device: Non-FT roaming support
Use netdev_reassociate if FT is not available. device_select_akm_suite is only moved up in the file and the reused code from device_connect is moved to a separate function.
This commit is contained in:
parent
c8b251a475
commit
10a160a6e1
360
src/device.c
360
src/device.c
|
@ -573,6 +573,167 @@ static void device_disconnect_by_ap(struct device *device)
|
||||||
device_disassociated(device);
|
device_disassociated(device);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static enum ie_rsn_akm_suite device_select_akm_suite(struct network *network,
|
||||||
|
struct scan_bss *bss,
|
||||||
|
struct ie_rsn_info *info)
|
||||||
|
{
|
||||||
|
enum security security = network_get_security(network);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If FT is available, use FT authentication to keep the door open
|
||||||
|
* for fast transitions. Otherwise use SHA256 version if present.
|
||||||
|
*/
|
||||||
|
|
||||||
|
if (security == SECURITY_8021X) {
|
||||||
|
if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_OVER_8021X) &&
|
||||||
|
bss->rsne && bss->mde_present)
|
||||||
|
return IE_RSN_AKM_SUITE_FT_OVER_8021X;
|
||||||
|
|
||||||
|
if (info->akm_suites & IE_RSN_AKM_SUITE_8021X_SHA256)
|
||||||
|
return IE_RSN_AKM_SUITE_8021X_SHA256;
|
||||||
|
|
||||||
|
if (info->akm_suites & IE_RSN_AKM_SUITE_8021X)
|
||||||
|
return IE_RSN_AKM_SUITE_8021X;
|
||||||
|
} else if (security == SECURITY_PSK) {
|
||||||
|
if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_USING_PSK) &&
|
||||||
|
bss->rsne && bss->mde_present)
|
||||||
|
return IE_RSN_AKM_SUITE_FT_USING_PSK;
|
||||||
|
|
||||||
|
if (info->akm_suites & IE_RSN_AKM_SUITE_PSK_SHA256)
|
||||||
|
return IE_RSN_AKM_SUITE_PSK_SHA256;
|
||||||
|
|
||||||
|
if (info->akm_suites & IE_RSN_AKM_SUITE_PSK)
|
||||||
|
return IE_RSN_AKM_SUITE_PSK;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static struct handshake_state *device_handshake_setup(struct device *device,
|
||||||
|
struct network *network,
|
||||||
|
struct scan_bss *bss)
|
||||||
|
{
|
||||||
|
enum security security = network_get_security(network);
|
||||||
|
struct wiphy *wiphy = device->wiphy;
|
||||||
|
struct handshake_state *hs;
|
||||||
|
bool add_mde = false;
|
||||||
|
|
||||||
|
hs = handshake_state_new(netdev_get_ifindex(device->netdev));
|
||||||
|
|
||||||
|
if (security == SECURITY_PSK || security == SECURITY_8021X) {
|
||||||
|
const struct l_settings *settings = iwd_get_config();
|
||||||
|
struct ie_rsn_info bss_info;
|
||||||
|
uint8_t rsne_buf[256];
|
||||||
|
struct ie_rsn_info info;
|
||||||
|
const char *ssid;
|
||||||
|
uint32_t mfp_setting;
|
||||||
|
|
||||||
|
memset(&info, 0, sizeof(info));
|
||||||
|
|
||||||
|
memset(&bss_info, 0, sizeof(bss_info));
|
||||||
|
scan_bss_get_rsn_info(bss, &bss_info);
|
||||||
|
|
||||||
|
info.akm_suites = device_select_akm_suite(network, bss,
|
||||||
|
&bss_info);
|
||||||
|
|
||||||
|
if (!info.akm_suites)
|
||||||
|
goto not_supported;
|
||||||
|
|
||||||
|
info.pairwise_ciphers = wiphy_select_cipher(wiphy,
|
||||||
|
bss_info.pairwise_ciphers);
|
||||||
|
info.group_cipher = wiphy_select_cipher(wiphy,
|
||||||
|
bss_info.group_cipher);
|
||||||
|
|
||||||
|
if (!info.pairwise_ciphers || !info.group_cipher)
|
||||||
|
goto not_supported;
|
||||||
|
|
||||||
|
if (!l_settings_get_uint(settings, "General",
|
||||||
|
"ManagementFrameProtection", &mfp_setting))
|
||||||
|
mfp_setting = 1;
|
||||||
|
|
||||||
|
if (mfp_setting > 2) {
|
||||||
