @@ define Package/eapol-test SECTION:=net CATEGORY:=Network VARIANT:=supplicant-full-internal - DEPENDS:=$(DRV_DEPENDS) +libubus + DEPENDS:=$(DRV_DEPENDS) endef define Package/eapol-test-openssl @@ -402,7 +371,7 @@ define Package/eapol-test-openssl CATEGORY:=Network VARIANT:=supplicant-full-openssl CONFLICTS:=$(filter-out eapol-test-openssl ,$(EAPOL_TEST_PROVIDERS)) - DEPENDS:=$(DRV_DEPENDS) +libubus +libopenssl + DEPENDS:=$(DRV_DEPENDS) +libopenssl PROVIDES:=eapol-test endef @@ -412,7 +381,7 @@ define Package/eapol-test-wolfssl CATEGORY:=Network VARIANT:=supplicant-full-wolfssl CONFLICTS:=$(filter-out eapol-test-openssl ,$(filter-out eapol-test-wolfssl ,$(EAPOL_TEST_PROVIDERS))) - DEPENDS:=$(DRV_DEPENDS) +libubus +libwolfssl + DEPENDS:=$(DRV_DEPENDS) +libwolfssl PROVIDES:=eapol-test endef @@ -443,8 +412,11 @@ TARGET_CPPFLAGS := \ -D_GNU_SOURCE \ $(if $(CONFIG_WPA_MSG_MIN_PRIORITY),-DCONFIG_MSG_MIN_PRIORITY=$(CONFIG_WPA_MSG_MIN_PRIORITY)) -TARGET_CFLAGS += -ffunction-sections -fdata-sections -flto -TARGET_LDFLAGS += -Wl,--gc-sections -flto=jobserver -fuse-linker-plugin -lubox -lubus +TARGET_CFLAGS += -ffunction-sections -fdata-sections +TARGET_LDFLAGS += -Wl,--gc-sections +ifeq ($(findstring supplicant,$(BUILD_VARIANT)),) + TARGET_LDFLAGS += -lubox -lubus +endif ifdef CONFIG_PACKAGE_kmod-cfg80211 TARGET_LDFLAGS += -lm -lnl-tiny @@ -457,7 +429,6 @@ define Build/RunMake $(DRIVER_MAKEOPTS) \ LIBS="$(TARGET_LDFLAGS)" \ LIBS_c="$(TARGET_LDFLAGS_C)" \ - AR="$(TARGET_CROSS)gcc-ar" \ BCHECK= \ $(2) endef @@ -479,7 +450,7 @@ define Build/Compile/wpad MULTICALL=1 \ wpa_cli wpa_supplicant_multi.a \ ) - +export MAKEFLAGS="$(MAKE_JOBSERVER)"; $(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \ + $(TARGET_CC) -o $(PKG_BUILD_DIR)/wpad \ $(TARGET_CFLAGS) \ ./files/multicall.c \ $(PKG_BUILD_DIR)/hostapd/hostapd_multi.a \ @@ -531,24 +502,23 @@ define Install/supplicant endef define Package/hostapd-common/install - $(INSTALL_DIR) $(1)/lib/netifd $(1)/etc/rc.button + $(INSTALL_DIR) $(1)/lib/netifd $(INSTALL_DATA) ./files/hostapd.sh $(1)/lib/netifd/hostapd.sh - $(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps endef define Package/hostapd/install $(call Install/hostapd,$(1)) $(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd $(1)/usr/sbin/ endef -Package/hostapd-basic/install = $(Package/hostapd/install) Package/hostapd-mini/install = $(Package/hostapd/install) Package/hostapd-openssl/install = $(Package/hostapd/install) Package/hostapd-wolfssl/install = $(Package/hostapd/install) ifneq ($(LOCAL_TYPE),supplicant) define Package/hostapd-utils/install - $(INSTALL_DIR) $(1)/usr/sbin + $(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/rc.button $(INSTALL_BIN) $(PKG_BUILD_DIR)/hostapd/hostapd_cli $(1)/usr/sbin/ + $(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps endef endif @@ -559,7 +529,6 @@ define Package/wpad/install $(LN) wpad $(1)/usr/sbin/hostapd $(LN) wpad $(1)/usr/sbin/wpa_supplicant endef -Package/wpad-basic/install = $(Package/wpad/install) Package/wpad-mini/install = $(Package/wpad/install) Package/wpad-openssl/install = $(Package/wpad/install) Package/wpad-wolfssl/install = $(Package/wpad/install) @@ -570,7 +539,6 @@ define Package/wpa-supplicant/install $(call Install/supplicant,$(1)) $(INSTALL_BIN) $(PKG_BUILD_DIR)/wpa_supplicant/wpa_supplicant $(1)/usr/sbin/ endef -Package/wpa-supplicant-basic/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-mini/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-p2p/install = $(Package/wpa-supplicant/install) Package/wpa-supplicant-openssl/install = $(Package/wpa-supplicant/install) @@ -607,21 +575,18 @@ ifeq ($(BUILD_VARIANT),supplicant-full-wolfssl) endif $(eval $(call BuildPackage,hostapd)) -$(eval $(call BuildPackage,hostapd-basic)) $(eval $(call BuildPackage,hostapd-mini)) $(eval $(call BuildPackage,hostapd-openssl)) $(eval $(call BuildPackage,hostapd-wolfssl)) $(eval $(call BuildPackage,wpad)) $(eval $(call BuildPackage,wpad-mesh-openssl)) $(eval $(call BuildPackage,wpad-mesh-wolfssl)) -$(eval $(call BuildPackage,wpad-basic)) $(eval $(call BuildPackage,wpad-mini)) $(eval $(call BuildPackage,wpad-openssl)) $(eval $(call BuildPackage,wpad-wolfssl)) $(eval $(call BuildPackage,wpa-supplicant)) $(eval $(call BuildPackage,wpa-supplicant-mesh-openssl)) $(eval $(call BuildPackage,wpa-supplicant-mesh-wolfssl)) -$(eval $(call BuildPackage,wpa-supplicant-basic)) $(eval $(call BuildPackage,wpa-supplicant-mini)) $(eval $(call BuildPackage,wpa-supplicant-p2p)) $(eval $(call BuildPackage,wpa-supplicant-openssl)) diff --git a/package/network/services/hostapd/files/hostapd-basic.config b/package/network/services/hostapd/files/hostapd-basic.config deleted file mode 100755 index b15116fbbe..0000000000 --- a/package/network/services/hostapd/files/hostapd-basic.config +++ /dev/null @@ -1,380 +0,0 @@ -# Example hostapd build time configuration -# -# This file lists the configuration options that are used when building the -# hostapd binary. All lines starting with # are ignored. Configuration option -# lines must be commented out complete, if they are not to be included, i.e., -# just setting VARIABLE=n is not disabling that variable. -# -# This file is included in Makefile, so variables like CFLAGS and LIBS can also -# be modified from here. In most cass, these lines should use += in order not -# to override previous values of the variables. - -# Driver interface for Host AP driver -#CONFIG_DRIVER_HOSTAP=y - -# Driver interface for wired authenticator -CONFIG_DRIVER_WIRED=y - -# Driver interface for drivers using the nl80211 kernel interface -CONFIG_DRIVER_NL80211=y - -# QCA vendor extensions to nl80211 -#CONFIG_DRIVER_NL80211_QCA=y - -# driver_nl80211.c requires libnl. If you are compiling it yourself -# you may need to point hostapd to your version of libnl. -# -#CFLAGS += -I$ -#LIBS += -L$ - -# Use libnl v2.0 (or 3.0) libraries. -#CONFIG_LIBNL20=y - -# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored) -#CONFIG_LIBNL32=y - - -# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver) -#CONFIG_DRIVER_BSD=y -#CFLAGS += -I/usr/local/include -#LIBS += -L/usr/local/lib -#LIBS_p += -L/usr/local/lib -#LIBS_c += -L/usr/local/lib - -# Driver interface for no driver (e.g., RADIUS server only) -#CONFIG_DRIVER_NONE=y - -# IEEE 802.11F/IAPP -#CONFIG_IAPP=y - -# WPA2/IEEE 802.11i RSN pre-authentication -CONFIG_RSN_PREAUTH=y - -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=y - -# IEEE 802.11w (management frame protection) -# Driver support is also needed for IEEE 802.11w. -#CONFIG_IEEE80211W=y - -# Integrated EAP server -#CONFIG_EAP=y - -# EAP Re-authentication Protocol (ERP) in integrated EAP server -#CONFIG_ERP=y - -# EAP-MD5 for the integrated EAP server -#CONFIG_EAP_MD5=y - -# EAP-TLS for the integrated EAP server -#CONFIG_EAP_TLS=y - -# EAP-MSCHAPv2 for the integrated EAP server -#CONFIG_EAP_MSCHAPV2=y - -# EAP-PEAP for the integrated EAP server -#CONFIG_EAP_PEAP=y - -# EAP-GTC for the integrated EAP server -#CONFIG_EAP_GTC=y - -# EAP-TTLS for the integrated EAP server -#CONFIG_EAP_TTLS=y - -# EAP-SIM for the integrated EAP server -#CONFIG_EAP_SIM=y - -# EAP-AKA for the integrated EAP server -#CONFIG_EAP_AKA=y - -# EAP-AKA' for the integrated EAP server -# This requires CONFIG_EAP_AKA to be enabled, too. -#CONFIG_EAP_AKA_PRIME=y - -# EAP-PAX for the integrated EAP server -#CONFIG_EAP_PAX=y - -# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK) -#CONFIG_EAP_PSK=y - -# EAP-pwd for the integrated EAP server (secure authentication with a password) -#CONFIG_EAP_PWD=y - -# EAP-SAKE for the integrated EAP server -#CONFIG_EAP_SAKE=y - -# EAP-GPSK for the integrated EAP server -#CONFIG_EAP_GPSK=y -# Include support for optional SHA256 cipher suite in EAP-GPSK -#CONFIG_EAP_GPSK_SHA256=y - -# EAP-FAST for the integrated EAP server -# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed -# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g., -# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions. -#CONFIG_EAP_FAST=y - -# Wi-Fi Protected Setup (WPS) -#CONFIG_WPS=y -# Enable UPnP support for external WPS Registrars -#CONFIG_WPS_UPNP=y -# Enable WPS support with NFC config method -#CONFIG_WPS_NFC=y - -# EAP-IKEv2 -#CONFIG_EAP_IKEV2=y - -# Trusted Network Connect (EAP-TNC) -#CONFIG_EAP_TNC=y - -# EAP-EKE for the integrated EAP server -#CONFIG_EAP_EKE=y - -# PKCS#12 (PFX) support (used to read private key and certificate file from -# a file that usually has extension .p12 or .pfx) -#CONFIG_PKCS12=y - -# RADIUS authentication server. This provides access to the integrated EAP -# server from external hosts using RADIUS. -#CONFIG_RADIUS_SERVER=y - -# Build IPv6 support for RADIUS operations -#CONFIG_IPV6=y - -# IEEE Std 802.11r-2008 (Fast BSS Transition) -CONFIG_IEEE80211R=y - -# Use the hostapd's IEEE 802.11 authentication (ACL), but without -# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211) -#CONFIG_DRIVER_RADIUS_ACL=y - -# IEEE 802.11n (High Throughput) support -CONFIG_IEEE80211N=y - -# Wireless Network Management (IEEE Std 802.11v-2011) -# Note: This is experimental and not complete implementation. -#CONFIG_WNM=y - -# IEEE 802.11ac (Very High Throughput) support -CONFIG_IEEE80211AC=y - -# IEEE 802.11ax HE support -# Note: This is experimental and work in progress. The definitions are still -# subject to change and this should not be expected to interoperate with the -# final IEEE 802.11ax version. -#CONFIG_IEEE80211AX=y - -# Remove debugging code that is printing out debug messages to stdout. -# This can be used to reduce the size of the hostapd considerably if debugging -# code is not needed. -#CONFIG_NO_STDOUT_DEBUG=y - -# Add support for writing debug log to a file: -f /tmp/hostapd.log -# Disabled by default. -#CONFIG_DEBUG_FILE=y - -# Send debug messages to syslog instead of stdout -CONFIG_DEBUG_SYSLOG=y - -# Add support for sending all debug messages (regardless of debug verbosity) -# to the Linux kernel tracing facility. This helps debug the entire stack by -# making it easy to record everything happening from the driver up into the -# same file, e.g., using trace-cmd. -#CONFIG_DEBUG_LINUX_TRACING=y - -# Remove support for RADIUS accounting -CONFIG_NO_ACCOUNTING=y - -# Remove support for RADIUS -CONFIG_NO_RADIUS=y - -# Remove support for VLANs -#CONFIG_NO_VLAN=y - -# Enable support for fully dynamic VLANs. This enables hostapd to -# automatically create bridge and VLAN interfaces if necessary. -#CONFIG_FULL_DYNAMIC_VLAN=y - -# Use netlink-based kernel API for VLAN operations instead of ioctl() -# Note: This requires libnl 3.1 or newer. -#CONFIG_VLAN_NETLINK=y - -# Remove support for dumping internal state through control interface commands -# This can be used to reduce binary size at the cost of disabling a debugging -# option. -CONFIG_NO_DUMP_STATE=y - -# Enable tracing code for developer debugging -# This tracks use of memory allocations and other registrations and reports -# incorrect use with a backtrace of call (or allocation) location. -#CONFIG_WPA_TRACE=y -# For BSD, comment out these. -#LIBS += -lexecinfo -#LIBS_p += -lexecinfo -#LIBS_c += -lexecinfo - -# Use libbfd to get more details for developer debugging -# This enables use of libbfd to get more detailed symbols for the backtraces -# generated by CONFIG_WPA_TRACE=y. -#CONFIG_WPA_TRACE_BFD=y -# For BSD, comment out these. -#LIBS += -lbfd -liberty -lz -#LIBS_p += -lbfd -liberty -lz -#LIBS_c += -lbfd -liberty -lz - -# hostapd depends on strong random number generation being available from the -# operating system. os_get_random() function is used to fetch random data when -# needed, e.g., for key generation. On Linux and BSD systems, this works by -# reading /dev/urandom. It should be noted that the OS entropy pool needs to be -# properly initialized before hostapd is started. This is important especially -# on embedded devices that do not have a hardware random number generator and -# may by default start up with minimal entropy available for random number -# generation. -# -# As a safety net, hostapd is by default trying to internally collect -# additional entropy for generating random data to mix in with the data -# fetched from the OS. This by itself is not considered to be very strong, but -# it may help in cases where the system pool is not initialized properly. -# However, it is very strongly recommended that the system pool is initialized -# with enough entropy either by using hardware assisted random number -# generator or by storing state over device reboots. -# -# hostapd can be configured to maintain its own entropy store over restarts to -# enhance random number generation. This is not perfect, but it is much more -# secure than using the same sequence of random numbers after every reboot. -# This can be enabled with -e command line option. The specified -# file needs to be readable and writable by hostapd. -# -# If the os_get_random() is known to provide strong random data (e.g., on -# Linux/BSD, the board in question is known to have reliable source of random -# data from /dev/urandom), the internal hostapd random pool can be disabled. -# This will save some in binary size and CPU use. However, this should only be -# considered for builds that are known to be used on devices that meet the -# requirements described above. -CONFIG_NO_RANDOM_POOL=y - -# Should we use poll instead of select? Select is used by default. -#CONFIG_ELOOP_POLL=y - -# Should we use epoll instead of select? Select is used by default. -#CONFIG_ELOOP_EPOLL=y - -# Should we use kqueue instead of select? Select is used by default. -#CONFIG_ELOOP_KQUEUE=y - -# Select TLS implementation -# openssl = OpenSSL (default) -# gnutls = GnuTLS -# internal = Internal TLSv1 implementation (experimental) -# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental) -# none = Empty template -CONFIG_TLS=internal - -# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1) -# can be enabled to get a stronger construction of messages when block ciphers -# are used. -#CONFIG_TLSV11=y - -# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2) -# can be enabled to enable use of stronger crypto algorithms. -#CONFIG_TLSV12=y - -# Select which ciphers to use by default with OpenSSL if the user does not -# specify them. -#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW" - -# If CONFIG_TLS=internal is used, additional library and include paths are -# needed for LibTomMath. Alternatively, an integrated, minimal version of -# LibTomMath can be used. See beginning of libtommath.c for details on benefits -# and drawbacks of this option. -#CONFIG_INTERNAL_LIBTOMMATH=y -#ifndef CONFIG_INTERNAL_LIBTOMMATH -#LTM_PATH=/usr/src/libtommath-0.39 -#CFLAGS += -I$(LTM_PATH) -#LIBS += -L$(LTM_PATH) -#LIBS_p += -L$(LTM_PATH) -#endif -# At the cost of about 4 kB of additional binary size, the internal LibTomMath -# can be configured to include faster routines for exptmod, sqr, and div to -# speed up DH and RSA calculation considerably -#CONFIG_INTERNAL_LIBTOMMATH_FAST=y - -# Interworking (IEEE 802.11u) -# This can be used to enable functionality to improve interworking with -# external networks. -#CONFIG_INTERWORKING=y - -# Hotspot 2.0 -#CONFIG_HS20=y - -# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file -#CONFIG_SQLITE=y - -# Enable Fast Session Transfer (FST) -#CONFIG_FST=y - -# Enable CLI commands for FST testing -#CONFIG_FST_TEST=y - -# Testing options -# This can be used to enable some testing options (see also the example -# configuration file) that are really useful only for testing clients that -# connect to this hostapd. These options allow, for example, to drop a -# certain percentage of probe requests or auth/(re)assoc frames. -# -#CONFIG_TESTING_OPTIONS=y - -# Automatic Channel Selection -# This will allow hostapd to pick the channel automatically when channel is set -# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in -# similar way. -# -# Automatic selection is currently only done through initialization, later on -# we hope to do background checks to keep us moving to more ideal channels as -# time goes by. ACS is currently only supported through the nl80211 driver and -# your driver must have survey dump capability that is filled by the driver -# during scanning. -# -# You can customize the ACS survey algorithm with the hostapd.conf variable -# acs_num_scans. -# -# Supported ACS drivers: -# * ath9k -# * ath5k -# * ath10k -# -# For more details refer to: -# http://wireless.kernel.org/en/users/Documentation/acs -# -#CONFIG_ACS=y - -# Multiband Operation support -# These extentions facilitate efficient use of multiple frequency bands -# available to the AP and the devices that may associate with it. -#CONFIG_MBO=y - -# Client Taxonomy -# Has the AP retain the Probe Request and (Re)Association Request frames from -# a client, from which a signature can be produced which can identify the model -# of client device like "Nexus 6P" or "iPhone 5s". -#CONFIG_TAXONOMY=y - -# Fast Initial Link Setup (FILS) (IEEE 802.11ai) -# Note: This is an experimental and not yet complete implementation. This -# should not be enabled for production use. -#CONFIG_FILS=y -# FILS shared key authentication with PFS -#CONFIG_FILS_SK_PFS=y - -# Include internal line edit mode in hostapd_cli. This can be used to provide -# limited command line editing and history support. -#CONFIG_WPA_CLI_EDIT=y - -# Opportunistic Wireless Encryption (OWE) -# Experimental implementation of draft-harkins-owe-07.txt -#CONFIG_OWE=y - -# uBus IPC/RPC System -# Services can connect to the bus and provide methods -# that can be called by other services or clients. -CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/hostapd-full.config b/package/network/services/hostapd/files/hostapd-full.config old mode 100755 new mode 100644 index b4159c2d28..355a70b9e1 --- a/package/network/services/hostapd/files/hostapd-full.config +++ b/package/network/services/hostapd/files/hostapd-full.config @@ -50,7 +50,11 @@ CONFIG_IAPP=y # WPA2/IEEE 802.11i RSN pre-authentication CONFIG_RSN_PREAUTH=y +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +CONFIG_PEERKEY=y + # IEEE 802.11w (management frame protection) +# Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y # Integrated EAP server @@ -370,10 +374,6 @@ CONFIG_TAXONOMY=y # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y -# Override default value for the wpa_disable_eapol_key_retries configuration -# parameter. See that parameter in hostapd.conf for more details. -#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1 - # uBus IPC/RPC System # Services can connect to the bus and provide methods # that can be called by other services or clients. diff --git a/package/network/services/hostapd/files/hostapd-mini.config b/package/network/services/hostapd/files/hostapd-mini.config old mode 100755 new mode 100644 index 9057658c16..661983a94b --- a/package/network/services/hostapd/files/hostapd-mini.config +++ b/package/network/services/hostapd/files/hostapd-mini.config @@ -50,7 +50,11 @@ CONFIG_DRIVER_NL80211=y # WPA2/IEEE 802.11i RSN pre-authentication CONFIG_RSN_PREAUTH=y +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +CONFIG_PEERKEY=y + # IEEE 802.11w (management frame protection) +# Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y # Integrated EAP server @@ -370,10 +374,6 @@ CONFIG_TLS=internal # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y -# Override default value for the wpa_disable_eapol_key_retries configuration -# parameter. See that parameter in hostapd.conf for more details. -#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1 - # uBus IPC/RPC System # Services can connect to the bus and provide methods # that can be called by other services or clients. diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh old mode 100755 new mode 100644 index 46acbefeee..7ffff4e7e1 --- a/package/network/services/hostapd/files/hostapd.sh +++ b/package/network/services/hostapd/files/hostapd.sh @@ -37,38 +37,11 @@ hostapd_append_wep_key() { } hostapd_append_wpa_key_mgmt() { - local auth_type_l="$(echo $auth_type | tr 'a-z' 'A-Z')" + local auth_type="$(echo $auth_type | tr 'a-z' 'A-Z')" - case "$auth_type" in - psk|eap) - append wpa_key_mgmt "WPA-$auth_type_l" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type_l}" - [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type_l}-SHA256" - ;; - eap192) - append wpa_key_mgmt "WPA-EAP-SUITE-B-192" - ;; - eap-eap192) - append wpa_key_mgmt "WPA-EAP-SUITE-B-192" - append wpa_key_mgmt "WPA-EAP" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-EAP" - [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-EAP-SHA256" - ;; - sae) - append wpa_key_mgmt "SAE" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE" - ;; - psk-sae) - append wpa_key_mgmt "WPA-PSK" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-PSK" - [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-PSK-SHA256" - append wpa_key_mgmt "SAE" - [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-SAE" - ;; - owe) - append wpa_key_mgmt "OWE" - ;; - esac + append wpa_key_mgmt "WPA-$auth_type" + [ "${ieee80211r:-0}" -gt 0 ] && append wpa_key_mgmt "FT-${auth_type}" + [ "${ieee80211w:-0}" -gt 0 ] && append wpa_key_mgmt "WPA-${auth_type}-SHA256" } hostapd_add_log_config() { @@ -168,7 +141,7 @@ EOF hostapd_common_add_bss_config() { config_add_string 'bssid:macaddr' 'ssid:string' - config_add_boolean wds wmm uapsd hidden utf8_ssid + config_add_boolean wds wmm uapsd hidden config_add_int maxassoc max_inactivity config_add_boolean disassoc_low_ack isolate short_preamble @@ -212,12 +185,9 @@ hostapd_common_add_bss_config() { config_add_string wpa_psk_file - config_add_int multi_ap - config_add_boolean wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 config_add_int wps_ap_setup_locked wps_independent config_add_string wps_device_type wps_device_name wps_manufacturer wps_pin - config_add_string multi_ap_backhaul_ssid multi_ap_backhaul_key config_add_boolean ieee80211v wnm_sleep_mode bss_transition config_add_int time_advertisement @@ -239,10 +209,6 @@ hostapd_common_add_bss_config() { config_add_int mcast_rate config_add_array basic_rate config_add_array supported_rates - - config_add_boolean sae_require_mfp - - config_add_string 'owe_transition_bssid:macaddr' 'owe_transition_ssid:string' } hostapd_set_bss_options() { @@ -261,11 +227,10 @@ hostapd_set_bss_options() { maxassoc max_inactivity disassoc_low_ack isolate auth_cache \ wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \ wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \ - macfilter ssid utf8_ssid wmm uapsd hidden short_preamble rsn_preauth \ + macfilter ssid wmm uapsd hidden short_preamble rsn_preauth \ iapp_interface eapol_version dynamic_vlan ieee80211w nasid \ acct_server acct_secret acct_port acct_interval \ - bss_load_update_period chan_util_avg_period sae_require_mfp \ - multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key + bss_load_update_period chan_util_avg_period set_default isolate 0 set_default maxassoc 0 @@ -281,9 +246,7 @@ hostapd_set_bss_options() { set_default acct_port 1813 set_default bss_load_update_period 60 set_default chan_util_avg_period 600 - set_default utf8_ssid 1 - set_default multi_ap 0 - + append bss_conf "ctrl_interface=/var/run/hostapd" if [ "$isolate" -gt 0 ]; then append bss_conf "ap_isolate=$isolate" "$N" @@ -302,8 +265,6 @@ hostapd_set_bss_options() { append bss_conf "wmm_enabled=$wmm" "$N" append bss_conf "ignore_broadcast_ssid=$hidden" "$N" append bss_conf "uapsd_advertisement_enabled=$uapsd" "$N" - append bss_conf "utf8_ssid=$utf8_ssid" "$N" - append bss_conf "multi_ap=$multi_ap" "$N" [ "$tdls_prohibit" -gt 0 ] && append bss_conf "tdls_prohibit=$tdls_prohibit" "$N" @@ -323,33 +284,16 @@ hostapd_set_bss_options() { append bss_conf "radius_acct_interim_interval=$acct_interval" "$N" } - case "$auth_type" in - sae|owe|eap192|eap-eap192) - set_default ieee80211w 2 - set_default sae_require_mfp 1 - ;; - psk-sae) - set_default ieee80211w 1 - set_default sae_require_mfp 1 - ;; - esac - [ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N" - local vlan_possible="" case "$auth_type" in - none|owe) - json_get_vars owe_transition_bssid owe_transition_ssid - - [ -n "$owe_transition_ssid" ] && append bss_conf "owe_transition_ssid=\"$owe_transition_ssid\"" "$N" - [ -n "$owe_transition_bssid" ] && append bss_conf "owe_transition_bssid=$owe_transition_bssid" "$N" - + none) wps_possible=1 # Here we make the assumption that if we're in open mode # with WPS enabled, we got to be in unconfigured state. wps_not_configured=1 ;; - psk|sae|psk-sae) + psk) json_get_vars key wpa_psk_file if [ ${#key} -lt 8 ]; then wireless_setup_vif_failed INVALID_WPA_PSK @@ -367,7 +311,7 @@ hostapd_set_bss_options() { wps_possible=1 ;; - eap|eap192|eap-eap192) + eap) json_get_vars \ auth_server auth_secret auth_port \ dae_client dae_secret dae_port \ @@ -426,9 +370,6 @@ hostapd_set_bss_options() { [ "$wps_pushbutton" -gt 0 ] && append config_methods push_button [ "$wps_label" -gt 0 ] && append config_methods label - # WPS not possible on Multi-AP backhaul-only SSID - [ "$multi_ap" = 1 ] && wps_possible= - [ -n "$wps_possible" -a -n "$config_methods" ] && { set_default ext_registrar 0 set_default wps_device_type "6-0050F204-1" @@ -451,19 +392,6 @@ hostapd_set_bss_options() { append bss_conf "wps_independent=$wps_independent" "$N" [ -n "$wps_ap_setup_locked" ] && append bss_conf "ap_setup_locked=$wps_ap_setup_locked" "$N" [ "$wps_pbc_in_m1" -gt 0 ] && append bss_conf "pbc_in_m1=$wps_pbc_in_m1" "$N" - [ "$multi_ap" -gt 0 ] && [ -n "$multi_ap_backhaul_ssid" ] && { - append bss_conf "multi_ap_backhaul_ssid=\"$multi_ap_backhaul_ssid\"" "$N" - if [ -z "$multi_ap_backhaul_key" ]; then - : - elif [ ${#multi_ap_backhaul_key} -lt 8 ]; then - wireless_setup_vif_failed INVALID_WPA_PSK - return 1 - elif [ ${#multi_ap_backhaul_key} -eq 64 ]; then - append bss_conf "multi_ap_backhaul_wpa_psk=$multi_ap_backhaul_key" "$N" - else - append bss_conf "multi_ap_backhaul_wpa_passphrase=$multi_ap_backhaul_key" "$N" - fi - } } append bss_conf "ssid=$ssid" "$N" @@ -662,7 +590,7 @@ wpa_supplicant_prepare_interface() { _wpa_supplicant_common "$1" - json_get_vars mode wds multi_ap + json_get_vars mode wds [ -n "$network_bridge" ] && { fail= @@ -671,7 +599,7 @@ wpa_supplicant_prepare_interface() { fail=1 ;; sta) - [ "$wds" = 1 -o "$multi_ap" = 1 ] || fail=1 + [ "$wds" = 1 ] || fail=1 ;; esac @@ -697,12 +625,6 @@ wpa_supplicant_prepare_interface() { country_str="country=$country" } - multiap_flag_file="${_config}.is_multiap" - if [ "$multi_ap" = "1" ]; then - touch "$multiap_flag_file" - else - [ -e "$multiap_flag_file" ] && rm "$multiap_flag_file" - fi wpa_supplicant_teardown_interface "$ifname" cat > "$_config" <> "$_config" - else - cat >> "$_config" <> "$_config" < -#LIBS += -L$ - -# Use libnl v2.0 (or 3.0) libraries. -#CONFIG_LIBNL20=y - -# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored) -#CONFIG_LIBNL32=y - - -# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver) -#CONFIG_DRIVER_BSD=y -#CFLAGS += -I/usr/local/include -#LIBS += -L/usr/local/lib -#LIBS_p += -L/usr/local/lib -#LIBS_c += -L/usr/local/lib - -# Driver interface for Windows NDIS -#CONFIG_DRIVER_NDIS=y -#CFLAGS += -I/usr/include/w32api/ddk -#LIBS += -L/usr/local/lib -# For native build using mingw -#CONFIG_NATIVE_WINDOWS=y -# Additional directories for cross-compilation on Linux host for mingw target -#CFLAGS += -I/opt/mingw/mingw32/include/ddk -#LIBS += -L/opt/mingw/mingw32/lib -#CC=mingw32-gcc -# By default, driver_ndis uses WinPcap for low-level operations. This can be -# replaced with the following option which replaces WinPcap calls with NDISUIO. -# However, this requires that WZC is disabled (net stop wzcsvc) before starting -# wpa_supplicant. -# CONFIG_USE_NDISUIO=y - -# Driver interface for wired Ethernet drivers -CONFIG_DRIVER_WIRED=y - -# Driver interface for the Broadcom RoboSwitch family -#CONFIG_DRIVER_ROBOSWITCH=y - -# Driver interface for no driver (e.g., WPS ER only) -#CONFIG_DRIVER_NONE=y - -# Solaris libraries -#LIBS += -lsocket -ldlpi -lnsl -#LIBS_c += -lsocket - -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is -# included) -#CONFIG_IEEE8021X_EAPOL=y - -# EAP-MD5 -#CONFIG_EAP_MD5=y - -# EAP-MSCHAPv2 -#CONFIG_EAP_MSCHAPV2=y - -# EAP-TLS -#CONFIG_EAP_TLS=y - -# EAL-PEAP -#CONFIG_EAP_PEAP=y - -# EAP-TTLS -#CONFIG_EAP_TTLS=y - -# EAP-FAST -# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed -# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g., -# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions. -#CONFIG_EAP_FAST=y - -# EAP-GTC -#CONFIG_EAP_GTC=y - -# EAP-OTP -#CONFIG_EAP_OTP=y - -# EAP-SIM (enable CONFIG_PCSC, if EAP-SIM is used) -#CONFIG_EAP_SIM=y - -# EAP-PSK (experimental; this is _not_ needed for WPA-PSK) -#CONFIG_EAP_PSK=y - -# EAP-pwd (secure authentication using only a password) -#CONFIG_EAP_PWD=y - -# EAP-PAX -#CONFIG_EAP_PAX=y - -# LEAP -#CONFIG_EAP_LEAP=y - -# EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used) -#CONFIG_EAP_AKA=y - -# EAP-AKA' (enable CONFIG_PCSC, if EAP-AKA' is used). -# This requires CONFIG_EAP_AKA to be enabled, too. -#CONFIG_EAP_AKA_PRIME=y - -# Enable USIM simulator (Milenage) for EAP-AKA -#CONFIG_USIM_SIMULATOR=y - -# EAP-SAKE -#CONFIG_EAP_SAKE=y - -# EAP-GPSK -#CONFIG_EAP_GPSK=y -# Include support for optional SHA256 cipher suite in EAP-GPSK -#CONFIG_EAP_GPSK_SHA256=y - -# EAP-TNC and related Trusted Network Connect support (experimental) -#CONFIG_EAP_TNC=y - -# Wi-Fi Protected Setup (WPS) -#CONFIG_WPS=y -# Enable WPS external registrar functionality -#CONFIG_WPS_ER=y -# Disable credentials for an open network by default when acting as a WPS -# registrar. -#CONFIG_WPS_REG_DISABLE_OPEN=y -# Enable WPS support with NFC config method -#CONFIG_WPS_NFC=y - -# EAP-IKEv2 -#CONFIG_EAP_IKEV2=y - -# EAP-EKE -#CONFIG_EAP_EKE=y - -# PKCS#12 (PFX) support (used to read private key and certificate file from -# a file that usually has extension .p12 or .pfx) -#CONFIG_PKCS12=y - -# Smartcard support (i.e., private key on a smartcard), e.g., with openssl -# engine. -#CONFIG_SMARTCARD=y - -# PC/SC interface for smartcards (USIM, GSM SIM) -# Enable this if EAP-SIM or EAP-AKA is included -#CONFIG_PCSC=y - -# Support HT overrides (disable HT/HT40, mask MCS rates, etc.) -CONFIG_HT_OVERRIDES=y - -# Support VHT overrides (disable VHT, mask MCS rates, etc.) -CONFIG_VHT_OVERRIDES=y - -# Development testing -#CONFIG_EAPOL_TEST=y - -# Select control interface backend for external programs, e.g, wpa_cli: -# unix = UNIX domain sockets (default for Linux/*BSD) -# udp = UDP sockets using localhost (127.0.0.1) -# udp6 = UDP IPv6 sockets using localhost (::1) -# named_pipe = Windows Named Pipe (default for Windows) -# udp-remote = UDP sockets with remote access (only for tests systems/purpose) -# udp6-remote = UDP IPv6 sockets with remote access (only for tests purpose) -# y = use default (backwards compatibility) -# If this option is commented out, control interface is not included in the -# build. -CONFIG_CTRL_IFACE=y - -# Include support for GNU Readline and History Libraries in wpa_cli. -# When building a wpa_cli binary for distribution, please note that these -# libraries are licensed under GPL and as such, BSD license may not apply for -# the resulting binary. -#CONFIG_READLINE=y - -# Include internal line edit mode in wpa_cli. This can be used as a replacement -# for GNU Readline to provide limited command line editing and history support. -#CONFIG_WPA_CLI_EDIT=y - -# Remove debugging code that is printing out debug message to stdout. -# This can be used to reduce the size of the wpa_supplicant considerably -# if debugging code is not needed. The size reduction can be around 35% -# (e.g., 90 kB). -#CONFIG_NO_STDOUT_DEBUG=y - -# Remove WPA support, e.g., for wired-only IEEE 802.1X supplicant, to save -# 35-50 kB in code size. -#CONFIG_NO_WPA=y - -# Remove IEEE 802.11i/WPA-Personal ASCII passphrase support -# This option can be used to reduce code size by removing support for -# converting ASCII passphrases into PSK. If this functionality is removed, the -# PSK can only be configured as the 64-octet hexstring (e.g., from -# wpa_passphrase). This saves about 0.5 kB in code size. -#CONFIG_NO_WPA_PASSPHRASE=y - -# Disable scan result processing (ap_mode=1) to save code size by about 1 kB. -# This can be used if ap_scan=1 mode is never enabled. -#CONFIG_NO_SCAN_PROCESSING=y - -# Select configuration backend: -# file = text file (e.g., wpa_supplicant.conf; note: the configuration file -# path is given on command line, not here; this option is just used to -# select the backend that allows configuration files to be used) -# winreg = Windows registry (see win_example.reg for an example) -CONFIG_BACKEND=file - -# Remove configuration write functionality (i.e., to allow the configuration -# file to be updated based on runtime configuration changes). The runtime -# configuration can still be changed, the changes are just not going to be -# persistent over restarts. This option can be used to reduce code size by -# about 3.5 kB. -#CONFIG_NO_CONFIG_WRITE=y - -# Remove support for configuration blobs to reduce code size by about 1.5 kB. -#CONFIG_NO_CONFIG_BLOBS=y - -# Select program entry point implementation: -# main = UNIX/POSIX like main() function (default) -# main_winsvc = Windows service (read parameters from registry) -# main_none = Very basic example (development use only) -#CONFIG_MAIN=main - -# Select wrapper for operating system and C library specific functions -# unix = UNIX/POSIX like systems (default) -# win32 = Windows systems -# none = Empty template -#CONFIG_OS=unix - -# Select event loop implementation -# eloop = select() loop (default) -# eloop_win = Windows events and WaitForMultipleObject() loop -#CONFIG_ELOOP=eloop - -# Should we use poll instead of select? Select is used by default. -#CONFIG_ELOOP_POLL=y - -# Should we use epoll instead of select? Select is used by default. -#CONFIG_ELOOP_EPOLL=y - -# Should we use kqueue instead of select? Select is used by default. -#CONFIG_ELOOP_KQUEUE=y - -# Select layer 2 packet implementation -# linux = Linux packet socket (default) -# pcap = libpcap/libdnet/WinPcap -# freebsd = FreeBSD libpcap -# winpcap = WinPcap with receive thread -# ndis = Windows NDISUIO (note: requires CONFIG_USE_NDISUIO=y) -# none = Empty template -#CONFIG_L2_PACKET=linux - -# Disable Linux packet socket workaround applicable for station interface -# in a bridge for EAPOL frames. This should be uncommented only if the kernel -# is known to not have the regression issue in packet socket behavior with -# bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). -#CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y - -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -#CONFIG_PEERKEY=y - -# IEEE 802.11w (management frame protection), also known as PMF -# Driver support is also needed for IEEE 802.11w. -#CONFIG_IEEE80211W=y - -# Select TLS implementation -# openssl = OpenSSL (default) -# gnutls = GnuTLS -# internal = Internal TLSv1 implementation (experimental) -# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental) -# none = Empty template -CONFIG_TLS=internal - -# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1) -# can be enabled to get a stronger construction of messages when block ciphers -# are used. It should be noted that some existing TLS v1.0 -based -# implementation may not be compatible with TLS v1.1 message (ClientHello is -# sent prior to negotiating which version will be used) -#CONFIG_TLSV11=y - -# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2) -# can be enabled to enable use of stronger crypto algorithms. It should be -# noted that some existing TLS v1.0 -based implementation may not be compatible -# with TLS v1.2 message (ClientHello is sent prior to negotiating which version -# will be used) -#CONFIG_TLSV12=y - -# Select which ciphers to use by default with OpenSSL if the user does not -# specify them. -#CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW" - -# If CONFIG_TLS=internal is used, additional library and include paths are -# needed for LibTomMath. Alternatively, an integrated, minimal version of -# LibTomMath can be used. See beginning of libtommath.c for details on benefits -# and drawbacks of this option. -#CONFIG_INTERNAL_LIBTOMMATH=y -#ifndef CONFIG_INTERNAL_LIBTOMMATH -#LTM_PATH=/usr/src/libtommath-0.39 -#CFLAGS += -I$(LTM_PATH) -#LIBS += -L$(LTM_PATH) -#LIBS_p += -L$(LTM_PATH) -#endif -# At the cost of about 4 kB of additional binary size, the internal LibTomMath -# can be configured to include faster routines for exptmod, sqr, and div to -# speed up DH and RSA calculation considerably -#CONFIG_INTERNAL_LIBTOMMATH_FAST=y - -# Include NDIS event processing through WMI into wpa_supplicant/wpasvc. -# This is only for Windows builds and requires WMI-related header files and -# WbemUuid.Lib from Platform SDK even when building with MinGW. -#CONFIG_NDIS_EVENTS_INTEGRATED=y -#PLATFORMSDKLIB="/opt/Program Files/Microsoft Platform SDK/Lib" - -# Add support for old DBus control interface -# (fi.epitest.hostap.WPASupplicant) -#CONFIG_CTRL_IFACE_DBUS=y - -# Add support for new DBus control interface -# (fi.w1.hostap.wpa_supplicant1) -#CONFIG_CTRL_IFACE_DBUS_NEW=y - -# Add introspection support for new DBus control interface -#CONFIG_CTRL_IFACE_DBUS_INTRO=y - -# Add support for loading EAP methods dynamically as shared libraries. -# When this option is enabled, each EAP method can be either included -# statically (CONFIG_EAP_=y) or dynamically (CONFIG_EAP_=dyn). -# Dynamic EAP methods are build as shared objects (eap_*.so) and they need to -# be loaded in the beginning of the wpa_supplicant configuration file -# (see load_dynamic_eap parameter in the example file) before being used in -# the network blocks. -# -# Note that some shared parts of EAP methods are included in the main program -# and in order to be able to use dynamic EAP methods using these parts, the -# main program must have been build with the EAP method enabled (=y or =dyn). -# This means that EAP-TLS/PEAP/TTLS/FAST cannot be added as dynamic libraries -# unless at least one of them was