Enterprise security doesn't have either SAE or PSK, so, using a blanker
else throws a false warning. Fix the checks to proper handler enterprise
mode.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
EAP-FAST has extra requirements (TLS 1.3, session tickets etc) and is
seldom used, so, remove it from Enterprise list and add a separate
Kconfig option.
This solves the build error when Enterprise mode is enabled.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Enabling all EAP types for enterprise mode increases
memory usage in both ROM and RAM. Provide config options for each
type to let solutions choose the methods based on their
requirements.
Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
The format of wpa_passphrase and sae_password is wrong when start the
SAP, which leads the invaild MIC check error when other STA try to
connect in security mode. Change the wrong format can fix this issue.
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
Now that hostap is used k_heap, it needs to reserve the kernel heap not
libc heap.
Fixes#79477.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
This was we can modify it in a single place that works both for native
and OS specific code.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Add crypto module test kconfig option
CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST,
which is default n and hidden.
It is only available by developer for crypto module test.
Signed-off-by: Fengming Ye <frank.ye@nxp.com>
The previous NET_EVENT_SUPPLICANT_CMD_INT_EVENT is from
"enum net_event_supplicant_cmd" but the supplicant_send_wifi_mgmt_event()
has the event parameter as an "enum net_event_wifi_cmd" and those event
number spaces are different.
This meant that the wrong event value NET_EVENT_SUPPLICANT_CMD_INT_EVENT
maps to NET_EVENT_WIFI_CMD_TWT (from "enum net_event_wifi_cmd") which
fortunately did not cause issue in this case because the
supplicant_send_wifi_mgmt_event() has no handling for this TWT event value.
It is important we fix this as this can cause great confusion in the
future.
Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
Using a separate workqueue causes issues without any special locking to
synchronize with networking threads e.g., interface being removed while
the workqueue is trying to synchronize with WPA supplicant.
It's easier to use the net_mgmt thread which is in better sync with
networking.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
In case of error conditions post successfully sending the message, the
event is already freed but we attempt to free it again.
Rejig the labels to easily reflect thier purpose.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
When an event is sent the receiver gets is asynchronously and hence is
responsible for free the event, the sender should only free in case of
error conditions i.e., unable to send.
Else, this causes a tough to debug double-free.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
In case WPA supplicant disabled DPP, we need to compile out the
corresponding DPP code in Wi-Fi shell too.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
The security check case statements were in frequency band
setting checks. This is totally wrong and will cause compiler
warnings. Moving the checks to correct function.
Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
For add_interface(), only add STA interface when hostapd enabled,
and the Soft-AP interface will be added in zephyr_hostapd_init().
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
When we have coexistence of hostapd and wpa_supplicant,
wpa_msg has different implementation.
So to let them work together, we need to have common implementation
for wpa_msg and dispatch msgs for hostapd and wpa_supplicant.
So add register zephyr_hostap_ctrl_iface_msg_cb,
and judge if ctx is hostapd by the first integer where ctx points to.
Signed-off-by: Fengming Ye <frank.ye@nxp.com>
Hostapd has TODO in hostapd_dpp_handle_config_obj,
to save DPP connector using wpa_msg.
AP DPP needs to use dpp_connector, dpp_netaccesskey and dpp_csign
in DPP Peer Discovery handshake in hostapd_dpp_rx_peer_disc_req.
So add AP DPP wpa_msg event handler to store these info.
Signed-off-by: Fengming Ye <frank.ye@nxp.com>
Add hostapd mgmt ops, some use same api as wpa_supplicant,
and DPP use different ops.
supplicant_dpp_dispatch use wpa_cli and hapd_dpp_dispatch use hostapd_cli.
And use common DPP param parse.
Signed-off-by: Fengming Ye <frank.ye@nxp.com>
Add null termination of ssid and psk. If user pass ssid,
psk without null terminator it will add by default.
Signed-off-by: Kapil Bhatt <kapil.bhatt@nordicsemi.no>
The default Max A-MPDU length is 8191 shown in the VHT Cap Info from
SAP's beacon/Assoc response, and this length is read from
hapd->iface->conf->vht_capab. It will lead to the AMPDU only contains
5 packets and the throughput is only 60Mbps for 1x1 HE case in 5GHz.
Change the default vht_capab to VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MAX
(1048575), and the throughput can be increased to 83Mbps.
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
When build with the psa_crypto_driver, it will try to include common.h
of mbedtls, but actually include the common.h from hostap, and causes
build error of undefined symbol. Use zephyr_interface_library_named
to define hostap, and other modules needs to link the library of hostap
when wants to use the header file in /utils path, such as the common.h.
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA should not be by default
selected when WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT is selcted. Enable
PSA APIs if desired separately.
Signed-off-by: Vivekananda Uppunda <vivekananda.uppunda@nordicsemi.no>
Set WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT as the default crypto
configuration. The crypto ALT implementation contains the necessary
crypto operations and also allows the user to choose PSA or non PSA
crypto operation.
Signed-off-by: Vivekananda Uppunda <vivekananda.uppunda@nordicsemi.no>
Link mode shows unknown when legacy (A or bg only) device connects to
APUT. Set the link mode to WIFI_2 when the host freq over 4000 and set
link mode to WIFI_3 when the host freq over 2000.
Signed-off-by: Hui Bai <hui.bai@nxp.com>
Added new flag CONFIG_WIFI_NM_HOSTAPD_AP for hostapd support. Once this
flag is enabled, softAP will be setup by hostapd. Both wpa_supplicant
and hostapd uses same task and eloop.
Included necessary hostapd files when compiling wifi samples if
CONFIG_WIFI_NM_HOSTAPD_AP is enabled. Added hostapd support for all
softAP command of L2 wifi shell commands.
Signed-off-by: Hui Bai <hui.bai@nxp.com>
For Enterprise crypto MbedTLS needs more heap either separate pool or
libc heap, based on experiments 55000 was arrived for a successful
WPA2-EAP-TLS association.
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
Add basic WPA2 EAP-TLS support.
Also, add test infrasturcture esp. the certification handling,
non-certificate credentials are take as runtime input and certificated
are build time input for testing.
A real application can set certificates at runtime too.
Signed-off-by: Maochen Wang <maochen.wang@nxp.com>
Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
