tests: Additional BSS and BSS_FLUSH ctrl_iface command coverage

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Additional P2P_FIND parameter coverage

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Additional P2P_CONNECT coverage

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: P2P_LISTEN while interface is disabled

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Additional coverage for P2P_PROV_DISC

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Invalid P2P_REJECT command

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Invalid P2P_INVITE parameters

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: P2P_GET_PASSPHRASE in P2P Client mode

Signed-off-by: Jouni Malinen <j@w1.fi>
tests: Additional P2P SD coverage

This adds P2P_SERV_DISC_REQ, P2P_SERVICE_ADD, and P2P_SERVICE_DEL error
cases and P2P_SERVICE_FLUSH and P2P_SERC_DISC_EXTERNAL testing.

Signed-off-by: Jouni Malinen <j@w1.fi>
nl80211: Add frame control and sequence control field in RX frame debug

This makes it easier to debug issues related to duplicated management
frames on receive path.

Signed-off-by: Jouni Malinen <j@w1.fi>
P2P: Check Invitation Response dialog token match for resend case

Commit ac330cfd87397a1a01e697984f3944f427e88dad ('P2P: Reinvite with
social operation channel if no common channels') introduced a mechamisn
to reinvite a peer during a persistent group reinvocation from a GO with
a different operating channel proposal. This mechanism can fail if the
inviting device (GO) ends up getting a retransmitted, duplicated
Invitation Response frame processed second time while waiting for the
response to the retried Invitation Request (using one of the social
channels as the operating channel). IEEE 802.11 duplicate frame
detection mechanisms are supposed to prevent this type of sequence, but
not all drivers support those rules properly for pre-association frames,
including P2P Public Action frames.

Work around this issue by checking that the dialog token in the
Invitation Response frame matches the one from the last Invitation
Request if the special invitation retry mechanism is used. This is safer
to do now than to enable dialog token matching for all invitation cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
tests: Invitation Request retry and duplicated response

This verifies that the corner case of a duplicated, retransmitted
Invitation Response frame ends up being dropped instead of being
processed twice for the case of Invitation Request getting resend with
social channel as an operating channel in case of no common channels
found.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
MACsec: Update protect frames and replay on reauthentication

Some cases like ifconfig down/up may require MACsec restart. To make
sure the appropriate protect frames and replay parameters get configured
in cases where the interface was down, set these parameters from KaY
configuration to the driver before creating a new transmit SC. This
allows MACsec functionality to recover automatically on such restart.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
OpenSSL: Remove support for the old EAP-FAST interface

Commit f5fa824e9a86940835e30a5a0b1fd3d8a7c4c640 ('Update OpenSSL 0.9.8
patch for EAP-FAST support') changed the OpenSSL 0.9.8 patch to support
the new API that was introduced in OpenSSL 1.0.0 for EAP-FAST. As such,
there should be no valid users of the old API anymore and tls_openssl.c
can be cleaned up to use only the new API.

Signed-off-by: Jouni Malinen <j@w1.fi>
TLS: Add new cipher suites to tls_get_cipher()

This fixes EAP-FAST server side issues for anonymous provisioning when
using the internal TLS implementation.

Signed-off-by: Jouni Malinen <j@w1.fi>
Fix OpenSSL 0.9.8za patch for EAP-FAST support

OpenSSL 0.9.8za added a fix for CVE-2014-0224 and the original fix broke
EAP-FAST support due to forgotten SSL3_FLAGS_CCS_OK marking for
tls_session_secret_cb. Fix for this regression was added into OpenSSL
1.x and newer. The same fix is needed in this backport patch for
0.9.8za.

Signed-off-by: Jouni Malinen <j@w1.fi>
OpenSSL: Fix EAP-FAST peer regression

Commit 35efa2479ff19c3f13e69dc50d2708ce79a99beb ('OpenSSL: Allow TLS
v1.1 and v1.2 to be negotiated by default') changed from using
TLSv1_method() to SSLv23_method() to allow negotiation of TLS v1.0,
v1.1, and v1.2.

Unfortunately, it looks like EAP-FAST does not work with this due to
OpenSSL not allowing ClientHello extensions to be configured with
SSL_set_session_ticket_ext() when SSLv23_method() is used. Work around
this regression by initiating a separate SSL_CTX instance for EAP-FAST
phase 1 needs with TLSv1_method() while leaving all other EAP cases
using TLS to work with the new default that allows v1.1 and v1.2 to be
negotiated. This is not ideal and will hopefully get fixed in the future
with a new OpenSSL method, but until that time, this can be used allow
other methods use newer TLS versions while still allowing EAP-FAST to be
used even if it remains to be constraint to TLS v1.0 only.

Signed-off-by: Jouni Malinen <j@w1.fi>
nl80211: Add QCA vendor specific query of device/driver features

This commit introduces a QCA vendor command that allows interrogation of
the vendor-specific features supported by the device/driver. Currently
the only defined feature is the ability to offload key management.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
add generic parser for address lists

This change generalizes the code used for parsing the configuration option
'p2p_client_list' and makes it suitable to use it in other contexts.
add network specific AP black- & whitelists

This change allows the configuration options "bssid_whitelist" and
"bssid_blacklist" to limit the AP selection of a network to a specified
(finite) set or discard certain APs.

This can be useful for environments where multiple networks operate using the
same ESSID and where roaming between those is not desired.

It is also useful to ignore a faulty or otherwise unwanted AP.