included in the main build to force inclusion -# of the shared code. Similarly, at least one of EAP-SIM/AKA must be included -# in the main build to be able to load these methods dynamically. -# -# Please also note that using dynamic libraries will increase the total binary -# size. Thus, it may not be the best option for targets that have limited -# amount of memory/flash. -#CONFIG_DYNAMIC_EAP_METHODS=y - -# IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode -CONFIG_IEEE80211R=y - -# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies -# CONFIG_IEEE80211R). -#CONFIG_IEEE80211R_AP=y - -# Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) -#CONFIG_DEBUG_FILE=y - -# Send debug messages to syslog instead of stdout -CONFIG_DEBUG_SYSLOG=y -# Set syslog facility for debug messages -CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON - -# Add support for sending all debug messages (regardless of debug verbosity) -# to the Linux kernel tracing facility. This helps debug the entire stack by -# making it easy to record everything happening from the driver up into the -# same file, e.g., using trace-cmd. -#CONFIG_DEBUG_LINUX_TRACING=y - -# Add support for writing debug log to Android logcat instead of standard -# output -#CONFIG_ANDROID_LOG=y - -# Enable privilege separation (see README 'Privilege separation' for details) -#CONFIG_PRIVSEP=y - -# Enable mitigation against certain attacks against TKIP by delaying Michael -# MIC error reports by a random amount of time between 0 and 60 seconds -#CONFIG_DELAYED_MIC_ERROR_REPORT=y - -# Enable tracing code for developer debugging -# This tracks use of memory allocations and other registrations and reports -# incorrect use with a backtrace of call (or allocation) location. -#CONFIG_WPA_TRACE=y -# For BSD, uncomment these. -#LIBS += -lexecinfo -#LIBS_p += -lexecinfo -#LIBS_c += -lexecinfo - -# Use libbfd to get more details for developer debugging -# This enables use of libbfd to get more detailed symbols for the backtraces -# generated by CONFIG_WPA_TRACE=y. -#CONFIG_WPA_TRACE_BFD=y -# For BSD, uncomment these. -#LIBS += -lbfd -liberty -lz -#LIBS_p += -lbfd -liberty -lz -#LIBS_c += -lbfd -liberty -lz - -# wpa_supplicant depends on strong random number generation being available -# from the operating system. os_get_random() function is used to fetch random -# data when needed, e.g., for key generation. On Linux and BSD systems, this -# works by reading /dev/urandom. It should be noted that the OS entropy pool -# needs to be properly initialized before wpa_supplicant is started. This is -# important especially on embedded devices that do not have a hardware random -# number generator and may by default start up with minimal entropy available -# for random number generation. -# -# As a safety net, wpa_supplicant is by default trying to internally collect -# additional entropy for generating random data to mix in with the data fetched -# from the OS. This by itself is not considered to be very strong, but it may -# help in cases where the system pool is not initialized properly. However, it -# is very strongly recommended that the system pool is initialized with enough -# entropy either by using hardware assisted random number generator or by -# storing state over device reboots. -# -# wpa_supplicant can be configured to maintain its own entropy store over -# restarts to enhance random number generation. This is not perfect, but it is -# much more secure than using the same sequence of random numbers after every -# reboot. This can be enabled with -e command line option. The -# specified file needs to be readable and writable by wpa_supplicant. -# -# If the os_get_random() is known to provide strong random data (e.g., on -# Linux/BSD, the board in question is known to have reliable source of random -# data from /dev/urandom), the internal wpa_supplicant random pool can be -# disabled. This will save some in binary size and CPU use. However, this -# should only be considered for builds that are known to be used on devices -# that meet the requirements described above. -CONFIG_NO_RANDOM_POOL=y - -# IEEE 802.11n (High Throughput) support (mainly for AP mode) -#CONFIG_IEEE80211N=y - -# IEEE 802.11ac (Very High Throughput) support (mainly for AP mode) -# (depends on CONFIG_IEEE80211N) -#CONFIG_IEEE80211AC=y - -# Wireless Network Management (IEEE Std 802.11v-2011) -# Note: This is experimental and not complete implementation. -#CONFIG_WNM=y - -# Interworking (IEEE 802.11u) -# This can be used to enable functionality to improve interworking with -# external networks (GAS/ANQP to learn more about the networks and network -# selection based on available credentials). -#CONFIG_INTERWORKING=y - -# Hotspot 2.0 -#CONFIG_HS20=y - -# Enable interface matching in wpa_supplicant -#CONFIG_MATCH_IFACE=y - -# Disable roaming in wpa_supplicant -#CONFIG_NO_ROAMING=y - -# AP mode operations with wpa_supplicant -# This can be used for controlling AP mode operations with wpa_supplicant. It -# should be noted that this is mainly aimed at simple cases like -# WPA2-Personal while more complex configurations like WPA2-Enterprise with an -# external RADIUS server can be supported with hostapd. -#CONFIG_AP=y - -# P2P (Wi-Fi Direct) -# This can be used to enable P2P support in wpa_supplicant. See README-P2P for -# more information on P2P operations. -#CONFIG_P2P=y - -# Enable TDLS support -#CONFIG_TDLS=y - -# Wi-Fi Direct -# This can be used to enable Wi-Fi Direct extensions for P2P using an external -# program to control the additional information exchanges in the messages. -#CONFIG_WIFI_DISPLAY=y - -# Autoscan -# This can be used to enable automatic scan support in wpa_supplicant. -# See wpa_supplicant.conf for more information on autoscan usage. -# -# Enabling directly a module will enable autoscan support. -# For exponential module: -#CONFIG_AUTOSCAN_EXPONENTIAL=y -# For periodic module: -#CONFIG_AUTOSCAN_PERIODIC=y - -# Password (and passphrase, etc.) backend for external storage -# These optional mechanisms can be used to add support for storing passwords -# and other secrets in external (to wpa_supplicant) location. This allows, for -# example, operating system specific key storage to be used -# -# External password backend for testing purposes (developer use) -#CONFIG_EXT_PASSWORD_TEST=y - -# Enable Fast Session Transfer (FST) -#CONFIG_FST=y - -# Enable CLI commands for FST testing -#CONFIG_FST_TEST=y - -# OS X builds. This is only for building eapol_test. -#CONFIG_OSX=y - -# Automatic Channel Selection -# This will allow wpa_supplicant to pick the channel automatically when channel -# is set to "0". -# -# TODO: Extend parser to be able to parse "channel=acs_survey" as an alternative -# to "channel=0". This would enable us to eventually add other ACS algorithms in -# similar way. -# -# Automatic selection is currently only done through initialization, later on -# we hope to do background checks to keep us moving to more ideal channels as -# time goes by. ACS is currently only supported through the nl80211 driver and -# your driver must have survey dump capability that is filled by the driver -# during scanning. -# -# TODO: In analogy to hostapd be able to customize the ACS survey algorithm with -# a newly to create wpa_supplicant.conf variable acs_num_scans. -# -# Supported ACS drivers: -# * ath9k -# * ath5k -# * ath10k -# -# For more details refer to: -# http://wireless.kernel.org/en/users/Documentation/acs -#CONFIG_ACS=y - -# Support Multi Band Operation -#CONFIG_MBO=y - -# Fast Initial Link Setup (FILS) (IEEE 802.11ai) -# Note: This is an experimental and not yet complete implementation. This -# should not be enabled for production use. -#CONFIG_FILS=y -# FILS shared key authentication with PFS -#CONFIG_FILS_SK_PFS=y - -# Support RSN on IBSS networks -# This is needed to be able to use mode=1 network profile with proto=RSN and -# key_mgmt=WPA-PSK (i.e., full key management instead of WPA-None). -#CONFIG_IBSS_RSN=y - -# External PMKSA cache control -# This can be used to enable control interface commands that allow the current -# PMKSA cache entries to be fetched and new entries to be added. -#CONFIG_PMKSA_CACHE_EXTERNAL=y - -# Mesh Networking (IEEE 802.11s) -#CONFIG_MESH=y - -# Background scanning modules -# These can be used to request wpa_supplicant to perform background scanning -# operations for roaming within an ESS (same SSID). See the bgscan parameter in -# the wpa_supplicant.conf file for more details. -# Periodic background scans based on signal strength -#CONFIG_BGSCAN_SIMPLE=y -# Learn channels used by the network and try to avoid bgscans on other -# channels (experimental) -#CONFIG_BGSCAN_LEARN=y - -# Opportunistic Wireless Encryption (OWE) -# Experimental implementation of draft-harkins-owe-07.txt -#CONFIG_OWE=y - -# uBus IPC/RPC System -# Services can connect to the bus and provide methods -# that can be called by other services or clients. -CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-full.config b/package/network/services/hostapd/files/wpa_supplicant-full.config old mode 100755 new mode 100644 index 5f6e82f7b6..c22e1cca5d --- a/package/network/services/hostapd/files/wpa_supplicant-full.config +++ b/package/network/services/hostapd/files/wpa_supplicant-full.config @@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y -# Driver interface for MACsec capable Qualcomm Atheros drivers -#CONFIG_DRIVER_MACSEC_QCA=y - -# Driver interface for Linux MACsec drivers -#CONFIG_DRIVER_MACSEC_LINUX=y - # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or -# MACsec is included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is +# included) CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -172,9 +166,6 @@ CONFIG_WPS=y # EAP-EKE #CONFIG_EAP_EKE=y -# MACsec -#CONFIG_MACSEC=y - # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) CONFIG_PKCS12=y @@ -297,6 +288,9 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +CONFIG_PEERKEY=y + # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y @@ -384,13 +378,17 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode CONFIG_IEEE80211R=y +# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies +# CONFIG_IEEE80211R). +#CONFIG_IEEE80211R_AP=y + # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -CONFIG_DEBUG_SYSLOG=y +#CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -593,8 +591,3 @@ CONFIG_IBSS_RSN=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y - -# uBus IPC/RPC System -# Services can connect to the bus and provide methods -# that can be called by other services or clients. -CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-mini.config b/package/network/services/hostapd/files/wpa_supplicant-mini.config old mode 100755 new mode 100644 index 5e6f154105..3e088715c8 --- a/package/network/services/hostapd/files/wpa_supplicant-mini.config +++ b/package/network/services/hostapd/files/wpa_supplicant-mini.config @@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y -# Driver interface for MACsec capable Qualcomm Atheros drivers -#CONFIG_DRIVER_MACSEC_QCA=y - -# Driver interface for Linux MACsec drivers -#CONFIG_DRIVER_MACSEC_LINUX=y - # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or -# MACsec is included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is +# included) #CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -172,9 +166,6 @@ CONFIG_DRIVER_WIRED=y # EAP-EKE #CONFIG_EAP_EKE=y -# MACsec -#CONFIG_MACSEC=y - # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) #CONFIG_PKCS12=y @@ -297,6 +288,9 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +#CONFIG_PEERKEY=y + # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. #CONFIG_IEEE80211W=y @@ -384,13 +378,17 @@ CONFIG_TLS=internal # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode #CONFIG_IEEE80211R=y +# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies +# CONFIG_IEEE80211R). +#CONFIG_IEEE80211R_AP=y + # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -CONFIG_DEBUG_SYSLOG=y +#CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -593,8 +591,3 @@ CONFIG_NO_RANDOM_POOL=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y - -# uBus IPC/RPC System -# Services can connect to the bus and provide methods -# that can be called by other services or clients. -CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wpa_supplicant-p2p.config b/package/network/services/hostapd/files/wpa_supplicant-p2p.config old mode 100755 new mode 100644 index bbbb8e6e30..420aebcf98 --- a/package/network/services/hostapd/files/wpa_supplicant-p2p.config +++ b/package/network/services/hostapd/files/wpa_supplicant-p2p.config @@ -73,12 +73,6 @@ CONFIG_DRIVER_NL80211=y # Driver interface for wired Ethernet drivers CONFIG_DRIVER_WIRED=y -# Driver interface for MACsec capable Qualcomm Atheros drivers -#CONFIG_DRIVER_MACSEC_QCA=y - -# Driver interface for Linux MACsec drivers -#CONFIG_DRIVER_MACSEC_LINUX=y - # Driver interface for the Broadcom RoboSwitch family #CONFIG_DRIVER_ROBOSWITCH=y @@ -89,8 +83,8 @@ CONFIG_DRIVER_WIRED=y #LIBS += -lsocket -ldlpi -lnsl #LIBS_c += -lsocket -# Enable IEEE 802.1X Supplicant (automatically included if any EAP method or -# MACsec is included) +# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is +# included) CONFIG_IEEE8021X_EAPOL=y # EAP-MD5 @@ -172,9 +166,6 @@ CONFIG_WPS=y # EAP-EKE #CONFIG_EAP_EKE=y -# MACsec -#CONFIG_MACSEC=y - # PKCS#12 (PFX) support (used to read private key and certificate file from # a file that usually has extension .p12 or .pfx) CONFIG_PKCS12=y @@ -297,6 +288,9 @@ CONFIG_BACKEND=file # bridge interfaces (commit 'bridge: respect RFC2863 operational state')'). #CONFIG_NO_LINUX_PACKET_SOCKET_WAR=y +# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) +CONFIG_PEERKEY=y + # IEEE 802.11w (management frame protection), also known as PMF # Driver support is also needed for IEEE 802.11w. CONFIG_IEEE80211W=y @@ -384,13 +378,17 @@ CONFIG_INTERNAL_LIBTOMMATH_FAST=y # IEEE Std 802.11r-2008 (Fast BSS Transition) for station mode #CONFIG_IEEE80211R=y +# IEEE Std 802.11r-2008 (Fast BSS Transition) for AP mode (implies +# CONFIG_IEEE80211R). +#CONFIG_IEEE80211R_AP=y + # Add support for writing debug log to a file (/tmp/wpa_supplicant-log-#.txt) #CONFIG_DEBUG_FILE=y # Send debug messages to syslog instead of stdout -CONFIG_DEBUG_SYSLOG=y +#CONFIG_DEBUG_SYSLOG=y # Set syslog facility for debug messages -CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON +#CONFIG_DEBUG_SYSLOG_FACILITY=LOG_DAEMON # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by @@ -593,8 +591,3 @@ CONFIG_IBSS_RSN=y # Opportunistic Wireless Encryption (OWE) # Experimental implementation of draft-harkins-owe-07.txt #CONFIG_OWE=y - -# uBus IPC/RPC System -# Services can connect to the bus and provide methods -# that can be called by other services or clients. -CONFIG_UBUS=y diff --git a/package/network/services/hostapd/files/wps-hotplug.sh b/package/network/services/hostapd/files/wps-hotplug.sh old mode 100755 new mode 100644 index d00939d769..24af80e55b --- a/package/network/services/hostapd/files/wps-hotplug.sh +++ b/package/network/services/hostapd/files/wps-hotplug.sh @@ -1,62 +1,11 @@ #!/bin/sh -wps_catch_credentials() { - local iface ifaces ifc ifname ssid encryption key radio radios - local found=0 - - . /usr/share/libubox/jshn.sh - ubus -S -t 30 listen wps_credentials | while read creds; do - json_init - json_load "$creds" - json_select wps_credentials || continue - json_get_vars ifname ssid key encryption - local ifcname="$ifname" - json_init - json_load "$(ubus -S call network.wireless status)" - json_get_keys radios - for radio in $radios; do - json_select $radio - json_select interfaces - json_get_keys ifaces - for ifc in $ifaces; do - json_select $ifc - json_get_vars ifname - [ "$ifname" = "$ifcname" ] && { - ubus -S call uci set "{\"config\":\"wireless\", \"type\":\"wifi-iface\", \ - \"match\": { \"device\": \"$radio\", \"encryption\": \"wps\" }, \ - \"values\": { \"encryption\": \"$encryption\", \ - \"ssid\": \"$ssid\", \ - \"key\": \"$key\" } }" - ubus -S call uci commit '{"config": "wireless"}' - ubus -S call uci apply - } - json_select .. - done - json_select .. - json_select .. - done - done -} - if [ "$ACTION" = "pressed" -a "$BUTTON" = "wps" ]; then - wps_done=0 - ubusobjs="$( ubus -S list hostapd.* )" - for ubusobj in $ubusobjs; do - ubus -S call $ubusobj wps_start && wps_done=1 + cd /var/run/hostapd + for socket in *; do + [ -S "$socket" ] || continue + hostapd_cli -i "$socket" wps_pbc done - [ $wps_done = 0 ] || return 0 - wps_done=0 - ubusobjs="$( ubus -S list wpa_supplicant.* )" - for ubusobj in $ubusobjs; do - ifname="$(echo $ubusobj | cut -d'.' -f2 )" - multi_ap="" - if [ -e "/var/run/wpa_supplicant-${ifname}.conf.is_multiap" ]; then - ubus -S call $ubusobj wps_start '{ "multi_ap": true }' && wps_done=1 - else - ubus -S call $ubusobj wps_start && wps_done=1 - fi - done - [ $wps_done = 0 ] || wps_catch_credentials & fi return 0 diff --git a/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch b/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch new file mode 100644 index 0000000000..3fc80a01d7 --- /dev/null +++ b/package/network/services/hostapd/patches/000-0001-Reduce-undesired-logging-of-ACL-rejection.patch @@ -0,0 +1,39 @@ +From 6588f712220797c69dbd019daa19b82a50d92782 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sun, 14 Oct 2018 19:57:22 +0300 +Subject: Reduce undesired logging of ACL rejection events from AP mode + +When Probe Request frame handling was extended to use MAC ACL through +ieee802_11_allowed_address(), the MSG_INFO level log print ("Station + not allowed to authenticate") from that function ended up getting +printed even for Probe Request frames. That was not by design and it can +result in excessive logging and MSG_INFO level if MAC ACL is used. + +Fix this by printing this log entry only for authentication and +association frames. In addition, drop the priority of that log entry to +MSG_DEBUG since this is not really an unexpected behavior in most MAC +ACL use cases. + +Fixes: 92eb00aec2a0 ("Extend ACL check for Probe Request frames") +Signed-off-by: Jouni Malinen +--- + src/ap/ieee802_11.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -1636,9 +1636,11 @@ ieee802_11_allowed_address(struct hostap + is_probe_req); + + if (res == HOSTAPD_ACL_REJECT) { +- wpa_printf(MSG_INFO, +- "Station " MACSTR " not allowed to authenticate", +- MAC2STR(addr)); ++ if (!is_probe_req) ++ wpa_printf(MSG_DEBUG, ++ "Station " MACSTR ++ " not allowed to authenticate", ++ MAC2STR(addr)); + return HOSTAPD_ACL_REJECT; + } + diff --git a/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch b/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch new file mode 100644 index 0000000000..82165a94f9 --- /dev/null +++ b/package/network/services/hostapd/patches/000-0002-Drop-logging-priority-for-handle_auth_cb.patch @@ -0,0 +1,28 @@ +From dc1b1c8db7905639be6f4de8173e2d97bf6df90d Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sun, 14 Oct 2018 20:03:55 +0300 +Subject: Drop logging priority for handle_auth_cb no-STA-match messages + +This message was printed and MSG_INFO level which would be more +reasonable for error cases where hostapd has accepted authentication. +However, this is not really an error case for the cases where +authentication was rejected (e.g., due to MAC ACL). Drop this to use +MSG_DEBUG level. + +Signed-off-by: Jouni Malinen +--- + src/ap/ieee802_11.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/src/ap/ieee802_11.c ++++ b/src/ap/ieee802_11.c +@@ -4018,7 +4018,8 @@ static void handle_auth_cb(struct hostap + + sta = ap_get_sta(hapd, mgmt->da); + if (!sta) { +- wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found", ++ wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR ++ " not found", + MAC2STR(mgmt->da)); + return; + } diff --git a/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch b/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch new file mode 100644 index 0000000000..633ab58623 --- /dev/null +++ b/package/network/services/hostapd/patches/0001-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch @@ -0,0 +1,43 @@ +From 3e34cfdff6b192fe337c6fb3f487f73e96582961 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Sun, 15 Jul 2018 01:25:53 +0200 +Subject: [PATCH] WPA: Ignore unauthenticated encrypted EAPOL-Key data + +Ignore unauthenticated encrypted EAPOL-Key data in supplicant +processing. When using WPA2, these are frames that have the Encrypted +flag set, but not the MIC flag. + +When using WPA2, EAPOL-Key frames that had the Encrypted flag set but +not the MIC flag, had their data field decrypted without first verifying +the MIC. In case the data field was encrypted using RC4 (i.e., when +negotiating TKIP as the pairwise cipher), this meant that +unauthenticated but decrypted data would then be processed. An adversary +could abuse this as a decryption oracle to recover sensitive information +in the data field of EAPOL-Key messages (e.g., the group key). +(CVE-2018-14526) + +Signed-off-by: Mathy Vanhoef +--- + src/rsn_supp/wpa.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/src/rsn_supp/wpa.c ++++ b/src/rsn_supp/wpa.c +@@ -2208,6 +2208,17 @@ int wpa_sm_rx_eapol(struct wpa_sm *sm, c + + if ((sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) && + (key_info & WPA_KEY_INFO_ENCR_KEY_DATA) && mic_len) { ++ /* ++ * Only decrypt the Key Data field if the frame's authenticity ++ * was verified. When using AES-SIV (FILS), the MIC flag is not ++ * set, so this check should only be performed if mic_len != 0 ++ * which is the case in this code branch. ++ */ ++ if (!(key_info & WPA_KEY_INFO_MIC)) { ++ wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, ++ "WPA: Ignore EAPOL-Key with encrypted but unauthenticated data"); ++ goto out; ++ } + if (wpa_supplicant_decrypt_key_data(sm, key, mic_len, + ver, key_data, + &key_data_len)) diff --git a/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch b/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch old mode 100755 new mode 100644 index de8d65b982..a1d668b283 --- a/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch +++ b/package/network/services/hostapd/patches/001-mesh-factor-out-mesh-join-function.patch @@ -201,7 +201,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant_i.h +++ b/wpa_supplicant/wpa_supplicant_i.h -@@ -814,6 +814,7 @@ struct wpa_supplicant { +@@ -810,6 +810,7 @@ struct wpa_supplicant { unsigned int mesh_if_created:1; unsigned int mesh_ht_enabled:1; unsigned int mesh_vht_enabled:1; diff --git a/package/network/services/hostapd/patches/002-mesh-factor-out-rsn-initialization.patch b/package/network/services/hostapd/patches/002-mesh-factor-out-rsn-initialization.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/003-mesh-relocate-RSN-init-function.patch b/package/network/services/hostapd/patches/003-mesh-relocate-RSN-init-function.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/004-mesh-use-setup-completion-callback-to-complete-mesh-.patch b/package/network/services/hostapd/patches/004-mesh-use-setup-completion-callback-to-complete-mesh-.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/005-mesh-reflect-country-setting-to-mesh-configuration.patch b/package/network/services/hostapd/patches/005-mesh-reflect-country-setting-to-mesh-configuration.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch b/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch old mode 100755 new mode 100644 index 5ec7aa0837..fe2353cd81 --- a/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch +++ b/package/network/services/hostapd/patches/006-mesh-inform-kernel-driver-DFS-handler-in-userspace.patch @@ -16,7 +16,7 @@ Signed-off-by: Peter Oh --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1402,6 +1402,7 @@ struct wpa_driver_mesh_join_params { +@@ -1390,6 +1390,7 @@ struct wpa_driver_mesh_join_params { #define WPA_DRIVER_MESH_FLAG_SAE_AUTH 0x00000004 #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008 unsigned int flags; @@ -26,7 +26,7 @@ Signed-off-by: Peter Oh /** --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9375,6 +9375,9 @@ static int nl80211_join_mesh(struct i802 +@@ -9270,6 +9270,9 @@ static int nl80211_join_mesh(struct i802 wpa_printf(MSG_DEBUG, " * flags=%08X", params->flags); diff --git a/package/network/services/hostapd/patches/007-mesh-apply-channel-attributes-before-running-Mesh.patch b/package/network/services/hostapd/patches/007-mesh-apply-channel-attributes-before-running-Mesh.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/008-mesh-set-interface-type-to-mesh-before-setting-inter.patch b/package/network/services/hostapd/patches/008-mesh-set-interface-type-to-mesh-before-setting-inter.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/009-mesh-set-mesh-center-frequency.patch b/package/network/services/hostapd/patches/009-mesh-set-mesh-center-frequency.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch b/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch old mode 100755 new mode 100644 index 0c82d84d6b..3f5178a74b --- a/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch +++ b/package/network/services/hostapd/patches/010-mesh-consider-mesh-interface-on-dfs-event-handler.patch @@ -15,7 +15,7 @@ Signed-off-by: Masashi Honma --- a/wpa_supplicant/ap.c +++ b/wpa_supplicant/ap.c -@@ -1379,13 +1379,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_ +@@ -1337,13 +1337,18 @@ int ap_ctrl_iface_chanswitch(struct wpa_ void wpas_ap_ch_switch(struct wpa_supplicant *wpa_s, int freq, int ht, int offset, int width, int cf1, int cf2) { @@ -37,7 +37,7 @@ Signed-off-by: Masashi Honma offset, width, cf1, cf2); } -@@ -1582,10 +1587,16 @@ int wpas_ap_pmksa_cache_add_external(str +@@ -1540,10 +1545,16 @@ int wpas_ap_pmksa_cache_add_external(str void wpas_ap_event_dfs_radar_detected(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -57,7 +57,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); -@@ -1595,10 +1606,16 @@ void wpas_ap_event_dfs_radar_detected(st +@@ -1553,10 +1564,16 @@ void wpas_ap_event_dfs_radar_detected(st void wpas_ap_event_dfs_cac_started(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -77,7 +77,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1607,10 +1624,16 @@ void wpas_ap_event_dfs_cac_started(struc +@@ -1565,10 +1582,16 @@ void wpas_ap_event_dfs_cac_started(struc void wpas_ap_event_dfs_cac_finished(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -97,7 +97,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1619,10 +1642,16 @@ void wpas_ap_event_dfs_cac_finished(stru +@@ -1577,10 +1600,16 @@ void wpas_ap_event_dfs_cac_finished(stru void wpas_ap_event_dfs_cac_aborted(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -117,7 +117,7 @@ Signed-off-by: Masashi Honma radar->ht_enabled, radar->chan_offset, radar->chan_width, radar->cf1, radar->cf2); } -@@ -1631,10 +1660,16 @@ void wpas_ap_event_dfs_cac_aborted(struc +@@ -1589,10 +1618,16 @@ void wpas_ap_event_dfs_cac_aborted(struc void wpas_ap_event_dfs_cac_nop_finished(struct wpa_supplicant *wpa_s, struct dfs_event *radar) { @@ -139,7 +139,7 @@ Signed-off-by: Masashi Honma } --- a/wpa_supplicant/events.c +++ b/wpa_supplicant/events.c -@@ -3840,7 +3840,7 @@ static void wpas_event_dfs_cac_started(s +@@ -3802,7 +3802,7 @@ static void wpas_event_dfs_cac_started(s struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -148,7 +148,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_started(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -3861,7 +3861,7 @@ static void wpas_event_dfs_cac_finished( +@@ -3823,7 +3823,7 @@ static void wpas_event_dfs_cac_finished( struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -157,7 +157,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_finished(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -3877,7 +3877,7 @@ static void wpas_event_dfs_cac_aborted(s +@@ -3839,7 +3839,7 @@ static void wpas_event_dfs_cac_aborted(s struct dfs_event *radar) { #if defined(NEED_AP_MLME) && defined(CONFIG_AP) @@ -166,7 +166,7 @@ Signed-off-by: Masashi Honma wpas_ap_event_dfs_cac_aborted(wpa_s, radar); } else #endif /* NEED_AP_MLME && CONFIG_AP */ -@@ -4328,6 +4328,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -4278,6 +4278,7 @@ void wpa_supplicant_event(void *ctx, enu #ifdef CONFIG_AP if (wpa_s->current_ssid->mode == WPAS_MODE_AP || wpa_s->current_ssid->mode == WPAS_MODE_P2P_GO || diff --git a/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch b/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch old mode 100755 new mode 100644 index 184b6e9e9d..2022bbbdd2 --- a/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch +++ b/package/network/services/hostapd/patches/011-mesh-Allow-DFS-channels-to-be-selected-if-dfs-is-ena.patch @@ -1,7 +1,7 @@ -From bbaa6142eadf229334436fdbf51aa65bb819f771 Mon Sep 17 00:00:00 2001 +From ce3e491e445ebea9705e76ac7ee3d4841ace1cad Mon Sep 17 00:00:00 2001 From: Peter Oh -Date: Tue, 29 May 2018 14:39:15 -0700 -Subject: [PATCH 11/18] mesh: Allow DFS channels to be selected if dfs is +Date: Tue, 17 Apr 2018 21:55:08 -0700 +Subject: [PATCH 11/16] mesh: Allow DFS channels to be selected if dfs is enabled Note: DFS is assumed to be usable if a country code has been set @@ -14,7 +14,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2090,6 +2090,8 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2060,6 +2060,8 @@ void ibss_mesh_setup_freq(struct wpa_sup struct hostapd_freq_params vht_freq; int chwidth, seg0, seg1; u32 vht_caps = 0; @@ -23,7 +23,7 @@ Signed-off-by: Peter Oh freq->freq = ssid->frequency; -@@ -2166,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2136,8 +2138,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Check primary channel flags */ @@ -36,7 +36,7 @@ Signed-off-by: Peter Oh #ifdef CONFIG_HT_OVERRIDES if (ssid->disable_ht40) -@@ -2193,8 +2198,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2163,8 +2168,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Check secondary channel flags */ @@ -49,7 +49,7 @@ Signed-off-by: Peter Oh freq->channel = pri_chan->chan; -@@ -2284,8 +2292,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2254,8 +2262,11 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Back to HT configuration if channel not usable */ @@ -62,7 +62,7 @@ Signed-off-by: Peter Oh } chwidth = VHT_CHANWIDTH_80MHZ; -@@ -2305,10 +2316,11 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2275,10 +2286,11 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!chan) continue; diff --git a/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch b/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch new file mode 100644 index 0000000000..793f4f5db1 --- /dev/null +++ b/package/network/services/hostapd/patches/012-mesh-allow-mesh-to-send-channel-switch-request.patch @@ -0,0 +1,25 @@ +From 4a8245ec2e9d48e464488477a3e7ed234009c216 Mon Sep 17 00:00:00 2001 +From: Peter Oh +Date: Tue, 29 May 2018 14:39:16 -0700 +Subject: [PATCH 12/18] mesh: allow mesh to send channel switch request + +add mesh type to nl80211 channel switch request, +so mesh is able to send the request to kernel drivers. + +Signed-off-by: Peter Oh +--- + src/drivers/driver_nl80211.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/src/drivers/driver_nl80211.c ++++ b/src/drivers/driver_nl80211.c +@@ -8685,7 +8685,8 @@ static int nl80211_switch_channel(void * + } + + if ((drv->nlmode != NL80211_IFTYPE_AP) && +- (drv->nlmode != NL80211_IFTYPE_P2P_GO)) ++ (drv->nlmode != NL80211_IFTYPE_P2P_GO) && ++ (drv->nlmode != NL80211_IFTYPE_MESH_POINT) ) + return -EOPNOTSUPP; + + /* diff --git a/package/network/services/hostapd/patches/013-mesh-do-not-allow-pri-sec-channel-switch.patch b/package/network/services/hostapd/patches/013-mesh-do-not-allow-pri-sec-channel-switch.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch b/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch old mode 100755 new mode 100644 index afcbcbb0ad..a6cb1b469c --- a/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch +++ b/package/network/services/hostapd/patches/014-mesh-do-not-allow-scan-result-to-swap-pri-sec.patch @@ -1,7 +1,7 @@ -From f95897cef614fff710c31d9e478eacc85d6312d5 Mon Sep 17 00:00:00 2001 +From cf2ba81fb307f3e87e13896f9dbf93c0c2a9eb92 Mon Sep 17 00:00:00 2001 From: Peter Oh -Date: Tue, 29 May 2018 14:39:18 -0700 -Subject: [PATCH 14/18] mesh: do not allow scan result to swap pri/sec +Date: Tue, 17 Apr 2018 21:55:11 -0700 +Subject: [PATCH 14/16] mesh: do not allow scan result to swap pri/sec Swapping between primary and secondary channel will break mesh from joining, hence don't allow it. @@ -13,7 +13,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2215,7 +2215,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2185,7 +2185,7 @@ void ibss_mesh_setup_freq(struct wpa_sup } freq->sec_channel_offset = ht40; diff --git a/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch b/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch old mode 100755 new mode 100644 index c921436925..148e90d859 --- a/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch +++ b/package/network/services/hostapd/patches/015-mesh-do-not-use-offchan-mgmt-tx-on-DFS.patch @@ -14,7 +14,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -7268,6 +7268,10 @@ static int wpa_driver_nl80211_send_actio +@@ -7165,6 +7165,10 @@ static int wpa_driver_nl80211_send_actio struct wpa_driver_nl80211_data *drv = bss->drv; int ret = -1; u8 *buf; @@ -25,7 +25,7 @@ Signed-off-by: Daniel Golle struct ieee80211_hdr *hdr; wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, " -@@ -7292,7 +7296,11 @@ static int wpa_driver_nl80211_send_actio +@@ -7189,7 +7193,11 @@ static int wpa_driver_nl80211_send_actio } else { os_memset(bss->rand_addr, 0, ETH_ALEN); } @@ -38,7 +38,7 @@ Signed-off-by: Daniel Golle if (is_ap_interface(drv->nlmode) && (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) || (int) freq == bss->freq || drv->device_ap_sme || -@@ -7304,7 +7312,7 @@ static int wpa_driver_nl80211_send_actio +@@ -7201,7 +7209,7 @@ static int wpa_driver_nl80211_send_actio ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf, 24 + data_len, &drv->send_action_cookie, diff --git a/package/network/services/hostapd/patches/016-mesh-fix-channel-switch-error-during-CAC.patch b/package/network/services/hostapd/patches/016-mesh-fix-channel-switch-error-during-CAC.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/017-mesh-use-right-interface-context-to-send-DFS-event-m.patch b/package/network/services/hostapd/patches/017-mesh-use-right-interface-context-to-send-DFS-event-m.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch b/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch old mode 100755 new mode 100644 index 2eb2d7de07..682eb46503 --- a/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch +++ b/package/network/services/hostapd/patches/018-mesh-make-forwarding-configurable.patch @@ -1,7 +1,7 @@ -From 90fe6429624fc48bc0e5d2d7eeecb7498708b5e3 Mon Sep 17 00:00:00 2001 +From 9a01d7f21bd33725dc33325a437c3cc4185ee8bd Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Wed, 18 Apr 2018 19:24:31 +0200 -Subject: [PATCH 18/18] mesh: make forwarding configurable +Subject: [PATCH 16/16] mesh: make forwarding configurable Allow mesh_fwding to be specified in a mesh bss config, pass that to the driver (only nl80211 implemented for now) and announce @@ -31,7 +31,7 @@ Signed-off-by: Daniel Golle }; #define MAX_STA_COUNT 2007 -@@ -628,6 +629,7 @@ struct hostapd_bss_config { +@@ -624,6 +625,7 @@ struct hostapd_bss_config { #define MESH_ENABLED BIT(0) int mesh; @@ -41,7 +41,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1375,6 +1375,7 @@ struct wpa_driver_mesh_bss_params { +@@ -1363,6 +1363,7 @@ struct wpa_driver_mesh_bss_params { #define WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS 0x00000004 #define WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE 0x00000008 #define WPA_DRIVER_MESH_CONF_FLAG_RSSI_THRESHOLD 0x00000010 @@ -49,7 +49,7 @@ Signed-off-by: Daniel Golle /* * TODO: Other mesh configuration parameters would go here. * See NL80211_MESHCONF_* for all the mesh config parameters. -@@ -1384,6 +1385,7 @@ struct wpa_driver_mesh_bss_params { +@@ -1372,6 +1373,7 @@ struct wpa_driver_mesh_bss_params { int peer_link_timeout; int max_peer_links; int rssi_threshold; @@ -59,7 +59,7 @@ Signed-off-by: Daniel Golle --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9332,6 +9332,9 @@ static int nl80211_put_mesh_config(struc +@@ -9228,6 +9228,9 @@ static int nl80211_put_mesh_config(struc if (((params->flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) && nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, params->auto_plinks)) || @@ -71,7 +71,7 @@ Signed-off-by: Daniel Golle params->max_peer_links)) || --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2228,6 +2228,7 @@ static const struct parse_data ssid_fiel +@@ -2212,6 +2212,7 @@ static const struct parse_data ssid_fiel #ifdef CONFIG_MESH { INT_RANGE(mode, 0, 5) }, { INT_RANGE(no_auto_peer, 0, 1) }, @@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle { INT_RANGE(mesh_rssi_threshold, -255, 1) }, #else /* CONFIG_MESH */ { INT_RANGE(mode, 0, 4) }, -@@ -2779,6 +2780,7 @@ void wpa_config_set_network_defaults(str +@@ -2763,6 +2764,7 @@ void wpa_config_set_network_defaults(str ssid->dot11MeshRetryTimeout = DEFAULT_MESH_RETRY_TIMEOUT; ssid->dot11MeshConfirmTimeout = DEFAULT_MESH_CONFIRM_TIMEOUT; ssid->dot11MeshHoldingTimeout = DEFAULT_MESH_HOLDING_TIMEOUT; @@ -87,7 +87,7 @@ Signed-off-by: Daniel Golle ssid->mesh_rssi_threshold = DEFAULT_MESH_RSSI_THRESHOLD; #endif /* CONFIG_MESH */ #ifdef CONFIG_HT_OVERRIDES -@@ -3996,6 +3998,7 @@ struct wpa_config * wpa_config_alloc_emp +@@ -3978,6 +3980,7 @@ struct wpa_config * wpa_config_alloc_emp config->user_mpm = DEFAULT_USER_MPM; config->max_peer_links = DEFAULT_MAX_PEER_LINKS; config->mesh_max_inactivity = DEFAULT_MESH_MAX_INACTIVITY; @@ -95,7 +95,7 @@ Signed-off-by: Daniel Golle config->dot11RSNASAERetransPeriod = DEFAULT_DOT11_RSNA_SAE_RETRANS_PERIOD; config->fast_reauth = DEFAULT_FAST_REAUTH; -@@ -4618,6 +4621,7 @@ static const struct global_parse_data gl +@@ -4600,6 +4603,7 @@ static const struct global_parse_data gl { INT(user_mpm), 0 }, { INT_RANGE(max_peer_links, 0, 255), 0 }, { INT(mesh_max_inactivity), 0 }, @@ -193,7 +193,7 @@ Signed-off-by: Daniel Golle wpa_msg(wpa_s, MSG_ERROR, "Failed to init mesh"); --- a/wpa_supplicant/mesh_mpm.c +++ b/wpa_supplicant/mesh_mpm.c -@@ -289,9 +289,9 @@ static void mesh_mpm_send_plink_action(s +@@ -288,9 +288,9 @@ static void mesh_mpm_send_plink_action(s info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1; /* TODO: Add Connected to Mesh Gate/AS subfields */ wpabuf_put_u8(buf, info); diff --git a/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch b/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch new file mode 100644 index 0000000000..56554ef02f --- /dev/null +++ b/package/network/services/hostapd/patches/022-mesh-fix-crash-with-CONFIG_TAXONOMY-enabled.patch @@ -0,0 +1,23 @@ +From: Felix Fietkau +Date: Thu, 3 May 2018 12:34:31 +0200 +Subject: [PATCH] mesh: fix crash with CONFIG_TAXONOMY enabled + +wpa_s->ifmsh needs to be allocated using hostapd_alloc_iface() instead +of a direct call to os_zalloc, otherwise the linked list for station +taxonomy items remains uninitialized, leading to a crash on the first +attempt to traverse that list + +Signed-off-by: Felix Fietkau +--- + +--- a/wpa_supplicant/mesh.c ++++ b/wpa_supplicant/mesh.c +@@ -215,7 +215,7 @@ static int wpa_supplicant_mesh_init(stru + return 0; + } + +- wpa_s->ifmsh = ifmsh = os_zalloc(sizeof(*wpa_s->ifmsh)); ++ wpa_s->ifmsh = ifmsh = hostapd_alloc_iface(); + if (!ifmsh) + return -ENOMEM; + diff --git a/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch b/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch old mode 100755 new mode 100644 index de64a59372..925a53818d --- a/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch +++ b/package/network/services/hostapd/patches/031-mesh-add-VHT_CHANWIDTH_USE_HT-to-max_oper_chwidth.patch @@ -17,7 +17,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2818,6 +2818,7 @@ void wpa_config_set_network_defaults(str +@@ -2802,6 +2802,7 @@ void wpa_config_set_network_defaults(str ssid->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER; #endif /* CONFIG_MACSEC */ ssid->mac_addr = -1; @@ -37,7 +37,7 @@ Signed-off-by: Peter Oh struct dl_list list; --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2342,6 +2342,9 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2312,6 +2312,9 @@ void ibss_mesh_setup_freq(struct wpa_sup vht_caps |= VHT_CAP_SUPP_CHAN_WIDTH_160MHZ; seg0 = 114; } diff --git a/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch b/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch old mode 100755 new mode 100644 index 4691a79404..083bdfe1d1 --- a/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch +++ b/package/network/services/hostapd/patches/032-mesh-implement-use-of-VHT20-config-in-mesh-mode.patch @@ -33,7 +33,7 @@ Signed-off-by: Peter Oh --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2174,9 +2174,15 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2144,9 +2144,15 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!dfs_enabled) return; @@ -51,7 +51,7 @@ Signed-off-by: Peter Oh #endif /* CONFIG_HT_OVERRIDES */ /* Check/setup HT40+/HT40- */ -@@ -2204,8 +2210,6 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2174,8 +2180,6 @@ void ibss_mesh_setup_freq(struct wpa_sup if (!dfs_enabled) return; @@ -60,7 +60,7 @@ Signed-off-by: Peter Oh if (ht40 == -1) { if (!