|
l_error("Invalid MFP value, using default of 1");
|
||||||
|
mfp_setting = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
switch (mfp_setting) {
|
||||||
|
case 0:
|
||||||
|
break;
|
||||||
|
case 1:
|
||||||
|
info.group_management_cipher =
|
||||||
|
wiphy_select_cipher(wiphy,
|
||||||
|
bss_info.group_management_cipher);
|
||||||
|
info.mfpc = info.group_management_cipher != 0;
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
info.group_management_cipher =
|
||||||
|
wiphy_select_cipher(wiphy,
|
||||||
|
bss_info.group_management_cipher);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* MFP required on our side, but AP doesn't support MFP
|
||||||
|
* or cipher mismatch
|
||||||
|
*/
|
||||||
|
if (info.group_management_cipher == 0)
|
||||||
|
goto not_supported;
|
||||||
|
|
||||||
|
info.mfpc = true;
|
||||||
|
info.mfpr = true;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bss_info.mfpr && !info.mfpc)
|
||||||
|
goto not_supported;
|
||||||
|
|
||||||
|
ssid = network_get_ssid(network);
|
||||||
|
handshake_state_set_ssid(hs, (void *) ssid, strlen(ssid));
|
||||||
|
|
||||||
|
/* RSN takes priority */
|
||||||
|
if (bss->rsne) {
|
||||||
|
ie_build_rsne(&info, rsne_buf);
|
||||||
|
handshake_state_set_ap_rsn(hs, bss->rsne);
|
||||||
|
handshake_state_set_own_rsn(hs, rsne_buf);
|
||||||
|
} else {
|
||||||
|
ie_build_wpa(&info, rsne_buf);
|
||||||
|
handshake_state_set_ap_wpa(hs, bss->wpa);
|
||||||
|
handshake_state_set_own_wpa(hs, rsne_buf);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (security == SECURITY_PSK)
|
||||||
|
handshake_state_set_pmk(hs, network_get_psk(network));
|
||||||
|
else
|
||||||
|
handshake_state_set_8021x_config(hs,
|
||||||
|
network_get_settings(network));
|
||||||
|
|
||||||
|
if (info.akm_suites & (IE_RSN_AKM_SUITE_FT_OVER_8021X |
|
||||||
|
IE_RSN_AKM_SUITE_FT_USING_PSK |
|
||||||
|
IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
|
||||||
|
add_mde = true;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (security == SECURITY_NONE)
|
||||||
|
/* Perform FT association if available */
|
||||||
|
add_mde = bss->mde_present;
|
||||||
|
|
||||||
|
if (add_mde) {
|
||||||
|
uint8_t mde[5];
|
||||||
|
|
||||||
|
/* The MDE advertised by the BSS must be passed verbatim */
|
||||||
|
mde[0] = IE_TYPE_MOBILITY_DOMAIN;
|
||||||
|
mde[1] = 3;
|
||||||
|
memcpy(mde + 2, bss->mde, 3);
|
||||||
|
|
||||||
|
handshake_state_set_mde(hs, mde);
|
||||||
|
}
|
||||||
|
|
||||||
|
return hs;
|
||||||
|
|
||||||
|
not_supported:
|
||||||
|
handshake_state_free(hs);
|
||||||
|
|
||||||
|
return NULL;
|
||||||
|
}
|
||||||
|
|
||||||
static void device_roam_failed(struct device *device)
|
static void device_roam_failed(struct device *device)
|
||||||
{
|
{
|
||||||
/*
|
/*
|
||||||
|
@ -593,6 +754,30 @@ static void device_roam_failed(struct device *device)
|
||||||
device_roam_timeout_rearm(device, 60);
|
device_roam_timeout_rearm(device, 60);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void device_reassociate_cb(struct netdev *netdev,
|
||||||
|
enum netdev_result result,
|
||||||
|
void *user_data)
|
||||||
|
{
|
||||||
|
struct device *device = user_data;
|
||||||
|
|
||||||
|
l_debug("%d, result: %d", device->index, result);
|
||||||
|
|
||||||
|
if (device->state != DEVICE_STATE_ROAMING)
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (result == NETDEV_RESULT_OK) {
|
||||||
|
/*
|
||||||
|
* New signal high/low notification should occur on the next
|
||||||
|
* beacon from new AP.
