Fix hostapd error path regression

Commit 354c903f8e47ae0fb41fb54ecc018e61d9573506 added setting of
driver_ap_teardown on the hostapd exit path without taking into account
that this may also be called on an error path where the interface has
not been initialized. Fix the resulting NULL pointer dereference to
allow hostapd to exit cleanly in error case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Fix PMF protect disconnection on session timeout

Request the driver to send a Deauthentication frame before doing
any other disconnection steps on the session timeout path. This is
needed when PMF is negotiated for the association since the driver
will need to find the STA entry and the PTK for it to be able to
protect the robust Deauthentication frame.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Allow arbitrary RADIUS attributes to be added into Access-Accept

This extends the design already available for Access-Request packets to
the RADIUS server and Access-Accept messages. Each user entry can be
configured to add arbitrary RADIUS attributes.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
tests: Verify HS 2.0 deauth request from RADIUS Access-Accept

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Revert "bridge: Track inter-BSS usage"

This reverts commit 4345fe963e7bc6461b7547766d47fd4722d72130. That
introduced number of memory leaks and since the rest of the VLAN changes
did not yet go in, it is easier to revert this for now and bring back
the changes after fixes if there is sufficient interest for them in the
future.

Signed-off-by: Jouni Malinen <j@w1.fi>
Enable RADIUS message dumps with excessive debug verbosity

Previously, this was enabled only at msgdump verbosity level, but any
level that is more verbose than it should also be included.

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Add test cases for AP VLAN

These verify dynamic AP VLAN interface addition with open and WPA2-PSK
network.

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: VLAN tests using RADIUS tunnel attributes

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: HS 2.0 subscription remediation notification

Signed-off-by: Jouni Malinen <j@w1.fi>
wpa_supplicant: Allow external management frame processing for testing

This enables more convenient protocol testing of AP and P2P
functionality in various error cases and unexpected sequences without
having to implement each test scenario within wpa_supplicant.
ext_mgmt_frame_handle parameter can be set to 1 to move all management
frame processing into an external program through control interface
events (MGMT-RX and MGMT-TX-STATUS) and command (MGMT_TX). This is
similar to the test interface that was added to hostapd previously, but
allows more control on offchannel operations and more direct integration
with the internal P2P module.

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Non-compliant reject-by-user indication in GO Neg Req

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: RADIUS interim accounting update

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Simultaneous GO Neg initiation

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Fix a typo in check_p2p_response error path

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Protocol tests for unexpected/invalid GO Neg Resp

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS server: Enable SHA256-based cipher suites

The SHA256-based RSA-AES-128/256 cipher suites were already implemented
and enabled for the internal TLS client, but they had not been enabled
for the server.

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS: Add support for DHE-RSA cipher suites

This extends the internal TLS implementation to support DHE-RSA
cipher suites in both server and client roles.

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS: Use a helper function for calculating ServerKeyExchange hash

Instead of separate server and client side implementations, use a common
set of helper functions for calculating the ServerParams hash for
ServerKeyExchange.

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS: Share a helper function for verifying Signature

This same design is used in both the server and the client roles in the
internal TLS implementation. Instead of duplicated implementation, use a
helper function.

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS client: Send decrypt_error on verify_data validation error

Previously, this was silently dropped which left the connection waiting
for timeout. decrypt_error alert can be used here to avoid that.

Signed-off-by: Jouni Malinen <j@w1.fi>