(pri_chan->flag & HOSTAPD_CHAN_HT40MINUS)) return; -@@ -2249,6 +2253,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2219,6 +2223,7 @@ void ibss_mesh_setup_freq(struct wpa_sup wpa_scan_results_free(scan_res); } @@ -68,7 +68,7 @@ Signed-off-by: Peter Oh wpa_printf(MSG_DEBUG, "IBSS/mesh: setup freq channel %d, sec_channel_offset %d", freq->channel, freq->sec_channel_offset); -@@ -2344,7 +2349,10 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2314,7 +2319,10 @@ void ibss_mesh_setup_freq(struct wpa_sup } } else if (ssid->max_oper_chwidth == VHT_CHANWIDTH_USE_HT) { chwidth = VHT_CHANWIDTH_USE_HT; diff --git a/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch b/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch new file mode 100644 index 0000000000..cb922ba1e2 --- /dev/null +++ b/package/network/services/hostapd/patches/033-mesh-fix-parsing-of-max_oper_chwidth.patch @@ -0,0 +1,45 @@ +From 444adf78eeb129e415d53fcb2fa2f05b6a69abdc Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Mon, 7 May 2018 15:24:29 +0200 +Subject: wpa_supplicant: Fix parsing of max_oper_chwidth + +The max_oper_chwidth is parsed in wpa_config_set as INT_RANGE (see +ssid_fields). The actual parsing for INT_RANGE is done by +wpa_config_parse_int which can only store the result as full integer. + +max_oper_chwidth is stored as u8 (a single byte) in wpa_ssid. This means +that on little endian systems, the least significant byte of the parsed +value are really stored in the max_oper_chwidth. But on big endian system, +the only most significant byte is stored as max_oper_chwidth. This means +that 0 is always stored because the provided range doesn't allow any other +value for systems with multi-byte-wide integers. + +This also means that for common systems with 4-byte-wide integers, the +remaining 3 bytes were written after the actual member of the struct. This +should not have influenced the behavior of succeeding members because these +bytes would have been part of the padding between the members on most +systems. + +Increasing its size to a full int fixes the write operations outside of the +member and allows to use the max_oper_chwidth setting on big endian +systems. + +Fixes: 0f29bc68d18e ("IBSS/mesh: Add support for VHT80P80 configuration") +Signed-off-by: Sven Eckelmann + +Forwarded: https://patchwork.ozlabs.org/patch/909751/ +--- + wpa_supplicant/config_ssid.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/wpa_supplicant/config_ssid.h ++++ b/wpa_supplicant/config_ssid.h +@@ -511,7 +511,7 @@ struct wpa_ssid { + + int vht; + +- u8 max_oper_chwidth; ++ int max_oper_chwidth; + + unsigned int vht_center_freq1; + unsigned int vht_center_freq2; diff --git a/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch b/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch deleted file mode 100755 index 66ffd9e48b..0000000000 --- a/package/network/services/hostapd/patches/040-FT-Fix-CONFIG_IEEE80211X-y-build-without-CONFIG_FILS.patch +++ /dev/null @@ -1,33 +0,0 @@ -From f2973fa39d6109f0f34969e91551a98dc340d537 Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Mon, 3 Dec 2018 12:00:26 +0200 -Subject: FT: Fix CONFIG_IEEE80211X=y build without CONFIG_FILS=y - -remove_ie() was defined within an ifdef CONFIG_FILS block while it is -now needed even without CONFIG_FILS=y. Remove the CONFIG_FILS condition -there. - -Fixes 8c41734e5de1 ("FT: Fix Reassociation Request IEs during FT protocol") -Signed-off-by: Jouni Malinen ---- - wpa_supplicant/sme.c | 2 -- - 1 file changed, 2 deletions(-) - ---- a/wpa_supplicant/sme.c -+++ b/wpa_supplicant/sme.c -@@ -1386,7 +1386,6 @@ void sme_event_auth(struct wpa_supplican - } - - --#ifdef CONFIG_FILS - #ifdef CONFIG_IEEE80211R - static void remove_ie(u8 *buf, size_t *len, u8 eid) - { -@@ -1401,7 +1400,6 @@ static void remove_ie(u8 *buf, size_t *l - } - } - #endif /* CONFIG_IEEE80211R */ --#endif /* CONFIG_FILS */ - - - void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode, diff --git a/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch b/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch deleted file mode 100755 index 26842c97d5..0000000000 --- a/package/network/services/hostapd/patches/051-wpa_supplicant-fix-race-condition-in-mesh-mpm-new-pe.patch +++ /dev/null @@ -1,34 +0,0 @@ -From: Felix Fietkau -Date: Tue, 12 Feb 2019 14:22:43 +0100 -Subject: [PATCH v2] wpa_supplicant: fix race condition in mesh mpm new peer - handling - -When wpa_supplicant receives another new peer event before the first one -has been processed, it tries to add a station to the driver a second time -(which fails) and then tears down the station entry until another event -comes in. -Fix this by only adding a station to the driver if it didn't exist already. - -Signed-off-by: Felix Fietkau ---- - ---- a/wpa_supplicant/mesh_mpm.c -+++ b/wpa_supplicant/mesh_mpm.c -@@ -663,11 +663,12 @@ static struct sta_info * mesh_mpm_add_pe - } - - sta = ap_get_sta(data, addr); -- if (!sta) { -- sta = ap_sta_add(data, addr); -- if (!sta) -- return NULL; -- } -+ if (sta) -+ return NULL; -+ -+ sta = ap_sta_add(data, addr); -+ if (!sta) -+ return NULL; - - /* Set WMM by default since Mesh STAs are QoS STAs */ - sta->flags |= WLAN_STA_WMM; diff --git a/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch b/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch new file mode 100644 index 0000000000..6d35769e30 --- /dev/null +++ b/package/network/services/hostapd/patches/060-0001-EAP-pwd-Move-EC-group-initialization-to-earlier-step.patch @@ -0,0 +1,104 @@ +From 2a5c291881fa819325d0287d0763776edfcb1943 Mon Sep 17 00:00:00 2001 +From: Dan Harkins +Date: Fri, 25 May 2018 21:40:04 +0300 +Subject: [PATCH] EAP-pwd: Move EC group initialization to earlier step + +This is needed for adding support for salted passwords. + +Signed-off-by: Dan Harkins +--- + src/eap_common/eap_pwd_common.c | 32 +++++++++++++++++++++++--------- + src/eap_common/eap_pwd_common.h | 1 + + src/eap_peer/eap_pwd.c | 2 +- + src/eap_server/eap_server_pwd.c | 2 +- + 4 files changed, 26 insertions(+), 11 deletions(-) + +--- a/src/eap_common/eap_pwd_common.c ++++ b/src/eap_common/eap_pwd_common.c +@@ -81,6 +81,27 @@ static int eap_pwd_kdf(const u8 *key, si + } + + ++EAP_PWD_group * get_eap_pwd_group(u16 num) ++{ ++ EAP_PWD_group *grp; ++ ++ grp = os_zalloc(sizeof(EAP_PWD_group)); ++ if (!grp) ++ return NULL; ++ grp->group = crypto_ec_init(num); ++ if (!grp->group) { ++ wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group"); ++ os_free(grp); ++ return NULL; ++ } ++ ++ grp->group_num = num; ++ wpa_printf(MSG_INFO, "EAP-pwd: provisioned group %d", num); ++ ++ return grp; ++} ++ ++ + /* + * compute a "random" secret point on an elliptic curve based + * on the password and identities. +@@ -97,12 +118,8 @@ int compute_password_element(EAP_PWD_gro + size_t primebytelen, primebitlen; + struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL; + +- grp->pwe = NULL; +- grp->group = crypto_ec_init(num); +- if (!grp->group) { +- wpa_printf(MSG_INFO, "EAP-pwd: unable to create EC group"); +- goto fail; +- } ++ if (grp->pwe) ++ return -1; + + cofactor = crypto_bignum_init(); + grp->pwe = crypto_ec_point_init(grp->group); +@@ -234,11 +251,8 @@ int compute_password_element(EAP_PWD_gro + break; + } + wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr); +- grp->group_num = num; + if (0) { + fail: +- crypto_ec_deinit(grp->group); +- grp->group = NULL; + crypto_ec_point_deinit(grp->pwe, 1); + grp->pwe = NULL; + ret = 1; +--- a/src/eap_common/eap_pwd_common.h ++++ b/src/eap_common/eap_pwd_common.h +@@ -50,6 +50,7 @@ struct eap_pwd_id { + } STRUCT_PACKED; + + /* common routines */ ++EAP_PWD_group * get_eap_pwd_group(u16 num); + int compute_password_element(EAP_PWD_group *grp, u16 num, + const u8 *password, size_t password_len, + const u8 *id_server, size_t id_server_len, +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -265,7 +265,7 @@ eap_pwd_perform_id_exchange(struct eap_s + wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of", + data->id_server, data->id_server_len); + +- data->grp = os_zalloc(sizeof(EAP_PWD_group)); ++ data->grp = get_eap_pwd_group(data->group_num); + if (data->grp == NULL) { + wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for " + "group"); +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -562,7 +562,7 @@ static void eap_pwd_process_id_resp(stru + wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of", + data->id_peer, data->id_peer_len); + +- data->grp = os_zalloc(sizeof(EAP_PWD_group)); ++ data->grp = get_eap_pwd_group(data->group_num); + if (data->grp == NULL) { + wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for " + "group"); diff --git a/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch b/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch new file mode 100644 index 0000000000..0a27abb9e9 --- /dev/null +++ b/package/network/services/hostapd/patches/060-0002-EAP-pwd-Mask-timing-of-PWE-derivation.patch @@ -0,0 +1,247 @@ +From 22ac3dfebf7b25a3aae02f9b4f69025bb4173137 Mon Sep 17 00:00:00 2001 +From: Dan Harkins +Date: Fri, 25 May 2018 21:40:04 +0300 +Subject: [PATCH] EAP-pwd: Mask timing of PWE derivation + +Run through the hunting-and-pecking loop 40 times to mask the time +necessary to find PWE. The odds of PWE not being found in 40 loops is +roughly 1 in 1 trillion. + +Signed-off-by: Dan Harkins +--- + src/eap_common/eap_pwd_common.c | 171 ++++++++++++++++++++++++-------- + 1 file changed, 130 insertions(+), 41 deletions(-) + +--- a/src/eap_common/eap_pwd_common.c ++++ b/src/eap_common/eap_pwd_common.c +@@ -112,18 +112,25 @@ int compute_password_element(EAP_PWD_gro + const u8 *id_peer, size_t id_peer_len, + const u8 *token) + { ++ struct crypto_bignum *qr = NULL, *qnr = NULL, *one = NULL; ++ struct crypto_bignum *tmp1 = NULL, *tmp2 = NULL, *pm1 = NULL; + struct crypto_hash *hash; + unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr; +- int is_odd, ret = 0; ++ int is_odd, ret = 0, check, found = 0; + size_t primebytelen, primebitlen; + struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL; ++ const struct crypto_bignum *prime; + + if (grp->pwe) + return -1; + ++ prime = crypto_ec_get_prime(grp->group); + cofactor = crypto_bignum_init(); + grp->pwe = crypto_ec_point_init(grp->group); +- if (!cofactor || !grp->pwe) { ++ tmp1 = crypto_bignum_init(); ++ pm1 = crypto_bignum_init(); ++ one = crypto_bignum_init_set((const u8 *) "\x01", 1); ++ if (!cofactor || !grp->pwe || !tmp1 || !pm1 || !one) { + wpa_printf(MSG_INFO, "EAP-pwd: unable to create bignums"); + goto fail; + } +@@ -140,15 +147,36 @@ int compute_password_element(EAP_PWD_gro + "buffer"); + goto fail; + } ++ if (crypto_bignum_sub(prime, one, pm1) < 0) ++ goto fail; ++ ++ /* get a random quadratic residue and nonresidue */ ++ while (!qr || !qnr) { ++ int res; ++ ++ if (crypto_bignum_rand(tmp1, prime) < 0) ++ goto fail; ++ res = crypto_bignum_legendre(tmp1, prime); ++ if (!qr && res == 1) { ++ qr = tmp1; ++ tmp1 = crypto_bignum_init(); ++ } else if (!qnr && res == -1) { ++ qnr = tmp1; ++ tmp1 = crypto_bignum_init(); ++ } ++ if (!tmp1) ++ goto fail; ++ } ++ + os_memset(prfbuf, 0, primebytelen); + ctr = 0; +- while (1) { +- if (ctr > 30) { +- wpa_printf(MSG_INFO, "EAP-pwd: unable to find random " +- "point on curve for group %d, something's " +- "fishy", num); +- goto fail; +- } ++ ++ /* ++ * Run through the hunting-and-pecking loop 40 times to mask the time ++ * necessary to find PWE. The odds of PWE not being found in 40 loops is ++ * roughly 1 in 1 trillion. ++ */ ++ while (ctr < 40) { + ctr++; + + /* +@@ -199,58 +227,113 @@ int compute_password_element(EAP_PWD_gro + x_candidate) < 0) + goto fail; + +- if (crypto_bignum_cmp(x_candidate, +- crypto_ec_get_prime(grp->group)) >= 0) ++ if (crypto_bignum_cmp(x_candidate, prime) >= 0) + continue; + + wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate", + prfbuf, primebytelen); + + /* +- * need to unambiguously identify the solution, if there is +- * one... ++ * compute y^2 using the equation of the curve ++ * ++ * y^2 = x^3 + ax + b + */ +- is_odd = crypto_bignum_is_odd(rnd); ++ tmp2 = crypto_ec_point_compute_y_sqr(grp->group, x_candidate); ++ if (!tmp2) ++ goto fail; + + /* +- * solve the quadratic equation, if it's not solvable then we +- * don't have a point ++ * mask tmp2 so doing legendre won't leak timing info ++ * ++ * tmp1 is a random number between 1 and p-1 + */ +- if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe, +- x_candidate, is_odd) != 0) { +- wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y"); +- continue; +- } ++ if (crypto_bignum_rand(tmp1, pm1) < 0 || ++ crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0 || ++ crypto_bignum_mulmod(tmp2, tmp1, prime, tmp2) < 0) ++ goto fail; ++ + /* +- * If there's a solution to the equation then the point must be +- * on the curve so why check again explicitly? OpenSSL code +- * says this is required by X9.62. We're not X9.62 but it can't +- * hurt just to be sure. ++ * Now tmp2 (y^2) is masked, all values between 1 and p-1 ++ * are equally probable. Multiplying by r^2 does not change ++ * whether or not tmp2 is a quadratic residue, just masks it. ++ * ++ * Flip a coin, multiply by the random quadratic residue or the ++ * random quadratic nonresidue and record heads or tails. + */ +- if (!crypto_ec_point_is_on_curve(grp->group, grp->pwe)) { +- wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve"); +- continue; ++ if (crypto_bignum_is_odd(tmp1)) { ++ crypto_bignum_mulmod(tmp2, qr, prime, tmp2); ++ check = 1; ++ } else { ++ crypto_bignum_mulmod(tmp2, qnr, prime, tmp2); ++ check = -1; + } + +- if (!crypto_bignum_is_one(cofactor)) { +- /* make sure the point is not in a small sub-group */ +- if (crypto_ec_point_mul(grp->group, grp->pwe, +- cofactor, grp->pwe) != 0) { +- wpa_printf(MSG_INFO, "EAP-pwd: cannot " +- "multiply generator by order"); ++ /* ++ * Now it's safe to do legendre, if check is 1 then it's ++ * a straightforward test (multiplying by qr does not ++ * change result), if check is -1 then it's the opposite test ++ * (multiplying a qr by qnr would make a qnr). ++ */ ++ if (crypto_bignum_legendre(tmp2, prime) == check) { ++ if (found == 1) ++ continue; ++ ++ /* need to unambiguously identify the solution */ ++ is_odd = crypto_bignum_is_odd(rnd); ++ ++ /* ++ * We know x_candidate is a quadratic residue so set ++ * it here. ++ */ ++ if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe, ++ x_candidate, ++ is_odd) != 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Could not solve for y"); + continue; + } +- if (crypto_ec_point_is_at_infinity(grp->group, +- grp->pwe)) { +- wpa_printf(MSG_INFO, "EAP-pwd: point is at " +- "infinity"); ++ ++ /* ++ * If there's a solution to the equation then the point ++ * must be on the curve so why check again explicitly? ++ * OpenSSL code says this is required by X9.62. We're ++ * not X9.62 but it can't hurt just to be sure. ++ */ ++ if (!crypto_ec_point_is_on_curve(grp->group, ++ grp->pwe)) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: point is not on curve"); + continue; + } ++ ++ if (!crypto_bignum_is_one(cofactor)) { ++ /* make sure the point is not in a small ++ * sub-group */ ++ if (crypto_ec_point_mul(grp->group, grp->pwe, ++ cofactor, ++ grp->pwe) != 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: cannot multiply generator by order"); ++ continue; ++ } ++ if (crypto_ec_point_is_at_infinity(grp->group, ++ grp->pwe)) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: point is at infinity"); ++ continue; ++ } ++ } ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: found a PWE in %d tries", ctr); ++ found = 1; + } +- /* if we got here then we have a new generator. */ +- break; + } +- wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %d tries", ctr); ++ if (found == 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: unable to find random point on curve for group %d, something's fishy", ++ num); ++ goto fail; ++ } + if (0) { + fail: + crypto_ec_point_deinit(grp->pwe, 1); +@@ -261,6 +344,12 @@ int compute_password_element(EAP_PWD_gro + crypto_bignum_deinit(cofactor, 1); + crypto_bignum_deinit(x_candidate, 1); + crypto_bignum_deinit(rnd, 1); ++ crypto_bignum_deinit(pm1, 0); ++ crypto_bignum_deinit(tmp1, 1); ++ crypto_bignum_deinit(tmp2, 1); ++ crypto_bignum_deinit(qr, 1); ++ crypto_bignum_deinit(qnr, 1); ++ crypto_bignum_deinit(one, 0); + os_free(prfbuf); + + return ret; diff --git a/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch b/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch new file mode 100644 index 0000000000..8e6a8cfec3 --- /dev/null +++ b/package/network/services/hostapd/patches/061-0001-OpenSSL-Use-constant-time-operations-for-private-big.patch @@ -0,0 +1,88 @@ +From d42c477cc794163a3757956bbffca5cea000923c Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 26 Feb 2019 11:43:03 +0200 +Subject: [PATCH 01/14] OpenSSL: Use constant time operations for private + bignums + +This helps in reducing measurable timing differences in operations +involving private information. BoringSSL has removed BN_FLG_CONSTTIME +and expects specific constant time functions to be called instead, so a +bit different approach is needed depending on which library is used. + +The main operation that needs protection against side channel attacks is +BN_mod_exp() that depends on private keys (the public key validation +step in crypto_dh_derive_secret() is an exception that can use the +faster version since it does not depend on private keys). + +crypto_bignum_div() is currently used only in SAE FFC case with not +safe-prime groups and only with values that do not depend on private +keys, so it is not critical to protect it. + +crypto_bignum_inverse() is currently used only in SAE FFC PWE +derivation. The additional protection here is targeting only OpenSSL. +BoringSSL may need conversion to using BN_mod_inverse_blinded(). + +This is related to CVE-2019-9494 and CVE-2019-9495. + +Signed-off-by: Jouni Malinen +--- + src/crypto/crypto_openssl.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/src/crypto/crypto_openssl.c ++++ b/src/crypto/crypto_openssl.c +@@ -548,7 +548,8 @@ int crypto_mod_exp(const u8 *base, size_ + bn_result == NULL) + goto error; + +- if (BN_mod_exp(bn_result, bn_base, bn_exp, bn_modulus, ctx) != 1) ++ if (BN_mod_exp_mont_consttime(bn_result, bn_base, bn_exp, bn_modulus, ++ ctx, NULL) != 1) + goto error; + + *result_len = BN_bn2bin(bn_result, result); +@@ -1294,8 +1295,9 @@ int crypto_bignum_exptmod(const struct c + bnctx = BN_CTX_new(); + if (bnctx == NULL) + return -1; +- res = BN_mod_exp((BIGNUM *) d, (const BIGNUM *) a, (const BIGNUM *) b, +- (const BIGNUM *) c, bnctx); ++ res = BN_mod_exp_mont_consttime((BIGNUM *) d, (const BIGNUM *) a, ++ (const BIGNUM *) b, (const BIGNUM *) c, ++ bnctx, NULL); + BN_CTX_free(bnctx); + + return res ? 0 : -1; +@@ -1314,6 +1316,11 @@ int crypto_bignum_inverse(const struct c + bnctx = BN_CTX_new(); + if (bnctx == NULL) + return -1; ++#ifdef OPENSSL_IS_BORINGSSL ++ /* TODO: use BN_mod_inverse_blinded() ? */ ++#else /* OPENSSL_IS_BORINGSSL */ ++ BN_set_flags((BIGNUM *) a, BN_FLG_CONSTTIME); ++#endif /* OPENSSL_IS_BORINGSSL */ + res = BN_mod_inverse((BIGNUM *) c, (const BIGNUM *) a, + (const BIGNUM *) b, bnctx); + BN_CTX_free(bnctx); +@@ -1347,6 +1354,9 @@ int crypto_bignum_div(const struct crypt + bnctx = BN_CTX_new(); + if (bnctx == NULL) + return -1; ++#ifndef OPENSSL_IS_BORINGSSL ++ BN_set_flags((BIGNUM *) a, BN_FLG_CONSTTIME); ++#endif /* OPENSSL_IS_BORINGSSL */ + res = BN_div((BIGNUM *) c, NULL, (const BIGNUM *) a, + (const BIGNUM *) b, bnctx); + BN_CTX_free(bnctx); +@@ -1438,8 +1448,8 @@ int crypto_bignum_legendre(const struct + /* exp = (p-1) / 2 */ + !BN_sub(exp, (const BIGNUM *) p, BN_value_one()) || + !BN_rshift1(exp, exp) || +- !BN_mod_exp(tmp, (const BIGNUM *) a, exp, (const BIGNUM *) p, +- bnctx)) ++ !BN_mod_exp_mont_consttime(tmp, (const BIGNUM *) a, exp, ++ (const BIGNUM *) p, bnctx, NULL)) + goto fail; + + if (BN_is_word(tmp, 1)) diff --git a/package/network/services/hostapd/patches/061-0002-Add-helper-functions-for-constant-time-operations.patch b/package/network/services/hostapd/patches/061-0002-Add-helper-functions-for-constant-time-operations.patch new file mode 100644 index 0000000000..87e41aea87 --- /dev/null +++ b/package/network/services/hostapd/patches/061-0002-Add-helper-functions-for-constant-time-operations.patch @@ -0,0 +1,212 @@ +From 6e34f618d37ddbb5854c42e2ad4fca83492fa7b7 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Wed, 27 Feb 2019 18:38:30 +0200 +Subject: [PATCH 02/14] Add helper functions for constant time operations + +These functions can be used to help implement constant time operations +for various cryptographic operations that must minimize externally +observable differences in processing (both in timing and also in +internal cache use, etc.). + +This is related to CVE-2019-9494 and CVE-2019-9495. + +Signed-off-by: Jouni Malinen +--- + src/utils/const_time.h | 191 +++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 191 insertions(+) + create mode 100644 src/utils/const_time.h + +--- /dev/null ++++ b/src/utils/const_time.h +@@ -0,0 +1,191 @@ ++/* ++ * Helper functions for constant time operations ++ * Copyright (c) 2019, The Linux Foundation ++ * ++ * This software may be distributed under the terms of the BSD license. ++ * See README for more details. ++ * ++ * These helper functions can be used to implement logic that needs to minimize ++ * externally visible differences in execution path by avoiding use of branches, ++ * avoiding early termination or other time differences, and forcing same memory ++ * access pattern regardless of values. ++ */ ++ ++#ifndef CONST_TIME_H ++#define CONST_TIME_H ++ ++ ++#if defined(__clang__) ++#define NO_UBSAN_UINT_OVERFLOW \ ++ __attribute__((no_sanitize("unsigned-integer-overflow"))) ++#else ++#define NO_UBSAN_UINT_OVERFLOW ++#endif ++ ++ ++/** ++ * const_time_fill_msb - Fill all bits with MSB value ++ * @val: Input value ++ * Returns: Value with all the bits set to the MSB of the input val ++ */ ++static inline unsigned int const_time_fill_msb(unsigned int val) ++{ ++ /* Move the MSB to LSB and multiple by -1 to fill in all bits. */ ++ return (val >> (sizeof(val) * 8 - 1)) * ~0U; ++} ++ ++ ++/* Returns: -1 if val is zero; 0 if val is not zero */ ++static inline unsigned int const_time_is_zero(unsigned int val) ++ NO_UBSAN_UINT_OVERFLOW ++{ ++ /* Set MSB to 1 for 0 and fill rest of bits with the MSB value */ ++ return const_time_fill_msb(~val & (val - 1)); ++} ++ ++ ++/* Returns: -1 if a == b; 0 if a != b */ ++static inline unsigned int const_time_eq(unsigned int a, unsigned int b) ++{ ++ return const_time_is_zero(a ^ b); ++} ++ ++ ++/* Returns: -1 if a == b; 0 if a != b */ ++static inline u8 const_time_eq_u8(unsigned int a, unsigned int b) ++{ ++ return (u8) const_time_eq(a, b); ++} ++ ++ ++/** ++ * const_time_eq_bin - Constant time memory comparison ++ * @a: First buffer to compare ++ * @b: Second buffer to compare ++ * @len: Number of octets to compare ++ * Returns: -1 if buffers are equal, 0 if not ++ * ++ * This function is meant for comparing passwords or hash values where ++ * difference in execution time or memory access pattern could provide external ++ * observer information about the location of the difference in the memory ++ * buffers. The return value does not behave like memcmp(), i.e., ++ * const_time_eq_bin() cannot be used to sort items into a defined order. Unlike ++ * memcmp(), the execution time of const_time_eq_bin() does not depend on the ++ * contents of the compared memory buffers, but only on the total compared ++ * length. ++ */ ++static inline unsigned int const_time_eq_bin(const void *a, const void *b, ++ size_t len) ++{ ++ const u8 *aa = a; ++ const u8 *bb = b; ++ size_t i; ++ u8 res = 0; ++ ++ for (i = 0; i < len; i++) ++ res |= aa[i] ^ bb[i]; ++ ++ return const_time_is_zero(res); ++} ++ ++ ++/** ++ * const_time_select - Constant time unsigned int selection ++ * @mask: 0 (false) or -1 (true) to identify which value to select ++ * @true_val: Value to select for the true case ++ * @false_val: Value to select for the false case ++ * Returns: true_val if mask == -1, false_val if mask == 0 ++ */ ++static inline unsigned int const_time_select(unsigned int mask, ++ unsigned int true_val, ++ unsigned int false_val) ++{ ++ return (mask & true_val) | (~mask & false_val); ++} ++ ++ ++/** ++ * const_time_select_int - Constant time int selection ++ * @mask: 0 (false) or -1 (true) to identify which value to select ++ * @true_val: Value to select for the true case ++ * @false_val: Value to select for the false case ++ * Returns: true_val if mask == -1, false_val if mask == 0 ++ */ ++static inline int const_time_select_int(unsigned int mask, int true_val, ++ int false_val) ++{ ++ return (int) const_time_select(mask, (unsigned int) true_val, ++ (unsigned int) false_val); ++} ++ ++ ++/** ++ * const_time_select_u8 - Constant time u8 selection ++ * @mask: 0 (false) or -1 (true) to identify which value to select ++ * @true_val: Value to select for the true case ++ * @false_val: Value to select for the false case ++ * Returns: true_val if mask == -1, false_val if mask == 0 ++ */ ++static inline u8 const_time_select_u8(u8 mask, u8 true_val, u8 false_val) ++{ ++ return (u8) const_time_select(mask, true_val, false_val); ++} ++ ++ ++/** ++ * const_time_select_s8 - Constant time s8 selection ++ * @mask: 0 (false) or -1 (true) to identify which value to select ++ * @true_val: Value to select for the true case ++ * @false_val: Value to select for the false case ++ * Returns: true_val if mask == -1, false_val if mask == 0 ++ */ ++static inline s8 const_time_select_s8(u8 mask, s8 true_val, s8 false_val) ++{ ++ return (s8) const_time_select(mask, (unsigned int) true_val, ++ (unsigned int) false_val); ++} ++ ++ ++/** ++ * const_time_select_bin - Constant time binary buffer selection copy ++ * @mask: 0 (false) or -1 (true) to identify which value to copy ++ * @true_val: Buffer to copy for the true case ++ * @false_val: Buffer to copy for the false case ++ * @len: Number of octets to copy ++ * @dst: Destination buffer for the copy ++ * ++ * This function copies the specified buffer into the destination buffer using ++ * operations with identical memory access pattern regardless of which buffer ++ * is being copied. ++ */ ++static inline void const_time_select_bin(u8 mask, const u8 *true_val, ++ const u8 *false_val, size_t len, ++ u8 *dst) ++{ ++ size_t i; ++ ++ for (i = 0; i < len; i++) ++ dst[i] = const_time_select_u8(mask, true_val[i], false_val[i]); ++} ++ ++ ++static inline int const_time_memcmp(const void *a, const void *b, size_t len) ++{ ++ const u8 *aa = a; ++ const u8 *bb = b; ++ int diff, res = 0; ++ unsigned int mask; ++ ++ if (len == 0) ++ return 0; ++ do { ++ len--; ++ diff = (int) aa[len] - (int) bb[len]; ++ mask = const_time_is_zero((unsigned int) diff); ++ res = const_time_select_int(mask, res, diff); ++ } while (len); ++ ++ return res; ++} ++ ++#endif /* CONST_TIME_H */ diff --git a/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch b/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch new file mode 100644 index 0000000000..003985bdd2 --- /dev/null +++ b/package/network/services/hostapd/patches/061-0003-OpenSSL-Use-constant-time-selection-for-crypto_bignu.patch @@ -0,0 +1,55 @@ +From c93461c1d98f52681717a088776ab32fd97872b0 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Fri, 8 Mar 2019 00:24:12 +0200 +Subject: [PATCH 03/14] OpenSSL: Use constant time selection for + crypto_bignum_legendre() + +Get rid of the branches that depend on the result of the Legendre +operation. This is needed to avoid leaking information about different +temporary results in blinding mechanisms. + +This is related to CVE-2019-9494 and CVE-2019-9495. + +Signed-off-by: Jouni Malinen +--- + src/crypto/crypto_openssl.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/src/crypto/crypto_openssl.c ++++ b/src/crypto/crypto_openssl.c +@@ -24,6 +24,7 @@ + #endif /* CONFIG_ECC */ + + #include "common.h" ++#include "utils/const_time.h" + #include "wpabuf.h" + #include "dh_group5.h" + #include "sha1.h" +@@ -1434,6 +1435,7 @@ int crypto_bignum_legendre(const struct + BN_CTX *bnctx; + BIGNUM *exp = NULL, *tmp = NULL; + int res = -2; ++ unsigned int mask; + + if (TEST_FAIL()) + return -2; +@@ -1452,12 +1454,13 @@ int crypto_bignum_legendre(const struct + (const BIGNUM *) p, bnctx, NULL)) + goto fail; + +- if (BN_is_word(tmp, 1)) +- res = 1; +- else if (BN_is_zero(tmp)) +- res = 0; +- else +- res = -1; ++ /* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need to use ++ * constant time selection to avoid branches here. */ ++ res = -1; ++ mask = const_time_eq(BN_is_word(tmp, 1), 1); ++ res = const_time_select_int(mask, 1, res); ++ mask = const_time_eq(BN_is_zero(tmp), 1); ++ res = const_time_select_int(mask, 0, res); + + fail: + BN_clear_free(tmp); diff --git a/package/network/services/hostapd/patches/061-0005-SAE-Minimize-timing-differences-in-PWE-derivation.patch b/package/network/services/hostapd/patches/061-0005-SAE-Minimize-timing-differences-in-PWE-derivation.patch new file mode 100644 index 0000000000..e72a9cbe5a --- /dev/null +++ b/package/network/services/hostapd/patches/061-0005-SAE-Minimize-timing-differences-in-PWE-derivation.patch @@ -0,0 +1,242 @@ +From 6513db3e96c43c2e36805cf5ead349765d18eaf7 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 26 Feb 2019 13:05:09 +0200 +Subject: [PATCH 05/14] SAE: Minimize timing differences in PWE derivation + +The QR test result can provide information about the password to an +attacker, so try to minimize differences in how the +sae_test_pwd_seed_ecc() result is used. (CVE-2019-9494) + +Use heap memory for the dummy password to allow the same password length +to be used even with long passwords. + +Use constant time selection functions to track the real vs. dummy +variables so that the exact same operations can be performed for both QR +test results. + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 106 ++++++++++++++++++++++++++++++------------------------- + 1 file changed, 57 insertions(+), 49 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -9,6 +9,7 @@ + #include "includes.h" + + #include "common.h" ++#include "utils/const_time.h" + #include "crypto/crypto.h" + #include "crypto/sha256.h" + #include "crypto/random.h" +@@ -269,15 +270,12 @@ static int sae_test_pwd_seed_ecc(struct + const u8 *prime, + const struct crypto_bignum *qr, + const struct crypto_bignum *qnr, +- struct crypto_bignum **ret_x_cand) ++ u8 *pwd_value) + { +- u8 pwd_value[SAE_MAX_ECC_PRIME_LEN]; + struct crypto_bignum *y_sqr, *x_cand; + int res; + size_t bits; + +- *ret_x_cand = NULL; +- + wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); + + /* pwd-value = KDF-z(pwd-seed, "SAE Hunting and Pecking", p) */ +@@ -286,7 +284,7 @@ static int sae_test_pwd_seed_ecc(struct + prime, sae->tmp->prime_len, pwd_value, bits) < 0) + return -1; + if (bits % 8) +- buf_shift_right(pwd_value, sizeof(pwd_value), 8 - bits % 8); ++ buf_shift_right(pwd_value, sae->tmp->prime_len, 8 - bits % 8); + wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", + pwd_value, sae->tmp->prime_len); + +@@ -297,20 +295,13 @@ static int sae_test_pwd_seed_ecc(struct + if (!x_cand) + return -1; + y_sqr = crypto_ec_point_compute_y_sqr(sae->tmp->ec, x_cand); +- if (!y_sqr) { +- crypto_bignum_deinit(x_cand, 1); ++ crypto_bignum_deinit(x_cand, 1); ++ if (!y_sqr) + return -1; +- } + + res = is_quadratic_residue_blind(sae, prime, bits, qr, qnr, y_sqr); + crypto_bignum_deinit(y_sqr, 1); +- if (res <= 0) { +- crypto_bignum_deinit(x_cand, 1); +- return res; +- } +- +- *ret_x_cand = x_cand; +- return 1; ++ return res; + } + + +@@ -431,25 +422,30 @@ static int sae_derive_pwe_ecc(struct sae + const u8 *addr[3]; + size_t len[3]; + size_t num_elem; +- u8 dummy_password[32]; +- size_t dummy_password_len; ++ u8 *dummy_password, *tmp_password; + int pwd_seed_odd = 0; + u8 prime[SAE_MAX_ECC_PRIME_LEN]; + size_t prime_len; +- struct crypto_bignum *x = NULL, *qr, *qnr; ++ struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL; ++ u8 x_bin[SAE_MAX_ECC_PRIME_LEN]; ++ u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN]; + size_t bits; +- int res; +- +- dummy_password_len = password_len; +- if (dummy_password_len > sizeof(dummy_password)) +- dummy_password_len = sizeof(dummy_password); +- if (random_get_bytes(dummy_password, dummy_password_len) < 0) +- return -1; ++ int res = -1; ++ u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* ++ * mask */ ++ ++ os_memset(x_bin, 0, sizeof(x_bin)); ++ ++ dummy_password = os_malloc(password_len); ++ tmp_password = os_malloc(password_len); ++ if (!dummy_password || !tmp_password || ++ random_get_bytes(dummy_password, password_len) < 0) ++ goto fail; + + prime_len = sae->tmp->prime_len; + if (crypto_bignum_to_bin(sae->tmp->prime, prime, sizeof(prime), + prime_len) < 0) +- return -1; ++ goto fail; + bits = crypto_ec_prime_len_bits(sae->tmp->ec); + + /* +@@ -458,7 +454,7 @@ static int sae_derive_pwe_ecc(struct sae + */ + if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits, + &qr, &qnr) < 0) +- return -1; ++ goto fail; + + wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", + password, password_len); +@@ -474,7 +470,7 @@ static int sae_derive_pwe_ecc(struct sae + */ + sae_pwd_seed_key(addr1, addr2, addrs); + +- addr[0] = password; ++ addr[0] = tmp_password; + len[0] = password_len; + num_elem = 1; + if (identifier) { +@@ -491,9 +487,8 @@ static int sae_derive_pwe_ecc(struct sae + * attacks that attempt to determine the number of iterations required + * in the loop. + */ +- for (counter = 1; counter <= k || !x; counter++) { ++ for (counter = 1; counter <= k || !found; counter++) { + u8 pwd_seed[SHA256_MAC_LEN]; +- struct crypto_bignum *x_cand; + + if (counter > 200) { + /* This should not happen in practice */ +@@ -501,40 +496,49 @@ static int sae_derive_pwe_ecc(struct sae + break; + } + +- wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter); ++ wpa_printf(MSG_DEBUG, "SAE: counter = %03u", counter); ++ const_time_select_bin(found, dummy_password, password, ++ password_len, tmp_password); + if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem, + addr, len, pwd_seed) < 0) + break; + + res = sae_test_pwd_seed_ecc(sae, pwd_seed, +- prime, qr, qnr, &x_cand); ++ prime, qr, qnr, x_cand_bin); ++ const_time_select_bin(found, x_bin, x_cand_bin, prime_len, ++ x_bin); ++ pwd_seed_odd = const_time_select_u8( ++ found, pwd_seed_odd, ++ pwd_seed[SHA256_MAC_LEN - 1] & 0x01); ++ os_memset(pwd_seed, 0, sizeof(pwd_seed)); + if (res < 0) + goto fail; +- if (res > 0 && !x) { +- wpa_printf(MSG_DEBUG, +- "SAE: Selected pwd-seed with counter %u", +- counter); +- x = x_cand; +- pwd_seed_odd = pwd_seed[SHA256_MAC_LEN - 1] & 0x01; +- os_memset(pwd_seed, 0, sizeof(pwd_seed)); +- +- /* +- * Use a dummy password for the following rounds, if +- * any. +- */ +- addr[0] = dummy_password; +- len[0] = dummy_password_len; +- } else if (res > 0) { +- crypto_bignum_deinit(x_cand, 1); +- } ++ /* Need to minimize differences in handling res == 0 and 1 here ++ * to avoid differences in timing and instruction cache access, ++ * so use const_time_select_*() to make local copies of the ++ * values based on whether this loop iteration was the one that ++ * found the pwd-seed/x. */ ++ ++ /* found is 0 or 0xff here and res is 0 or 1. Bitwise OR of them ++ * (with res converted to 0/0xff) handles this in constant time. ++ */ ++ found |= res * 0xff; ++ wpa_printf(MSG_DEBUG, "SAE: pwd-seed result %d found=0x%02x", ++ res, found); + } + +- if (!x) { ++ if (!found) { + wpa_printf(MSG_DEBUG, "SAE: Could not generate PWE"); + res = -1; + goto fail; + } + ++ x = crypto_bignum_init_set(x_bin, prime_len); ++ if (!x) { ++ res = -1; ++ goto fail; ++ } ++ + if (!sae->tmp->pwe_ecc) + sae->tmp->pwe_ecc = crypto_ec_point_init(sae->tmp->ec); + if (!sae->tmp->pwe_ecc) +@@ -543,7 +547,6 @@ static int sae_derive_pwe_ecc(struct sae + res = crypto_ec_point_solve_y_coord(sae->tmp->ec, + sae->tmp->pwe_ecc, x, + pwd_seed_odd); +- crypto_bignum_deinit(x, 1); + if (res < 0) { + /* + * This should not happen since we already checked that there +@@ -555,6 +558,11 @@ static int sae_derive_pwe_ecc(struct sae + fail: + crypto_bignum_deinit(qr, 0); + crypto_bignum_deinit(qnr, 0); ++ os_free(dummy_password); ++ bin_clear_free(tmp_password, password_len); ++ crypto_bignum_deinit(x, 1); ++ os_memset(x_bin, 0, sizeof(x_bin)); ++ os_memset(x_cand_bin, 0, sizeof(x_cand_bin)); + + return res; + } diff --git a/package/network/services/hostapd/patches/061-0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch b/package/network/services/hostapd/patches/061-0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch new file mode 100644 index 0000000000..6d93cb2480 --- /dev/null +++ b/package/network/services/hostapd/patches/061-0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch @@ -0,0 +1,139 @@ +From 362704dda04507e7ebb8035122e83d9f0ae7c320 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 26 Feb 2019 19:34:38 +0200 +Subject: [PATCH 06/14] SAE: Avoid branches in is_quadratic_residue_blind() + +Make the non-failure path in the function proceed without branches based +on r_odd and in constant time to minimize risk of observable differences +in timing or cache use. (CVE-2019-9494) + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 64 ++++++++++++++++++++++++++++++++------------------------ + 1 file changed, 37 insertions(+), 27 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -209,12 +209,14 @@ get_rand_1_to_p_1(const u8 *prime, size_ + + static int is_quadratic_residue_blind(struct sae_data *sae, + const u8 *prime, size_t bits, +- const struct crypto_bignum *qr, +- const struct crypto_bignum *qnr, ++ const u8 *qr, const u8 *qnr, + const struct crypto_bignum *y_sqr) + { +- struct crypto_bignum *r, *num; ++ struct crypto_bignum *r, *num, *qr_or_qnr = NULL; + int r_odd, check, res = -1; ++ u8 qr_or_qnr_bin[SAE_MAX_ECC_PRIME_LEN]; ++ size_t prime_len = sae->tmp->prime_len; ++ unsigned int mask; + + /* + * Use the blinding technique to mask y_sqr while determining +@@ -225,7 +227,7 @@ static int is_quadratic_residue_blind(st + * r = a random number between 1 and p-1, inclusive + * num = (v * r * r) modulo p + */ +- r = get_rand_1_to_p_1(prime, sae->tmp->prime_len, bits, &r_odd); ++ r = get_rand_1_to_p_1(prime, prime_len, bits, &r_odd); + if (!r) + return -1; + +@@ -235,41 +237,45 @@ static int is_quadratic_residue_blind(st + crypto_bignum_mulmod(num, r, sae->tmp->prime, num) < 0) + goto fail; + +- if (r_odd) { +- /* +- * num = (num * qr) module p +- * LGR(num, p) = 1 ==> quadratic residue +- */ +- if (crypto_bignum_mulmod(num, qr, sae->tmp->prime, num) < 0) +- goto fail; +- check = 1; +- } else { +- /* +- * num = (num * qnr) module p +- * LGR(num, p) = -1 ==> quadratic residue +- */ +- if (crypto_bignum_mulmod(num, qnr, sae->tmp->prime, num) < 0) +- goto fail; +- check = -1; +- } ++ /* ++ * Need to minimize differences in handling different cases, so try to ++ * avoid branches and timing differences. ++ * ++ * If r_odd: ++ * num = (num * qr) module p ++ * LGR(num, p) = 1 ==> quadratic residue ++ * else: ++ * num = (num * qnr) module p ++ * LGR(num, p) = -1 ==> quadratic residue ++ */ ++ mask = const_time_is_zero(r_odd); ++ const_time_select_bin(mask, qnr, qr, prime_len, qr_or_qnr_bin); ++ qr_or_qnr = crypto_bignum_init_set(qr_or_qnr_bin, prime_len); ++ if (!qr_or_qnr || ++ crypto_bignum_mulmod(num, qr_or_qnr, sae->tmp->prime, num) < 0) ++ goto fail; ++ /* r_odd is 0 or 1; branchless version of check = r_odd ? 