Fix off-by-one bounds checking in printf_encode()

The off-by-one error in printf_encode() bounds checking could have
allowed buffer overflow with 0x00 being written to the memory position
following the last octet of the target buffer. Since this output is used
as \0-terminated string, the following operation would likely read past
the buffer as well. Either of these operations can result in the process
dying either due to buffer overflow protection or by a read from
unallowed address.

This has been seen to cause wpa_supplicant crash on OpenBSD when control
interface client attaches (debug print shows the client socket address).
Similarly, it may be possible to trigger the issue in RADIUS/EAP server
implementation within hostapd with a suitable constructed user name.

Signed-off-by: Stuart Henderson <sthen@openbsd.org>
tests: printf_encode unit test for bounds checking

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
RADIUS/EAP server: Use longer username buffer to avoid truncation

If the peer provides a username with large part of it being non-ASCII
characters, the previously used buffers may not have been long enough to
include the full string in debug logs and database search due to forced
truncation of the string by printf_encode(). Avoid this by increasing
the buffer sizes to fit in the maximum result.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
tests: Non-ASCII EAP user identity

This is a regression test for printf_encode() bounds checking issues
that can now be caught under valgrind.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add rsn_pairwise bits to set_ieee8021x() driver_ops

This fixes an issue where a driver using the deprecated set_ieee8021x()
callback did not include rsn_pairwise bits in the driver configuration
even if mixed WPA+WPA2 configuration was used. This could result, e.g.,
in CCMP not being enabled properly when wpa_pairwise=TKIP and
rsn_pairwise=CCMP was used in the configuration. Fix this by using
bitwise OR of the wpa_pairwise and rsn_pairwise values to allow the
driver to enable all pairwise ciphers.

In addition, make the newer set_ap() driver_ops use the same bitwise OR
design instead of picking between rsn_pairwise and wpa_pairwise. This
makes the code paths consistent and can also fix issues with mixed mode
configuration with set_ap().

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Fix offchannel TX not to retransmit pending frame on callback

If the offchannel TX frame command was offloaded to the driver in
offchannel_send_action(), we must not send another copy of the frame if
a remain-on-channel event happens to be delivered between this TX
command and the matching TX status event. It was possible for the
duplicated frame to cause problems, e.g., with P2P invitation exchange
if the same Invitation Request frame got sent twice and only the first
one getting accepted by the peer.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
ChangeLog entries for v2.2

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Change version information for the 2.2 release

Signed-off-by: Jouni Malinen <j@w1.fi>
Include CONTRIBUTIONS file in the release tarballs

Signed-off-by: Jouni Malinen <j@w1.fi>
hostap:  Ensure netlink recv buf size is large enough.

I was getting this error on wpa_supplicant startup when configured
for 200+ stations:

1333514002.074458: netlink: recvfrom failed: No buffer space available

So, increase rcv buffer size to 1MB so we don't drop netlink
packets.

Signed-hostap: Ben Greear <greearb@candelatech.com>
wpa_supplicant: Support minimum interval between scan attempts.

When running lots of vifs, they can all end up wanting to
scan right after the other.  This leaves too little time for
useful work to happen.  Allow users to configure a minimum
timer interval (in seconds) between scans.  Default is zero,
which is current behaviour.

Signed-off-by: Ben Greear <greearb@candelatech.com>
supplicant:  Allow limiting number of concurrent associations.

When using lots of virtual clients, it may be useful to
limit the number that attempt to connect to the AP at
once.  Limitting the associations per scan response is
an easy way to do this.

Signed-off-by: Ben Greear <greearb@candelatech.com>
nl80211:  Increase verbosity for some auth failures.

Makes the logs a bit more useful when running in default
message level (INFO).

Signed-off-by: Ben Greear <greearb@candelatech.com>
supplicant:  Update HS20 readme.

Mention dependencies needed to properly implement HS20.

Signed-off-by: Ben Greear <greearb@candelatech.com>
supplicant/interworking:  Convert wpa_printf to wpa_msg.

Also adds a few messages that helped me track down why things
were not working as expected.

Signed-off-by: Ben Greear <greearb@candelatech.com>
supplicant:  Allow user-defined defaults for Interworking network blocks.

This way users can still configure the HT over-rides and some other
constraints that Interworking has no interest or ability to configure.

Example config file (to disable HT-40 on an Interworking/HS20 interface):

ctrl_interface=/var/run/wpa_supplicant
fast_reauth=1

interworking=1
auto_interworking=1
access_network_type=0

hs20=1

bss_max_count=2000
network={
    interworking_defaults=1
    disable_ht=0
    disable_ht40=1
    disable_sgi=0
    ht_mcs=""
    disable_max_amsdu=-1
    ampdu_factor=-1
    ampdu_density=-1

}

cred={
    username="client2"
    password="lanforge"
    ca_cert="/home/lanforge/ca.pem"
    private_key="/home/lanforge/client.p12"
    private_key_passwd="lanforge"
    realm="lanforge.org"
    domain="lanforge.org"
    eap=TLS

}

Signed-off-by: Ben Greear <greearb@candelatech.com>
rsn:  Add debug code for pmksa cache.

Dodgy radius server was causing failures.  This code was added
to debug the problem, but was never used as user figured out RADIUS
problem first.

Signed-hostap: Ben Greear <greearb@candelatech.com>
hostap:  Debug messages for dodgy RADIUS servers.

These were helpful when tracking down why hostapd did not work
properly with a RADIUS server.

Signed-hostap: Ben Greear <greearb@candelatech.com>
Add some documentation relating to EAP-AKA.

Signed-hostapd: Ben Greear <greearb@candelatech.com>
interworking:  Add logging to track nai_realm_find_eap failures.

There are lots of reasons we can fail to match an EAP, so add
logging to help determine why it is happening in various cases.

Signed-off-by: Ben Greear <greearb@candelatech.com>