|
||||||
|
*/
|
||||||
|
device->signal_low = false;
|
||||||
|
device->roam_min_time.tv_sec = 0;
|
||||||
|
|
||||||
|
device_enter_state(device, DEVICE_STATE_CONNECTED);
|
||||||
|
} else
|
||||||
|
device_roam_failed(device);
|
||||||
|
}
|
||||||
|
|
||||||
static void device_fast_transition_cb(struct netdev *netdev,
|
static void device_fast_transition_cb(struct netdev *netdev,
|
||||||
enum netdev_result result,
|
enum netdev_result result,
|
||||||
void *user_data)
|
void *user_data)
|
||||||
|
@ -621,6 +806,7 @@ static void device_transition_start(struct device *device, struct scan_bss *bss)
|
||||||
{
|
{
|
||||||
struct handshake_state *hs = netdev_get_handshake(device->netdev);
|
struct handshake_state *hs = netdev_get_handshake(device->netdev);
|
||||||
uint16_t mdid;
|
uint16_t mdid;
|
||||||
|
struct handshake_state *new_hs;
|
||||||
|
|
||||||
l_debug("%d, target %s", device->index,
|
l_debug("%d, target %s", device->index,
|
||||||
util_address_to_string(bss->addr));
|
util_address_to_string(bss->addr));
|
||||||
|
@ -654,8 +840,27 @@ static void device_transition_start(struct device *device, struct scan_bss *bss)
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Non-FT transition not supported yet */
|
/* Non-FT transition */
|
||||||
|
|
||||||
|
new_hs = device_handshake_setup(device, device->connected_network, bss);
|
||||||
|
if (!new_hs) {
|
||||||
|
l_error("device_handshake_setup failed in reassociation");
|
||||||
|
|
||||||
device_roam_failed(device);
|
device_roam_failed(device);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (netdev_reassociate(device->netdev, bss, new_hs,
|
||||||
|
device_reassociate_cb) < 0) {
|
||||||
|
handshake_state_free(new_hs);
|
||||||
|
|
||||||
|
device_roam_failed(device);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
device->connected_bss = bss;
|
||||||
|
device->preparing_roam = false;
|
||||||
|
device_enter_state(device, DEVICE_STATE_ROAMING);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void device_roam_scan_triggered(int err, void *user_data)
|
static void device_roam_scan_triggered(int err, void *user_data)
|
||||||
|
@ -1112,158 +1317,20 @@ bool device_set_autoconnect(struct device *device, bool autoconnect)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
static enum ie_rsn_akm_suite device_select_akm_suite(struct network *network,
|
|
||||||
struct scan_bss *bss,
|
|
||||||
struct ie_rsn_info *info)
|
|
||||||
{
|
|
||||||
enum security security = network_get_security(network);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* If FT is available, use FT authentication to keep the door open
|
|
||||||
* for fast transitions. Otherwise use SHA256 version if present.