1 : -1, */ ++ check = const_time_select_int(mask, -1, 1); + + res = crypto_bignum_legendre(num, sae->tmp->prime); + if (res == -2) { + res = -1; + goto fail; + } +- res = res == check; ++ /* branchless version of res = res == check ++ * (res is -1, 0, or 1; check is -1 or 1) */ ++ mask = const_time_eq(res, check); ++ res = const_time_select_int(mask, 1, 0); + fail: + crypto_bignum_deinit(num, 1); + crypto_bignum_deinit(r, 1); ++ crypto_bignum_deinit(qr_or_qnr, 1); + return res; + } + + + static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed, +- const u8 *prime, +- const struct crypto_bignum *qr, +- const struct crypto_bignum *qnr, ++ const u8 *prime, const u8 *qr, const u8 *qnr, + u8 *pwd_value) + { + struct crypto_bignum *y_sqr, *x_cand; +@@ -429,6 +435,8 @@ static int sae_derive_pwe_ecc(struct sae + struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL; + u8 x_bin[SAE_MAX_ECC_PRIME_LEN]; + u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN]; ++ u8 qr_bin[SAE_MAX_ECC_PRIME_LEN]; ++ u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN]; + size_t bits; + int res = -1; + u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* +@@ -453,7 +461,9 @@ static int sae_derive_pwe_ecc(struct sae + * (qnr) modulo p for blinding purposes during the loop. + */ + if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits, +- &qr, &qnr) < 0) ++ &qr, &qnr) < 0 || ++ crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 || ++ crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0) + goto fail; + + wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", +@@ -504,7 +514,7 @@ static int sae_derive_pwe_ecc(struct sae + break; + + res = sae_test_pwd_seed_ecc(sae, pwd_seed, +- prime, qr, qnr, x_cand_bin); ++ prime, qr_bin, qnr_bin, x_cand_bin); + const_time_select_bin(found, x_bin, x_cand_bin, prime_len, + x_bin); + pwd_seed_odd = const_time_select_u8( diff --git a/package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch b/package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch new file mode 100644 index 0000000000..229d2b1070 --- /dev/null +++ b/package/network/services/hostapd/patches/061-0007-SAE-Mask-timing-of-MODP-groups-22-23-24.patch @@ -0,0 +1,113 @@ +From 90839597cc4016b33f00055b12d59174c62770a3 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sat, 2 Mar 2019 12:24:09 +0200 +Subject: [PATCH 07/14] SAE: Mask timing of MODP groups 22, 23, 24 + +These groups have significant probability of coming up with pwd-value +that is equal or greater than the prime and as such, need for going +through the PWE derivation loop multiple times. This can result in +sufficient timing different to allow an external observer to determine +how many rounds are needed and that can leak information about the used +password. + +Force at least 40 loop rounds for these MODP groups similarly to the ECC +group design to mask timing. This behavior is not described in IEEE Std +802.11-2016 for SAE, but it does not result in different values (i.e., +only different timing), so such implementation specific countermeasures +can be done without breaking interoperability with other implementation. + +Note: These MODP groups 22, 23, and 24 are not considered sufficiently +strong to be used with SAE (or more or less anything else). As such, +they should never be enabled in runtime configuration for any production +use cases. These changes to introduce additional protection to mask +timing is only for completeness of implementation and not an indication +that these groups should be used. + +This is related to CVE-2019-9494. + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 38 ++++++++++++++++++++++++++++---------- + 1 file changed, 28 insertions(+), 10 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -578,22 +578,27 @@ fail: + } + + ++static int sae_modp_group_require_masking(int group) ++{ ++ /* Groups for which pwd-value is likely to be >= p frequently */ ++ return group == 22 || group == 23 || group == 24; ++} ++ ++ + static int sae_derive_pwe_ffc(struct sae_data *sae, const u8 *addr1, + const u8 *addr2, const u8 *password, + size_t password_len, const char *identifier) + { +- u8 counter; ++ u8 counter, k; + u8 addrs[2 * ETH_ALEN]; + const u8 *addr[3]; + size_t len[3]; + size_t num_elem; + int found = 0; ++ struct crypto_bignum *pwe = NULL; + +- if (sae->tmp->pwe_ffc == NULL) { +- sae->tmp->pwe_ffc = crypto_bignum_init(); +- if (sae->tmp->pwe_ffc == NULL) +- return -1; +- } ++ crypto_bignum_deinit(sae->tmp->pwe_ffc, 1); ++ sae->tmp->pwe_ffc = NULL; + + wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", + password, password_len); +@@ -617,7 +622,9 @@ static int sae_derive_pwe_ffc(struct sae + len[num_elem] = sizeof(counter); + num_elem++; + +- for (counter = 1; !found; counter++) { ++ k = sae_modp_group_require_masking(sae->group) ? 40 : 1; ++ ++ for (counter = 1; counter <= k || !found; counter++) { + u8 pwd_seed[SHA256_MAC_LEN]; + int res; + +@@ -627,19 +634,30 @@ static int sae_derive_pwe_ffc(struct sae + break; + } + +- wpa_printf(MSG_DEBUG, "SAE: counter = %u", counter); ++ wpa_printf(MSG_DEBUG, "SAE: counter = %02u", counter); + if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem, + addr, len, pwd_seed) < 0) + break; +- res = sae_test_pwd_seed_ffc(sae, pwd_seed, sae->tmp->pwe_ffc); ++ if (!pwe) { ++ pwe = crypto_bignum_init(); ++ if (!pwe) ++ break; ++ } ++ res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe); + if (res < 0) + break; + if (res > 0) { +- wpa_printf(MSG_DEBUG, "SAE: Use this PWE"); + found = 1; ++ if (!sae->tmp->pwe_ffc) { ++ wpa_printf(MSG_DEBUG, "SAE: Use this PWE"); ++ sae->tmp->pwe_ffc = pwe; ++ pwe = NULL; ++ } + } + } + ++ crypto_bignum_deinit(pwe, 1); ++ + return found ? 0 : -1; + } + diff --git a/package/network/services/hostapd/patches/061-0008-SAE-Use-const_time-selection-for-PWE-in-FFC.patch b/package/network/services/hostapd/patches/061-0008-SAE-Use-const_time-selection-for-PWE-in-FFC.patch new file mode 100644 index 0000000000..47e1b3c68e --- /dev/null +++ b/package/network/services/hostapd/patches/061-0008-SAE-Use-const_time-selection-for-PWE-in-FFC.patch @@ -0,0 +1,100 @@ +From f8f20717f87eff1f025f48ed585c7684debacf72 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sat, 2 Mar 2019 12:45:33 +0200 +Subject: [PATCH 08/14] SAE: Use const_time selection for PWE in FFC + +This is an initial step towards making the FFC case use strictly +constant time operations similarly to the ECC case. +sae_test_pwd_seed_ffc() does not yet have constant time behavior, +though. + +This is related to CVE-2019-9494. + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 53 +++++++++++++++++++++++++++++++++++------------------ + 1 file changed, 35 insertions(+), 18 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -589,17 +589,28 @@ static int sae_derive_pwe_ffc(struct sae + const u8 *addr2, const u8 *password, + size_t password_len, const char *identifier) + { +- u8 counter, k; ++ u8 counter, k, sel_counter = 0; + u8 addrs[2 * ETH_ALEN]; + const u8 *addr[3]; + size_t len[3]; + size_t num_elem; +- int found = 0; +- struct crypto_bignum *pwe = NULL; ++ u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* ++ * mask */ ++ u8 mask; ++ struct crypto_bignum *pwe; ++ size_t prime_len = sae->tmp->prime_len * 8; ++ u8 *pwe_buf; + + crypto_bignum_deinit(sae->tmp->pwe_ffc, 1); + sae->tmp->pwe_ffc = NULL; + ++ /* Allocate a buffer to maintain selected and candidate PWE for constant ++ * time selection. */ ++ pwe_buf = os_zalloc(prime_len * 2); ++ pwe = crypto_bignum_init(); ++ if (!pwe_buf || !pwe) ++ goto fail; ++ + wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password", + password, password_len); + +@@ -638,27 +649,33 @@ static int sae_derive_pwe_ffc(struct sae + if (hmac_sha256_vector(addrs, sizeof(addrs), num_elem, + addr, len, pwd_seed) < 0) + break; +- if (!pwe) { +- pwe = crypto_bignum_init(); +- if (!pwe) +- break; +- } + res = sae_test_pwd_seed_ffc(sae, pwd_seed, pwe); ++ /* res is -1 for fatal failure, 0 if a valid PWE was not found, ++ * or 1 if a valid PWE was found. */ + if (res < 0) + break; +- if (res > 0) { +- found = 1; +- if (!sae->tmp->pwe_ffc) { +- wpa_printf(MSG_DEBUG, "SAE: Use this PWE"); +- sae->tmp->pwe_ffc = pwe; +- pwe = NULL; +- } +- } ++ /* Store the candidate PWE into the second half of pwe_buf and ++ * the selected PWE in the beginning of pwe_buf using constant ++ * time selection. */ ++ if (crypto_bignum_to_bin(pwe, pwe_buf + prime_len, prime_len, ++ prime_len) < 0) ++ break; ++ const_time_select_bin(found, pwe_buf, pwe_buf + prime_len, ++ prime_len, pwe_buf); ++ sel_counter = const_time_select_u8(found, sel_counter, counter); ++ mask = const_time_eq_u8(res, 1); ++ found = const_time_select_u8(found, found, mask); + } + +- crypto_bignum_deinit(pwe, 1); ++ if (!found) ++ goto fail; + +- return found ? 0 : -1; ++ wpa_printf(MSG_DEBUG, "SAE: Use PWE from counter = %02u", sel_counter); ++ sae->tmp->pwe_ffc = crypto_bignum_init_set(pwe_buf, prime_len); ++fail: ++ crypto_bignum_deinit(pwe, 1); ++ bin_clear_free(pwe_buf, prime_len * 2); ++ return sae->tmp->pwe_ffc ? 0 : -1; + } + + diff --git a/package/network/services/hostapd/patches/061-0009-SAE-Use-constant-time-operations-in-sae_test_pwd_see.patch b/package/network/services/hostapd/patches/061-0009-SAE-Use-constant-time-operations-in-sae_test_pwd_see.patch new file mode 100644 index 0000000000..150cbeb8ac --- /dev/null +++ b/package/network/services/hostapd/patches/061-0009-SAE-Use-constant-time-operations-in-sae_test_pwd_see.patch @@ -0,0 +1,133 @@ +From cff138b0747fa39765cbc641b66cfa5d7f1735d1 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Sat, 2 Mar 2019 16:05:56 +0200 +Subject: [PATCH 09/14] SAE: Use constant time operations in + sae_test_pwd_seed_ffc() + +Try to avoid showing externally visible timing or memory access +differences regardless of whether the derived pwd-value is smaller than +the group prime. + +This is related to CVE-2019-9494. + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 75 ++++++++++++++++++++++++++++++++++---------------------- + 1 file changed, 46 insertions(+), 29 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -311,14 +311,17 @@ static int sae_test_pwd_seed_ecc(struct + } + + ++/* Returns -1 on fatal failure, 0 if PWE cannot be derived from the provided ++ * pwd-seed, or 1 if a valid PWE was derived from pwd-seed. */ + static int sae_test_pwd_seed_ffc(struct sae_data *sae, const u8 *pwd_seed, + struct crypto_bignum *pwe) + { + u8 pwd_value[SAE_MAX_PRIME_LEN]; + size_t bits = sae->tmp->prime_len * 8; + u8 exp[1]; +- struct crypto_bignum *a, *b; +- int res; ++ struct crypto_bignum *a, *b = NULL; ++ int res, is_val; ++ u8 pwd_value_valid; + + wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-seed", pwd_seed, SHA256_MAC_LEN); + +@@ -330,16 +333,29 @@ static int sae_test_pwd_seed_ffc(struct + wpa_hexdump_key(MSG_DEBUG, "SAE: pwd-value", pwd_value, + sae->tmp->prime_len); + +- if (os_memcmp(pwd_value, sae->tmp->dh->prime, sae->tmp->prime_len) >= 0) +- { +- wpa_printf(MSG_DEBUG, "SAE: pwd-value >= p"); +- return 0; +- } ++ /* Check whether pwd-value < p */ ++ res = const_time_memcmp(pwd_value, sae->tmp->dh->prime, ++ sae->tmp->prime_len); ++ /* pwd-value >= p is invalid, so res is < 0 for the valid cases and ++ * the negative sign can be used to fill the mask for constant time ++ * selection */ ++ pwd_value_valid = const_time_fill_msb(res); ++ ++ /* If pwd-value >= p, force pwd-value to be < p and perform the ++ * calculations anyway to hide timing difference. The derived PWE will ++ * be ignored in that case. */ ++ pwd_value[0] = const_time_select_u8(pwd_value_valid, pwd_value[0], 0); + + /* PWE = pwd-value^((p-1)/r) modulo p */ + ++ res = -1; + a = crypto_bignum_init_set(pwd_value, sae->tmp->prime_len); ++ if (!a) ++ goto fail; + ++ /* This is an optimization based on the used group that does not depend ++ * on the password in any way, so it is fine to use separate branches ++ * for this step without constant time operations. */ + if (sae->tmp->dh->safe_prime) { + /* + * r = (p-1)/2 for the group used here, so this becomes: +@@ -353,33 +369,34 @@ static int sae_test_pwd_seed_ffc(struct + b = crypto_bignum_init_set(exp, sizeof(exp)); + if (b == NULL || + crypto_bignum_sub(sae->tmp->prime, b, b) < 0 || +- crypto_bignum_div(b, sae->tmp->order, b) < 0) { +- crypto_bignum_deinit(b, 0); +- b = NULL; +- } ++ crypto_bignum_div(b, sae->tmp->order, b) < 0) ++ goto fail; + } + +- if (a == NULL || b == NULL) +- res = -1; +- else +- res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe); +- +- crypto_bignum_deinit(a, 0); +- crypto_bignum_deinit(b, 0); +- +- if (res < 0) { +- wpa_printf(MSG_DEBUG, "SAE: Failed to calculate PWE"); +- return -1; +- } +- +- /* if (PWE > 1) --> found */ +- if (crypto_bignum_is_zero(pwe) || crypto_bignum_is_one(pwe)) { +- wpa_printf(MSG_DEBUG, "SAE: PWE <= 1"); +- return 0; +- } ++ if (!b) ++ goto fail; + +- wpa_printf(MSG_DEBUG, "SAE: PWE found"); +- return 1; ++ res = crypto_bignum_exptmod(a, b, sae->tmp->prime, pwe); ++ if (res < 0) ++ goto fail; ++ ++ /* There were no fatal errors in calculations, so determine the return ++ * value using constant time operations. We get here for number of ++ * invalid cases which are cleared here after having performed all the ++ * computation. PWE is valid if pwd-value was less than prime and ++ * PWE > 1. Start with pwd-value check first and then use constant time ++ * operations to clear res to 0 if PWE is 0 or 1. ++ */ ++ res = const_time_select_u8(pwd_value_valid, 1, 0); ++ is_val = crypto_bignum_is_zero(pwe); ++ res = const_time_select_u8(const_time_is_zero(is_val), res, 0); ++ is_val = crypto_bignum_is_one(pwe); ++ res = const_time_select_u8(const_time_is_zero(is_val), res, 0); ++ ++fail: ++ crypto_bignum_deinit(a, 1); ++ crypto_bignum_deinit(b, 1); ++ return res; + } + + diff --git a/package/network/services/hostapd/patches/062-0004-EAP-pwd-Use-constant-time-and-memory-access-for-find.patch b/package/network/services/hostapd/patches/062-0004-EAP-pwd-Use-constant-time-and-memory-access-for-find.patch new file mode 100644 index 0000000000..1870c497c4 --- /dev/null +++ b/package/network/services/hostapd/patches/062-0004-EAP-pwd-Use-constant-time-and-memory-access-for-find.patch @@ -0,0 +1,319 @@ +From aaf65feac67c3993935634eefe5bc76b9fce03aa Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 26 Feb 2019 11:59:45 +0200 +Subject: [PATCH 04/14] EAP-pwd: Use constant time and memory access for + finding the PWE + +This algorithm could leak information to external observers in form of +timing differences or memory access patterns (cache use). While the +previous implementation had protection against the most visible timing +differences (looping 40 rounds and masking the legendre operation), it +did not protect against memory access patterns between the two possible +code paths in the masking operations. That might be sufficient to allow +an unprivileged process running on the same device to be able to +determine which path is being executed through a cache attack and based +on that, determine information about the used password. + +Convert the PWE finding loop to use constant time functions and +identical memory access path without different branches for the QR/QNR +cases to minimize possible side-channel information similarly to the +changes done for SAE authentication. (CVE-2019-9495) + +Signed-off-by: Jouni Malinen +--- + src/eap_common/eap_pwd_common.c | 187 +++++++++++++++++++++------------------- + 1 file changed, 99 insertions(+), 88 deletions(-) + +--- a/src/eap_common/eap_pwd_common.c ++++ b/src/eap_common/eap_pwd_common.c +@@ -8,11 +8,15 @@ + + #include "includes.h" + #include "common.h" ++#include "utils/const_time.h" + #include "crypto/sha256.h" + #include "crypto/crypto.h" + #include "eap_defs.h" + #include "eap_pwd_common.h" + ++#define MAX_ECC_PRIME_LEN 66 ++ ++ + /* The random function H(x) = HMAC-SHA256(0^32, x) */ + struct crypto_hash * eap_pwd_h_init(void) + { +@@ -102,6 +106,15 @@ EAP_PWD_group * get_eap_pwd_group(u16 nu + } + + ++static void buf_shift_right(u8 *buf, size_t len, size_t bits) ++{ ++ size_t i; ++ for (i = len - 1; i > 0; i--) ++ buf[i] = (buf[i - 1] << (8 - bits)) | (buf[i] >> bits); ++ buf[0] >>= bits; ++} ++ ++ + /* + * compute a "random" secret point on an elliptic curve based + * on the password and identities. +@@ -113,17 +126,27 @@ int compute_password_element(EAP_PWD_gro + const u8 *token) + { + struct crypto_bignum *qr = NULL, *qnr = NULL, *one = NULL; ++ struct crypto_bignum *qr_or_qnr = NULL; ++ u8 qr_bin[MAX_ECC_PRIME_LEN]; ++ u8 qnr_bin[MAX_ECC_PRIME_LEN]; ++ u8 qr_or_qnr_bin[MAX_ECC_PRIME_LEN]; ++ u8 x_bin[MAX_ECC_PRIME_LEN]; + struct crypto_bignum *tmp1 = NULL, *tmp2 = NULL, *pm1 = NULL; + struct crypto_hash *hash; + unsigned char pwe_digest[SHA256_MAC_LEN], *prfbuf = NULL, ctr; +- int is_odd, ret = 0, check, found = 0; +- size_t primebytelen, primebitlen; +- struct crypto_bignum *x_candidate = NULL, *rnd = NULL, *cofactor = NULL; ++ int ret = 0, check, res; ++ u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_* ++ * mask */ ++ size_t primebytelen = 0, primebitlen; ++ struct crypto_bignum *x_candidate = NULL, *cofactor = NULL; + const struct crypto_bignum *prime; ++ u8 mask, found_ctr = 0, is_odd = 0; + + if (grp->pwe) + return -1; + ++ os_memset(x_bin, 0, sizeof(x_bin)); ++ + prime = crypto_ec_get_prime(grp->group); + cofactor = crypto_bignum_init(); + grp->pwe = crypto_ec_point_init(grp->group); +@@ -152,8 +175,6 @@ int compute_password_element(EAP_PWD_gro + + /* get a random quadratic residue and nonresidue */ + while (!qr || !qnr) { +- int res; +- + if (crypto_bignum_rand(tmp1, prime) < 0) + goto fail; + res = crypto_bignum_legendre(tmp1, prime); +@@ -167,6 +188,11 @@ int compute_password_element(EAP_PWD_gro + if (!tmp1) + goto fail; + } ++ if (crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), ++ primebytelen) < 0 || ++ crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), ++ primebytelen) < 0) ++ goto fail; + + os_memset(prfbuf, 0, primebytelen); + ctr = 0; +@@ -194,17 +220,16 @@ int compute_password_element(EAP_PWD_gro + eap_pwd_h_update(hash, &ctr, sizeof(ctr)); + eap_pwd_h_final(hash, pwe_digest); + +- crypto_bignum_deinit(rnd, 1); +- rnd = crypto_bignum_init_set(pwe_digest, SHA256_MAC_LEN); +- if (!rnd) { +- wpa_printf(MSG_INFO, "EAP-pwd: unable to create rnd"); +- goto fail; +- } ++ is_odd = const_time_select_u8( ++ found, is_odd, pwe_digest[SHA256_MAC_LEN - 1] & 0x01); + if (eap_pwd_kdf(pwe_digest, SHA256_MAC_LEN, + (u8 *) "EAP-pwd Hunting And Pecking", + os_strlen("EAP-pwd Hunting And Pecking"), + prfbuf, primebitlen) < 0) + goto fail; ++ if (primebitlen % 8) ++ buf_shift_right(prfbuf, primebytelen, ++ 8 - primebitlen % 8); + + crypto_bignum_deinit(x_candidate, 1); + x_candidate = crypto_bignum_init_set(prfbuf, primebytelen); +@@ -214,24 +239,13 @@ int compute_password_element(EAP_PWD_gro + goto fail; + } + +- /* +- * eap_pwd_kdf() returns a string of bits 0..primebitlen but +- * BN_bin2bn will treat that string of bits as a big endian +- * number. If the primebitlen is not an even multiple of 8 +- * then excessive bits-- those _after_ primebitlen-- so now +- * we have to shift right the amount we masked off. +- */ +- if ((primebitlen % 8) && +- crypto_bignum_rshift(x_candidate, +- (8 - (primebitlen % 8)), +- x_candidate) < 0) +- goto fail; +- + if (crypto_bignum_cmp(x_candidate, prime) >= 0) + continue; + +- wpa_hexdump(MSG_DEBUG, "EAP-pwd: x_candidate", +- prfbuf, primebytelen); ++ wpa_hexdump_key(MSG_DEBUG, "EAP-pwd: x_candidate", ++ prfbuf, primebytelen); ++ const_time_select_bin(found, x_bin, prfbuf, primebytelen, ++ x_bin); + + /* + * compute y^2 using the equation of the curve +@@ -260,13 +274,15 @@ int compute_password_element(EAP_PWD_gro + * Flip a coin, multiply by the random quadratic residue or the + * random quadratic nonresidue and record heads or tails. + */ +- if (crypto_bignum_is_odd(tmp1)) { +- crypto_bignum_mulmod(tmp2, qr, prime, tmp2); +- check = 1; +- } else { +- crypto_bignum_mulmod(tmp2, qnr, prime, tmp2); +- check = -1; +- } ++ mask = const_time_eq_u8(crypto_bignum_is_odd(tmp1), 1); ++ check = const_time_select_s8(mask, 1, -1); ++ const_time_select_bin(mask, qr_bin, qnr_bin, primebytelen, ++ qr_or_qnr_bin); ++ crypto_bignum_deinit(qr_or_qnr, 1); ++ qr_or_qnr = crypto_bignum_init_set(qr_or_qnr_bin, primebytelen); ++ if (!qr_or_qnr || ++ crypto_bignum_mulmod(tmp2, qr_or_qnr, prime, tmp2) < 0) ++ goto fail; + + /* + * Now it's safe to do legendre, if check is 1 then it's +@@ -274,59 +290,12 @@ int compute_password_element(EAP_PWD_gro + * change result), if check is -1 then it's the opposite test + * (multiplying a qr by qnr would make a qnr). + */ +- if (crypto_bignum_legendre(tmp2, prime) == check) { +- if (found == 1) +- continue; +- +- /* need to unambiguously identify the solution */ +- is_odd = crypto_bignum_is_odd(rnd); +- +- /* +- * We know x_candidate is a quadratic residue so set +- * it here. +- */ +- if (crypto_ec_point_solve_y_coord(grp->group, grp->pwe, +- x_candidate, +- is_odd) != 0) { +- wpa_printf(MSG_INFO, +- "EAP-pwd: Could not solve for y"); +- continue; +- } +- +- /* +- * If there's a solution to the equation then the point +- * must be on the curve so why check again explicitly? +- * OpenSSL code says this is required by X9.62. We're +- * not X9.62 but it can't hurt just to be sure. +- */ +- if (!crypto_ec_point_is_on_curve(grp->group, +- grp->pwe)) { +- wpa_printf(MSG_INFO, +- "EAP-pwd: point is not on curve"); +- continue; +- } +- +- if (!crypto_bignum_is_one(cofactor)) { +- /* make sure the point is not in a small +- * sub-group */ +- if (crypto_ec_point_mul(grp->group, grp->pwe, +- cofactor, +- grp->pwe) != 0) { +- wpa_printf(MSG_INFO, +- "EAP-pwd: cannot multiply generator by order"); +- continue; +- } +- if (crypto_ec_point_is_at_infinity(grp->group, +- grp->pwe)) { +- wpa_printf(MSG_INFO, +- "EAP-pwd: point is at infinity"); +- continue; +- } +- } +- wpa_printf(MSG_DEBUG, +- "EAP-pwd: found a PWE in %d tries", ctr); +- found = 1; +- } ++ res = crypto_bignum_legendre(tmp2, prime); ++ if (res == -2) ++ goto fail; ++ mask = const_time_eq(res, check); ++ found_ctr = const_time_select_u8(found, found_ctr, ctr); ++ found |= mask; + } + if (found == 0) { + wpa_printf(MSG_INFO, +@@ -334,6 +303,44 @@ int compute_password_element(EAP_PWD_gro + num); + goto fail; + } ++ ++ /* ++ * We know x_candidate is a quadratic residue so set it here. ++ */ ++ crypto_bignum_deinit(x_candidate, 1); ++ x_candidate = crypto_bignum_init_set(x_bin, primebytelen); ++ if (!x_candidate || ++ crypto_ec_point_solve_y_coord(grp->group, grp->pwe, x_candidate, ++ is_odd) != 0) { ++ wpa_printf(MSG_INFO, "EAP-pwd: Could not solve for y"); ++ goto fail; ++ } ++ ++ /* ++ * If there's a solution to the equation then the point must be on the ++ * curve so why check again explicitly? OpenSSL code says this is ++ * required by X9.62. We're not X9.62 but it can't hurt just to be sure. ++ */ ++ if (!crypto_ec_point_is_on_curve(grp->group, grp->pwe)) { ++ wpa_printf(MSG_INFO, "EAP-pwd: point is not on curve"); ++ goto fail; ++ } ++ ++ if (!crypto_bignum_is_one(cofactor)) { ++ /* make sure the point is not in a small sub-group */ ++ if (crypto_ec_point_mul(grp->group, grp->pwe, cofactor, ++ grp->pwe) != 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: cannot multiply generator by order"); ++ goto fail; ++ } ++ if (crypto_ec_point_is_at_infinity(grp->group, grp->pwe)) { ++ wpa_printf(MSG_INFO, "EAP-pwd: point is at infinity"); ++ goto fail; ++ } ++ } ++ wpa_printf(MSG_DEBUG, "EAP-pwd: found a PWE in %02d tries", found_ctr); ++ + if (0) { + fail: + crypto_ec_point_deinit(grp->pwe, 1); +@@ -343,14 +350,18 @@ int compute_password_element(EAP_PWD_gro + /* cleanliness and order.... */ + crypto_bignum_deinit(cofactor, 1); + crypto_bignum_deinit(x_candidate, 1); +- crypto_bignum_deinit(rnd, 1); + crypto_bignum_deinit(pm1, 0); + crypto_bignum_deinit(tmp1, 1); + crypto_bignum_deinit(tmp2, 1); + crypto_bignum_deinit(qr, 1); + crypto_bignum_deinit(qnr, 1); ++ crypto_bignum_deinit(qr_or_qnr, 1); + crypto_bignum_deinit(one, 0); +- os_free(prfbuf); ++ bin_clear_free(prfbuf, primebytelen); ++ os_memset(qr_bin, 0, sizeof(qr_bin)); ++ os_memset(qnr_bin, 0, sizeof(qnr_bin)); ++ os_memset(qr_or_qnr_bin, 0, sizeof(qr_or_qnr_bin)); ++ os_memset(pwe_digest, 0, sizeof(pwe_digest)); + + return ret; + } diff --git a/package/network/services/hostapd/patches/063-0010-SAE-Fix-confirm-message-validation-in-error-cases.patch b/package/network/services/hostapd/patches/063-0010-SAE-Fix-confirm-message-validation-in-error-cases.patch new file mode 100644 index 0000000000..3a3658e640 --- /dev/null +++ b/package/network/services/hostapd/patches/063-0010-SAE-Fix-confirm-message-validation-in-error-cases.patch @@ -0,0 +1,52 @@ +From ac8fa9ef198640086cf2ce7c94673be2b6a018a0 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 5 Mar 2019 23:43:25 +0200 +Subject: [PATCH 10/14] SAE: Fix confirm message validation in error cases + +Explicitly verify that own and peer commit scalar/element are available +when trying to check SAE confirm message. It could have been possible to +hit a NULL pointer dereference if the peer element could not have been +parsed. (CVE-2019-9496) + +Signed-off-by: Jouni Malinen +--- + src/common/sae.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/src/common/sae.c ++++ b/src/common/sae.c +@@ -1464,23 +1464,31 @@ int sae_check_confirm(struct sae_data *s + + wpa_printf(MSG_DEBUG, "SAE: peer-send-confirm %u", WPA_GET_LE16(data)); + +- if (sae->tmp == NULL) { ++ if (!sae->tmp || !sae->peer_commit_scalar || ++ !sae->tmp->own_commit_scalar) { + wpa_printf(MSG_DEBUG, "SAE: Temporary data not yet available"); + return -1; + } + +- if (sae->tmp->ec) ++ if (sae->tmp->ec) { ++ if (!sae->tmp->peer_commit_element_ecc || ++ !sae->tmp->own_commit_element_ecc) ++ return -1; + sae_cn_confirm_ecc(sae, data, sae->peer_commit_scalar, + sae->tmp->peer_commit_element_ecc, + sae->tmp->own_commit_scalar, + sae->tmp->own_commit_element_ecc, + verifier); +- else ++ } else { ++ if (!sae->tmp->peer_commit_element_ffc || ++ !sae->tmp->own_commit_element_ffc) ++ return -1; + sae_cn_confirm_ffc(sae, data, sae->peer_commit_scalar, + sae->tmp->peer_commit_element_ffc, + sae->tmp->own_commit_scalar, + sae->tmp->own_commit_element_ffc, + verifier); ++ } + + if (os_memcmp_const(verifier, data + 2, SHA256_MAC_LEN) != 0) { + wpa_printf(MSG_DEBUG, "SAE: Confirm mismatch"); diff --git a/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch new file mode 100644 index 0000000000..5e0d0d2078 --- /dev/null +++ b/package/network/services/hostapd/patches/064-0011-EAP-pwd-server-Verify-received-scalar-and-element.patch @@ -0,0 +1,53 @@ +From 70ff850e89fbc8bc7da515321b4d15b5eef70581 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Sun, 31 Mar 2019 17:13:06 +0200 +Subject: [PATCH 11/14] EAP-pwd server: Verify received scalar and element + +When processing an EAP-pwd Commit frame, the peer's scalar and element +(elliptic curve point) were not validated. This allowed an adversary to +bypass authentication, and impersonate any user if the crypto +implementation did not verify the validity of the EC point. + +Fix this vulnerability by assuring the received scalar lies within the +valid range, and by checking that the received element is not the point +at infinity and lies on the elliptic curve being used. (CVE-2019-9498) + +The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower +is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL +(and also BoringSSL) implicitly validate the elliptic curve point in +EC_POINT_set_affine_coordinates_GFp(), preventing the attack. + +Signed-off-by: Mathy Vanhoef +--- + src/eap_server/eap_server_pwd.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -653,6 +653,26 @@ eap_pwd_process_commit_resp(struct eap_s + goto fin; + } + ++ /* verify received scalar */ ++ if (crypto_bignum_is_zero(data->peer_scalar) || ++ crypto_bignum_is_one(data->peer_scalar) || ++ crypto_bignum_cmp(data->peer_scalar, ++ crypto_ec_get_order(data->grp->group)) >= 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (server): received scalar is invalid"); ++ goto fin; ++ } ++ ++ /* verify received element */ ++ if (!crypto_ec_point_is_on_curve(data->grp->group, ++ data->peer_element) || ++ crypto_ec_point_is_at_infinity(data->grp->group, ++ data->peer_element)) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (server): received element is invalid"); ++ goto fin; ++ } ++ + /* check to ensure peer's element is not in a small sub-group */ + if (!crypto_bignum_is_one(cofactor)) { + if (crypto_ec_point_mul(data->grp->group, data->peer_element, diff --git a/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch b/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch new file mode 100644 index 0000000000..340b23395f --- /dev/null +++ b/package/network/services/hostapd/patches/064-0012-EAP-pwd-server-Detect-reflection-attacks.patch @@ -0,0 +1,40 @@ +From d63edfa90243e9a7de6ae5c275032f2cc79fef95 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Sun, 31 Mar 2019 17:26:01 +0200 +Subject: [PATCH 12/14] EAP-pwd server: Detect reflection attacks + +When processing an EAP-pwd Commit frame, verify that the peer's scalar +and elliptic curve element differ from the one sent by the server. This +prevents reflection attacks where the adversary reflects the scalar and +element sent by the server. (CVE-2019-9497) + +The vulnerability allows an adversary to complete the EAP-pwd handshake +as any user. However, the adversary does not learn the negotiated +session key, meaning the subsequent 4-way handshake would fail. As a +result, this cannot be abused to bypass authentication unless EAP-pwd is +used in non-WLAN cases without any following key exchange that would +require the attacker to learn the MSK. + +Signed-off-by: Mathy Vanhoef +--- + src/eap_server/eap_server_pwd.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -688,6 +688,15 @@ eap_pwd_process_commit_resp(struct eap_s + } + } + ++ /* detect reflection attacks */ ++ if (crypto_bignum_cmp(data->my_scalar, data->peer_scalar) == 0 || ++ crypto_ec_point_cmp(data->grp->group, data->my_element, ++ data->peer_element) == 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (server): detected reflection attack!"); ++ goto fin; ++ } ++ + /* compute the shared key, k */ + if ((crypto_ec_point_mul(data->grp->group, data->grp->pwe, + data->peer_scalar, K) < 0) || diff --git a/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch b/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch new file mode 100644 index 0000000000..f20b491306 --- /dev/null +++ b/package/network/services/hostapd/patches/064-0013-EAP-pwd-client-Verify-received-scalar-and-element.patch @@ -0,0 +1,53 @@ +From 8ad8585f91823ddcc3728155e288e0f9f872e31a Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Sun, 31 Mar 2019 17:43:44 +0200 +Subject: [PATCH 13/14] EAP-pwd client: Verify received scalar and element + +When processing an EAP-pwd Commit frame, the server's scalar and element +(elliptic curve point) were not validated. This allowed an adversary to +bypass authentication, and act as a rogue Access Point (AP) if the +crypto implementation did not verify the validity of the EC point. + +Fix this vulnerability by assuring the received scalar lies within the +valid range, and by checking that the received element is not the point +at infinity and lies on the elliptic curve being used. (CVE-2019-9499) + +The vulnerability is only exploitable if OpenSSL version 1.0.2 or lower +is used, or if LibreSSL or wolfssl is used. Newer versions of OpenSSL +(and also BoringSSL) implicitly validate the elliptic curve point in +EC_POINT_set_affine_coordinates_GFp(), preventing the attack. + +Signed-off-by: Mathy Vanhoef +--- + src/eap_peer/eap_pwd.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -436,6 +436,26 @@ eap_pwd_perform_commit_exchange(struct e + goto fin; + } + ++ /* verify received scalar */ ++ if (crypto_bignum_is_zero(data->server_scalar) || ++ crypto_bignum_is_one(data->server_scalar) || ++ crypto_bignum_cmp(data->server_scalar, ++ crypto_ec_get_order(data->grp->group)) >= 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (peer): received scalar is invalid"); ++ goto fin; ++ } ++ ++ /* verify received element */ ++ if (!crypto_ec_point_is_on_curve(data->grp->group, ++ data->server_element) || ++ crypto_ec_point_is_at_infinity(data->grp->group, ++ data->server_element)) { ++ wpa_printf(MSG_INFO, ++ "EAP-PWD (peer): received element is invalid"); ++ goto fin; ++ } ++ + /* check to ensure server's element is not in a small sub-group */ + if (!crypto_bignum_is_one(cofactor)) { + if (crypto_ec_point_mul(data->grp->group, data->server_element, diff --git a/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch b/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch new file mode 100644 index 0000000000..17984312ff --- /dev/null +++ b/package/network/services/hostapd/patches/064-0014-EAP-pwd-Check-element-x-y-coordinates-explicitly.patch @@ -0,0 +1,321 @@ +From 16d4f1069118aa19bfce013493e1ac5783f92f1d Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Fri, 5 Apr 2019 02:12:50 +0300 +Subject: [PATCH 14/14] EAP-pwd: Check element x,y coordinates explicitly + +This adds an explicit check for 0 < x,y < prime based on RFC 5931, +2.8.5.2.2 requirement. The earlier checks might have covered this +implicitly, but it is safer to avoid any dependency on implicit checks +and specific crypto library behavior. (CVE-2019-9498 and CVE-2019-9499) + +Furthermore, this moves the EAP-pwd element and scalar parsing and +validation steps into shared helper functions so that there is no need +to maintain two separate copies of this common functionality between the +server and peer implementations. + +Signed-off-by: Jouni Malinen +--- + src/eap_common/eap_pwd_common.c | 106 ++++++++++++++++++++++++++++++++++++++++ + src/eap_common/eap_pwd_common.h | 3 ++ + src/eap_peer/eap_pwd.c | 45 ++--------------- + src/eap_server/eap_server_pwd.c | 45 ++--------------- + 4 files changed, 117 insertions(+), 82 deletions(-) + +--- a/src/eap_common/eap_pwd_common.c ++++ b/src/eap_common/eap_pwd_common.c +@@ -427,3 +427,109 @@ int compute_keys(EAP_PWD_group *grp, con + + return 1; + } ++ ++ ++static int eap_pwd_element_coord_ok(const struct crypto_bignum *prime, ++ const u8 *buf, size_t len) ++{ ++ struct crypto_bignum *val; ++ int ok = 1; ++ ++ val = crypto_bignum_init_set(buf, len); ++ if (!val || crypto_bignum_is_zero(val) || ++ crypto_bignum_cmp(val, prime) >= 0) ++ ok = 0; ++ crypto_bignum_deinit(val, 0); ++ return ok; ++} ++ ++ ++struct crypto_ec_point * eap_pwd_get_element(EAP_PWD_group *group, ++ const u8 *buf) ++{ ++ struct crypto_ec_point *element; ++ const struct crypto_bignum *prime; ++ size_t prime_len; ++ struct crypto_bignum *cofactor = NULL; ++ ++ prime = crypto_ec_get_prime(group->group); ++ prime_len = crypto_ec_prime_len(group->group); ++ ++ /* RFC 5931, 2.8.5.2.2: 0 < x,y < p */ ++ if (!eap_pwd_element_coord_ok(prime, buf, prime_len) || ++ !eap_pwd_element_coord_ok(prime, buf + prime_len, prime_len)) { ++ wpa_printf(MSG_INFO, "EAP-pwd: Invalid coordinate in element"); ++ return NULL; ++ } ++ ++ element = crypto_ec_point_from_bin(group->group, buf); ++ if (!element) { ++ wpa_printf(MSG_INFO, "EAP-pwd: EC point from element failed"); ++ return NULL; ++ } ++ ++ /* RFC 5931, 2.8.5.2.2: on curve and not the point at infinity */ ++ if (!crypto_ec_point_is_on_curve(group->group, element) || ++ crypto_ec_point_is_at_infinity(group->group, element)) { ++ wpa_printf(MSG_INFO, "EAP-pwd: Invalid element"); ++ goto fail; ++ } ++ ++ cofactor = crypto_bignum_init(); ++ if (!cofactor || crypto_ec_cofactor(group->group, cofactor) < 0) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Unable to get cofactor for curve"); ++ goto fail; ++ } ++ ++ if (!crypto_bignum_is_one(cofactor)) { ++ struct crypto_ec_point *point; ++ int ok = 1; ++ ++ /* check to ensure peer's element is not in a small sub-group */ ++ point = crypto_ec_point_init(group->group); ++ if (!point || ++ crypto_ec_point_mul(group->group, element, ++ cofactor, point) != 0 || ++ crypto_ec_point_is_at_infinity(group->group, point)) ++ ok = 0; ++ crypto_ec_point_deinit(point, 0); ++ ++ if (!ok) { ++ wpa_printf(MSG_INFO, ++ "EAP-pwd: Small sub-group check on peer element failed"); ++ goto fail; ++ } ++ } ++ ++out: ++ crypto_bignum_deinit(cofactor, 0); ++ return element; ++fail: ++ crypto_ec_point_deinit(element, 0); ++ element = NULL; ++ goto out; ++} ++ ++ ++struct crypto_bignum * eap_pwd_get_scalar(EAP_PWD_group *group, const u8 *buf) ++{ ++ struct crypto_bignum *scalar; ++ const struct crypto_bignum *order; ++ size_t order_len; ++ ++ order = crypto_ec_get_order(group->group); ++ order_len = crypto_ec_order_len(group->group); ++ ++ /* RFC 5931, 2.8.5.2: 1 < scalar < r */ ++ scalar = crypto_bignum_init_set(buf, order_len); ++ if (!scalar || crypto_bignum_is_zero(scalar) || ++ crypto_bignum_is_one(scalar) || ++ crypto_bignum_cmp(scalar, order) >= 0) { ++ wpa_printf(MSG_INFO, "EAP-pwd: received scalar is invalid"); ++ crypto_bignum_deinit(scalar, 0); ++ scalar = NULL; ++ } ++ ++ return scalar; ++} +--- a/src/eap_common/eap_pwd_common.h ++++ b/src/eap_common/eap_pwd_common.h +@@ -64,5 +64,8 @@ int compute_keys(EAP_PWD_group *grp, con + struct crypto_hash * eap_pwd_h_init(void); + void eap_pwd_h_update(struct crypto_hash *hash, const u8 *data, size_t len); + void eap_pwd_h_final(struct crypto_hash *hash, u8 *digest); ++struct crypto_ec_point * eap_pwd_get_element(EAP_PWD_group *group, ++ const u8 *buf); ++struct crypto_bignum * eap_pwd_get_scalar(EAP_PWD_group *group, const u8 *buf); + + #endif /* EAP_PWD_COMMON_H */ +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -344,7 +344,7 @@ eap_pwd_perform_commit_exchange(struct e + const struct wpabuf *reqData, + const u8 *payload, size_t payload_len) + { +- struct crypto_ec_point *K = NULL, *point = NULL; ++ struct crypto_ec_point *K = NULL; + struct crypto_bignum *mask = NULL, *cofactor = NULL; + const u8 *ptr; + u8 *scalar = NULL, *element = NULL; +@@ -413,8 +413,7 @@ eap_pwd_perform_commit_exchange(struct e + /* process the request */ + data->k = crypto_bignum_init(); + K = crypto_ec_point_init(data->grp->group); +- point = crypto_ec_point_init(data->grp->group); +- if (!data->k || !K || !point) { ++ if (!data->k || !K) { + wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation " + "fail"); + goto fin; +@@ -422,55 +421,20 @@ eap_pwd_perform_commit_exchange(struct e + + /* element, x then y, followed by scalar */ + ptr = payload; +- data->server_element = crypto_ec_point_from_bin(data->grp->group, ptr); ++ data->server_element = eap_pwd_get_element(data->grp, ptr); + if (!data->server_element) { + wpa_printf(MSG_INFO, "EAP-PWD (peer): setting peer element " + "fail"); + goto fin; + } + ptr += prime_len * 2; +- data->server_scalar = crypto_bignum_init_set(ptr, order_len); ++ data->server_scalar = eap_pwd_get_scalar(data->grp, ptr); + if (!data->server_scalar) { + wpa_printf(MSG_INFO, + "EAP-PWD (peer): setting peer scalar fail"); + goto fin; + } + +- /* verify received scalar */ +- if (crypto_bignum_is_zero(data->server_scalar) || +- crypto_bignum_is_one(data->server_scalar) || +- crypto_bignum_cmp(data->server_scalar, +- crypto_ec_get_order(data->grp->group)) >= 0) { +- wpa_printf(MSG_INFO, +- "EAP-PWD (peer): received scalar is invalid"); +- goto fin; +- } +- +- /* verify received element */ +- if (!crypto_ec_point_is_on_curve(data->grp->group, +- data->server_element) || +- crypto_ec_point_is_at_infinity(data->grp->group, +- data->server_element)) { +- wpa_printf(MSG_INFO, +- "EAP-PWD (peer): received element is invalid"); +- goto fin; +- } +- +- /* check to ensure server's element is not in a small sub-group */ +- if (!crypto_bignum_is_one(cofactor)) { +- if (crypto_ec_point_mul(data->grp->group, data->server_element, +- cofactor, point) < 0) { +- wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply " +- "server element by order!\n"); +- goto fin; +- } +- if (crypto_ec_point_is_at_infinity(data->grp->group, point)) { +- wpa_printf(MSG_INFO, "EAP-PWD (peer): server element " +- "is at infinity!\n"); +- goto fin; +- } +- } +- + /* compute the shared key, k */ + if (crypto_ec_point_mul(data->grp->group, data->grp->pwe, + data->server_scalar, K) < 0 || +@@ -544,7 +508,6 @@ fin: + crypto_bignum_deinit(mask, 1); + crypto_bignum_deinit(cofactor, 1); + crypto_ec_point_deinit(K, 1); +- crypto_ec_point_deinit(point, 1); + if (data->outbuf == NULL) + eap_pwd_state(data, FAILURE); + else +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -604,7 +604,7 @@ eap_pwd_process_commit_resp(struct eap_s + { + const u8 *ptr; + struct crypto_bignum *cofactor = NULL; +- struct crypto_ec_point *K = NULL, *point = NULL; ++ struct crypto_ec_point *K = NULL; + int res = 0; + size_t prime_len, order_len; + +@@ -623,9 +623,8 @@ eap_pwd_process_commit_resp(struct eap_s + + data->k = crypto_bignum_init(); + cofactor = crypto_bignum_init(); +- point = crypto_ec_point_init(data->grp->group); + K = crypto_ec_point_init(data->grp->group); +- if (!data->k || !cofactor || !point || !K) { ++ if (!data->k || !cofactor || !K) { + wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation " + "fail"); + goto fin; +@@ -639,55 +638,20 @@ eap_pwd_process_commit_resp(struct eap_s + + /* element, x then y, followed by scalar */ + ptr = payload; +- data->peer_element = crypto_ec_point_from_bin(data->grp->group, ptr); ++ data->peer_element = eap_pwd_get_element(data->grp, ptr); + if (!data->peer_element) { + wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element " + "fail"); + goto fin; + } + ptr += prime_len * 2; +- data->peer_scalar = crypto_bignum_init_set(ptr, order_len); ++ data->peer_scalar = eap_pwd_get_scalar(data->grp, ptr); + if (!data->peer_scalar) { + wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation " + "fail"); + goto fin; + } + +- /* verify received scalar */ +- if (crypto_bignum_is_zero(data->peer_scalar) || +- crypto_bignum_is_one(data->peer_scalar) || +- crypto_bignum_cmp(data->peer_scalar, +- crypto_ec_get_order(data->grp->group)) >= 0) { +- wpa_printf(MSG_INFO, +- "EAP-PWD (server): received scalar is invalid"); +- goto fin; +- } +- +- /* verify received element */ +- if (!crypto_ec_point_is_on_curve(data->grp->group, +- data->peer_element) || +- crypto_ec_point_is_at_infinity(data->grp->group, +- data->peer_element)) { +- wpa_printf(MSG_INFO, +- "EAP-PWD (server): received element is invalid"); +- goto fin; +- } +- +- /* check to ensure peer's element is not in a small sub-group */ +- if (!crypto_bignum_is_one(cofactor)) { +- if (crypto_ec_point_mul(data->grp->group, data->peer_element, +- cofactor, point) != 0) { +- wpa_printf(MSG_INFO, "EAP-PWD (server): cannot " +- "multiply peer element by order"); +- goto fin; +- } +- if (crypto_ec_point_is_at_infinity(data->grp->group, point)) { +- wpa_printf(MSG_INFO, "EAP-PWD (server): peer element " +- "is at infinity!\n"); +- goto fin; +- } +- } +- + /* detect reflection attacks */ + if (crypto_bignum_cmp(data->my_scalar, data->peer_scalar) == 0 || + crypto_ec_point_cmp(data->grp->group, data->my_element, +@@ -739,7 +703,6 @@ eap_pwd_process_commit_resp(struct eap_s + + fin: + crypto_ec_point_deinit(K, 1); +- crypto_ec_point_deinit(point, 1); + crypto_bignum_deinit(cofactor, 1); + + if (res) diff --git a/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch b/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch new file mode 100644 index 0000000000..9ceb8d7098 --- /dev/null +++ b/package/network/services/hostapd/patches/065-0001-EAP-pwd-server-Fix-reassembly-buffer-handling.patch @@ -0,0 +1,40 @@ +From fe76f487e28bdc61940f304f153a954cf36935ea Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Wed, 17 Apr 2019 01:55:32 +0300 +Subject: [PATCH 1/3] EAP-pwd server: Fix reassembly buffer handling + +data->inbuf allocation might fail and if that were to happen, the next +fragment in the exchange could have resulted in NULL pointer +dereference. Unexpected fragment with more bit might also be able to +trigger this. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen +--- + src/eap_server/eap_server_pwd.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/src/eap_server/eap_server_pwd.c ++++ b/src/eap_server/eap_server_pwd.c +@@ -882,6 +882,12 @@ static void eap_pwd_process(struct eap_s + * the first and all intermediate fragments have the M bit set + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ eap_pwd_state(data, FAILURE); ++ return; ++ } + if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow " + "attack detected! (%d+%d > %d)", +@@ -902,7 +908,7 @@ static void eap_pwd_process(struct eap_s + * last fragment won't have the M bit set (but we're obviously + * buffering fragments so that's how we know it's the last) + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + pos = wpabuf_head_u8(data->inbuf); + len = data->in_frag_pos; + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", diff --git a/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch b/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch new file mode 100644 index 0000000000..b62420da37 --- /dev/null +++ b/package/network/services/hostapd/patches/065-0003-EAP-pwd-peer-Fix-reassembly-buffer-handling.patch @@ -0,0 +1,40 @@ +From d2d1a324ce937628e4d9d9999fe113819b7d4478 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Wed, 17 Apr 2019 02:21:20 +0300 +Subject: [PATCH 3/3] EAP-pwd peer: Fix reassembly buffer handling + +Unexpected fragment might result in data->inbuf not being allocated +before processing and that could have resulted in NULL pointer +dereference. Fix that by explicitly checking for data->inbuf to be +available before using it. + +Signed-off-by: Jouni Malinen +--- + src/eap_peer/eap_pwd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/src/eap_peer/eap_pwd.c ++++ b/src/eap_peer/eap_pwd.c +@@ -805,6 +805,13 @@ eap_pwd_process(struct eap_sm *sm, void + * buffer and ACK the fragment + */ + if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { ++ if (!data->inbuf) { ++ wpa_printf(MSG_DEBUG, ++ "EAP-pwd: No buffer for reassembly"); ++ ret->methodState = METHOD_DONE; ++ ret->decision = DECISION_FAIL; ++ return NULL; ++ } + data->in_frag_pos += len; + if (data->in_frag_pos > wpabuf_size(data->inbuf)) { + wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " +@@ -831,7 +838,7 @@ eap_pwd_process(struct eap_sm *sm, void + /* + * we're buffering and this is the last fragment + */ +- if (data->in_frag_pos) { ++ if (data->in_frag_pos && data->inbuf) { + wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", + (int) len); + pos = wpabuf_head_u8(data->inbuf); diff --git a/package/network/services/hostapd/patches/100-daemonize_fix.patch b/package/network/services/hostapd/patches/100-daemonize_fix.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/110-no_eapol_fix.patch b/package/network/services/hostapd/patches/110-no_eapol_fix.patch old mode 100755 new mode 100644 index 2a9c5ec807..ac53cbc92d --- a/package/network/services/hostapd/patches/110-no_eapol_fix.patch +++ b/package/network/services/hostapd/patches/110-no_eapol_fix.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -295,9 +295,10 @@ void wpa_supplicant_cancel_auth_timeout( +@@ -292,9 +292,10 @@ void wpa_supplicant_cancel_auth_timeout( */ void wpa_supplicant_initiate_eapol(struct wpa_supplicant *wpa_s) { diff --git a/package/network/services/hostapd/patches/120-disable_bridge_packet_workaround.patch b/package/network/services/hostapd/patches/120-disable_bridge_packet_workaround.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch old mode 100755 new mode 100644 index 9c7936695a..273af644c6 --- a/package/network/services/hostapd/patches/200-multicall.patch +++ b/package/network/services/hostapd/patches/200-multicall.patch @@ -156,7 +156,7 @@ wpa_cli.exe: wpa_cli --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -5476,8 +5476,8 @@ union wpa_event_data { +@@ -5449,8 +5449,8 @@ union wpa_event_data { * Driver wrapper code should call this function whenever an event is received * from the driver. */ @@ -167,7 +167,7 @@ /** * wpa_supplicant_event_global - Report a driver event for wpa_supplicant -@@ -5489,7 +5489,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -5462,7 +5462,7 @@ void wpa_supplicant_event(void *ctx, enu * Same as wpa_supplicant_event(), but we search for the interface in * wpa_global. */ @@ -178,7 +178,7 @@ /* --- a/src/ap/drv_callbacks.c +++ b/src/ap/drv_callbacks.c -@@ -1527,8 +1527,8 @@ static void hostapd_event_wds_sta_interf +@@ -1515,8 +1515,8 @@ static void hostapd_event_wds_sta_interf } @@ -189,7 +189,7 @@ { struct hostapd_data *hapd = ctx; #ifndef CONFIG_NO_STDOUT_DEBUG -@@ -1757,7 +1757,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -1742,7 +1742,7 @@ void wpa_supplicant_event(void *ctx, enu } @@ -231,7 +231,7 @@ os_memset(&global, 0, sizeof(global)); --- a/wpa_supplicant/events.c +++ b/wpa_supplicant/events.c -@@ -4026,8 +4026,8 @@ static void wpas_event_assoc_reject(stru +@@ -3976,8 +3976,8 @@ static void wpas_event_assoc_reject(stru } @@ -242,7 +242,7 @@ { struct wpa_supplicant *wpa_s = ctx; int resched; -@@ -4796,7 +4796,7 @@ void wpa_supplicant_event(void *ctx, enu +@@ -4745,7 +4745,7 @@ void wpa_supplicant_event(void *ctx, enu } @@ -253,7 +253,7 @@ struct wpa_supplicant *wpa_s; --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -5861,7 +5861,6 @@ struct wpa_interface * wpa_supplicant_ma +@@ -5797,7 +5797,6 @@ struct wpa_interface * wpa_supplicant_ma return NULL; } @@ -261,7 +261,7 @@ /** * wpa_supplicant_match_existing - Match existing interfaces * @global: Pointer to global data from wpa_supplicant_init() -@@ -5898,6 +5897,11 @@ static int wpa_supplicant_match_existing +@@ -5834,6 +5833,11 @@ static int wpa_supplicant_match_existing #endif /* CONFIG_MATCH_IFACE */ @@ -273,7 +273,7 @@ /** * wpa_supplicant_add_iface - Add a new network interface -@@ -6154,6 +6158,8 @@ struct wpa_global * wpa_supplicant_init( +@@ -6090,6 +6094,8 @@ struct wpa_global * wpa_supplicant_init( #ifndef CONFIG_NO_WPA_MSG wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb); #endif /* CONFIG_NO_WPA_MSG */ diff --git a/package/network/services/hostapd/patches/300-noscan.patch b/package/network/services/hostapd/patches/300-noscan.patch old mode 100755 new mode 100644 index d055422969..4463c75c91 --- a/package/network/services/hostapd/patches/300-noscan.patch +++ b/package/network/services/hostapd/patches/300-noscan.patch @@ -1,6 +1,6 @@ --- a/hostapd/config_file.c +++ b/hostapd/config_file.c -@@ -3317,6 +3317,10 @@ static int hostapd_config_fill(struct ho +@@ -3214,6 +3214,10 @@ static int hostapd_config_fill(struct ho } #endif /* CONFIG_IEEE80211W */ #ifdef CONFIG_IEEE80211N @@ -13,7 +13,7 @@ } else if (os_strcmp(buf, "ht_capab") == 0) { --- a/src/ap/ap_config.h +++ b/src/ap/ap_config.h -@@ -781,6 +781,8 @@ struct hostapd_config { +@@ -775,6 +775,8 @@ struct hostapd_config { int ht_op_mode_fixed; u16 ht_capab; diff --git a/package/network/services/hostapd/patches/301-mesh-noscan.patch b/package/network/services/hostapd/patches/301-mesh-noscan.patch old mode 100755 new mode 100644 index ed4e91cae9..0c42d2b110 --- a/package/network/services/hostapd/patches/301-mesh-noscan.patch +++ b/package/network/services/hostapd/patches/301-mesh-noscan.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/config.c +++ b/wpa_supplicant/config.c -@@ -2233,6 +2233,7 @@ static const struct parse_data ssid_fiel +@@ -2217,6 +2217,7 @@ static const struct parse_data ssid_fiel #else /* CONFIG_MESH */ { INT_RANGE(mode, 0, 4) }, #endif /* CONFIG_MESH */ @@ -31,7 +31,7 @@ if (conf->hw_mode == HOSTAPD_MODE_IEEE80211A && ssid->vht) { --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2081,12 +2081,12 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2051,12 +2051,12 @@ void ibss_mesh_setup_freq(struct wpa_sup { enum hostapd_hw_mode hw_mode; struct hostapd_hw_modes *mode = NULL; @@ -46,7 +46,7 @@ unsigned int j, k; struct hostapd_freq_params vht_freq; int chwidth, seg0, seg1; -@@ -2156,7 +2156,7 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2126,7 +2126,7 @@ void ibss_mesh_setup_freq(struct wpa_sup return; /* Setup higher BW only for 5 GHz */ diff --git a/package/network/services/hostapd/patches/310-rescan_immediately.patch b/package/network/services/hostapd/patches/310-rescan_immediately.patch old mode 100755 new mode 100644 index 84eb252319..1fb05401f8 --- a/package/network/services/hostapd/patches/310-rescan_immediately.patch +++ b/package/network/services/hostapd/patches/310-rescan_immediately.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -4312,7 +4312,7 @@ wpa_supplicant_alloc(struct wpa_supplica +@@ -4248,7 +4248,7 @@ wpa_supplicant_alloc(struct wpa_supplica if (wpa_s == NULL) return NULL; wpa_s->scan_req = INITIAL_SCAN_REQ; diff --git a/package/network/services/hostapd/patches/320-optional_rfkill.patch b/package/network/services/hostapd/patches/320-optional_rfkill.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch old mode 100755 new mode 100644 index e175bbc103..6aa8d1a3a7 --- a/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch +++ b/package/network/services/hostapd/patches/330-nl80211_fix_set_freq.patch @@ -1,6 +1,6 @@ --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -4318,7 +4318,7 @@ static int nl80211_set_channel(struct i8 +@@ -4234,7 +4234,7 @@ static int nl80211_set_channel(struct i8 freq->freq, freq->ht_enabled, freq->vht_enabled, freq->bandwidth, freq->center_freq1, freq->center_freq2); diff --git a/package/network/services/hostapd/patches/340-reload_freq_change.patch b/package/network/services/hostapd/patches/340-reload_freq_change.patch old mode 100755 new mode 100644 index 81c20970e7..d46f5144d0 --- a/package/network/services/hostapd/patches/340-reload_freq_change.patch +++ b/package/network/services/hostapd/patches/340-reload_freq_change.patch @@ -1,6 +1,6 @@ --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c -@@ -103,6 +103,25 @@ static void hostapd_reload_bss(struct ho +@@ -93,6 +93,25 @@ static void hostapd_reload_bss(struct ho #endif /* CONFIG_NO_RADIUS */ ssid = &hapd->conf->ssid; @@ -26,7 +26,7 @@ if (!ssid->wpa_psk_set && ssid->wpa_psk && !ssid->wpa_psk->next && ssid->wpa_passphrase_set && ssid->wpa_passphrase) { /* -@@ -200,6 +219,7 @@ int hostapd_reload_config(struct hostapd +@@ -171,6 +190,7 @@ int hostapd_reload_config(struct hostapd struct hostapd_data *hapd = iface->bss[0]; struct hostapd_config *newconf, *oldconf; size_t j; @@ -34,8 +34,8 @@ if (iface->config_fname == NULL) { /* Only in-memory config in use - assume it has been updated */ -@@ -250,21 +270,20 @@ int hostapd_reload_config(struct hostapd - } +@@ -192,21 +212,20 @@ int hostapd_reload_config(struct hostapd + oldconf = hapd->iconf; iface->conf = newconf; + for (i = 0; i < iface->num_hw_features; i++) { diff --git a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch b/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch deleted file mode 100755 index b9a0b23a7b..0000000000 --- a/package/network/services/hostapd/patches/341-mesh-ctrl-iface-channel-switch.patch +++ /dev/null @@ -1,39 +0,0 @@ ---- a/wpa_supplicant/ap.c -+++ b/wpa_supplicant/ap.c -@@ -1363,15 +1363,35 @@ int ap_switch_channel(struct wpa_supplic - - - #ifdef CONFIG_CTRL_IFACE -+ -+static int __ap_ctrl_iface_chanswitch(struct hostapd_iface *iface, -+ struct csa_settings *settings) -+{ -+#ifdef NEED_AP_MLME -+ if (!iface || !iface->bss[0]) -+ return 0; -+ -+ return hostapd_switch_channel(iface->bss[0], settings); -+#else -+ return -1; -+#endif -+} -+ -+ - int ap_ctrl_iface_chanswitch(struct wpa_supplicant *wpa_s, const char *pos) - { - struct csa_settings settings; - int ret = hostapd_parse_csa_settings(pos, &settings); - -+ if (!(wpa_s->ap_iface && wpa_s->ap_iface->bss[0]) && -+ !(wpa_s->ifmsh && wpa_s->ifmsh->bss[0])) -+ return -1; -+ -+ ret = __ap_ctrl_iface_chanswitch(wpa_s->ap_iface, &settings); - if (ret) - return ret; - -- return ap_switch_channel(wpa_s, &settings); -+ return __ap_ctrl_iface_chanswitch(wpa_s->ifmsh, &settings); - } - #endif /* CONFIG_CTRL_IFACE */ - diff --git a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch old mode 100755 new mode 100644 index 836339f2e2..9d7a2a4431 --- a/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch +++ b/package/network/services/hostapd/patches/350-nl80211_del_beacon_bss.patch @@ -1,6 +1,6 @@ --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -2634,10 +2634,15 @@ static int wpa_driver_nl80211_del_beacon +@@ -2566,10 +2566,15 @@ static int wpa_driver_nl80211_del_beacon struct nl_msg *msg; struct wpa_driver_nl80211_data *drv = bss->drv; @@ -18,7 +18,7 @@ return send_and_recv_msgs(drv, msg, NULL, NULL); } -@@ -4919,7 +4924,7 @@ static void nl80211_teardown_ap(struct i +@@ -4835,7 +4840,7 @@ static void nl80211_teardown_ap(struct i nl80211_mgmt_unsubscribe(bss, "AP teardown"); nl80211_put_wiphy_data_ap(bss); @@ -27,7 +27,7 @@ } -@@ -7160,8 +7165,6 @@ static int wpa_driver_nl80211_if_remove( +@@ -7057,8 +7062,6 @@ static int wpa_driver_nl80211_if_remove( } else { wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context"); nl80211_teardown_ap(bss); @@ -36,7 +36,7 @@ nl80211_destroy_bss(bss); if (!bss->added_if) i802_set_iface_flags(bss, 0); -@@ -7540,7 +7543,6 @@ static int wpa_driver_nl80211_deinit_ap( +@@ -7437,7 +7440,6 @@ static int wpa_driver_nl80211_deinit_ap( if (!is_ap_interface(drv->nlmode)) return -1; wpa_driver_nl80211_del_beacon(bss); @@ -44,7 +44,7 @@ /* * If the P2P GO interface was dynamically added, then it is -@@ -7560,7 +7562,6 @@ static int wpa_driver_nl80211_stop_ap(vo +@@ -7457,7 +7459,6 @@ static int wpa_driver_nl80211_stop_ap(vo if (!is_ap_interface(drv->nlmode)) return -1; wpa_driver_nl80211_del_beacon(bss); diff --git a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch old mode 100755 new mode 100644 index 537c0881c4..07faead2c5 --- a/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch +++ b/package/network/services/hostapd/patches/360-ctrl_iface_reload.patch @@ -78,7 +78,7 @@ #ifdef CONFIG_IEEE80211W #ifdef NEED_AP_MLME -@@ -3084,6 +3141,8 @@ static int hostapd_ctrl_iface_receive_pr +@@ -3031,6 +3088,8 @@ static int hostapd_ctrl_iface_receive_pr } else if (os_strncmp(buf, "VENDOR ", 7) == 0) { reply_len = hostapd_ctrl_iface_vendor(hapd, buf + 7, reply, reply_size); diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch old mode 100755 new mode 100644 index d93984a172..58a0044849 --- a/package/network/services/hostapd/patches/370-ap_sta_support.patch +++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch @@ -30,7 +30,7 @@ #include "drivers/driver.h" #include "eap_peer/eap.h" #include "wpa_supplicant_i.h" -@@ -294,6 +295,10 @@ void calculate_update_time(const struct +@@ -292,6 +293,10 @@ void calculate_update_time(const struct static void wpa_bss_copy_res(struct wpa_bss *dst, struct wpa_scan_res *src, struct os_reltime *fetch_time) { @@ -41,7 +41,7 @@ dst->flags = src->flags; os_memcpy(dst->bssid, src->bssid, ETH_ALEN); dst->freq = src->freq; -@@ -306,6 +311,15 @@ static void wpa_bss_copy_res(struct wpa_ +@@ -304,6 +309,15 @@ static void wpa_bss_copy_res(struct wpa_ dst->est_throughput = src->est_throughput; dst->snr = src->snr; @@ -59,7 +59,7 @@ --- a/wpa_supplicant/bss.h +++ b/wpa_supplicant/bss.h -@@ -82,6 +82,10 @@ struct wpa_bss { +@@ -81,6 +81,10 @@ struct wpa_bss { u8 ssid[SSID_MAX_LEN]; /** Length of SSID */ size_t ssid_len; @@ -166,7 +166,7 @@ /* Configure default/group WEP keys for static WEP */ int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid) { -@@ -920,12 +969,16 @@ void wpa_supplicant_set_state(struct wpa +@@ -913,12 +962,16 @@ void wpa_supplicant_set_state(struct wpa sme_sched_obss_scan(wpa_s, 1); @@ -183,7 +183,7 @@ wpa_s->new_connection = 1; wpa_drv_set_operstate(wpa_s, 0); #ifndef IEEE8021X_EAPOL -@@ -1977,6 +2030,8 @@ void wpa_supplicant_associate(struct wpa +@@ -1947,6 +2000,8 @@ void wpa_supplicant_associate(struct wpa wpa_ssid_txt(ssid->ssid, ssid->ssid_len), ssid->id); wpas_notify_mesh_group_started(wpa_s, ssid); @@ -192,7 +192,7 @@ #else /* CONFIG_MESH */ wpa_msg(wpa_s, MSG_ERROR, "mesh mode support not included in the build"); -@@ -5487,6 +5542,16 @@ static int wpa_supplicant_init_iface(str +@@ -5423,6 +5478,16 @@ static int wpa_supplicant_init_iface(str sizeof(wpa_s->bridge_ifname)); } @@ -209,7 +209,7 @@ /* RSNA Supplicant Key Management - INITIALIZE */ eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE); eapol_sm_notify_portValid(wpa_s->eapol, FALSE); -@@ -5808,6 +5873,11 @@ static void wpa_supplicant_deinit_iface( +@@ -5744,6 +5809,11 @@ static void wpa_supplicant_deinit_iface( if (terminate) wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING); @@ -244,184 +244,3 @@ char *confname; char *confanother; ---- a/hostapd/ctrl_iface.c -+++ b/hostapd/ctrl_iface.c -@@ -2328,6 +2328,11 @@ static int hostapd_ctrl_iface_chan_switc - if (ret) - return ret; - -+ if (os_strstr(pos, " auto-ht")) { -+ settings.freq_params.ht_enabled = iface->conf->ieee80211n; -+ settings.freq_params.vht_enabled = iface->conf->ieee80211ac; -+ } -+ - for (i = 0; i < iface->num_bss; i++) { - - /* Save CHAN_SWITCH VHT config */ ---- a/src/ap/beacon.c -+++ b/src/ap/beacon.c -@@ -1381,11 +1381,6 @@ int ieee802_11_set_beacon(struct hostapd - struct wpabuf *beacon, *proberesp, *assocresp; - int res, ret = -1; - -- if (hapd->csa_in_progress) { -- wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period"); -- return -1; -- } -- - hapd->beacon_set_done = 1; - - if (ieee802_11_build_ap_params(hapd, ¶ms) < 0) ---- a/src/drivers/driver.h -+++ b/src/drivers/driver.h -@@ -4469,6 +4469,13 @@ enum wpa_event_type { - EVENT_CH_SWITCH, - - /** -+ * EVENT_CH_SWITCH - AP or GO will switch channels soon -+ * -+ * Described in wpa_event_data.ch_switch -+ * */ -+ EVENT_CH_SWITCH_STARTED, -+ -+ /** - * EVENT_WNM - Request WNM operation - * - * This event can be used to request a WNM operation to be performed. -@@ -5306,6 +5313,7 @@ union wpa_event_data { - - /** - * struct ch_switch -+ * @count: countdown until channel switch - * @freq: Frequency of new channel in MHz - * @ht_enabled: Whether this is an HT channel - * @ch_offset: Secondary channel offset -@@ -5314,6 +5322,7 @@ union wpa_event_data { - * @cf2: Center frequency 2 - */ - struct ch_switch { -+ int count; - int freq; - int ht_enabled; - int ch_offset; ---- a/src/drivers/driver_nl80211_event.c -+++ b/src/drivers/driver_nl80211_event.c -@@ -526,7 +526,8 @@ static int calculate_chan_offset(int wid - static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv, - struct nlattr *ifindex, struct nlattr *freq, - struct nlattr *type, struct nlattr *bw, -- struct nlattr *cf1, struct nlattr *cf2) -+ struct nlattr *cf1, struct nlattr *cf2, -+ struct nlattr *count) - { - struct i802_bss *bss; - union wpa_event_data data; -@@ -584,11 +585,15 @@ static void mlme_event_ch_switch(struct - data.ch_switch.cf1 = nla_get_u32(cf1); - if (cf2) - data.ch_switch.cf2 = nla_get_u32(cf2); -+ if (count) -+ data.ch_switch.count = nla_get_u32(count); - - bss->freq = data.ch_switch.freq; - drv->assoc_freq = data.ch_switch.freq; - -- wpa_supplicant_event(bss->ctx, EVENT_CH_SWITCH, &data); -+ wpa_supplicant_event(bss->ctx, -+ count ? EVENT_CH_SWITCH_STARTED : EVENT_CH_SWITCH, -+ &data); - } - - -@@ -2446,6 +2451,7 @@ static void do_process_drv_event(struct - tb[NL80211_ATTR_PMK], - tb[NL80211_ATTR_PMKID]); - break; -+ case NL80211_CMD_CH_SWITCH_STARTED_NOTIFY: - case NL80211_CMD_CH_SWITCH_NOTIFY: - mlme_event_ch_switch(drv, - tb[NL80211_ATTR_IFINDEX], -@@ -2453,7 +2459,8 @@ static void do_process_drv_event(struct - tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE], - tb[NL80211_ATTR_CHANNEL_WIDTH], - tb[NL80211_ATTR_CENTER_FREQ1], -- tb[NL80211_ATTR_CENTER_FREQ2]); -+ tb[NL80211_ATTR_CENTER_FREQ2], -+ tb[NL80211_ATTR_CH_SWITCH_COUNT]); - break; - case NL80211_CMD_DISCONNECT: - mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE], ---- a/wpa_supplicant/events.c -+++ b/wpa_supplicant/events.c -@@ -4026,6 +4026,60 @@ static void wpas_event_assoc_reject(stru - } - - -+static void -+supplicant_ch_switch_started(struct wpa_supplicant *wpa_s, -+ union wpa_event_data *data) -+{ -+ char buf[256]; -+ size_t len = sizeof(buf); -+ char *cmd = NULL; -+ int width = 20; -+ int ret; -+ -+ if (!wpa_s->hostapd) -+ return; -+ -+ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_CHANNEL_SWITCH -+ "count=%d freq=%d ht_enabled=%d ch_offset=%d ch_width=%s cf1=%d cf2=%d", -+ data->ch_switch.count, -+ data->ch_switch.freq, -+ data->ch_switch.ht_enabled, -+ data->ch_switch.ch_offset, -+ channel_width_to_string(data->ch_switch.ch_width), -+ data->ch_switch.cf1, -+ data->ch_switch.cf2); -+ -+ switch (data->ch_switch.ch_width) { -+ case CHAN_WIDTH_20_NOHT: -+ case CHAN_WIDTH_20: -+ width = 20; -+ break; -+ case CHAN_WIDTH_40: -+ width = 40; -+ break; -+ case CHAN_WIDTH_80: -+ width = 80; -+ break; -+ case CHAN_WIDTH_160: -+ case CHAN_WIDTH_80P80: -+ width = 160; -+ break; -+ } -+ -+ asprintf(&cmd, "CHAN_SWITCH %d %d sec_channel_offset=%d center_freq1=%d center_freq2=%d, bandwidth=%d auto-ht\n", -+ data->ch_switch.count - 1, -+ data->ch_switch.freq, -+ data->ch_switch.ch_offset, -+ data->ch_switch.cf1, -+ data->ch_switch.cf2, -+ width); -+ ret = wpa_ctrl_request(wpa_s->hostapd, cmd, os_strlen(cmd), buf, &len, NULL); -+ free(cmd); -+ -+ if (ret < 0) -+ wpa_printf(MSG_ERROR, "\nFailed to reload hostapd AP interfaces\n"); -+} -+ - void supplicant_event(void *ctx, enum wpa_event_type event, - union wpa_event_data *data) - { -@@ -4309,6 +4363,10 @@ void supplicant_event(void *ctx, enum wp - data->rx_from_unknown.wds); - break; - #endif /* CONFIG_AP */ -+ case EVENT_CH_SWITCH_STARTED: -+ supplicant_ch_switch_started(wpa_s, data); -+ break; -+ - case EVENT_CH_SWITCH: - if (!data || !wpa_s->current_ssid) - break; diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch old mode 100755 new mode 100644 index 2fe03340a8..cd050fc0c9 --- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch +++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch @@ -12,7 +12,7 @@ else --- a/hostapd/ctrl_iface.c +++ b/hostapd/ctrl_iface.c -@@ -2912,6 +2912,7 @@ static int hostapd_ctrl_iface_receive_pr +@@ -2857,6 +2857,7 @@ static int hostapd_ctrl_iface_receive_pr reply_size); } else if (os_strcmp(buf, "STATUS-DRIVER") == 0) { reply_len = hostapd_drv_status(hapd, reply, reply_size); @@ -20,7 +20,7 @@ } else if (os_strcmp(buf, "MIB") == 0) { reply_len = ieee802_11_get_mib(hapd, reply, reply_size); if (reply_len >= 0) { -@@ -2953,6 +2954,7 @@ static int hostapd_ctrl_iface_receive_pr +@@ -2898,6 +2899,7 @@ static int hostapd_ctrl_iface_receive_pr } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) { reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply, reply_size); @@ -42,7 +42,7 @@ --- a/wpa_supplicant/ctrl_iface.c +++ b/wpa_supplicant/ctrl_iface.c -@@ -2117,7 +2117,7 @@ static int wpa_supplicant_ctrl_iface_sta +@@ -2108,7 +2108,7 @@ static int wpa_supplicant_ctrl_iface_sta pos += ret; } @@ -51,7 +51,7 @@ if (wpa_s->ap_iface) { pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos, end - pos, -@@ -9852,6 +9852,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -9825,6 +9825,7 @@ char * wpa_supplicant_ctrl_iface_process reply_len = -1; } else if (os_strncmp(buf, "NOTE ", 5) == 0) { wpa_printf(MSG_INFO, "NOTE: %s", buf + 5); @@ -59,7 +59,7 @@ } else if (os_strcmp(buf, "MIB") == 0) { reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size); if (reply_len >= 0) { -@@ -9859,6 +9860,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -9832,6 +9833,7 @@ char * wpa_supplicant_ctrl_iface_process reply + reply_len, reply_size - reply_len); } @@ -67,7 +67,7 @@ } else if (os_strncmp(buf, "STATUS", 6) == 0) { reply_len = wpa_supplicant_ctrl_iface_status( wpa_s, buf + 6, reply, reply_size); -@@ -10340,6 +10342,7 @@ char * wpa_supplicant_ctrl_iface_process +@@ -10313,6 +10315,7 @@ char * wpa_supplicant_ctrl_iface_process reply_len = wpa_supplicant_ctrl_iface_bss( wpa_s, buf + 4, reply, reply_size); #ifdef CONFIG_AP @@ -75,7 +75,7 @@ } else if (os_strcmp(buf, "STA-FIRST") == 0) { reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size); } else if (os_strncmp(buf, "STA ", 4) == 0) { -@@ -10348,12 +10351,15 @@ char * wpa_supplicant_ctrl_iface_process +@@ -10321,12 +10324,15 @@ char * wpa_supplicant_ctrl_iface_process } else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) { reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply, reply_size); @@ -126,7 +126,7 @@ if (os_snprintf_error(buflen - len, ret)) --- a/src/ap/ieee802_1x.c +++ b/src/ap/ieee802_1x.c -@@ -2581,6 +2581,7 @@ static const char * bool_txt(Boolean val +@@ -2555,6 +2555,7 @@ static const char * bool_txt(Boolean val return val ? "TRUE" : "FALSE"; } @@ -134,7 +134,7 @@ int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen) { -@@ -2756,6 +2757,7 @@ int ieee802_1x_get_mib_sta(struct hostap +@@ -2730,6 +2731,7 @@ int ieee802_1x_get_mib_sta(struct hostap return len; } @@ -144,7 +144,7 @@ static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx) --- a/src/ap/wpa_auth.c +++ b/src/ap/wpa_auth.c -@@ -3798,6 +3798,7 @@ static const char * wpa_bool_txt(int val +@@ -3772,6 +3772,7 @@ static const char * wpa_bool_txt(int val return val ? "TRUE" : "FALSE"; } @@ -152,7 +152,7 @@ #define RSN_SUITE "%02x-%02x-%02x-%d" #define RSN_SUITE_ARG(s) \ -@@ -3942,7 +3943,7 @@ int wpa_get_mib_sta(struct wpa_state_mac +@@ -3916,7 +3917,7 @@ int wpa_get_mib_sta(struct wpa_state_mac return len; } @@ -163,7 +163,7 @@ { --- a/src/rsn_supp/wpa.c +++ b/src/rsn_supp/wpa.c -@@ -2319,6 +2319,8 @@ static u32 wpa_key_mgmt_suite(struct wpa +@@ -2306,6 +2306,8 @@ static u32 wpa_key_mgmt_suite(struct wpa } @@ -172,7 +172,7 @@ #define RSN_SUITE "%02x-%02x-%02x-%d" #define RSN_SUITE_ARG(s) \ ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff -@@ -2402,6 +2404,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch +@@ -2389,6 +2391,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch return (int) len; } @@ -182,7 +182,7 @@ --- a/wpa_supplicant/ap.c +++ b/wpa_supplicant/ap.c -@@ -1221,7 +1221,7 @@ int wpas_ap_wps_nfc_report_handover(stru +@@ -1179,7 +1179,7 @@ int wpas_ap_wps_nfc_report_handover(stru #endif /* CONFIG_WPS */ diff --git a/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch b/package/network/services/hostapd/patches/381-hostapd_cli_UNKNOWN-COMMAND.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch old mode 100755 new mode 100644 index 855fc808e9..1646627191 --- a/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch +++ b/package/network/services/hostapd/patches/390-wpa_ie_cap_workaround.patch @@ -1,6 +1,6 @@ --- a/src/common/wpa_common.c +++ b/src/common/wpa_common.c -@@ -2042,6 +2042,31 @@ u32 wpa_akm_to_suite(int akm) +@@ -1849,6 +1849,31 @@ u32 wpa_akm_to_suite(int akm) } @@ -32,7 +32,7 @@ int wpa_compare_rsn_ie(int ft_initial_assoc, const u8 *ie1, size_t ie1len, const u8 *ie2, size_t ie2len) -@@ -2049,8 +2074,19 @@ int wpa_compare_rsn_ie(int ft_initial_as +@@ -1856,8 +1881,19 @@ int wpa_compare_rsn_ie(int ft_initial_as if (ie1 == NULL || ie2 == NULL) return -1; diff --git a/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch b/package/network/services/hostapd/patches/400-wps_single_auth_enc_type.