|
|
||||||
*/
|
|
||||||
|
|
||||||
if (security == SECURITY_8021X) {
|
|
||||||
if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_OVER_8021X) &&
|
|
||||||
bss->rsne && bss->mde_present)
|
|
||||||
return IE_RSN_AKM_SUITE_FT_OVER_8021X;
|
|
||||||
|
|
||||||
if (info->akm_suites & IE_RSN_AKM_SUITE_8021X_SHA256)
|
|
||||||
return IE_RSN_AKM_SUITE_8021X_SHA256;
|
|
||||||
|
|
||||||
if (info->akm_suites & IE_RSN_AKM_SUITE_8021X)
|
|
||||||
return IE_RSN_AKM_SUITE_8021X;
|
|
||||||
} else if (security == SECURITY_PSK) {
|
|
||||||
if ((info->akm_suites & IE_RSN_AKM_SUITE_FT_USING_PSK) &&
|
|
||||||
bss->rsne && bss->mde_present)
|
|
||||||
return IE_RSN_AKM_SUITE_FT_USING_PSK;
|
|
||||||
|
|
||||||
if (info->akm_suites & IE_RSN_AKM_SUITE_PSK_SHA256)
|
|
||||||
return IE_RSN_AKM_SUITE_PSK_SHA256;
|
|
||||||
|
|
||||||
if (info->akm_suites & IE_RSN_AKM_SUITE_PSK)
|
|
||||||
return IE_RSN_AKM_SUITE_PSK;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
void device_connect_network(struct device *device, struct network *network,
|
void device_connect_network(struct device *device, struct network *network,
|
||||||
struct scan_bss *bss,
|
struct scan_bss *bss,
|
||||||
struct l_dbus_message *message)
|
struct l_dbus_message *message)
|
||||||
{
|
{
|
||||||
enum security security = network_get_security(network);
|
|
||||||
struct wiphy *wiphy = device->wiphy;
|
|
||||||
struct l_dbus *dbus = dbus_get_bus();
|
struct l_dbus *dbus = dbus_get_bus();
|
||||||
struct handshake_state *hs;
|
struct handshake_state *hs;
|
||||||
bool add_mde = false;
|
|
||||||
|
|
||||||
hs = handshake_state_new(netdev_get_ifindex(device->netdev));
|
hs = device_handshake_setup(device, network, bss);
|
||||||
|
|
||||||
if (security == SECURITY_PSK || security == SECURITY_8021X) {
|
if (!hs) {
|
||||||
const struct l_settings *settings = iwd_get_config();
|
if (message)
|
||||||
struct ie_rsn_info bss_info;
|
l_dbus_send(dbus, dbus_error_not_supported(message));
|
||||||
uint8_t rsne_buf[256];
|
|
||||||
struct ie_rsn_info info;
|
|
||||||
const char *ssid;
|
|
||||||
uint32_t mfp_setting;
|
|
||||||
|
|
||||||
memset(&info, 0, sizeof(info));
|
return;
|
||||||
|
|
||||||
memset(&bss_info, 0, sizeof(bss_info));
|
|
||||||
scan_bss_get_rsn_info(bss, &bss_info);
|
|
||||||
|
|
||||||
info.akm_suites = device_select_akm_suite(network, bss,
|
|
||||||
&bss_info);
|
|
||||||
|
|
||||||
if (!info.akm_suites)
|
|
||||||
goto not_supported;
|
|
||||||
|
|
||||||
info.pairwise_ciphers = wiphy_select_cipher(wiphy,
|
|
||||||
bss_info.pairwise_ciphers);
|
|
||||||
info.group_cipher = wiphy_select_cipher(wiphy,
|
|
||||||
bss_info.group_cipher);
|
|
||||||
|
|
||||||
if (!info.pairwise_ciphers || !info.group_cipher)
|
|
||||||
goto not_supported;
|
|
||||||
|
|
||||||
if (!l_settings_get_uint(settings, "General",
|
|
||||||
"ManagementFrameProtection", &mfp_setting))
|
|
||||||
mfp_setting = 1;
|
|
||||||
|
|
||||||
if (mfp_setting > 2) {
|
|
||||||
l_error("Invalid MFP value, using default of 1");
|
|
||||||
mfp_setting = 1;
|
|
||||||
}
|
|
||||||
|
|
||||||
switch (mfp_setting) {
|
|
||||||
case 0:
|
|
||||||
break;
|
|
||||||
case 1:
|
|
||||||