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/410-limit_debug_messages.patch b/package/network/services/hostapd/patches/410-limit_debug_messages.patch old mode 100755 new mode 100644 index d182e8d986..b7dbbd0dc7 --- a/package/network/services/hostapd/patches/410-limit_debug_messages.patch +++ b/package/network/services/hostapd/patches/410-limit_debug_messages.patch @@ -1,6 +1,6 @@ --- a/src/utils/wpa_debug.c +++ b/src/utils/wpa_debug.c -@@ -205,7 +205,7 @@ void wpa_debug_close_linux_tracing(void) +@@ -201,7 +201,7 @@ void wpa_debug_close_linux_tracing(void) * * Note: New line '\n' is added to the end of the text when printing to stdout. */ @@ -9,7 +9,7 @@ { va_list ap; -@@ -252,8 +252,8 @@ void wpa_printf(int level, const char *f +@@ -248,8 +248,8 @@ void wpa_printf(int level, const char *f } @@ -20,7 +20,7 @@ { size_t i; -@@ -379,20 +379,8 @@ static void _wpa_hexdump(int level, cons +@@ -375,20 +375,8 @@ static void _wpa_hexdump(int level, cons #endif /* CONFIG_ANDROID_LOG */ } @@ -43,7 +43,7 @@ { size_t i, llen; const u8 *pos = buf; -@@ -499,20 +487,6 @@ static void _wpa_hexdump_ascii(int level +@@ -495,20 +483,6 @@ static void _wpa_hexdump_ascii(int level } @@ -64,7 +64,7 @@ #ifdef CONFIG_DEBUG_FILE static char *last_path = NULL; #endif /* CONFIG_DEBUG_FILE */ -@@ -628,7 +602,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_ +@@ -604,7 +578,7 @@ void wpa_msg_register_ifname_cb(wpa_msg_ } @@ -73,7 +73,7 @@ { va_list ap; char *buf; -@@ -666,7 +640,7 @@ void wpa_msg(void *ctx, int level, const +@@ -642,7 +616,7 @@ void wpa_msg(void *ctx, int level, const } diff --git a/package/network/services/hostapd/patches/420-indicate-features.patch b/package/network/services/hostapd/patches/420-indicate-features.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch b/package/network/services/hostapd/patches/430-hostapd_cli_ifdef.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/431-wpa_cli_ifdef.patch b/package/network/services/hostapd/patches/431-wpa_cli_ifdef.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/432-missing-typedef.patch b/package/network/services/hostapd/patches/432-missing-typedef.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/450-scan_wait.patch b/package/network/services/hostapd/patches/450-scan_wait.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch old mode 100755 new mode 100644 index 1bb5d6e620..81ad81c39a --- a/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch +++ b/package/network/services/hostapd/patches/460-wpa_supplicant-add-new-config-params-to-be-used-with.patch @@ -22,7 +22,7 @@ Signed-hostap: Antonio Quartulli #include "common/defs.h" #include "common/ieee802_11_defs.h" #include "common/wpa_common.h" -@@ -774,6 +775,9 @@ struct wpa_driver_associate_params { +@@ -762,6 +763,9 @@ struct wpa_driver_associate_params { * responsible for selecting with which BSS to associate. */ const u8 *bssid; @@ -42,7 +42,7 @@ Signed-hostap: Antonio Quartulli #include "config.h" -@@ -2053,6 +2054,97 @@ static char * wpa_config_write_peerkey(c +@@ -2037,6 +2038,97 @@ static char * wpa_config_write_peerkey(c #endif /* NO_CONFIG_WRITE */ @@ -140,7 +140,7 @@ Signed-hostap: Antonio Quartulli /* Helper macros for network block parser */ #ifdef OFFSET -@@ -2298,6 +2390,8 @@ static const struct parse_data ssid_fiel +@@ -2282,6 +2374,8 @@ static const struct parse_data ssid_fiel { INT(ap_max_inactivity) }, { INT(dtim_period) }, { INT(beacon_int) }, @@ -174,7 +174,7 @@ Signed-hostap: Antonio Quartulli * macsec_policy - Determines the policy for MACsec secure session --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -3117,6 +3117,12 @@ static void wpas_start_assoc_cb(struct w +@@ -3061,6 +3061,12 @@ static void wpas_start_assoc_cb(struct w params.beacon_int = ssid->beacon_int; else params.beacon_int = wpa_s->conf->beacon_int; diff --git a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch old mode 100755 new mode 100644 index 287cd1dd2e..b56fa3d38e --- a/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch +++ b/package/network/services/hostapd/patches/461-driver_nl80211-use-new-parameters-during-ibss-join.patch @@ -10,7 +10,7 @@ Signed-hostap: Antonio Quartulli --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -5178,7 +5178,7 @@ static int wpa_driver_nl80211_ibss(struc +@@ -5094,7 +5094,7 @@ static int wpa_driver_nl80211_ibss(struc struct wpa_driver_associate_params *params) { struct nl_msg *msg; @@ -19,7 +19,7 @@ Signed-hostap: Antonio Quartulli int count = 0; wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex); -@@ -5205,6 +5205,37 @@ retry: +@@ -5121,6 +5121,37 @@ retry: nl80211_put_beacon_int(msg, params->beacon_int)) goto fail; diff --git a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch old mode 100755 new mode 100644 index 55a48b9733..12cbd993a5 --- a/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch +++ b/package/network/services/hostapd/patches/463-add-mcast_rate-to-11s.patch @@ -19,7 +19,7 @@ Tested-by: Simon Wunderlich --- a/src/drivers/driver.h +++ b/src/drivers/driver.h -@@ -1409,6 +1409,7 @@ struct wpa_driver_mesh_join_params { +@@ -1397,6 +1397,7 @@ struct wpa_driver_mesh_join_params { #define WPA_DRIVER_MESH_FLAG_AMPE 0x00000008 unsigned int flags; u8 handle_dfs; @@ -29,7 +29,7 @@ Tested-by: Simon Wunderlich /** --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c -@@ -9352,6 +9352,18 @@ static int nl80211_put_mesh_id(struct nl +@@ -9248,6 +9248,18 @@ static int nl80211_put_mesh_id(struct nl } @@ -48,7 +48,7 @@ Tested-by: Simon Wunderlich static int nl80211_put_mesh_config(struct nl_msg *msg, struct wpa_driver_mesh_bss_params *params) { -@@ -9413,6 +9425,7 @@ static int nl80211_join_mesh(struct i802 +@@ -9309,6 +9321,7 @@ static int nl80211_join_mesh(struct i802 nl80211_put_basic_rates(msg, params->basic_rates) || nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) || nl80211_put_beacon_int(msg, params->beacon_int) || diff --git a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch old mode 100755 new mode 100644 index 3d4946e0b0..f630894c92 --- a/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch +++ b/package/network/services/hostapd/patches/464-fix-mesh-obss-check.patch @@ -1,6 +1,6 @@ --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c -@@ -2154,11 +2154,13 @@ void ibss_mesh_setup_freq(struct wpa_sup +@@ -2124,11 +2124,13 @@ void ibss_mesh_setup_freq(struct wpa_sup for (j = 0; j < wpa_s->last_scan_res_used; j++) { struct wpa_bss *bss = wpa_s->last_scan_res[j]; diff --git a/package/network/services/hostapd/patches/470-survey_data_fallback.patch b/package/network/services/hostapd/patches/470-survey_data_fallback.patch old mode 100755 new mode 100644 diff --git a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch b/package/network/services/hostapd/patches/500-lto-jobserver-support.patch deleted file mode 100755 index a65ad9c7f6..0000000000 --- a/package/network/services/hostapd/patches/500-lto-jobserver-support.patch +++ /dev/null @@ -1,50 +0,0 @@ ---- a/hostapd/Makefile -+++ b/hostapd/Makefile -@@ -1290,14 +1290,14 @@ hostapd_multi.a: $(BCHECK) $(OBJS) - @$(AR) cr $@ hostapd_multi.o $(OBJS) - - hostapd: $(BCHECK) $(OBJS) -- $(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS) -+ +$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS) - @$(E) " LD " $@ - - ifdef CONFIG_WPA_TRACE - OBJS_c += ../src/utils/trace.o - endif - hostapd_cli: $(OBJS_c) -- $(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c) -+ +$(Q)$(CC) $(LDFLAGS) -o hostapd_cli $(OBJS_c) $(LIBS_c) - @$(E) " LD " $@ - - NOBJS = nt_password_hash.o ../src/crypto/ms_funcs.o $(SHA1OBJS) ---- a/wpa_supplicant/Makefile -+++ b/wpa_supplicant/Makefile -@@ -1921,23 +1921,23 @@ wpa_supplicant_multi.a: .config $(BCHECK - @$(AR) cr $@ wpa_supplicant_multi.o $(OBJS) - - wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs) -- $(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS) -+ +$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS) - @$(E) " LD " $@ - - eapol_test: $(OBJS_t) -- $(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS) -+ +$(Q)$(LDO) $(LDFLAGS) -o eapol_test $(OBJS_t) $(LIBS) - @$(E) " LD " $@ - - preauth_test: $(OBJS_t2) -- $(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS) -+ +$(Q)$(LDO) $(LDFLAGS) -o preauth_test $(OBJS_t2) $(LIBS) - @$(E) " LD " $@ - - wpa_passphrase: $(OBJS_p) -- $(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS) -+ +$(Q)$(LDO) $(LDFLAGS) -o wpa_passphrase $(OBJS_p) $(LIBS_p) $(LIBS) - @$(E) " LD " $@ - - wpa_cli: $(OBJS_c) -- $(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c) -+ +$(Q)$(LDO) $(LDFLAGS) -o wpa_cli $(OBJS_c) $(LIBS_c) - @$(E) " LD " $@ - - LIBCTRL += ../src/common/wpa_ctrl.o diff --git a/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch b/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch deleted file mode 100755 index 812f794eda..0000000000 --- a/package/network/services/hostapd/patches/550-hostapd-Add-Multi-AP-protocol-support.patch +++ /dev/null @@ -1,306 +0,0 @@ -From 9c06f0f6aed26c1628acaa74df0232dd7b345e9a Mon Sep 17 00:00:00 2001 -From: Venkateswara Naralasetty -Date: Wed, 5 Dec 2018 11:23:51 +0100 -Subject: [PATCH] hostapd: Add Multi-AP protocol support - -The purpose of Multi-AP specification is to enable inter-operability -across Wi-Fi access points (APs) from different vendors. - -This patch introduces one new configuration parameter 'multi_ap' to -enable Multi-AP functionality and to configure the BSS as a backhaul -and/or fronthaul BSS. - -Advertise vendor specific Multi-AP capabilities in (Re)Association -Response frame, if Multi-AP functionality is enabled through the -configuration parameter. - -A backhaul AP must support receiving both 3addr and 4addr frames from a -backhaul STA, so create a VLAN for it just like is done for WDS, i.e., -by calling hostapd_set_wds_sta(). Since Multi-AP requires WPA2 (never -WEP), we can safely call hostapd_set_wds_encryption() as well and we can -reuse the entire WDS condition. - -To parse the Multi-AP Extension subelement, we use get_ie(): even though -that function is meant for parsing IEs, it works for subelements. - -Signed-off-by: Venkateswara Naralasetty -Signed-off-by: Jouni Malinen -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- - hostapd/config_file.c | 10 +++++ - hostapd/hostapd.conf | 7 ++++ - src/ap/ap_config.h | 4 ++ - src/ap/ieee802_11.c | 77 +++++++++++++++++++++++++++++++++- - src/ap/sta_info.c | 2 +- - src/ap/sta_info.h | 1 + - src/common/ieee802_11_common.c | 24 +++++++++++ - src/common/ieee802_11_common.h | 4 ++ - src/common/ieee802_11_defs.h | 7 ++++ - 9 files changed, 134 insertions(+), 2 deletions(-) - ---- a/hostapd/config_file.c -+++ b/hostapd/config_file.c -@@ -4115,6 +4115,16 @@ static int hostapd_config_fill(struct ho - } else if (os_strcmp(buf, "coloc_intf_reporting") == 0) { - bss->coloc_intf_reporting = atoi(pos); - #endif /* CONFIG_OWE */ -+ } else if (os_strcmp(buf, "multi_ap") == 0) { -+ int val = atoi(pos); -+ -+ if (val < 0 || val > 3) { -+ wpa_printf(MSG_ERROR, "Line %d: Invalid multi_ap '%s'", -+ line, buf); -+ return -1; -+ } -+ -+ bss->multi_ap = val; - } else { - wpa_printf(MSG_ERROR, - "Line %d: unknown configuration item '%s'", ---- a/hostapd/hostapd.conf -+++ b/hostapd/hostapd.conf -@@ -438,6 +438,13 @@ wmm_ac_vo_txop_limit=47 - wmm_ac_vo_acm=0 - # Note: for IEEE 802.11b mode: cWmin=3 cWmax=4 burst=102 - -+# Enable Multi-AP functionality -+# 0 = disabled (default) -+# 1 = AP support backhaul BSS -+# 2 = AP support fronthaul BSS -+# 3 = AP supports both backhaul BSS and fronthaul BSS -+#multi_ap=0 -+ - # Static WEP key configuration - # - # The key number to use when transmitting. ---- a/src/ap/ap_config.h -+++ b/src/ap/ap_config.h -@@ -688,6 +688,10 @@ struct hostapd_bss_config { - #endif /* CONFIG_OWE */ - - int coloc_intf_reporting; -+ -+#define BACKHAUL_BSS 1 -+#define FRONTHAUL_BSS 2 -+ int multi_ap; /* bitmap of BACKHAUL_BSS, FRONTHAUL_BSS */ - }; - - /** ---- a/src/ap/ieee802_11.c -+++ b/src/ap/ieee802_11.c -@@ -62,6 +62,22 @@ prepare_auth_resp_fils(struct hostapd_da - int *is_pub); - #endif /* CONFIG_FILS */ - -+ -+u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid) -+{ -+ u8 multi_ap_val = 0; -+ -+ if (!hapd->conf->multi_ap) -+ return eid; -+ if (hapd->conf->multi_ap & BACKHAUL_BSS) -+ multi_ap_val |= MULTI_AP_BACKHAUL_BSS; -+ if (hapd->conf->multi_ap & FRONTHAUL_BSS) -+ multi_ap_val |= MULTI_AP_FRONTHAUL_BSS; -+ -+ return eid + add_multi_ap_ie(eid, 9, multi_ap_val); -+} -+ -+ - u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid) - { - u8 *pos = eid; -@@ -2210,6 +2226,57 @@ static u16 check_wmm(struct hostapd_data - return WLAN_STATUS_SUCCESS; - } - -+static u16 check_multi_ap(struct hostapd_data *hapd, struct sta_info *sta, -+ const u8 *multi_ap_ie, size_t multi_ap_len) -+{ -+ u8 multi_ap_value = 0; -+ -+ sta->flags &= ~WLAN_STA_MULTI_AP; -+ -+ if (!hapd->conf->multi_ap) -+ return WLAN_STATUS_SUCCESS; -+ -+ if (multi_ap_ie) { -+ const u8 *multi_ap_subelem; -+ -+ multi_ap_subelem = get_ie(multi_ap_ie + 4, -+ multi_ap_len - 4, -+ MULTI_AP_SUB_ELEM_TYPE); -+ if (multi_ap_subelem && multi_ap_subelem[1] == 1) { -+ multi_ap_value = multi_ap_subelem[2]; -+ } else { -+ hostapd_logger(hapd, sta->addr, -+ HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_INFO, -+ "Multi-AP IE has missing or invalid Multi-AP subelement"); -+ return WLAN_STATUS_INVALID_IE; -+ } -+ } -+ -+ if (multi_ap_value == MULTI_AP_BACKHAUL_STA) -+ sta->flags |= WLAN_STA_MULTI_AP; -+ -+ if ((hapd->conf->multi_ap & BACKHAUL_BSS) && -+ multi_ap_value == MULTI_AP_BACKHAUL_STA) -+ return WLAN_STATUS_SUCCESS; -+ -+ if (hapd->conf->multi_ap & FRONTHAUL_BSS) { -+ if (multi_ap_value == MULTI_AP_BACKHAUL_STA) { -+ hostapd_logger(hapd, sta->addr, -+ HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_INFO, -+ "Backhaul STA tries to associate with fronthaul-only BSS"); -+ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; -+ } -+ return WLAN_STATUS_SUCCESS; -+ } -+ -+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_INFO, -+ "Non-Multi-AP STA tries to associate with backhaul-only BSS"); -+ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; -+} -+ - - static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta, - struct ieee802_11_elems *elems) -@@ -2466,6 +2533,11 @@ static u16 check_assoc_ies(struct hostap - resp = copy_supp_rates(hapd, sta, &elems); - if (resp != WLAN_STATUS_SUCCESS) - return resp; -+ -+ resp = check_multi_ap(hapd, sta, elems.multi_ap, elems.multi_ap_len); -+ if (resp != WLAN_STATUS_SUCCESS) -+ return resp; -+ - #ifdef CONFIG_IEEE80211N - resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities); - if (resp != WLAN_STATUS_SUCCESS) -@@ -2996,6 +3068,9 @@ static u16 send_assoc_resp(struct hostap - } - #endif /* CONFIG_WPS */ - -+ if (sta && (sta->flags & WLAN_STA_MULTI_AP)) -+ p = hostapd_eid_multi_ap(hapd, p); -+ - #ifdef CONFIG_P2P - if (sta && sta->p2p_ie && hapd->p2p_group) { - struct wpabuf *p2p_resp_ie; -@@ -4236,7 +4311,7 @@ static void handle_assoc_cb(struct hosta - sta->flags |= WLAN_STA_WDS; - } - -- if (sta->flags & WLAN_STA_WDS) { -+ if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) { - int ret; - char ifname_wds[IFNAMSIZ + 1]; - ---- a/src/ap/sta_info.c -+++ b/src/ap/sta_info.c -@@ -166,7 +166,7 @@ void ap_free_sta(struct hostapd_data *ha - /* just in case */ - ap_sta_set_authorized(hapd, sta, 0); - -- if (sta->flags & WLAN_STA_WDS) -+ if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) - hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0); - - if (sta->ipaddr) ---- a/src/ap/sta_info.h -+++ b/src/ap/sta_info.h -@@ -36,6 +36,7 @@ - #define WLAN_STA_VHT_OPMODE_ENABLED BIT(20) - #define WLAN_STA_VENDOR_VHT BIT(21) - #define WLAN_STA_PENDING_FILS_ERP BIT(22) -+#define WLAN_STA_MULTI_AP BIT(23) - #define WLAN_STA_PENDING_DISASSOC_CB BIT(29) - #define WLAN_STA_PENDING_DEAUTH_CB BIT(30) - #define WLAN_STA_NONERP BIT(31) ---- a/src/common/ieee802_11_common.c -+++ b/src/common/ieee802_11_common.c -@@ -126,6 +126,10 @@ static int ieee802_11_parse_vendor_speci - elems->roaming_cons_sel = pos; - elems->roaming_cons_sel_len = elen; - break; -+ case MULTI_AP_OUI_TYPE: -+ elems->multi_ap = pos; -+ elems->multi_ap_len = elen; -+ break; - default: - wpa_printf(MSG_MSGDUMP, "Unknown WFA " - "information element ignored " -@@ -1519,6 +1523,26 @@ size_t mbo_add_ie(u8 *buf, size_t len, c - } - - -+size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value) -+{ -+ u8 *pos = buf; -+ -+ if (len < 9) -+ return 0; -+ -+ *pos++ = WLAN_EID_VENDOR_SPECIFIC; -+ *pos++ = 7; /* len */ -+ WPA_PUT_BE24(pos, OUI_WFA); -+ pos += 3; -+ *pos++ = MULTI_AP_OUI_TYPE; -+ *pos++ = MULTI_AP_SUB_ELEM_TYPE; -+ *pos++ = 1; /* len */ -+ *pos++ = value; -+ -+ return pos - buf; -+} -+ -+ - static const struct country_op_class us_op_class[] = { - { 1, 115 }, - { 2, 118 }, ---- a/src/common/ieee802_11_common.h -+++ b/src/common/ieee802_11_common.h -@@ -84,6 +84,7 @@ struct ieee802_11_elems { - const u8 *power_capab; - const u8 *roaming_cons_sel; - const u8 *password_id; -+ const u8 *multi_ap; - - u8 ssid_len; - u8 supp_rates_len; -@@ -130,6 +131,7 @@ struct ieee802_11_elems { - u8 power_capab_len; - u8 roaming_cons_sel_len; - u8 password_id_len; -+ u8 multi_ap_len; - - struct mb_ies_info mb_ies; - }; -@@ -189,6 +191,8 @@ const u8 * get_ie_ext(const u8 *ies, siz - - size_t mbo_add_ie(u8 *buf, size_t len, const u8 *attr, size_t attr_len); - -+size_t add_multi_ap_ie(u8 *buf, size_t len, u8 value); -+ - struct country_op_class { - u8 country_op_class; - u8 global_op_class; ---- a/src/common/ieee802_11_defs.h -+++ b/src/common/ieee802_11_defs.h -@@ -1210,6 +1210,13 @@ struct ieee80211_ampe_ie { - #define MBO_OUI_TYPE 22 - #define OWE_IE_VENDOR_TYPE 0x506f9a1c - #define OWE_OUI_TYPE 28 -+#define MULTI_AP_OUI_TYPE 0x1B -+ -+#define MULTI_AP_SUB_ELEM_TYPE 0x06 -+#define MULTI_AP_TEAR_DOWN BIT(4) -+#define MULTI_AP_FRONTHAUL_BSS BIT(5) -+#define MULTI_AP_BACKHAUL_BSS BIT(6) -+#define MULTI_AP_BACKHAUL_STA BIT(7) - - #define WMM_OUI_TYPE 2 - #define WMM_OUI_SUBTYPE_INFORMATION_ELEMENT 0 diff --git a/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch b/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch deleted file mode 100755 index 5fc41c20e6..0000000000 --- a/package/network/services/hostapd/patches/551-wpa_supplicant-Add-Multi-AP-protocol-support-to-supp.patch +++ /dev/null @@ -1,311 +0,0 @@ -From 5abc7823bd01f69b8afbe1fd19f65fff86137c44 Mon Sep 17 00:00:00 2001 -From: Venkateswara Naralasetty -Date: Wed, 5 Dec 2018 11:23:53 +0100 -Subject: [PATCH] wpa_supplicant: Add Multi-AP backhaul STA support - -Advertise vendor specific Multi-AP IE in (Re)Association Request frames -and process Multi-AP IE from (Re)Association Response frames if the user -enables Multi-AP fuctionality. If the (Re)Association Response frame -does not contain the Multi-AP IE, disassociate. - -This adds a new configuration parameter 'multi_ap_backhaul_sta' to -enable/disable Multi-AP functionality. - -Enable 4-address mode after association (if the Association Response -frame contains the Multi-AP IE). Also enable the bridge in that case. -This is necessary because wpa_supplicant only enables the bridge in -wpa_drv_if_add(), which only gets called when an interface is added -through the control interface, not when it is configured from the -command line. - -Signed-off-by: Venkateswara Naralasetty -Signed-off-by: Jouni Malinen -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- - src/drivers/driver.h | 9 ++++++ - src/drivers/driver_nl80211.c | 44 ++++++++++++++++++++++++++ - wpa_supplicant/config.c | 1 + - wpa_supplicant/config_ssid.h | 7 +++++ - wpa_supplicant/driver_i.h | 8 +++++ - wpa_supplicant/events.c | 50 ++++++++++++++++++++++++++++++ - wpa_supplicant/sme.c | 16 ++++++++++ - wpa_supplicant/wpa_supplicant.c | 18 +++++++++++ - wpa_supplicant/wpa_supplicant.conf | 7 +++++ - wpa_supplicant/wpa_supplicant_i.h | 1 + - 10 files changed, 161 insertions(+) - ---- a/src/drivers/driver.h -+++ b/src/drivers/driver.h -@@ -4100,6 +4100,15 @@ struct wpa_driver_ops { - */ - int (*send_external_auth_status)(void *priv, - struct external_auth *params); -+ -+ /** -+ * set_4addr_mode - Set 4-address mode -+ * @priv: Private driver interface data -+ * @bridge_ifname: Bridge interface name -+ * @val: 0 - disable 4addr mode, 1 - enable 4addr mode -+ * Returns: 0 on success, < 0 on failure -+ */ -+ int (*set_4addr_mode)(void *priv, const char *bridge_ifname, int val); - }; - - /** ---- a/src/drivers/driver_nl80211.c -+++ b/src/drivers/driver_nl80211.c -@@ -10728,6 +10728,49 @@ fail: - } - - -+static int nl80211_set_4addr_mode(void *priv, const char *bridge_ifname, -+ int val) -+{ -+ struct i802_bss *bss = priv; -+ struct wpa_driver_nl80211_data *drv = bss->drv; -+ struct nl_msg *msg; -+ int ret = -ENOBUFS; -+ -+ wpa_printf(MSG_DEBUG, "nl80211: %s 4addr mode (bridge_ifname: %s)", -+ val ? "Enable" : "Disable", bridge_ifname); -+ -+ msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE); -+ if (!msg || nla_put_u8(msg, NL80211_ATTR_4ADDR, val)) -+ goto fail; -+ -+ if (bridge_ifname[0] && bss->added_if_into_bridge && !val) { -+ if (linux_br_del_if(drv->global->ioctl_sock, -+ bridge_ifname, bss->ifname)) { -+ wpa_printf(MSG_ERROR, -+ "nl80211: Failed to remove interface %s from bridge %s", -+ bss->ifname, bridge_ifname); -+ return -1; -+ } -+ bss->added_if_into_bridge = 0; -+ } -+ -+ ret = send_and_recv_msgs(drv, msg, NULL, NULL); -+ msg = NULL; -+ if (!ret) { -+ if (bridge_ifname[0] && val && -+ i802_check_bridge(drv, bss, bridge_ifname, bss->ifname) < 0) -+ return -1; -+ return 0; -+ } -+ -+fail: -+ nlmsg_free(msg); -+ wpa_printf(MSG_ERROR, "nl80211: Failed to enable/disable 4addr"); -+ -+ return ret; -+} -+ -+ - const struct wpa_driver_ops wpa_driver_nl80211_ops = { - .name = "nl80211", - .desc = "Linux nl80211/cfg80211", -@@ -10856,4 +10899,5 @@ const struct wpa_driver_ops wpa_driver_n - .get_ext_capab = nl80211_get_ext_capab, - .update_connect_params = nl80211_update_connection_params, - .send_external_auth_status = nl80211_send_external_auth_status, -+ .set_4addr_mode = nl80211_set_4addr_mode, - }; ---- a/wpa_supplicant/config.c -+++ b/wpa_supplicant/config.c -@@ -2416,6 +2416,7 @@ static const struct parse_data ssid_fiel - #endif /* CONFIG_DPP */ - { INT_RANGE(owe_group, 0, 65535) }, - { INT_RANGE(owe_only, 0, 1) }, -+ { INT_RANGE(multi_ap_backhaul_sta, 0, 1) }, - }; - - #undef OFFSET ---- a/wpa_supplicant/config_ssid.h -+++ b/wpa_supplicant/config_ssid.h -@@ -950,6 +950,13 @@ struct wpa_ssid { - * the selection attempts for OWE BSS exceed the configured threshold. - */ - int owe_transition_bss_select_count; -+ -+ /** -+ * multi_ap_backhaul_sta - Multi-AP backhaul STA -+ * 0 = normal (non-Multi-AP) station -+ * 1 = Multi-AP backhaul station -+ */ -+ int multi_ap_backhaul_sta; - }; - - #endif /* CONFIG_SSID_H */ ---- a/wpa_supplicant/driver_i.h -+++ b/wpa_supplicant/driver_i.h -@@ -1046,4 +1046,12 @@ wpa_drv_send_external_auth_status(struct - params); - } - -+static inline int wpa_drv_set_4addr_mode(struct wpa_supplicant *wpa_s, int val) -+{ -+ if (!wpa_s->driver->set_4addr_mode) -+ return -1; -+ return wpa_s->driver->set_4addr_mode(wpa_s->drv_priv, -+ wpa_s->bridge_ifname, val); -+} -+ - #endif /* DRIVER_I_H */ ---- a/wpa_supplicant/events.c -+++ b/wpa_supplicant/events.c -@@ -324,6 +324,9 @@ void wpa_supplicant_mark_disassoc(struct - os_memset(wpa_s->last_tk, 0, sizeof(wpa_s->last_tk)); - #endif /* CONFIG_TESTING_OPTIONS */ - wpa_s->ieee80211ac = 0; -+ -+ if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0) -+ wpa_s->enabled_4addr_mode = 0; - } - - -@@ -2267,6 +2270,50 @@ static void interworking_process_assoc_r - #endif /* CONFIG_INTERWORKING */ - - -+static void multi_ap_process_assoc_resp(struct wpa_supplicant *wpa_s, -+ const u8 *ies, size_t ies_len) -+{ -+ struct ieee802_11_elems elems; -+ const u8 *map_sub_elem, *pos; -+ size_t len; -+ -+ if (!wpa_s->current_ssid || -+ !wpa_s->current_ssid->multi_ap_backhaul_sta || -+ !ies || -+ ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) -+ return; -+ -+ if (!elems.multi_ap || elems.multi_ap_len < 7) { -+ wpa_printf(MSG_INFO, "AP doesn't support Multi-AP protocol"); -+ goto fail; -+ } -+ -+ pos = elems.multi_ap + 4; -+ len = elems.multi_ap_len - 4; -+ -+ map_sub_elem = get_ie(pos, len, MULTI_AP_SUB_ELEM_TYPE); -+ if (!map_sub_elem || map_sub_elem[1] < 1) { -+ wpa_printf(MSG_INFO, "invalid Multi-AP sub elem type"); -+ goto fail; -+ } -+ -+ if (!(map_sub_elem[2] & MULTI_AP_BACKHAUL_BSS)) { -+ wpa_printf(MSG_INFO, "AP doesn't support backhaul BSS"); -+ goto fail; -+ } -+ -+ if (wpa_drv_set_4addr_mode(wpa_s, 1) < 0) { -+ wpa_printf(MSG_ERROR, "Failed to set 4addr mode"); -+ goto fail; -+ } -+ wpa_s->enabled_4addr_mode = 1; -+ return; -+ -+fail: -+ wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING); -+} -+ -+ - #ifdef CONFIG_FST - static int wpas_fst_update_mbie(struct wpa_supplicant *wpa_s, - const u8 *ie, size_t ie_len) -@@ -2343,6 +2390,9 @@ static int wpa_supplicant_event_associnf - get_ie(data->assoc_info.resp_ies, - data->assoc_info.resp_ies_len, WLAN_EID_VHT_CAP)) - wpa_s->ieee80211ac = 1; -+ -+ multi_ap_process_assoc_resp(wpa_s, data->assoc_info.resp_ies, -+ data->assoc_info.resp_ies_len); - } - if (data->assoc_info.beacon_ies) - wpa_hexdump(MSG_DEBUG, "beacon_ies", ---- a/wpa_supplicant/sme.c -+++ b/wpa_supplicant/sme.c -@@ -1552,6 +1552,22 @@ void sme_associate(struct wpa_supplicant - } - #endif /* CONFIG_OWE */ - -+ if (wpa_s->current_ssid && wpa_s->current_ssid->multi_ap_backhaul_sta) { -+ size_t multi_ap_ie_len; -+ -+ multi_ap_ie_len = add_multi_ap_ie( -+ wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len, -+ sizeof(wpa_s->sme.assoc_req_ie) - -+ wpa_s->sme.assoc_req_ie_len, -+ MULTI_AP_BACKHAUL_STA); -+ if (multi_ap_ie_len == 0) { -+ wpa_printf(MSG_ERROR, -+ "Multi-AP: Failed to build Multi-AP IE"); -+ return; -+ } -+ wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len; -+ } -+ - params.bssid = bssid; - params.ssid = wpa_s->sme.ssid; - params.ssid_len = wpa_s->sme.ssid_len; ---- a/wpa_supplicant/wpa_supplicant.c -+++ b/wpa_supplicant/wpa_supplicant.c -@@ -2893,6 +2893,21 @@ static u8 * wpas_populate_assoc_ies( - } - #endif /* CONFIG_IEEE80211R */ - -+ if (ssid->multi_ap_backhaul_sta) { -+ size_t multi_ap_ie_len; -+ -+ multi_ap_ie_len = add_multi_ap_ie(wpa_ie + wpa_ie_len, -+ max_wpa_ie_len - wpa_ie_len, -+ MULTI_AP_BACKHAUL_STA); -+ if (multi_ap_ie_len == 0) { -+ wpa_printf(MSG_ERROR, -+ "Multi-AP: Failed to build Multi-AP IE"); -+ os_free(wpa_ie); -+ return NULL; -+ } -+ wpa_ie_len += multi_ap_ie_len; -+ } -+ - params->wpa_ie = wpa_ie; - params->wpa_ie_len = wpa_ie_len; - params->auth_alg = algs; -@@ -3377,6 +3392,9 @@ void wpa_supplicant_deauthenticate(struc - zero_addr = 1; - } - -+ if (wpa_s->enabled_4addr_mode && wpa_drv_set_4addr_mode(wpa_s, 0) == 0) -+ wpa_s->enabled_4addr_mode = 0; -+ - #ifdef CONFIG_TDLS - wpa_tdls_teardown_peers(wpa_s->wpa); - #endif /* CONFIG_TDLS */ ---- a/wpa_supplicant/wpa_supplicant.conf -+++ b/wpa_supplicant/wpa_supplicant.conf -@@ -1399,6 +1399,13 @@ fast_reauth=1 - # 2: MCS 0-9 - # 3: not supported - -+# multi_ap_backhaul_sta: Multi-AP backhaul STA functionality -+# 0 = normal STA (default) -+# 1 = backhaul STA -+# A backhaul STA sends the Multi-AP IE, fails to associate if the AP does not -+# support Multi-AP, and sets 4-address mode if it does. Thus, the netdev can be -+# added to a bridge to allow forwarding frames over this backhaul link. -+ - ##### Fast Session Transfer (FST) support ##################################### - # - # The options in this section are only available when the build configuration ---- a/wpa_supplicant/wpa_supplicant_i.h -+++ b/wpa_supplicant/wpa_supplicant_i.h -@@ -1242,6 +1242,7 @@ struct wpa_supplicant { - unsigned int disable_fils:1; - #endif /* CONFIG_FILS */ - unsigned int ieee80211ac:1; -+ unsigned int enabled_4addr_mode:1; - }; - - diff --git a/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch b/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch deleted file mode 100755 index 1f3aed92bd..0000000000 --- a/package/network/services/hostapd/patches/552-tests-Multi-AP-association.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 7488e0ade6dffb6df4c1fb6526a9f3ede0eb18ef Mon Sep 17 00:00:00 2001 -From: Jouni Malinen -Date: Thu, 20 Dec 2018 12:41:00 +0200 -Subject: [PATCH] tests: Multi-AP association - -Signed-off-by: Jouni Malinen ---- - tests/hwsim/test_multi_ap.py | 73 ++++++++++++++++++++++++++++++++++++ - tests/hwsim/wpasupplicant.py | 3 +- - 2 files changed, 75 insertions(+), 1 deletion(-) - create mode 100644 tests/hwsim/test_multi_ap.py - ---- /dev/null -+++ b/tests/hwsim/test_multi_ap.py -@@ -0,0 +1,73 @@ -+# Test cases for Multi-AP -+# Copyright (c) 2018, The Linux Foundation -+# -+# This software may be distributed under the terms of the BSD license. -+# See README for more details. -+ -+import hostapd -+ -+def test_multi_ap_association(dev, apdev): -+ """Multi-AP association in backhaul BSS""" -+ run_multi_ap_association(dev, apdev, 1) -+ dev[1].connect("multi-ap", psk="12345678", scan_freq="2412", -+ wait_connect=False) -+ ev = dev[1].wait_event([ "CTRL-EVENT-DISCONNECTED", -+ "CTRL-EVENT-CONNECTED", -+ "CTRL-EVENT-ASSOC-REJECT" ], -+ timeout=5) -+ dev[1].request("DISCONNECT") -+ if ev is None: -+ raise Exception("Connection result not reported") -+ if "CTRL-EVENT-ASSOC-REJECT" not in ev: -+ raise Exception("Association rejection not reported") -+ if "status_code=12" not in ev: -+ raise Exception("Unexpected association status code: " + ev) -+ -+def test_multi_ap_association_shared_bss(dev, apdev): -+ """Multi-AP association in backhaul BSS (with fronthaul BSS enabled)""" -+ run_multi_ap_association(dev, apdev, 3) -+ dev[1].connect("multi-ap", psk="12345678", scan_freq="2412") -+ -+def run_multi_ap_association(dev, apdev, multi_ap): -+ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -+ params["multi_ap"] = str(multi_ap) -+ hapd = hostapd.add_ap(apdev[0], params) -+ -+ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -+ scan_freq="2412") -+ -+def test_multi_ap_disabled_on_ap(dev, apdev): -+ """Multi-AP association attempt when disabled on AP""" -+ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -+ hapd = hostapd.add_ap(apdev[0], params) -+ -+ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -+ scan_freq="2412", wait_connect=False) -+ ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", -+ "CTRL-EVENT-CONNECTED" ], -+ timeout=5) -+ dev[0].request("DISCONNECT") -+ if ev is None: -+ raise Exception("Connection result not reported") -+ if "CTRL-EVENT-DISCONNECTED" not in ev: -+ raise Exception("Unexpected connection result") -+ -+def test_multi_ap_fronthaul_on_ap(dev, apdev): -+ """Multi-AP association attempt when only fronthaul BSS on AP""" -+ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -+ params["multi_ap"] = "2" -+ hapd = hostapd.add_ap(apdev[0], params) -+ -+ dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -+ scan_freq="2412", wait_connect=False) -+ ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", -+ "CTRL-EVENT-CONNECTED", -+ "CTRL-EVENT-ASSOC-REJECT" ], -+ timeout=5) -+ dev[0].request("DISCONNECT") -+ if ev is None: -+ raise Exception("Connection result not reported") -+ if "CTRL-EVENT-ASSOC-REJECT" not in ev: -+ raise Exception("Association rejection not reported") -+ if "status_code=12" not in ev: -+ raise Exception("Unexpected association status code: " + ev) ---- a/tests/hwsim/wpasupplicant.py -+++ b/tests/hwsim/wpasupplicant.py -@@ -1031,7 +1031,8 @@ class WpaSupplicant: - "dpp_csign", "dpp_csign_expiry", - "dpp_netaccesskey", "dpp_netaccesskey_expiry", - "group_mgmt", "owe_group", -- "roaming_consortium_selection" ] -+ "roaming_consortium_selection", "multi_ap_backhaul_sta" ] -+ - for field in not_quoted: - if field in kwargs and kwargs[field]: - self.set_network(id, field, kwargs[field]) diff --git a/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch b/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch deleted file mode 100755 index 240407fd1c..0000000000 --- a/package/network/services/hostapd/patches/553-tests-refactor-test_multi_ap.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 0f5029ff41ef286aa7b3e4a3efd3f1a16be925e8 Mon Sep 17 00:00:00 2001 -From: "Arnout Vandecappelle (Essensium/Mind)" -Date: Wed, 9 Jan 2019 18:41:08 +0100 -Subject: [PATCH] tests: refactor test_multi_ap - -With just one additional argument, the run_multi_ap_association function -can be used for all tests. - -While we're at it, also move it to the top of the file. - -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: new patch ---- - tests/hwsim/test_multi_ap.py | 30 +++++++++++------------------- - 1 file changed, 11 insertions(+), 19 deletions(-) - ---- a/tests/hwsim/test_multi_ap.py -+++ b/tests/hwsim/test_multi_ap.py -@@ -6,6 +6,15 @@ - - import hostapd - -+def run_multi_ap_association(dev, apdev, multi_ap, wait_connect=True): -+ params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -+ if multi_ap: -+ params["multi_ap"] = str(multi_ap) -+ hapd = hostapd.add_ap(apdev[0], params) -+ -+ dev[0].connect("multi-ap", psk="12345678", scan_freq="2412", -+ multi_ap_backhaul_sta="1", wait_connect=wait_connect) -+ - def test_multi_ap_association(dev, apdev): - """Multi-AP association in backhaul BSS""" - run_multi_ap_association(dev, apdev, 1) -@@ -28,21 +37,9 @@ def test_multi_ap_association_shared_bss - run_multi_ap_association(dev, apdev, 3) - dev[1].connect("multi-ap", psk="12345678", scan_freq="2412") - --def run_multi_ap_association(dev, apdev, multi_ap): -- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -- params["multi_ap"] = str(multi_ap) -- hapd = hostapd.add_ap(apdev[0], params) -- -- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -- scan_freq="2412") -- - def test_multi_ap_disabled_on_ap(dev, apdev): - """Multi-AP association attempt when disabled on AP""" -- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -- hapd = hostapd.add_ap(apdev[0], params) -- -- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -- scan_freq="2412", wait_connect=False) -+ run_multi_ap_association(dev, apdev, 0, wait_connect=False) - ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", - "CTRL-EVENT-CONNECTED" ], - timeout=5) -@@ -54,12 +51,7 @@ def test_multi_ap_disabled_on_ap(dev, ap - - def test_multi_ap_fronthaul_on_ap(dev, apdev): - """Multi-AP association attempt when only fronthaul BSS on AP""" -- params = hostapd.wpa2_params(ssid="multi-ap", passphrase="12345678") -- params["multi_ap"] = "2" -- hapd = hostapd.add_ap(apdev[0], params) -- -- dev[0].connect("multi-ap", psk="12345678", multi_ap_backhaul_sta="1", -- scan_freq="2412", wait_connect=False) -+ run_multi_ap_association(dev, apdev, 2, wait_connect=False) - ev = dev[0].wait_event([ "CTRL-EVENT-DISCONNECTED", - "CTRL-EVENT-CONNECTED", - "CTRL-EVENT-ASSOC-REJECT" ], diff --git a/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch b/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch deleted file mode 100755 index 6c30a1793e..0000000000 --- a/package/network/services/hostapd/patches/554-multi_ap-don-t-reject-backhaul-STA-on-fronhaul-BSS.patch +++ /dev/null @@ -1,106 +0,0 @@ -From 71b061b8a13791a1ed858d924e401541c8584030 Mon Sep 17 00:00:00 2001 -From: "Arnout Vandecappelle (Essensium/Mind)" -Date: Wed, 9 Jan 2019 19:08:00 +0100 -Subject: [PATCH] multi_ap: don't reject backhaul STA on fronhaul BSS - -The Multi-AP specification only specifies that information elements have -to be added to the association requests and responses; it doesn't -specify anything about what should be done in case they are missing. -Currently, we reject non-backhaul associations on a backhaul-only BSS, -and non-fronthaul associations on a fronthaul-only BSS. - -However, this makes WPS fail when fronthaul and backhaul are separate -SSIDs. Indeed, WPS for the backhaul link is performed on the *fronthaul* -SSID. Thus, the association request used for WPS *will* contain the -Multi-AP IE indicating a backhaul STA. Rejecting that association makes -WPS fail. - -Therefore, accept a multi-AP backhaul STA association request on a -fronthaul-only BSS. Still issue a warning about it, but only at level -DEBUG intead of INFO. Also change the condition checking to make it -clearer. - -While we're at it, also fix the handling of unexpected bits in the -Multi-AP IE. 4 bits are reserved in the specification, so these -certainly have to be ignored. The specification also doesn't say that -setting one of the other bits is not allowed. Therefore, only report -unexpected values in the Multi-AP IE, don't reject because of it. -Note that a malformed IE (containing more than one byte) still triggers -a rejection. - -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: new patch - -Cfr. discussion on http://lists.infradead.org/pipermail/hostap/2019-January/039232.html -and follow-ups. ---- - src/ap/ieee802_11.c | 38 +++++++++++++++++++----------------- - tests/hwsim/test_multi_ap.py | 6 ++---- - 2 files changed, 22 insertions(+), 22 deletions(-) - ---- a/src/ap/ieee802_11.c -+++ b/src/ap/ieee802_11.c -@@ -2253,28 +2253,30 @@ static u16 check_multi_ap(struct hostapd - } - } - -- if (multi_ap_value == MULTI_AP_BACKHAUL_STA) -- sta->flags |= WLAN_STA_MULTI_AP; -- -- if ((hapd->conf->multi_ap & BACKHAUL_BSS) && -- multi_ap_value == MULTI_AP_BACKHAUL_STA) -- return WLAN_STATUS_SUCCESS; -- -- if (hapd->conf->multi_ap & FRONTHAUL_BSS) { -- if (multi_ap_value == MULTI_AP_BACKHAUL_STA) { -- hostapd_logger(hapd, sta->addr, -- HOSTAPD_MODULE_IEEE80211, -- HOSTAPD_LEVEL_INFO, -- "Backhaul STA tries to associate with fronthaul-only BSS"); -- return WLAN_STATUS_ASSOC_DENIED_UNSPEC; -- } -- return WLAN_STATUS_SUCCESS; -+ if (multi_ap_value && multi_ap_value != MULTI_AP_BACKHAUL_STA) -+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_INFO, -+ "Multi-AP IE with unexpected value 0x%02x", -+ multi_ap_value); -+ -+ if (!(multi_ap_value & MULTI_AP_BACKHAUL_STA)) { -+ if (hapd->conf->multi_ap & FRONTHAUL_BSS) -+ return WLAN_STATUS_SUCCESS; -+ -+ hostapd_logger(hapd, sta->addr, -+ HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_INFO, -+ "Non-Multi-AP STA tries to associate with backhaul-only BSS"); -+ return WLAN_STATUS_ASSOC_DENIED_UNSPEC; - } - -- hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, -- HOSTAPD_LEVEL_INFO, -- "Non-Multi-AP STA tries to associate with backhaul-only BSS"); -- return WLAN_STATUS_ASSOC_DENIED_UNSPEC; -+ if (!