info.group_management_cipher =
|
|
||||||
wiphy_select_cipher(wiphy,
|
|
||||||
bss_info.group_management_cipher);
|
|
||||||
info.mfpc = info.group_management_cipher != 0;
|
|
||||||
break;
|
|
||||||
case 2:
|
|
||||||
info.group_management_cipher =
|
|
||||||
wiphy_select_cipher(wiphy,
|
|
||||||
bss_info.group_management_cipher);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* MFP required on our side, but AP doesn't support MFP
|
|
||||||
* or cipher mismatch
|
|
||||||
*/
|
|
||||||
if (info.group_management_cipher == 0)
|
|
||||||
goto not_supported;
|
|
||||||
|
|
||||||
info.mfpc = true;
|
|
||||||
info.mfpr = true;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (bss_info.mfpr && !info.mfpc)
|
|
||||||
goto not_supported;
|
|
||||||
|
|
||||||
ssid = network_get_ssid(network);
|
|
||||||
handshake_state_set_ssid(hs, (void *) ssid, strlen(ssid));
|
|
||||||
|
|
||||||
/* RSN takes priority */
|
|
||||||
if (bss->rsne) {
|
|
||||||
ie_build_rsne(&info, rsne_buf);
|
|
||||||
handshake_state_set_ap_rsn(hs, bss->rsne);
|
|
||||||
handshake_state_set_own_rsn(hs, rsne_buf);
|
|
||||||
} else {
|
|
||||||
ie_build_wpa(&info, rsne_buf);
|
|
||||||
handshake_state_set_ap_wpa(hs, bss->wpa);
|
|
||||||
handshake_state_set_own_wpa(hs, rsne_buf);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (security == SECURITY_PSK)
|
|
||||||
handshake_state_set_pmk(hs, network_get_psk(network));
|
|
||||||
else
|
|
||||||
handshake_state_set_8021x_config(hs,
|
|
||||||
network_get_settings(network));
|
|
||||||
|
|
||||||
if (info.akm_suites & (IE_RSN_AKM_SUITE_FT_OVER_8021X |
|
|
||||||
IE_RSN_AKM_SUITE_FT_USING_PSK |
|
|
||||||
IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
|
|
||||||
add_mde = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (security == SECURITY_NONE)
|
|
||||||
/* Perform FT association if available */
|
|
||||||
add_mde = bss->mde_present;
|
|
||||||
|
|
||||||
if (add_mde) {
|
|
||||||
uint8_t mde[5];
|
|
||||||
|
|
||||||
/* The MDE advertised by the BSS must be passed verbatim */
|
|
||||||
mde[0] = IE_TYPE_MOBILITY_DOMAIN;
|
|
||||||
mde[1] = 3;
|
|
||||||
memcpy(mde + 2, bss->mde, 3);
|
|
||||||
|
|
||||||
handshake_state_set_mde(hs, mde);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if (netdev_connect(device->netdev, bss, hs, device_netdev_event,
|
if (netdev_connect(device->netdev, bss, hs, device_netdev_event,
|
||||||
|
@ -1287,11 +1354,6 @@ void device_connect_network(struct device *device, struct network *network,
|
||||||
IWD_DEVICE_INTERFACE, "ConnectedNetwork");
|
IWD_DEVICE_INTERFACE, "ConnectedNetwork");
|
||||||
l_dbus_property_changed(dbus, network_get_path(network),
|
l_dbus_property_changed(dbus, network_get_path(network),
|
||||||
IWD_NETWORK_INTERFACE, "Connected");
|
IWD_NETWORK_INTERFACE, "Connected");
|
||||||
return;
|
|
||||||
|
|
||||||
not_supported:
|
|
||||||
if (message)
|
|
||||||
l_dbus_send(dbus, dbus_error_not_supported(message));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static void device_scan_triggered(int err, void *user_data)
|
static void device_scan_triggered(int err, void *user_data)
|
||||||
|
|
Loading…
Reference in New Issue