(hapd->conf->multi_ap & BACKHAUL_BSS)) -+ hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, -+ HOSTAPD_LEVEL_DEBUG, -+ "Backhaul STA tries to associate with fronthaul-only BSS"); -+ -+ sta->flags |= WLAN_STA_MULTI_AP; -+ return WLAN_STATUS_SUCCESS; - } - - ---- a/tests/hwsim/test_multi_ap.py -+++ b/tests/hwsim/test_multi_ap.py -@@ -59,7 +59,5 @@ def test_multi_ap_fronthaul_on_ap(dev, a - dev[0].request("DISCONNECT") - if ev is None: - raise Exception("Connection result not reported") -- if "CTRL-EVENT-ASSOC-REJECT" not in ev: -- raise Exception("Association rejection not reported") -- if "status_code=12" not in ev: -- raise Exception("Unexpected association status code: " + ev) -+ if "CTRL-EVENT-DISCONNECTED" not in ev: -+ raise Exception("Unexpected connection result") diff --git a/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch b/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch deleted file mode 100755 index 2a1dc76ac1..0000000000 --- a/package/network/services/hostapd/patches/555-WPS-wps_build_wfa_ext-add-multi_ap_subelem-parameter.patch +++ /dev/null @@ -1,342 +0,0 @@ -From ad3c6faca118c23cdafef418dc27b3cee7d0e06e Mon Sep 17 00:00:00 2001 -From: "Arnout Vandecappelle (Essensium/Mind)" -Date: Wed, 9 Jan 2019 19:19:26 +0100 -Subject: [PATCH] WPS: wps_build_wfa_ext(): add multi_ap_subelem parameter - -The Multi-AP specification adds a new subelement to the WFA extension -element in the WPS exchange. Add an additional parameter to -wps_build_wfa_ext() to add this subelement. The subelement is only added -if the parameter is non-0. Note that we don't reuse the existing -MULTI_AP_SUB_ELEM_TYPE definition here, but rather define a new -WFA_ELEM_MULTI_AP, to make sure the enum of WFA subelement types remains -complete. - -For now, all callers set the multi_ap_subelem parameter to 0. - -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: Split off from supplicant WPS patch - -Since the original patch from Davina Lyu didn't have this extra -argument, I kept myself as the author of this patch. ---- - src/p2p/p2p_build.c | 2 +- - src/wps/wps.c | 6 +++--- - src/wps/wps_attr_build.c | 11 ++++++++++- - src/wps/wps_common.c | 16 ++++++++-------- - src/wps/wps_defs.h | 3 ++- - src/wps/wps_enrollee.c | 10 +++++----- - src/wps/wps_er.c | 4 ++-- - src/wps/wps_i.h | 3 ++- - src/wps/wps_registrar.c | 14 +++++++------- - src/wps/wps_upnp.c | 2 +- - 10 files changed, 41 insertions(+), 30 deletions(-) - ---- a/src/p2p/p2p_build.c -+++ b/src/p2p/p2p_build.c -@@ -802,7 +802,7 @@ int p2p_build_wps_ie(struct p2p_data *p2 - wpabuf_put_be16(buf, p2p->cfg->config_methods); - } - -- if (wps_build_wfa_ext(buf, 0, NULL, 0) < 0) -+ if (wps_build_wfa_ext(buf, 0, NULL, 0, 0) < 0) - return -1; - - if (all_attr && p2p->cfg->num_sec_dev_types) { ---- a/src/wps/wps.c -+++ b/src/wps/wps.c -@@ -430,7 +430,7 @@ struct wpabuf * wps_build_assoc_req_ie(e - - if (wps_build_version(ie) || - wps_build_req_type(ie, req_type) || -- wps_build_wfa_ext(ie, 0, NULL, 0)) { -+ wps_build_wfa_ext(ie, 0, NULL, 0, 0)) { - wpabuf_free(ie); - return NULL; - } -@@ -464,7 +464,7 @@ struct wpabuf * wps_build_assoc_resp_ie( - - if (wps_build_version(ie) || - wps_build_resp_type(ie, WPS_RESP_AP) || -- wps_build_wfa_ext(ie, 0, NULL, 0)) { -+ wps_build_wfa_ext(ie, 0, NULL, 0, 0)) { - wpabuf_free(ie); - return NULL; - } -@@ -516,7 +516,7 @@ struct wpabuf * wps_build_probe_req_ie(u - wps_build_model_name(dev, ie) || - wps_build_model_number(dev, ie) || - wps_build_dev_name(dev, ie) || -- wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0) || -+ wps_build_wfa_ext(ie, req_type == WPS_REQ_ENROLLEE, NULL, 0, 0) || - wps_build_req_dev_type(dev, ie, num_req_dev_types, req_dev_types) - || - wps_build_secondary_dev_type(dev, ie) ---- a/src/wps/wps_attr_build.c -+++ b/src/wps/wps_attr_build.c -@@ -203,7 +203,8 @@ int wps_build_version(struct wpabuf *msg - - - int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll, -- const u8 *auth_macs, size_t auth_macs_count) -+ const u8 *auth_macs, size_t auth_macs_count, -+ u8 multi_ap_subelem) - { - u8 *len; - -@@ -244,6 +245,14 @@ int wps_build_wfa_ext(struct wpabuf *msg - MAC2STR(&auth_macs[i * ETH_ALEN])); - } - -+ if (multi_ap_subelem) { -+ wpa_printf(MSG_DEBUG, "WPS: * Multi-AP (0x%x)", -+ multi_ap_subelem); -+ wpabuf_put_u8(msg, WFA_ELEM_MULTI_AP); -+ wpabuf_put_u8(msg, 1); /* length */ -+ wpabuf_put_u8(msg, multi_ap_subelem); -+ } -+ - WPA_PUT_BE16(len, (u8 *) wpabuf_put(msg, 0) - len - 2); - - #ifdef CONFIG_WPS_TESTING ---- a/src/wps/wps_common.c -+++ b/src/wps/wps_common.c -@@ -374,7 +374,7 @@ struct wpabuf * wps_get_oob_cred(struct - (rf_band && wps_build_rf_bands_attr(plain, rf_band)) || - (channel && wps_build_ap_channel(plain, channel)) || - wps_build_mac_addr(plain, wps->dev.mac_addr) || -- wps_build_wfa_ext(plain, 0, NULL, 0)) { -+ wps_build_wfa_ext(plain, 0, NULL, 0, 0)) { - os_free(data.new_psk); - wpabuf_clear_free(plain); - return NULL; -@@ -421,7 +421,7 @@ struct wpabuf * wps_build_nfc_pw_token(u - - if (wps_build_oob_dev_pw(data, dev_pw_id, pubkey, - wpabuf_head(dev_pw), wpabuf_len(dev_pw)) || -- wps_build_wfa_ext(data, 0, NULL, 0)) { -+ wps_build_wfa_ext(data, 0, NULL, 0, 0)) { - wpa_printf(MSG_ERROR, "WPS: Failed to build NFC password " - "token"); - wpabuf_clear_free(data); -@@ -586,7 +586,7 @@ struct wpabuf * wps_build_wsc_ack(struct - wps_build_msg_type(msg, WPS_WSC_ACK) || - wps_build_enrollee_nonce(wps, msg) || - wps_build_registrar_nonce(wps, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -610,7 +610,7 @@ struct wpabuf * wps_build_wsc_nack(struc - wps_build_enrollee_nonce(wps, msg) || - wps_build_registrar_nonce(wps, msg) || - wps_build_config_error(msg, wps->config_error) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -726,7 +726,7 @@ struct wpabuf * wps_build_nfc_handover_r - if (wps_build_oob_dev_pw(msg, DEV_PW_NFC_CONNECTION_HANDOVER, - nfc_dh_pubkey, NULL, 0) || - wps_build_uuid_e(msg, ctx->uuid) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -809,7 +809,7 @@ struct wpabuf * wps_build_nfc_handover_s - wps_build_ssid(msg, ctx) || - wps_build_ap_freq(msg, freq) || - (bssid && wps_build_mac_addr(msg, bssid)) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -848,7 +848,7 @@ struct wpabuf * wps_build_nfc_handover_r - wps_build_rf_bands(&ctx->dev, msg, 0) || - wps_build_serial_number(&ctx->dev, msg) || - wps_build_uuid_e(msg, ctx->uuid) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -900,7 +900,7 @@ struct wpabuf * wps_build_nfc_handover_s - wps_build_rf_bands(&ctx->dev, msg, 0) || - wps_build_serial_number(&ctx->dev, msg) || - wps_build_uuid_e(msg, ctx->uuid) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } ---- a/src/wps/wps_defs.h -+++ b/src/wps/wps_defs.h -@@ -152,7 +152,8 @@ enum { - WFA_ELEM_NETWORK_KEY_SHAREABLE = 0x02, - WFA_ELEM_REQUEST_TO_ENROLL = 0x03, - WFA_ELEM_SETTINGS_DELAY_TIME = 0x04, -- WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05 -+ WFA_ELEM_REGISTRAR_CONFIGURATION_METHODS = 0x05, -+ WFA_ELEM_MULTI_AP = 0x06 - }; - - /* Device Password ID */ ---- a/src/wps/wps_enrollee.c -+++ b/src/wps/wps_enrollee.c -@@ -152,7 +152,7 @@ static struct wpabuf * wps_build_m1(stru - wps_build_dev_password_id(msg, wps->dev_pw_id) || - wps_build_config_error(msg, WPS_CFG_NO_ERROR) || - wps_build_os_version(&wps->wps->dev, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_vendor_ext_m1(&wps->wps->dev, msg)) { - wpabuf_free(msg); - return NULL; -@@ -190,7 +190,7 @@ static struct wpabuf * wps_build_m3(stru - wps_build_msg_type(msg, WPS_M3) || - wps_build_registrar_nonce(wps, msg) || - wps_build_e_hash(wps, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_free(msg); - return NULL; -@@ -223,7 +223,7 @@ static struct wpabuf * wps_build_m5(stru - wps_build_e_snonce1(wps, plain) || - wps_build_key_wrap_auth(wps, plain) || - wps_build_encr_settings(wps, msg, plain) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_clear_free(plain); - wpabuf_free(msg); -@@ -393,7 +393,7 @@ static struct wpabuf * wps_build_m7(stru - (wps->wps->ap && wps_build_ap_settings(wps, plain)) || - wps_build_key_wrap_auth(wps, plain) || - wps_build_encr_settings(wps, msg, plain) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_clear_free(plain); - wpabuf_free(msg); -@@ -430,7 +430,7 @@ static struct wpabuf * wps_build_wsc_don - wps_build_msg_type(msg, WPS_WSC_DONE) || - wps_build_enrollee_nonce(wps, msg) || - wps_build_registrar_nonce(wps, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } ---- a/src/wps/wps_er.c -+++ b/src/wps/wps_er.c -@@ -1530,7 +1530,7 @@ void wps_er_set_sel_reg(struct wps_er *e - wps_er_build_selected_registrar(msg, sel_reg) || - wps_er_build_dev_password_id(msg, dev_passwd_id) || - wps_er_build_sel_reg_config_methods(msg, sel_reg_config_methods) || -- wps_build_wfa_ext(msg, 0, auth_macs, count) || -+ wps_build_wfa_ext(msg, 0, auth_macs, count, 0) || - wps_er_build_uuid_r(msg, er->wps->uuid)) { - wpabuf_free(msg); - return; -@@ -2048,7 +2048,7 @@ struct wpabuf * wps_er_config_token_from - data.wps = wps; - data.use_cred = cred; - if (wps_build_cred(&data, ret) || -- wps_build_wfa_ext(ret, 0, NULL, 0)) { -+ wps_build_wfa_ext(ret, 0, NULL, 0, 0)) { - wpabuf_free(ret); - return NULL; - } ---- a/src/wps/wps_i.h -+++ b/src/wps/wps_i.h -@@ -163,7 +163,8 @@ int wps_build_encr_settings(struct wps_d - struct wpabuf *plain); - int wps_build_version(struct wpabuf *msg); - int wps_build_wfa_ext(struct wpabuf *msg, int req_to_enroll, -- const u8 *auth_macs, size_t auth_macs_count); -+ const u8 *auth_macs, size_t auth_macs_count, -+ u8 multi_ap_subelem); - int wps_build_msg_type(struct wpabuf *msg, enum wps_msg_type msg_type); - int wps_build_enrollee_nonce(struct wps_data *wps, struct wpabuf *msg); - int wps_build_registrar_nonce(struct wps_data *wps, struct wpabuf *msg); ---- a/src/wps/wps_registrar.c -+++ b/src/wps/wps_registrar.c -@@ -1281,7 +1281,7 @@ static int wps_set_ie(struct wps_registr - wps_build_sel_reg_config_methods(reg, beacon) || - wps_build_sel_pbc_reg_uuid_e(reg, beacon) || - (reg->dualband && wps_build_rf_bands(®->wps->dev, beacon, 0)) || -- wps_build_wfa_ext(beacon, 0, auth_macs, count) || -+ wps_build_wfa_ext(beacon, 0, auth_macs, count, 0) || - wps_build_vendor_ext(®->wps->dev, beacon)) { - wpabuf_free(beacon); - wpabuf_free(probe); -@@ -1311,7 +1311,7 @@ static int wps_set_ie(struct wps_registr - wps_build_device_attrs(®->wps->dev, probe) || - wps_build_probe_config_methods(reg, probe) || - (reg->dualband && wps_build_rf_bands(®->wps->dev, probe, 0)) || -- wps_build_wfa_ext(probe, 0, auth_macs, count) || -+ wps_build_wfa_ext(probe, 0, auth_macs, count, 0) || - wps_build_vendor_ext(®->wps->dev, probe)) { - wpabuf_free(beacon); - wpabuf_free(probe); -@@ -1845,7 +1845,7 @@ static struct wpabuf * wps_build_m2(stru - wps_build_config_error(msg, WPS_CFG_NO_ERROR) || - wps_build_dev_password_id(msg, wps->dev_pw_id) || - wps_build_os_version(&wps->wps->dev, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -1913,7 +1913,7 @@ static struct wpabuf * wps_build_m2d(str - wps_build_assoc_state(wps, msg) || - wps_build_config_error(msg, err) || - wps_build_os_version(&wps->wps->dev, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } -@@ -1949,7 +1949,7 @@ static struct wpabuf * wps_build_m4(stru - wps_build_r_snonce1(wps, plain) || - wps_build_key_wrap_auth(wps, plain) || - wps_build_encr_settings(wps, msg, plain) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_clear_free(plain); - wpabuf_free(msg); -@@ -1984,7 +1984,7 @@ static struct wpabuf * wps_build_m6(stru - wps_build_r_snonce2(wps, plain) || - wps_build_key_wrap_auth(wps, plain) || - wps_build_encr_settings(wps, msg, plain) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_clear_free(plain); - wpabuf_free(msg); -@@ -2021,7 +2021,7 @@ static struct wpabuf * wps_build_m8(stru - (!wps->wps->ap && !wps->er && wps_build_ap_settings(wps, plain)) || - wps_build_key_wrap_auth(wps, plain) || - wps_build_encr_settings(wps, msg, plain) || -- wps_build_wfa_ext(msg, 0, NULL, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, 0) || - wps_build_authenticator(wps, msg)) { - wpabuf_clear_free(plain); - wpabuf_clear_free(msg); ---- a/src/wps/wps_upnp.c -+++ b/src/wps/wps_upnp.c -@@ -599,7 +599,7 @@ static struct wpabuf * build_fake_wsc_ac - wpabuf_put_be16(msg, ATTR_REGISTRAR_NONCE); - wpabuf_put_be16(msg, WPS_NONCE_LEN); - wpabuf_put(msg, WPS_NONCE_LEN); -- if (wps_build_wfa_ext(msg, 0, NULL, 0)) { -+ if (wps_build_wfa_ext(msg, 0, NULL, 0, 0)) { - wpabuf_free(msg); - return NULL; - } diff --git a/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch b/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch deleted file mode 100755 index 11c65c71a0..0000000000 --- a/package/network/services/hostapd/patches/556-wpa_supplicant-support-Multi-AP-backhaul-STA-onboard.patch +++ /dev/null @@ -1,217 +0,0 @@ -From 6c4c98db9420a3321bbf091cfc254de5eba4b404 Mon Sep 17 00:00:00 2001 -From: Davina Lu -Date: Tue, 15 Jan 2019 19:17:51 +0100 -Subject: [PATCH] wpa_supplicant: support Multi-AP backhaul STA onboarding - -The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a -backhaul STA through WPS. To enable this, the backhaul STA needs to add -a Multi-AP IE to the WFA vendor extension element in the WSC M1 message -that indicates it supports the Multi-AP backhaul STA role. The registrar -(if it support Multi-AP onboarding) will respond to that with a WSC M8 -message that also contains the Multi-AP IE, and that contains the -credentials for the backhaul SSID (which may be different from the SSID -on which WPS is performed). - -Introduce a new parameter to wpas_wps_start_pbc() and allow it to be -set via control interface's new multi_ap=1 parameter of WPS_PBC call. -multi_ap_backhaul_sta is set to 1 in the automatically created SSID. -Thus, if the AP does not support Multi-AP, association will fail and -WPS will be terminated. - -Only wps_pbc is supported. - -The multi_ap argument is only added to the socket interface, not to the -dbus interface. - -Signed-off-by: Davina Lu -Signed-off-by: Igor Mitsyanko -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) -Signed-off-by: Daniel Golle ---- -v4: use argument to wps_pbc instead of a global configuration option - (requested by Jouni) ---- - src/eap_peer/eap_wsc.c | 3 +++ - src/wps/wps.h | 6 ++++++ - src/wps/wps_enrollee.c | 6 +++++- - wpa_supplicant/ctrl_iface.c | 5 ++++- - wpa_supplicant/dbus/dbus_new_handlers_wps.c | 2 +- - wpa_supplicant/dbus/dbus_old_handlers_wps.c | 4 ++-- - wpa_supplicant/events.c | 2 +- - wpa_supplicant/p2p_supplicant.c | 2 +- - wpa_supplicant/wps_supplicant.c | 9 +++++++-- - wpa_supplicant/wps_supplicant.h | 2 +- - 10 files changed, 31 insertions(+), 10 deletions(-) - ---- a/src/eap_peer/eap_wsc.c -+++ b/src/eap_peer/eap_wsc.c -@@ -274,6 +274,9 @@ static void * eap_wsc_init(struct eap_sm - cfg.pin, cfg.pin_len, 0); - } - -+ if (os_strstr(phase1, "multi_ap=1")) -+ wps->multi_ap_backhaul_sta = 1; -+ - /* Use reduced client timeout for WPS to avoid long wait */ - if (sm->ClientTimeout > 30) - sm->ClientTimeout = 30; ---- a/src/wps/wps.h -+++ b/src/wps/wps.h -@@ -613,6 +613,12 @@ struct wps_context { - int ap_setup_locked; - - /** -+ * multi_ap_backhaul_sta - Whether this is a Multi-AP backhaul STA -+ * enrollee -+ */ -+ int multi_ap_backhaul_sta; -+ -+ /** - * uuid - Own UUID - */ - u8 uuid[16]; ---- a/src/wps/wps_enrollee.c -+++ b/src/wps/wps_enrollee.c -@@ -105,6 +105,7 @@ static struct wpabuf * wps_build_m1(stru - { - struct wpabuf *msg; - u16 config_methods; -+ u8 multi_ap_backhaul_sta = 0; - - if (random_get_bytes(wps->nonce_e, WPS_NONCE_LEN) < 0) - return NULL; -@@ -134,6 +135,9 @@ static struct wpabuf * wps_build_m1(stru - WPS_CONFIG_PHY_PUSHBUTTON); - } - -+ if (wps->wps->multi_ap_backhaul_sta) -+ multi_ap_backhaul_sta = MULTI_AP_BACKHAUL_STA; -+ - if (wps_build_version(msg) || - wps_build_msg_type(msg, WPS_M1) || - wps_build_uuid_e(msg, wps->uuid_e) || -@@ -152,7 +156,7 @@ static struct wpabuf * wps_build_m1(stru - wps_build_dev_password_id(msg, wps->dev_pw_id) || - wps_build_config_error(msg, WPS_CFG_NO_ERROR) || - wps_build_os_version(&wps->wps->dev, msg) || -- wps_build_wfa_ext(msg, 0, NULL, 0, 0) || -+ wps_build_wfa_ext(msg, 0, NULL, 0, multi_ap_backhaul_sta) || - wps_build_vendor_ext_m1(&wps->wps->dev, msg)) { - wpabuf_free(msg); - return NULL; ---- a/wpa_supplicant/ctrl_iface.c -+++ b/wpa_supplicant/ctrl_iface.c -@@ -1167,6 +1167,7 @@ static int wpa_supplicant_ctrl_iface_wps - #ifdef CONFIG_AP - u8 *_p2p_dev_addr = NULL; - #endif /* CONFIG_AP */ -+ int multi_ap = 0; - - if (cmd == NULL || os_strcmp(cmd, "any") == 0) { - _bssid = NULL; -@@ -1184,6 +1185,8 @@ static int wpa_supplicant_ctrl_iface_wps - wpa_printf(MSG_DEBUG, "CTRL_IFACE WPS_PBC: invalid BSSID '%s'", - cmd); - return -1; -+ } else if (os_strncmp(cmd, "multi_ap=", 9) == 0) { -+ multi_ap = atoi(cmd + 9); - } - - #ifdef CONFIG_AP -@@ -1191,7 +1194,7 @@ static int wpa_supplicant_ctrl_iface_wps - return wpa_supplicant_ap_wps_pbc(wpa_s, _bssid, _p2p_dev_addr); - #endif /* CONFIG_AP */ - -- return wpas_wps_start_pbc(wpa_s, _bssid, 0); -+ return wpas_wps_start_pbc(wpa_s, _bssid, 0, multi_ap); - } - - ---- a/wpa_supplicant/dbus/dbus_new_handlers_wps.c -+++ b/wpa_supplicant/dbus/dbus_new_handlers_wps.c -@@ -289,7 +289,7 @@ DBusMessage * wpas_dbus_handler_wps_star - if (ret > 0) - os_snprintf(npin, sizeof(npin), "%08d", ret); - } else { -- ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0); -+ ret = wpas_wps_start_pbc(wpa_s, params.bssid, 0, 0); - } - - if (ret < 0) { ---- a/wpa_supplicant/dbus/dbus_old_handlers_wps.c -+++ b/wpa_supplicant/dbus/dbus_old_handlers_wps.c -@@ -37,9 +37,9 @@ DBusMessage * wpas_dbus_iface_wps_pbc(DB - return wpas_dbus_new_invalid_opts_error(message, NULL); - - if (os_strcmp(arg_bssid, "any") == 0) -- ret = wpas_wps_start_pbc(wpa_s, NULL, 0); -+ ret = wpas_wps_start_pbc(wpa_s, NULL, 0, 0); - else if (!hwaddr_aton(arg_bssid, bssid)) -- ret = wpas_wps_start_pbc(wpa_s, bssid, 0); -+ ret = wpas_wps_start_pbc(wpa_s, bssid, 0, 0); - else { - return wpas_dbus_new_invalid_opts_error(message, - "Invalid BSSID"); ---- a/wpa_supplicant/events.c -+++ b/wpa_supplicant/events.c -@@ -4816,7 +4816,7 @@ void supplicant_event(void *ctx, enum wp - break; - case EVENT_WPS_BUTTON_PUSHED: - #ifdef CONFIG_WPS -- wpas_wps_start_pbc(wpa_s, NULL, 0); -+ wpas_wps_start_pbc(wpa_s, NULL, 0, 0); - #endif /* CONFIG_WPS */ - break; - case EVENT_AVOID_FREQUENCIES: ---- a/wpa_supplicant/p2p_supplicant.c -+++ b/wpa_supplicant/p2p_supplicant.c -@@ -1649,7 +1649,7 @@ static void wpas_start_wps_enrollee(stru - wpa_supplicant_ap_deinit(wpa_s); - wpas_copy_go_neg_results(wpa_s, res); - if (res->wps_method == WPS_PBC) { -- wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1); -+ wpas_wps_start_pbc(wpa_s, res->peer_interface_addr, 1, 0); - #ifdef CONFIG_WPS_NFC - } else if (res->wps_method == WPS_NFC) { - wpas_wps_start_nfc(wpa_s, res->peer_device_addr, ---- a/wpa_supplicant/wps_supplicant.c -+++ b/wpa_supplicant/wps_supplicant.c -@@ -1137,9 +1137,10 @@ static void wpas_wps_reassoc(struct wpa_ - - - int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid, -- int p2p_group) -+ int p2p_group, int multi_ap_backhaul_sta) - { - struct wpa_ssid *ssid; -+ char phase1[32]; - - #ifdef CONFIG_AP - if (wpa_s->ap_iface) { -@@ -1177,10 +1178,14 @@ int wpas_wps_start_pbc(struct wpa_suppli - } - } - #endif /* CONFIG_P2P */ -- if (wpa_config_set(ssid, "phase1", "\"pbc=1\"", 0) < 0) -+ if (os_snprintf(phase1, sizeof(phase1), "pbc=1%s", -+ multi_ap_backhaul_sta ? " multi_ap=1" : "") || -+ wpa_config_set_quoted(ssid, "phase1", phase1) < 0) - return -1; - if (wpa_s->wps_fragment_size) - ssid->eap.fragment_size = wpa_s->wps_fragment_size; -+ if (multi_ap_backhaul_sta) -+ ssid->multi_ap_backhaul_sta = 1; - wpa_supplicant_wps_event(wpa_s, WPS_EV_PBC_ACTIVE, NULL); - eloop_register_timeout(WPS_PBC_WALK_TIME, 0, wpas_wps_timeout, - wpa_s, NULL); ---- a/wpa_supplicant/wps_supplicant.h -+++ b/wpa_supplicant/wps_supplicant.h -@@ -30,7 +30,7 @@ void wpas_wps_deinit(struct wpa_supplica - int wpas_wps_eapol_cb(struct wpa_supplicant *wpa_s); - enum wps_request_type wpas_wps_get_req_type(struct wpa_ssid *ssid); - int wpas_wps_start_pbc(struct wpa_supplicant *wpa_s, const u8 *bssid, -- int p2p_group); -+ int p2p_group, int multi_ap_backhaul_sta); - int wpas_wps_start_pin(struct wpa_supplicant *wpa_s, const u8 *bssid, - const char *pin, int p2p_group, u16 dev_pw_id); - void wpas_wps_pbc_overlap(struct wpa_supplicant *wpa_s); diff --git a/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch b/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch deleted file mode 100755 index c5785e50c3..0000000000 --- a/package/network/services/hostapd/patches/557-hostapd-support-Multi-AP-backhaul-STA-onboarding.patch +++ /dev/null @@ -1,339 +0,0 @@ -From 8b04a4cddbd6dbadb24279713af7ac677e80d342 Mon Sep 17 00:00:00 2001 -From: Davina Lu -Date: Tue, 2 Oct 2018 18:34:14 -0700 -Subject: [PATCH] hostapd: support Multi-AP backhaul STA onboarding - -The Wi-Fi Alliance Multi-AP Specification v1.0 allows onboarding of a -backhaul STA through WPS. To enable this, the WPS registrar offers a -different set of credentials (backhaul credentials instead of fronthaul -credentials) when the Multi-AP subelement is present in the WFA vendor -extension element of the WSC M1 message. - -Add 3 new configuration options to specify the backhaul credentials for -the hostapd internal registrar: multi_ap_backhaul_ssid, -multi_ap_backhaul_wpa_psk, multi_ap_backhaul_wpa_passphrase. These are -only relevant for a fronthaul SSID, i.e. where multi_ap is set to 2 or -3. When these options are set, pass the backhaul credentials instead of -the normal credentials when the Multi-AP subelement is present. - -Ignore the Multi-AP subelement if the backhaul config options are not -set. Note that for an SSID which is fronthaul and backhaul at the same -time (i.e., multi_ap == 3), this results in the correct credentials -being sent anyway. - -The security to be used for the backaul BSS is fixed to WPA2PSK. The -Multi-AP Specification only allows Open and WPA2PSK networks to be -configured. Although not stated explicitly, the backhaul link is -intended to be always encrypted, hence WPA2PSK. - -To build the credentials, the credential-building code is essentially -copied and simplified. Indeed, the backhaul credentials are always -WPA2PSK and never use per-device PSK. All the options set for the -fronthaul BSS WPS are simply ignored. - -Signed-off-by: Davina Lu -Signed-off-by: Igor Mitsyanko -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: no change ---- - hostapd/config_file.c | 47 ++++++++++++++++++++++++++++++++++++++++ - hostapd/hostapd.conf | 9 ++++++++ - src/ap/ap_config.c | 2 ++ - src/ap/ap_config.h | 1 + - src/ap/wps_hostapd.c | 26 ++++++++++++++++++++++ - src/wps/wps.h | 32 +++++++++++++++++++++++++++ - src/wps/wps_attr_parse.c | 11 ++++++++++ - src/wps/wps_attr_parse.h | 1 + - src/wps/wps_dev_attr.c | 5 +++++ - src/wps/wps_dev_attr.h | 1 + - src/wps/wps_registrar.c | 25 ++++++++++++++++++++- - 11 files changed, 159 insertions(+), 1 deletion(-) - ---- a/hostapd/config_file.c -+++ b/hostapd/config_file.c -@@ -3479,6 +3479,53 @@ static int hostapd_config_fill(struct ho - line, pos); - return 1; - } -+ } else if (os_strcmp(buf, "multi_ap_backhaul_ssid") == 0) { -+ size_t slen; -+ char *str = wpa_config_parse_string(pos, &slen); -+ -+ if (str == NULL || slen < 1 || slen > SSID_MAX_LEN) { -+ wpa_printf(MSG_ERROR, "Line %d: invalid SSID '%s'", -+ line, pos); -+ os_free(str); -+ return 1; -+ } -+ os_memcpy(bss->multi_ap_backhaul_ssid.ssid, str, slen); -+ bss->multi_ap_backhaul_ssid.ssid_len = slen; -+ bss->multi_ap_backhaul_ssid.ssid_set = 1; -+ os_free(str); -+ } else if (os_strcmp(buf, "multi_ap_backhaul_wpa_passphrase") == 0) { -+ int len = os_strlen(pos); -+ -+ if (len < 8 || len > 63) { -+ wpa_printf(MSG_ERROR, -+ "Line %d: invalid WPA passphrase length %d (expected 8..63)", -+ line, len); -+ return 1; -+ } -+ os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase); -+ bss->multi_ap_backhaul_ssid.wpa_passphrase = os_strdup(pos); -+ if (bss->multi_ap_backhaul_ssid.wpa_passphrase) { -+ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); -+ bss->multi_ap_backhaul_ssid.wpa_passphrase_set = 1; -+ } -+ } else if (os_strcmp(buf, "multi_ap_backhaul_wpa_psk") == 0) { -+ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); -+ bss->multi_ap_backhaul_ssid.wpa_psk = -+ os_zalloc(sizeof(struct hostapd_wpa_psk)); -+ if (bss->multi_ap_backhaul_ssid.wpa_psk == NULL) -+ return 1; -+ if (hexstr2bin(pos, bss->multi_ap_backhaul_ssid.wpa_psk->psk, -+ PMK_LEN) || -+ pos[PMK_LEN * 2] != '\0') { -+ wpa_printf(MSG_ERROR, "Line %d: Invalid PSK '%s'.", -+ line, pos); -+ hostapd_config_clear_wpa_psk(&bss->multi_ap_backhaul_ssid.wpa_psk); -+ return 1; -+ } -+ bss->multi_ap_backhaul_ssid.wpa_psk->group = 1; -+ os_free(bss->multi_ap_backhaul_ssid.wpa_passphrase); -+ bss->multi_ap_backhaul_ssid.wpa_passphrase = NULL; -+ bss->multi_ap_backhaul_ssid.wpa_psk_set = 1; - } else if (os_strcmp(buf, "upnp_iface") == 0) { - os_free(bss->upnp_iface); - bss->upnp_iface = os_strdup(pos); ---- a/hostapd/hostapd.conf -+++ b/hostapd/hostapd.conf -@@ -1852,6 +1852,15 @@ own_ip_addr=127.0.0.1 - # attribute. - #ap_settings=hostapd.ap_settings - -+# Multi-AP backhaul BSS config -+# Used in WPS when multi_ap=2 or 3. Defines "backhaul BSS" credentials. -+# These are passed in WPS M8 instead of the normal (fronthaul) credentials -+# if the enrollee has the Multi-AP subelement set. Backhaul SSID is formatted -+# like ssid2. The key is set like wpa_psk or wpa_passphrase. -+#multi_ap_backhaul_ssid="backhaul" -+#multi_ap_backhaul_wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef -+#multi_ap_backhaul_wpa_passphrase=secret passphrase -+ - # WPS UPnP interface - # If set, support for external Registrars is enabled. - #upnp_iface=br0 ---- a/src/ap/ap_config.c -+++ b/src/ap/ap_config.c -@@ -582,6 +582,8 @@ void hostapd_config_free_bss(struct host - os_free(conf->ap_pin); - os_free(conf->extra_cred); - os_free(conf->ap_settings); -+ hostapd_config_clear_wpa_psk(&conf->multi_ap_backhaul_ssid.wpa_psk); -+ str_clear_free(conf->multi_ap_backhaul_ssid.wpa_passphrase); - os_free(conf->upnp_iface); - os_free(conf->friendly_name); - os_free(conf->manufacturer_url); ---- a/src/ap/ap_config.h -+++ b/src/ap/ap_config.h -@@ -456,6 +456,7 @@ struct hostapd_bss_config { - int force_per_enrollee_psk; - u8 *ap_settings; - size_t ap_settings_len; -+ struct hostapd_ssid multi_ap_backhaul_ssid; - char *upnp_iface; - char *friendly_name; - char *manufacturer_url; ---- a/src/ap/wps_hostapd.c -+++ b/src/ap/wps_hostapd.c -@@ -962,6 +962,7 @@ static void hostapd_free_wps(struct wps_ - wpabuf_free(wps->dev.vendor_ext[i]); - wps_device_data_free(&wps->dev); - os_free(wps->network_key); -+ os_free(wps->multi_ap_backhaul_network_key); - hostapd_wps_nfc_clear(wps); - wpabuf_free(wps->dh_pubkey); - wpabuf_free(wps->dh_privkey); -@@ -1131,6 +1132,31 @@ int hostapd_init_wps(struct hostapd_data - wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP; - } - -+ if (hapd->conf->multi_ap & FRONTHAUL_BSS && -+ hapd->conf->multi_ap_backhaul_ssid.ssid_len) { -+ wps->multi_ap_backhaul_ssid_len = -+ hapd->conf->multi_ap_backhaul_ssid.ssid_len; -+ os_memcpy(wps->multi_ap_backhaul_ssid, -+ hapd->conf->multi_ap_backhaul_ssid.ssid, -+ wps->multi_ap_backhaul_ssid_len); -+ if (conf->multi_ap_backhaul_ssid.wpa_passphrase) { -+ wps->multi_ap_backhaul_network_key = -+ (u8 *) os_strdup(conf->multi_ap_backhaul_ssid.wpa_passphrase); -+ wps->multi_ap_backhaul_network_key_len = -+ os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase); -+ } else if (conf->multi_ap_backhaul_ssid.wpa_psk) { -+ wps->multi_ap_backhaul_network_key = -+ os_malloc(2 * PMK_LEN + 1); -+ if (wps->multi_ap_backhaul_network_key == NULL) -+ goto fail; -+ wpa_snprintf_hex((char *) wps->multi_ap_backhaul_network_key, -+ 2 * PMK_LEN + 1, -+ conf->multi_ap_backhaul_ssid.wpa_psk->psk, -+ PMK_LEN); -+ wps->multi_ap_backhaul_network_key_len = 2 * PMK_LEN; -+ } -+ } -+ - wps->ap_settings = conf->ap_settings; - wps->ap_settings_len = conf->ap_settings_len; - ---- a/src/wps/wps.h -+++ b/src/wps/wps.h -@@ -100,6 +100,7 @@ struct wps_device_data { - struct wpabuf *vendor_ext[MAX_WPS_VENDOR_EXTENSIONS]; - - int p2p; -+ u8 multi_ap_ext; - }; - - /** -@@ -730,6 +731,37 @@ struct wps_context { - int psk_set; - - /** -+ * multi_ap_backhaul_ssid - SSID to supply to a Multi-AP backhaul -+ * enrollee -+ * -+ * This SSID is used by the Registrar to fill in information for -+ * Credentials when the enrollee advertises it is a Multi-AP backhaul -+ * STA. -+ */ -+ u8 multi_ap_backhaul_ssid[SSID_MAX_LEN]; -+ -+ /** -+ * multi_ap_backhaul_ssid_len - Length of multi_ap_backhaul_ssid in -+ * octets -+ */ -+ size_t multi_ap_backhaul_ssid_len; -+ -+ /** -+ * multi_ap_backhaul_network_key - The Network Key (PSK) for the -+ * Multi-AP backhaul enrollee. -+ * -+ * This key can be either the ASCII passphrase (8..63 characters) or the -+ * 32-octet PSK (64 hex characters). -+ */ -+ u8 *multi_ap_backhaul_network_key; -+ -+ /** -+ * multi_ap_backhaul_network_key_len - Length of -+ * multi_ap_backhaul_network_key in octets -+ */ -+ size_t multi_ap_backhaul_network_key_len; -+ -+ /** - * ap_settings - AP Settings override for M7 (only used at AP) - * - * If %NULL, AP Settings attributes will be generated based on the ---- a/src/wps/wps_attr_parse.c -+++ b/src/wps/wps_attr_parse.c -@@ -67,6 +67,17 @@ static int wps_set_vendor_ext_wfa_subele - } - attr->registrar_configuration_methods = pos; - break; -+ case WFA_ELEM_MULTI_AP: -+ if (len != 1) { -+ wpa_printf(MSG_DEBUG, -+ "WPS: Invalid Multi-AP Extension length %u", -+ len); -+ return -1; -+ } -+ attr->multi_ap_ext = *pos; -+ wpa_printf(MSG_DEBUG, "WPS: Multi-AP Extension 0x%02x", -+ attr->multi_ap_ext); -+ break; - default: - wpa_printf(MSG_MSGDUMP, "WPS: Skipped unknown WFA Vendor " - "Extension subelement %u", id); ---- a/src/wps/wps_attr_parse.h -+++ b/src/wps/wps_attr_parse.h -@@ -97,6 +97,7 @@ struct wps_parse_attr { - const u8 *cred[MAX_CRED_COUNT]; - const u8 *req_dev_type[MAX_REQ_DEV_TYPE_COUNT]; - const u8 *vendor_ext[MAX_WPS_PARSE_VENDOR_EXT]; -+ u8 multi_ap_ext; - }; - - int wps_parse_msg(const struct wpabuf *msg, struct wps_parse_attr *attr); ---- a/src/wps/wps_dev_attr.c -+++ b/src/wps/wps_dev_attr.c -@@ -389,6 +389,11 @@ int wps_process_os_version(struct wps_de - return 0; - } - -+void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext) -+{ -+ dev->multi_ap_ext = ext; -+ wpa_printf(MSG_DEBUG, "WPS: Multi-AP extension value %02x", dev->multi_ap_ext); -+} - - int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands) - { ---- a/src/wps/wps_dev_attr.h -+++ b/src/wps/wps_dev_attr.h -@@ -29,6 +29,7 @@ int wps_build_dev_name(struct wps_device - int wps_process_device_attrs(struct wps_device_data *dev, - struct wps_parse_attr *attr); - int wps_process_os_version(struct wps_device_data *dev, const u8 *ver); -+void wps_process_vendor_ext_m1(struct wps_device_data *dev, const u8 ext); - int wps_process_rf_bands(struct wps_device_data *dev, const u8 *bands); - void wps_device_data_free(struct wps_device_data *dev); - int wps_build_vendor_ext(struct wps_device_data *dev, struct wpabuf *msg); ---- a/src/wps/wps_registrar.c -+++ b/src/wps/wps_registrar.c -@@ -1588,7 +1588,6 @@ int wps_build_credential_wrap(struct wpa - return 0; - } - -- - int wps_build_cred(struct wps_data *wps, struct wpabuf *msg) - { - struct wpabuf *cred; -@@ -1603,6 +1602,29 @@ int wps_build_cred(struct wps_data *wps, - } - os_memset(&wps->cred, 0, sizeof(wps->cred)); - -+ if (wps->peer_dev.multi_ap_ext == MULTI_AP_BACKHAUL_STA && -+ wps->wps->multi_ap_backhaul_ssid_len) { -+ wpa_printf(MSG_DEBUG, "WPS: Use backhaul STA credentials"); -+ os_memcpy(wps->cred.ssid, wps->wps->multi_ap_backhaul_ssid, -+ wps->wps->multi_ap_backhaul_ssid_len); -+ wps->cred.ssid_len = wps->wps->multi_ap_backhaul_ssid_len; -+ /* Backhaul is always WPA2PSK */ -+ wps->cred.auth_type = WPS_AUTH_WPA2PSK; -+ wps->cred.encr_type = WPS_ENCR_AES; -+ /* Set MAC address in the Credential to be the Enrollee's MAC -+ * address -+ */ -+ os_memcpy(wps->cred.mac_addr, wps->mac_addr_e, ETH_ALEN); -+ if (wps->wps->multi_ap_backhaul_network_key) { -+ os_memcpy(wps->cred.key, -+ wps->wps->multi_ap_backhaul_network_key, -+ wps->wps->multi_ap_backhaul_network_key_len); -+ wps->cred.key_len = -+ wps->wps->multi_ap_backhaul_network_key_len; -+ } -+ goto use_provided; -+ } -+ - os_memcpy(wps->cred.ssid, wps->wps->ssid, wps->wps->ssid_len); - wps->cred.ssid_len = wps->wps->ssid_len; - -@@ -2705,6 +2727,7 @@ static enum wps_process_res wps_process_ - wps->use_psk_key = 1; - } - #endif /* WPS_WORKAROUNDS */ -+ wps_process_vendor_ext_m1(&wps->peer_dev, attr->multi_ap_ext); - - wps->state = SEND_M2; - return WPS_CONTINUE; diff --git a/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch b/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch deleted file mode 100755 index b8526b8b71..0000000000 --- a/package/network/services/hostapd/patches/558-hostapd-add-README-MULTI-AP.patch +++ /dev/null @@ -1,181 +0,0 @@ -From bd733055a22c8ca3bcd7648bf716da2713b3d9f1 Mon Sep 17 00:00:00 2001 -From: "Arnout Vandecappelle (Essensium/Mind)" -Date: Mon, 21 Jan 2019 16:44:06 +0100 -Subject: [PATCH] hostapd: add README-MULTI-AP - -Document what hostapd and wpa_supplicant do for Multi-AP. - -This is only included in hostapd, since a Multi-AP device is always an -access point so it should have hostapd. - -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: wps_pbc has multi_ap as a parameter instead of config option. ---- - hostapd/README-MULTI-AP | 160 ++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 160 insertions(+) - create mode 100644 hostapd/README-MULTI-AP - ---- /dev/null -+++ b/hostapd/README-MULTI-AP -@@ -0,0 +1,160 @@ -+hostapd, wpa_supplicant and the Multi-AP Specification -+====================================================== -+ -+This document describes how hostapd and wpa_supplicant can be configured to -+support the Multi-AP Specification. -+ -+Introduction to Multi-AP -+------------------------ -+ -+The Wi-Fi Alliance Multi-AP Specification is the technical specification for -+Wi-Fi CERTIFIED EasyMesh(TM) [1], the Wi-Fi Alliance® certification program for -+Multi-AP. It defines control protocols between Wi-Fi® access points (APs) to -+join them into a network with centralized control and operation. It is targeted -+only at routers (repeaters, gateways, ...), not at clients. Clients are not -+involved at all in the protocols. -+ -+Most of the Multi-AP specification falls outside of the scope of -+hostapd/wpa_supplicant. hostapd/wpa_supplicant is only involved for the items -+summarized below. The rest of the protocol must be implemented by a separate -+daemon, e.g. prplMesh [2]. That daemon also needs to communicate with hostapd, -+e.g. to get a list of associated clients, but this can be done using the normal -+hostapd interfaces. -+ -+hostapd/wpa_supplicant needs to be configured specifically to support: -+- the WPS onboarding process; -+- configuring backhaul links. -+ -+The text below refers to "Multi-AP Specification v1.0" [3]. -+ -+ -+Fronthaul and backhaul links -+---------------------------- -+ -+In a Multi-AP network, the central controller can configure the SSIDs on the -+devices that are joined into the network. These are called fronthaul SSIDs. -+From the point of view of hostapd, there is nothing special about these -+fronthaul SSIDs. -+ -+In addition to fronthaul SSIDs, the controller can also configure backhaul -+links. A backhaul link is a link between two access point devices, giving -+internet access to access point devices that don't have a wired link. The -+Multi-AP specification doesn't dictate this, but typically the backhaul link -+will be bridged into a LAN together with (one of) the fronthaul SSID(s) and the -+wired Ethernet ports. -+ -+A backhaul link must be treated specially by hostapd and wpa_supplicant. One -+side of the backhaul link is configured through the Multi-AP protocol as the -+"backhaul STA", i.e. the client side of the link. A backhaul STA is like any -+station and is handled appropriately by wpa_supplicant, but two additional -+features are required. It must send an additional information element in each -+(Re-)Association Request ([3], section 5.2, paragraph 4). In addition, it must -+use 4-address mode for all frames sent over this link ([3], section 14). -+Therefore, wpa_supplicant must be configured explicitly as the backhaul STA -+role, by setting 'multi_ap_backhaul_sta=1' in the network configuration block -+or when configuring the SSID through the client socket. When -+'multi_ap_backhaul_sta=1', wpa_supplicant includes the Multi-AP IE in -+(Re-)Association Request messages and verifies that it is included in the -+(Re-)Association Response. If it is not, association fails. If it is, -+wpa_supplicant sets 4-address mode for this interface through a driver -+callback. -+ -+The AP side of the backhaul link is called a "backhaul SSID". Such an SSID must -+be handled specially by hostapd, because it must add an additional information -+element in each (Re-)Association Response, but only to stations that have -+identified themselves as backhaul stations ([3], section 5.2, paragraph 5-6). -+This is important because it is possible to use the same BSS and SSID for -+fronthaul and backhaul at the same time. The additional information element must -+only be used for frames sent to a backhaul STA, not to a normal STA. Also, -+frames sent to a backhaul STA must use 4-address mode, while frames sent to a -+normal STA (fronthaul, when it's a fronthaul and backhaul SSID) must use -+3-address mode. -+ -+An SSID is configured in Multi-AP mode in hostapd by setting the 'multi_ap' -+configuration option to 1 (backhaul SSID), 2 (fronthaul SSID) or 3 -+(simultaneous backhaul and fronthaul SSID). If this option is set, hostapd -+parses the Multi-AP information element in the Association Request. If the -+station is a backhaul STA and the SSID is configured as a backhaul SSID, -+hostapd sets up 4-address mode. Since there may be multiple stations connected -+simultaneously, and each of them has a different RA (receiver address), a VLAN -+is created for each backhaul STA and it is automatically added to a bridge. -+This is the same behavior as for WDS, and the relevant option ('bridge' or -+'wds_bridge') applies here as well. -+ -+If 'multi_ap' is 1 (backhaul SSID only), any station that tries to associate -+without the Multi-AP information element will be denied. -+ -+If 'multi_ap' is 2 (fronthaul SSID only), any station that tries to associate -+with the Multi-AP information element will be denied. That is also the only -+difference with 'multi_ap' set to 0: in the latter case, the Multi-AP -+information element is simply ignored. -+ -+In summary, this is the end-to-end behaviour for a backhaul BSS (i.e., -+multi_ap_backhaul_sta=1 in wpa_supplicant on STA, and multi_ap=1 or 3 in -+hostapd on AP). Note that point 1 means that hostapd must not be configured -+with WPS support on the backhaul BSS (multi_ap=1). hostapd does not check for -+that. -+ -+1. Backhaul BSS beacons do not advertise WPS support (other than that, nothing -+ multi-ap specific). -+2. STA sends authentication req (nothing multi-ap specific). -+3. AP sends authentication resp (nothing multi-ap specific). -+4. STA sends association req with Multi-AP IE. -+5. AP send association resp with Multi-AP IE. -+6. STA and AP both use 4-address mode for data. -+ -+ -+WPS support -+----------- -+ -+WPS requires more special handling. WPS must only be advertised on fronthaul -+SSIDs, not on backhaul SSIDs, so WPS should not be enabled on a backhaul-only -+SSID in hostapd.conf. The WPS configuration purely works on the fronthaul SSID. -+When a WPS M1 message has an additional subelement that indicates a request for -+a multi-AP backhaul link, hostapd must not respond with the normal fronthaul -+SSID credentials; instead, it should respond with the (potentially different) -+backhaul SSID credentials. -+ -+To support this, hostapd has the 'multi_ap_backhaul_ssid', -+'multi_ap_backhaul_wpa_psk' and 'multi_ap_backhaul_wpa_passphrase' options. -+When these are set on an SSID with WPS, they are used instead of the normal -+credentials when hostapd receives a WPS M1 message with the Multi-AP IE. Only -+WPA2 Personal is supported in the Multi-AP specification, so there is no need -+to specify authentication or encryption options. For the backhaul credentials, -+per-device PSK is not supported. -+ -+If the SSID is a simultaneous backhaul and fronthaul SSID, there is no need to -+specify the backhaul credentials, since the backhaul and fronthaul credentials -+are identical. -+ -+To enable the Multi-AP backhaul STA feature when it performs WPS, a new -+parameter has been introduced to the WPS_PBC control interface call. -+When this option is set, it adds the multi-AP backhaul subelement to -+the association and M1 messages. It then configures the new SSID with -+'multi_ap_backhaul_sta=1'. Note that this means that if the AP does not -+follow the Multi-AP specification, wpa_supplicant will fail to -+associate. -+ -+In summary, this is the end-to-end behaviour for WPS of a backhaul link (i.e., -+multi_ap=1 option is given in the wps_pbc call on the STA side, and multi_ap=2 -+and multi_ap_backhaul_ssid and either multi_ap_backhaul_wpa_psk or -+multi_ap_backhaul_wpa_passphrase are set to the credentials of a backhaul SSID -+in hostapd on registrar AP). -+ -+1. Fronthaul BSS beacons advertise WPS support (nothing multi-ap specific). -+2. Enrollee sends authentication req (nothing multi-ap specific). -+3. AP sends authentication resp (nothing multi-ap specific). -+4. Enrollee sends association req with Multi-AP IE. -+5. AP send association resp with Multi-AP IE. -+6. Enrollee sends M1 with additional Multi-AP subelement -+7. AP sends M8 with backhaul instead of fronthaul credentials. -+8. Enrollee sends Deauth. -+ -+ -+References -+---------- -+ -+[1] https://www.wi-fi.org/discover-wi-fi/wi-fi-easymesh -+[2] https://github.com/prplfoundation/prplMesh -+[3] https://www.wi-fi.org/file/multi-ap-specification-v10 -+ (requires registration) diff --git a/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch b/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch deleted file mode 100755 index 3a121ba911..0000000000 --- a/package/network/services/hostapd/patches/559-tests-add-WPS-tests-to-multi_ap-hwsim-tests.patch +++ /dev/null @@ -1,182 +0,0 @@ -From 0729e01f5830ebf4701f0b1b7ff1bd2a2eedae40 Mon Sep 17 00:00:00 2001 -From: "Arnout Vandecappelle (Essensium/Mind)" -Date: Tue, 12 Feb 2019 11:02:42 +0100 -Subject: [PATCH] tests: add WPS tests to multi_ap hwsim tests - -Signed-off-by: Arnout Vandecappelle (Essensium/Mind) ---- -v4: new patch ---- - tests/hwsim/test_multi_ap.py | 164 +++++++++++++++++++++++++++++++++++ - 1 file changed, 164 insertions(+) - ---- a/tests/hwsim/test_multi_ap.py -+++ b/tests/hwsim/test_multi_ap.py -@@ -61,3 +61,167 @@ def test_multi_ap_fronthaul_on_ap(dev, a - raise Exception("Connection result not reported") - if "CTRL-EVENT-DISCONNECTED" not in ev: - raise Exception("Unexpected connection result") -+ -+def run_multi_ap_wps(dev, apdev, params, multi_ap_bssid = None): -+ """Helper for running Multi-AP WPS tests -+ -+ dev[0] does multi_ap WPS, dev[1] does normal WPS. apdev[0] is the fronthaul -+ BSS. If there is a separate backhaul BSS, it must have been set up by the -+ caller. params are the normal SSID parameters, they will be extended with -+ the WPS parameters. multi_ap_bssid must be given if it is not equal to the -+ fronthaul BSSID.""" -+ -+ if multi_ap_bssid is None: -+ multi_ap_bssid = apdev[0]['bssid'] -+ params.update({"wps_state": "2", "eap_server": "1"}) -+ -+ # WPS with multi-ap station dev[0] -+ hapd = hostapd.add_ap(apdev[0], params) -+ hapd.request("WPS_PBC") -+ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): -+ raise Exception("PBC status not shown correctly") -+ -+ dev[0].request("WPS_PBC multi_ap=1") -+ dev[0].wait_connected(timeout=20) -+ status = dev[0].get_status() -+ if status['wpa_state'] != 'COMPLETED' or status['bssid'] != multi_ap_bssid: -+ raise Exception("Not fully connected") -+ if status['ssid'] != params['multi_ap_backhaul_ssid'].strip('"'): -+ raise Exception("Unexpected SSID %s != %s" % (status['ssid'], params["multi_ap_backhaul_ssid"])) -+ if status['pairwise_cipher'] != 'CCMP': -+ raise Exception("Unexpected encryption configuration %s" % status['pairwise_cipher']) -+ if status['key_mgmt'] != 'WPA2-PSK': -+ raise Exception("Unexpected key_mgmt") -+ -+ status = hapd.request("WPS_GET_STATUS") -+ if "PBC Status: Disabled" not in status: -+ raise Exception("PBC status not shown correctly") -+ if "Last WPS result: Success" not in status: -+ raise Exception("Last WPS result not shown correctly") -+ if "Peer Address: " + dev[0].p2p_interface_addr() not in status: -+ raise Exception("Peer address not shown correctly") -+ -+ if len(dev[0].list_networks()) != 1: -+ raise Exception("Unexpected number of network blocks") -+ -+ # WPS with non-multi-ap station dev[1] -+ hapd.request("WPS_PBC") -+ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): -+ raise Exception("PBC status not shown correctly") -+ -+ dev[1].request("WPS_PBC") -+ dev[1].wait_connected(timeout=20) -+ status = dev[1].get_status() -+ if status['wpa_state'] != 'COMPLETED' or status['bssid'] != apdev[0]['bssid']: -+ raise Exception("Not fully connected") -+ if status['ssid'] != params["ssid"]: -+ raise Exception("Unexpected SSID") -+ # Fronthaul may be something else than WPA2-PSK so don't test it. -+ -+ status = hapd.request("WPS_GET_STATUS") -+ if "PBC Status: Disabled" not in status: -+ raise Exception("PBC status not shown correctly") -+ if "Last WPS result: Success" not in status: -+ raise Exception("Last WPS result not shown correctly") -+ if "Peer Address: " + dev[1].p2p_interface_addr() not in status: -+ raise Exception("Peer address not shown correctly") -+ -+ if len(dev[1].list_networks()) != 1: -+ raise Exception("Unexpected number of network blocks") -+ -+ -+def test_multi_ap_wps_shared(dev, apdev): -+ """WPS on shared fronthaul/backhaul AP""" -+ ssid = "multi-ap-wps" -+ passphrase = "12345678" -+ params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase) -+ params.update({"multi_ap": "3", -+ "multi_ap_backhaul_ssid": '"%s"' % ssid, -+ "multi_ap_backhaul_wpa_passphrase": passphrase}) -+ run_multi_ap_wps(dev, apdev, params) -+ -+def test_multi_ap_wps_shared_psk(dev, apdev): -+ """WPS on shared fronthaul/backhaul AP using PSK""" -+ ssid = "multi-ap-wps" -+ psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef" -+ params = hostapd.wpa2_params(ssid=ssid) -+ params.update({"wpa_psk": psk, "multi_ap": "3", -+ "multi_ap_backhaul_ssid": '"%s"' % ssid, -+ "multi_ap_backhaul_wpa_psk": psk}) -+ run_multi_ap_wps(dev, apdev, params) -+ -+def test_multi_ap_wps_split(dev, apdev): -+ """WPS on split fronthaul and backhaul AP""" -+ backhaul_ssid = "multi-ap-backhaul-wps" -+ backhaul_passphrase = "87654321" -+ params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") -+ params.update({"multi_ap": "2", -+ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, -+ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase}) -+ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) -+ params_backhaul.update({"multi_ap": "1"}) -+ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) -+ -+ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) -+ -+def test_multi_ap_wps_split_psk(dev, apdev): -+ """WPS on split fronthaul and backhaul AP""" -+ backhaul_ssid = "multi-ap-backhaul-wps" -+ backhaul_psk = "1234567890abcdef0123456789abcdef0123456789abcdef0123456789abcdef" -+ params = hostapd.wpa2_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") -+ params.update({"multi_ap": "2", -+ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, -+ "multi_ap_backhaul_wpa_psk": backhaul_psk}) -+ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid) -+ params_backhaul.update({"multi_ap": "1", "wpa_psk": backhaul_psk}) -+ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) -+ -+ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) -+ -+def test_multi_ap_wps_split_mixed(dev, apdev): -+ """WPS on split fronthaul and backhaul AP with mixed-mode fronthaul""" -+ backhaul_ssid = "multi-ap-backhaul-wps" -+ backhaul_passphrase = "87654321" -+ params = hostapd.wpa_mixed_params(ssid="multi-ap-fronthaul-wps", passphrase="12345678") -+ params.update({"multi_ap": "2", -+ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, -+ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase}) -+ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) -+ params_backhaul.update({"multi_ap": "1"}) -+ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) -+ -+ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) -+ -+def test_multi_ap_wps_split_open(dev, apdev): -+ """WPS on split fronthaul and backhaul AP with open fronthaul""" -+ backhaul_ssid = "multi-ap-backhaul-wps" -+ backhaul_passphrase = "87654321" -+ params = {"ssid": "multi-ap-wps-fronthaul", "multi_ap": "2", -+ "multi_ap_backhaul_ssid": '"%s"' % backhaul_ssid, -+ "multi_ap_backhaul_wpa_passphrase": backhaul_passphrase} -+ params_backhaul = hostapd.wpa2_params(ssid=backhaul_ssid, passphrase=backhaul_passphrase) -+ params_backhaul.update({"multi_ap": "1"}) -+ hapd_backhaul = hostapd.add_ap(apdev[1], params_backhaul) -+ -+ run_multi_ap_wps(dev, apdev, params, hapd_backhaul.own_addr()) -+ -+def test_multi_ap_wps_fail_non_multi_ap(dev, apdev): -+ """Multi-AP WPS on non-WPS AP fails""" -+ -+ params = hostapd.wpa2_params(ssid="non-multi-ap-wps", passphrase="12345678") -+ params.update({"wps_state": "2", "eap_server": "1"}) -+ -+ hapd = hostapd.add_ap(apdev[0], params) -+ hapd.request("WPS_PBC") -+ if "PBC Status: Active" not in hapd.request("WPS_GET_STATUS"): -+ raise Exception("PBC status not shown correctly") -+ -+ dev[0].request("WPS_PBC multi_ap=1") -+ # Since we will fail to associate and WPS doesn't even get started, there -+ # isn't much we can do except wait for timeout. For PBC, it is not possible -+ # to change the timeout from 2 minutes. Instead of waiting for the timeout, -+ # just check that WPS doesn't finish within reasonable time. -+ ev = dev[0].wait_event(["WPS-SUCCESS", "WPS-FAIL"], timeout=20) -+ if ev: -+ raise Exception("WPS operation completed: " + ev) -+ dev[0].request("WPS_CANCEL") diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch old mode 100755 new mode 100644 index db037c6491..7ac16e62b3 --- a/package/network/services/hostapd/patches/600-ubus_support.patch +++ b/package/network/services/hostapd/patches/600-ubus_support.patch @@ -20,9 +20,9 @@ #include "drivers/driver.h" +#include "ubus.h" - #define OCE_STA_CFON_ENABLED(hapd) \ - ((hapd->conf->oce & OCE_STA_CFON) && \ -@@ -136,6 +137,7 @@ struct hostapd_data { + struct wpa_ctrl_dst; + struct radius_server_data; +@@ -129,6 +130,7 @@ struct hostapd_data { struct hostapd_iface *iface; struct hostapd_config *iconf; struct hostapd_bss_config *conf; @@ -30,7 +30,7 @@ int interface_added; /* virtual interface added for this BSS */ unsigned int started:1; unsigned int disabled:1; -@@ -547,6 +549,7 @@ hostapd_alloc_bss_data(struct hostapd_if +@@ -544,6 +546,7 @@ hostapd_alloc_bss_data(struct hostapd_if struct hostapd_bss_config *bss); int hostapd_setup_interface(struct hostapd_iface *iface); int hostapd_setup_interface_complete(struct hostapd_iface *iface, int err); @@ -40,7 +40,7 @@ struct hostapd_iface * hostapd_alloc_iface(void); --- a/src/ap/hostapd.c +++ b/src/ap/hostapd.c -@@ -373,6 +373,7 @@ static void hostapd_free_hapd_data(struc +@@ -315,6 +315,7 @@ static void hostapd_free_hapd_data(struc hapd->started = 0; wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface); @@ -48,7 +48,7 @@ iapp_deinit(hapd->iapp); hapd->iapp = NULL; accounting_deinit(hapd); -@@ -1295,6 +1296,8 @@ static int hostapd_setup_bss(struct host +@@ -1237,6 +1238,8 @@ static int hostapd_setup_bss(struct host if (hapd->driver && hapd->driver->set_operstate) hapd->driver->set_operstate(hapd->drv_priv, 1); @@ -57,7 +57,7 @@ return 0; } -@@ -1709,7 +1712,7 @@ static enum nr_chan_width hostapd_get_nr +@@ -1651,7 +1654,7 @@ static enum nr_chan_width hostapd_get_nr #endif /* NEED_AP_MLME */ @@ -66,7 +66,7 @@ { #ifdef NEED_AP_MLME u16 capab = hostapd_own_capab_info(hapd); -@@ -1930,6 +1933,7 @@ static int hostapd_setup_interface_compl +@@ -1872,6 +1875,7 @@ static int hostapd_setup_interface_compl if (err) goto fail; @@ -74,7 +74,7 @@ wpa_printf(MSG_DEBUG, "Completing interface initialization"); if (iface->conf->channel) { #ifdef NEED_AP_MLME -@@ -2110,6 +2114,7 @@ dfs_offload: +@@ -2052,6 +2056,7 @@ dfs_offload: fail: wpa_printf(MSG_ERROR, "Interface initialization failed"); @@ -82,7 +82,7 @@ hostapd_set_state(iface, HAPD_IFACE_DISABLED); wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED); #ifdef CONFIG_FST -@@ -2576,6 +2581,7 @@ void hostapd_interface_deinit_free(struc +@@ -2517,6 +2522,7 @@ void hostapd_interface_deinit_free(struc (unsigned int) iface->conf->num_bss); driver = iface->bss[0]->driver; drv_priv = iface->bss[0]->drv_priv; @@ -92,7 +92,7 @@ __func__, driver, drv_priv); --- a/src/ap/ieee802_11.c +++ b/src/ap/ieee802_11.c -@@ -1759,12 +1759,13 @@ ieee802_11_set_radius_info(struct hostap +@@ -1714,12 +1714,13 @@ ieee802_11_set_radius_info(struct hostap static void handle_auth(struct hostapd_data *hapd, @@ -108,7 +108,7 @@ u16 fc; const u8 *challenge = NULL; u32 session_timeout, acct_interim_interval; -@@ -1775,6 +1776,11 @@ static void handle_auth(struct hostapd_d +@@ -1730,6 +1731,11 @@ static void handle_auth(struct hostapd_d char *identity = NULL; char *radius_cui = NULL; u16 seq_ctrl; @@ -120,7 +120,7 @@ if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) { wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)", -@@ -1935,6 +1941,13 @@ static void handle_auth(struct hostapd_d +@@ -1890,6 +1896,13 @@ static void handle_auth(struct hostapd_d resp = WLAN_STATUS_UNSPECIFIED_FAILURE; goto fail; } @@ -134,7 +134,7 @@ if (res == HOSTAPD_ACL_PENDING) return; -@@ -3287,12 +3300,12 @@ void fils_hlp_timeout(void *eloop_ctx, v +@@ -3169,12 +3182,12 @@ void fils_hlp_timeout(void *eloop_ctx, v static void handle_assoc(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, @@ -149,7 +149,7 @@ struct sta_info *sta; u8 *tmp = NULL; struct hostapd_sta_wpa_psk_short *psk = NULL; -@@ -3301,6 +3314,11 @@ static void handle_assoc(struct hostapd_ +@@ -3183,6 +3196,11 @@ static void handle_assoc(struct hostapd_ #ifdef CONFIG_FILS int delay_assoc = 0; #endif /* CONFIG_FILS */ @@ -161,7 +161,7 @@ if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) : sizeof(mgmt->u.assoc_req))) { -@@ -3472,6 +3490,14 @@ static void handle_assoc(struct hostapd_ +@@ -3354,6 +3372,14 @@ static void handle_assoc(struct hostapd_ } #endif /* CONFIG_MBO */ @@ -176,7 +176,7 @@ /* * sta->capability is used in check_assoc_ies() for RRM enabled * capability element. -@@ -3685,6 +3711,7 @@ static void handle_disassoc(struct hosta +@@ -3567,6 +3593,7 @@ static void handle_disassoc(struct hosta wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.disassoc.reason_code)); @@ -184,7 +184,7 @@ sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { -@@ -3750,6 +3777,8 @@ static void handle_deauth(struct hostapd +@@ -3632,6 +3659,8 @@ static void handle_deauth(struct hostapd " reason_code=%d", MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code)); @@ -193,7 +193,7 @@ sta = ap_get_sta(hapd, mgmt->sa); if (sta == NULL) { wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying " -@@ -4077,7 +4106,7 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -3951,7 +3980,7 @@ int ieee802_11_mgmt(struct hostapd_data if (stype == WLAN_FC_STYPE_PROBE_REQ) { @@ -202,7 +202,7 @@ return 1; } -@@ -4097,17 +4126,17 @@ int ieee802_11_mgmt(struct hostapd_data +@@ -3971,17 +4000,17 @@ int ieee802_11_mgmt(struct hostapd_data switch (stype) { case WLAN_FC_STYPE_AUTH: wpa_printf(MSG_DEBUG, "mgmt::auth"); @@ -225,7 +225,7 @@ case WLAN_FC_STYPE_DISASSOC: --- a/src/ap/beacon.c +++ b/src/ap/beacon.c -@@ -725,7 +725,7 @@ void sta_track_claim_taxonomy_info(struc +@@ -720,7 +720,7 @@ void sta_track_claim_taxonomy_info(struc void handle_probe_req(struct hostapd_data *hapd, const struct ieee80211_mgmt *mgmt, size_t len, @@ -234,7 +234,7 @@ { u8 *resp; struct ieee802_11_elems elems; -@@ -734,6 +734,7 @@ void handle_probe_req(struct hostapd_dat +@@ -729,6 +729,7 @@ void handle_probe_req(struct hostapd_dat size_t i, resp_len; int noack; enum ssid_match_result res; @@ -242,7 +242,7 @@ int ret; u16 csa_offs[2]; size_t csa_offs_len; -@@ -742,6 +743,12 @@ void handle_probe_req(struct hostapd_dat +@@ -737,6 +738,11 @@ void handle_probe_req(struct hostapd_dat struct hostapd_sta_wpa_psk_short *psk = NULL; char *identity = NULL; char *radius_cui = NULL; @@ -250,12 +250,11 @@ + .type = HOSTAPD_UBUS_PROBE_REQ, + .mgmt_frame = mgmt, + .frame_info = fi, -+ .elems = &elems, + }; if (len < IEEE80211_HDRLEN) return; -@@ -919,6 +926,12 @@ void handle_probe_req(struct hostapd_dat +@@ -914,6 +920,12 @@ void handle_probe_req(struct hostapd_dat } #endif /* CONFIG_P2P */ @@ -307,7 +306,7 @@ wpabuf_free(sta->p2p_ie); --- a/src/ap/sta_info.c +++ b/src/ap/sta_info.c -@@ -416,6 +416,7 @@ void ap_handle_timer(void *eloop_ctx, vo +@@ -415,6 +415,7 @@ void ap_handle_timer(void *eloop_ctx, vo HOSTAPD_LEVEL_INFO, "deauthenticated due to " "local deauth request"); ap_free_sta(hapd, sta); @@ -315,7 +314,7 @@ return; } -@@ -563,6 +564,7 @@ skip_poll: +@@ -562,6 +563,7 @@ skip_poll: hapd, sta, WLAN_REASON_PREV_AUTH_NOT_VALID); ap_free_sta(hapd, sta); @@ -323,7 +322,7 @@ break; } } -@@ -1224,6 +1226,7 @@ void ap_sta_set_authorized(struct hostap +@@ -1223,6 +1225,7 @@ void ap_sta_set_authorized(struct hostap buf, ip_addr); } else { wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf); @@ -341,85 +340,3 @@ } ---- a/wpa_supplicant/Makefile -+++ b/wpa_supplicant/Makefile -@@ -189,6 +189,12 @@ ifdef CONFIG_EAPOL_TEST - CFLAGS += -Werror -DEAPOL_TEST - endif - -+ifdef CONFIG_UBUS -+CFLAGS += -DUBUS_SUPPORT -+OBJS += ubus.o -+LIBS += -lubox -lubus -+endif -+ - ifdef CONFIG_CODE_COVERAGE - CFLAGS += -O0 -fprofile-arcs -ftest-coverage - LIBS += -lgcov -@@ -915,6 +921,9 @@ endif - ifdef CONFIG_IEEE80211AX - OBJS += ../src/ap/ieee802_11_he.o - endif -+ifdef CONFIG_UBUS -+OBJS += ../src/ap/ubus.o -+endif - endif - ifdef CONFIG_WNM_AP - CFLAGS += -DCONFIG_WNM_AP ---- a/wpa_supplicant/wpa_supplicant.c -+++ b/wpa_supplicant/wpa_supplicant.c -@@ -6080,6 +6080,8 @@ struct wpa_supplicant * wpa_supplicant_a - } - #endif /* CONFIG_P2P */ - -+ wpas_ubus_add_bss(wpa_s); -+ - return wpa_s; - } - -@@ -6106,6 +6108,8 @@ int wpa_supplicant_remove_iface(struct w - struct wpa_supplicant *parent = wpa_s->parent; - #endif /* CONFIG_MESH */ - -+ wpas_ubus_free_bss(wpa_s); -+ - /* Remove interface from the global list of interfaces */ - prev = global->ifaces; - if (prev == wpa_s) { ---- a/wpa_supplicant/wpa_supplicant_i.h -+++ b/wpa_supplicant/wpa_supplicant_i.h -@@ -17,6 +17,7 @@ - #include "wps/wps_defs.h" - #include "config_ssid.h" - #include "wmm_ac.h" -+#include "ubus.h" - - extern const char *const wpa_supplicant_version; - extern const char *const wpa_supplicant_license; -@@ -500,6 +501,7 @@ struct wpa_supplicant { - unsigned char own_addr[ETH_ALEN]; - unsigned char perm_addr[ETH_ALEN]; - char ifname[100]; -+ struct wpas_ubus_bss ubus; - #ifdef CONFIG_MATCH_IFACE - int matched; - #endif /* CONFIG_MATCH_IFACE */ ---- a/wpa_supplicant/wps_supplicant.c -+++ b/wpa_supplicant/wps_supplicant.c -@@ -33,6 +33,7 @@ - #include "p2p/p2p.h" - #include "p2p_supplicant.h" - #include "wps_supplicant.h" -+#include "ubus.h" - - - #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG -@@ -388,6 +389,8 @@ static int wpa_supplicant_wps_cred(void - wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute", - cred->cred_attr, cred->cred_attr_len); - -+ wpas_ubus_notify(wpa_s, cred); -+ - if (wpa_s->conf->wps_cred_processing == 1) - return 0; - diff --git a/package/network/services/hostapd/patches/700-fix-openssl11.patch b/package/network/services/hostapd/patches/700-fix-openssl11.patch new file mode 100644 index 0000000000..86343c150b --- /dev/null +++ b/package/network/services/hostapd/patches/700-fix-openssl11.patch @@ -0,0 +1,35 @@ +From 672540d4ddbd24782b5c65b35d636bdfe8a90d0f Mon Sep 17 00:00:00 2001 +From: Rosen Penev +Date: Fri, 15 Jun 2018 18:35:30 -0700 +Subject: [PATCH] Fix compile with OpenSSL 1.1.0 and deprecated APIs + +SSL_session_reused is the same as SSL_cache_hit. The engine load stuff is +now handled by OPENSSL_init. + +Signed-off-by: Rosen Penev +--- + src/crypto/tls_openssl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/src/crypto/tls_openssl.c ++++ b/src/crypto/tls_openssl.c +@@ -1024,8 +1024,10 @@ void * tls_init(const struct tls_config + + #ifndef OPENSSL_NO_ENGINE + wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine"); ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + ERR_load_ENGINE_strings(); + ENGINE_load_dynamic(); ++#endif /* OPENSSL_VERSION_NUMBER */ + + if (conf && + (conf->opensc_engine_path || conf->pkcs11_engine_path || +@@ -3874,7 +3876,7 @@ struct wpabuf * tls_connection_decrypt(v + + int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn) + { +- return conn ? SSL_cache_hit(conn->ssl) : 0; ++ return conn ? SSL_session_reused(conn->ssl) : 0; + } + + diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c old mode 100755 new mode 100644 index 3375ac49f7..37a20ed774 --- a/package/network/services/hostapd/src/src/ap/ubus.c +++ b/package/network/services/hostapd/src/src/ap/ubus.c @@ -198,21 +198,6 @@ hostapd_bss_get_clients(struct ubus_context *ctx, struct ubus_object *obj, return 0; } -static int -hostapd_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj, - struct ubus_request_data *req, const char *method, - struct blob_attr *msg) -{ - struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj); - - blob_buf_init(&b, 0); - blobmsg_add_u8(&b, "ht_supported", ht_supported(hapd->iface->hw_features)); - blobmsg_add_u8(&b, "vht_supported", vht_supported(hapd->iface->hw_features)); - ubus_send_reply(ctx, req, b.head); - - return 0; -} - enum { NOTIFY_RESPONSE, __NOTIFY_MAX @@ -382,26 +367,16 @@ hostapd_bss_update_beacon(struct ubus_context *ctx, struct ubus_object *obj, enum { CSA_FREQ, CSA_BCN_COUNT, - CSA_CENTER_FREQ1, - CSA_CENTER_FREQ2, - CSA_BANDWIDTH, - CSA_SEC_CHANNEL_OFFSET, - CSA_HT, - CSA_VHT, - CSA_BLOCK_TX, __CSA_MAX }; static const struct blobmsg_policy csa_policy[__CSA_MAX] = { + /* + * for now, frequency and beacon count are enough, add more + * parameters on demand + */ [CSA_FREQ] = { "freq", BLOBMSG_TYPE_INT32 }, [CSA_BCN_COUNT] = { "bcn_count", BLOBMSG_TYPE_INT32 }, - [CSA_CENTER_FREQ1] = { "center_freq1", BLOBMSG_TYPE_INT32 }, - [CSA_CENTER_FREQ2] = { "center_freq2", BLOBMSG_TYPE_INT32 }, - [CSA_BANDWIDTH] = { "bandwidth", BLOBMSG_TYPE_INT32 }, - [CSA_SEC_CHANNEL_OFFSET] = { "sec_channel_offset", BLOBMSG_TYPE_INT32 }, - [CSA_HT] = { "ht", BLOBMSG_TYPE_BOOL }, - [CSA_VHT] = { "vht", BLOBMSG_TYPE_BOOL }, - [CSA_BLOCK_TX] = { "block_tx", BLOBMSG_TYPE_BOOL }, }; #ifdef NEED_AP_MLME @@ -421,27 +396,12 @@ hostapd_switch_chan(struct ubus_context *ctx, struct ubus_object *obj, memset(&css, 0, sizeof(css)); css.freq_params.freq = blobmsg_get_u32(tb[CSA_FREQ]); - -#define SET_CSA_SETTING(name, field, type) \ - do { \ - if (tb[name]) \ - css.field = blobmsg_get_ ## type(tb[name]); \ - } while(0) - - SET_CSA_SETTING(CSA_BCN_COUNT, cs_count, u32); - SET_CSA_SETTING(CSA_CENTER_FREQ1, freq_params.center_freq1, u32); - SET_CSA_SETTING(CSA_CENTER_FREQ2, freq_params.center_freq2, u32); - SET_CSA_SETTING(CSA_BANDWIDTH, freq_params.bandwidth, u32); - SET_CSA_SETTING(CSA_SEC_CHANNEL_OFFSET, freq_params.sec_channel_offset, u32); - SET_CSA_SETTING(CSA_HT, freq_params.ht_enabled, bool); - SET_CSA_SETTING(CSA_VHT, freq_params.vht_enabled, bool); - SET_CSA_SETTING(CSA_BLOCK_TX, block_tx, bool); - + if (tb[CSA_BCN_COUNT]) + css.cs_count = blobmsg_get_u32(tb[CSA_BCN_COUNT]); if (hostapd_switch_channel(hapd, &css) != 0) return UBUS_STATUS_NOT_SUPPORTED; return UBUS_STATUS_OK; -#undef SET_CSA_SETTING } #endif @@ -955,7 +915,6 @@ static const struct ubus_method bss_methods[] = { UBUS_METHOD_NOARG("wps_start", hostapd_bss_wps_start), UBUS_METHOD_NOARG("wps_cancel", hostapd_bss_wps_cancel), UBUS_METHOD_NOARG("update_beacon", hostapd_bss_update_beacon), - UBUS_METHOD_NOARG("get_features", hostapd_bss_get_features), #ifdef NEED_AP_MLME UBUS_METHOD("switch_chan", hostapd_switch_chan, csa_policy), #endif @@ -1069,47 +1028,6 @@ int hostapd_ubus_handle_event(struct hostapd_data *hapd, struct hostapd_ubus_req blobmsg_add_u32(&b, "signal", req->frame_info->ssi_signal); blobmsg_add_u32(&b, "freq", hapd->iface->freq); - if (req->elems) { - if(req->elems->ht_capabilities) - { - struct ieee80211_ht_capabilities *ht_capabilities; - void *ht_cap, *ht_cap_mcs_set, *mcs_set; - - - ht_capabilities = (struct ieee80211_ht_capabilities*) req->elems->ht_capabilities; - ht_cap = blobmsg_open_table(&b, "ht_capabilities"); - blobmsg_add_u16(&b, "ht_capabilities_info", ht_capabilities->ht_capabilities_info); - ht_cap_mcs_set = blobmsg_open_table(&b, "supported_mcs_set"); - blobmsg_add_u16(&b, "a_mpdu_params", ht_capabilities->a_mpdu_params); - blobmsg_add_u16(&b, "ht_extended_capabilities", ht_capabilities->ht_extended_capabilities); - blobmsg_add_u32(&b, "tx_bf_capability_info", ht_capabilities->tx_bf_capability_info); - blobmsg_add_u16(&b, "asel_capabilities", ht_capabilities->asel_capabilities); - mcs_set = blobmsg_open_array(&b, "supported_mcs_set"); - for (int i = 0; i < 16; i++) { - blobmsg_add_u16(&b, NULL, (u16) ht_capabilities->supported_mcs_set[i]); - } - blobmsg_close_array(&b, mcs_set); - blobmsg_close_table(&b, ht_cap_mcs_set); - blobmsg_close_table(&b, ht_cap); - } - if(req->elems->vht_capabilities) - { - struct ieee80211_vht_capabilities *vht_capabilities; - void *vht_cap, *vht_cap_mcs_set; - - vht_capabilities = (struct ieee80211_vht_capabilities*) req->elems->vht_capabilities; - vht_cap = blobmsg_open_table(&b, "vht_capabilities"); - blobmsg_add_u32(&b, "vht_capabilities_info", vht_capabilities->vht_capabilities_info); - vht_cap_mcs_set = blobmsg_open_table(&b, "vht_supported_mcs_set"); - blobmsg_add_u16(&b, "rx_map", vht_capabilities->vht_supported_mcs_set.rx_map); - blobmsg_add_u16(&b, "rx_highest", vht_capabilities->vht_supported_mcs_set.rx_highest); - blobmsg_add_u16(&b, "tx_map", vht_capabilities->vht_supported_mcs_set.tx_map); - blobmsg_add_u16(&b, "tx_highest", vht_capabilities->vht_supported_mcs_set.tx_highest); - blobmsg_close_table(&b, vht_cap_mcs_set); - blobmsg_close_table(&b, vht_cap); - } - } - if (!hapd->ubus.notify_response) { ubus_notify(ctx, &hapd->ubus.obj, type, b.head, -1); return WLAN_STATUS_SUCCESS; diff --git a/package/network/services/hostapd/src/src/ap/ubus.h b/package/network/services/hostapd/src/src/ap/ubus.h old mode 100755 new mode 100644 index 185af5a7f4..ca63b34cb7 --- a/package/network/services/hostapd/src/src/ap/ubus.h +++ b/package/network/services/hostapd/src/src/ap/ubus.h @@ -18,7 +18,6 @@ enum hostapd_ubus_event_type { struct hostapd_ubus_request { enum hostapd_ubus_event_type type; const struct ieee80211_mgmt *mgmt_frame; - const struct ieee802_11_elems *elems; const struct hostapd_frame_info *frame_info; const u8 *addr; }; diff --git a/package/network/services/hostapd/src/src/utils/build_features.h b/package/network/services/hostapd/src/src/utils/build_features.h old mode 100755 new mode 100644 index abebecb570..315804361c --- a/package/network/services/hostapd/src/src/utils/build_features.h +++ b/package/network/services/hostapd/src/src/utils/build_features.h @@ -22,22 +22,6 @@ static inline int has_feature(const char *feat) #ifdef CONFIG_IEEE80211W if (!strcmp(feat, "11w")) return 1; -#endif -#ifdef CONFIG_ACS - if (!strcmp(feat, "acs")) - return 1; -#endif -#ifdef CONFIG_SAE - if (!strcmp(feat, "sae")) - return 1; -#endif -#ifdef CONFIG_OWE - if (!strcmp(feat, "owe")) - return 1; -#endif -#ifdef CONFIG_SUITEB192 - if (!strcmp(feat, "suiteb192")) - return 1; #endif return 0; } diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.c b/package/network/services/hostapd/src/wpa_supplicant/ubus.c deleted file mode 100755 index 5fdb57be7a..0000000000 --- a/package/network/services/hostapd/src/wpa_supplicant/ubus.c +++ /dev/null @@ -1,265 +0,0 @@ -/* - * wpa_supplicant / ubus support - * Copyright (c) 2018, Daniel Golle - * Copyright (c) 2013, Felix Fietkau - * - * This software may be distributed under the terms of the BSD license. - * See README for more details. - */ - -#include "utils/includes.h" -#include "utils/common.h" -#include "utils/eloop.h" -#include "utils/wpabuf.h" -#include "common/ieee802_11_defs.h" -#include "wpa_supplicant_i.h" -#include "wps_supplicant.h" -#include "ubus.h" - -static struct ubus_context *ctx; -static struct blob_buf b; -static int ctx_ref; - -static inline struct wpa_supplicant *get_wpas_from_object(struct ubus_object *obj) -{ - return container_of(obj, struct wpa_supplicant, ubus.obj); -} - -static void ubus_receive(int sock, void *eloop_ctx, void *sock_ctx) -{ - struct ubus_context *ctx = eloop_ctx; - ubus_handle_event(ctx); -} - -static void ubus_reconnect_timeout(void *eloop_data, void *user_ctx) -{ - if (ubus_reconnect(ctx, NULL)) { - eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL); - return; - } - - eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL); -} - -static void wpas_ubus_connection_lost(struct ubus_context *ctx) -{ - eloop_unregister_read_sock(ctx->sock.fd); - eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL); -} - -static bool wpas_ubus_init(void) -{ - if (ctx) - return true; - - ctx = ubus_connect(NULL); - if (!ctx) - return false; - - ctx->connection_lost = wpas_ubus_connection_lost; - eloop_register_read_sock(ctx->sock.fd, ubus_receive, ctx, NULL); - return true; -} - -static void wpas_ubus_ref_inc(void) -{ - ctx_ref++; -} - -static void wpas_ubus_ref_dec(void) -{ - ctx_ref--; - if (!ctx) - return; - - if (ctx_ref) - return; - - eloop_unregister_read_sock(ctx->sock.fd); - ubus_free(ctx); - ctx = NULL; -} - -static int -wpas_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj, - struct ubus_request_data *req, const char *method, - struct blob_attr *msg) -{ - struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); - - blob_buf_init(&b, 0); - blobmsg_add_u8(&b, "ht_supported", ht_supported(wpa_s->hw.modes)); - blobmsg_add_u8(&b, "vht_supported", vht_supported(wpa_s->hw.modes)); - ubus_send_reply(ctx, req, b.head); - - return 0; -} - -#ifdef CONFIG_WPS -enum { - WPS_START_MULTI_AP, - __WPS_START_MAX -}; - -static const struct blobmsg_policy wps_start_policy[] = { - [WPS_START_MULTI_AP] = { "multi_ap", BLOBMSG_TYPE_BOOL }, -}; - -static int -wpas_bss_wps_start(struct ubus_context *ctx, struct ubus_object *obj, - struct ubus_request_data *req, const char *method, - struct blob_attr *msg) -{ - int rc; - struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); - struct blob_attr *tb[__WPS_START_MAX], *cur; - int multi_ap = 0; - - blobmsg_parse(wps_start_policy, __WPS_START_MAX, tb, blobmsg_data(msg), blobmsg_data_len(msg)); - - if (tb[WPS_START_MULTI_AP]) - multi_ap = blobmsg_get_bool(tb[WPS_START_MULTI_AP]); - - rc = wpas_wps_start_pbc(wpa_s, NULL, 0, multi_ap); - - if (rc != 0) - return UBUS_STATUS_NOT_SUPPORTED; - - return 0; -} - -static int -wpas_bss_wps_cancel(struct ubus_context *ctx, struct ubus_object *obj, - struct ubus_request_data *req, const char *method, - struct blob_attr *msg) -{ - int rc; - struct wpa_supplicant *wpa_s = get_wpas_from_object(obj); - - rc = wpas_wps_cancel(wpa_s); - - if (rc != 0) - return UBUS_STATUS_NOT_SUPPORTED; - - return 0; -} -#endif - -static const struct ubus_method bss_methods[] = { -#ifdef CONFIG_WPS - UBUS_METHOD_NOARG("wps_start", wpas_bss_wps_start), - UBUS_METHOD_NOARG("wps_cancel", wpas_bss_wps_cancel), -#endif - UBUS_METHOD_NOARG("get_features", wpas_bss_get_features), -}; - -static struct ubus_object_type bss_object_type = - UBUS_OBJECT_TYPE("wpas_bss", bss_methods); - -void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s) -{ - struct ubus_object *obj = &wpa_s->ubus.obj; - char *name; - int ret; - - if (!wpas_ubus_init()) - return; - - if (asprintf(&name, "wpa_supplicant.%s", wpa_s->ifname) < 0) - return; - - obj->name = name; - obj->type = &bss_object_type; - obj->methods = bss_object_type.methods; - obj->n_methods = bss_object_type.n_methods; - ret = ubus_add_object(ctx, obj); - wpas_ubus_ref_inc(); -} - -void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s) -{ - struct ubus_object *obj = &wpa_s->ubus.obj; - char *name = (char *) obj->name; - - if (!ctx) - return; - - if (obj->id) { - ubus_remove_object(ctx, obj); - wpas_ubus_ref_dec(); - } - - free(name); -} - -#ifdef CONFIG_WPS -void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred) -{ - u16 auth_type; - char *ifname, *encryption, *ssid, *key; - size_t ifname_len; - - if (!cred) - return; - - auth_type = cred->auth_type; - - if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK)) - auth_type = WPS_AUTH_WPA2PSK; - - if (auth_type != WPS_AUTH_OPEN && - auth_type != WPS_AUTH_WPAPSK && - auth_type != WPS_AUTH_WPA2PSK) { - wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for " - "unsupported authentication type 0x%x", - auth_type); - return; - } - - if (auth_type == WPS_AUTH_WPAPSK || auth_type == WPS_AUTH_WPA2PSK) { - if (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN) { - wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with " - "invalid Network Key length %lu", - (unsigned long) cred->key_len); - return; - } - } - - blob_buf_init(&b, 0); - - ifname_len = strlen(wpa_s->ifname); - ifname = blobmsg_alloc_string_buffer(&b, "ifname", ifname_len + 1); - memcpy(ifname, wpa_s->ifname, ifname_len + 1); - ifname[ifname_len] = '\0'; - blobmsg_add_string_buffer(&b); - - switch (auth_type) { - case WPS_AUTH_WPA2PSK: - encryption = "psk2"; - break; - case WPS_AUTH_WPAPSK: - encryption = "psk"; - break; - default: - encryption = "none"; - break; - } - - blobmsg_add_string(&b, "encryption", encryption); - - ssid = blobmsg_alloc_string_buffer(&b, "ssid", cred->ssid_len + 1); - memcpy(ssid, cred->ssid, cred->ssid_len); - ssid[cred->ssid_len] = '\0'; - blobmsg_add_string_buffer(&b); - - if (cred->key_len > 0) { - key = blobmsg_alloc_string_buffer(&b, "key", cred->key_len + 1); - memcpy(key, cred->key, cred->key_len); - key[cred->key_len] = '\0'; - blobmsg_add_string_buffer(&b); - } - -// ubus_notify(ctx, &wpa_s->ubus.obj, "wps_credentials", b.head, -1); - ubus_send_event(ctx, "wps_credentials", b.head); -} -#endif /* CONFIG_WPS */ diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.h b/package/network/services/hostapd/src/wpa_supplicant/ubus.h deleted file mode 100755 index c37e743e73..0000000000 --- a/package/network/services/hostapd/src/wpa_supplicant/ubus.h +++ /dev/null @@ -1,53 +0,0 @@ -/* - * wpa_supplicant / ubus support - * Copyright (c) 2018, Daniel Golle - * Copyright (c) 2013, Felix Fietkau - * - * This software may be distributed under the terms of the BSD license. - * See README for more details. - */ -#ifndef __WPAS_UBUS_H -#define __WPAS_UBUS_H - -struct wpa_supplicant; -#include "wps_supplicant.h" - -#ifdef UBUS_SUPPORT -#include - -struct wpas_ubus_bss { - struct ubus_object obj; -}; - -void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s); -void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s); - -#ifdef CONFIG_WPS -void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred); -#endif - -#else -struct wpas_ubus_bss {}; - -static inline void wpas_ubus_add_iface(struct wpa_supplicant *wpa_s) -{ -} - -static inline void wpas_ubus_free_iface(struct wpa_supplicant *wpa_s) -{ -} - -static inline void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s) -{ -} - -static inline void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s) -{ -} - -static inline void wpas_ubus_notify(struct wpa_supplicant *wpa_s, struct wps_credential *cred) -{ -} -#endif - -#endif