Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 13:02:44 +01:00
Code Releases Activity

wiphy: Fix not attempting WPA3 connections for APs in transition mode

Browse Source 
Fix a logic error which prevented iwd from using SAE/WPA3 when
attempting to connect to APs that are in transition mode.  The SAE/WPA3
check incorrectly required mfpr bit to be set, which is true for
APs in WPA3-Personal only mode, but is set to 0 for APs in
WPA3-Personal transition mode.

This patch also adds a bit more diagnostic output to help diagnose
causes for connections where WPA3 is not attempted even when advertised
by the AP.
This commit is contained in:
Denis Kenzior 2020-08-13 14:27:14 -05:00
parent 9e98a74efd
commit 4fbfa76fc5
3 changed files with 57 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
src/ie.c
View File

@ -1175,6 +1175,33 @@ bool ie_build_rsne(const struct ie_rsn_info *info, uint8_t *to)
return true;
}
bool ie_rsne_is_wpa3_personal(const struct ie_rsn_info *info)
{
bool is_transition = info->akm_suites & IE_RSN_AKM_SUITE_PSK;
/*
* WPA3 Specification, Version 2
*
* Section 2.2 WPA3-Personal only Mode:
* 1. An AP shall enable at least AKM suite selector 00-0F-AC:8 in
* the BSS
* 3. An AP shall not enable AKM suite selector: 00-0F-AC:2, 00-0F-AC:6
* 5. an AP shall set MFPC to 1, MFPR to 1
*
* Section 2.3 WPA3-Personal transition Mode:
* 1. an AP shall enable at least AKM suite selectors 00-0F-AC:2 and
* 00-0F-AC:8 in the BSS
* 3. an AP should enable AKM suite selector: 00-0F-AC:6
* 5. an AP shall set MFPC to 1, MFPR to 0
*/
if (!(info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256))
return false;
if (!info->mfpc)
return false;
return is_transition || info->mfpr;
}
bool ie_build_osen(const struct ie_rsn_info *info, uint8_t *to)
{
unsigned int pos;

1
src/ie.h
View File

@ -453,6 +453,7 @@ int ie_parse_rsne(struct ie_tlv_iter *iter, struct ie_rsn_info *info);
int ie_parse_rsne_from_data(const uint8_t *data, size_t len,
struct ie_rsn_info *info);
bool ie_build_rsne(const struct ie_rsn_info *info, uint8_t *to);
bool ie_rsne_is_wpa3_personal(const struct ie_rsn_info *info);
int ie_parse_wpa(struct ie_tlv_iter *iter, struct ie_rsn_info *out_info);
int ie_parse_wpa_from_data(const uint8_t *data, size_t len,

38
src/wiphy.c
View File

@ -173,22 +173,42 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
} else if (security == SECURITY_PSK) {
/*
* Prefer connecting to SAE/WPA3 network, but only if SAE is
* supported, we are MFP capable, and the AP has set the MFPR
* bit. If any of these conditions are not met, we can fallback
* to WPA2 (if the AKM is present).
* supported, we are MFP capable, and the AP has set the
* MFPR/MFPC bits correctly. If any of these conditions are not
* met, we can fallback to WPA2 (if the AKM is present).
*/
if (wiphy->supported_ciphers & IE_RSN_CIPHER_SUITE_BIP &&
wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) &&
info.mfpr) {
if ((info.akm_suites &
IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256) &&
wiphy->support_cmds_auth_assoc)
if (ie_rsne_is_wpa3_personal(&info)) {
l_debug("Network is WPA3-Personal...");
if (!(wiphy->supported_ciphers &
IE_RSN_CIPHER_SUITE_BIP)) {
l_debug("HW not MFP capable, trying WPA2");
goto wpa2_personal;
}
/*
* TODO: Only SoftMAC (mac80211) drivers are currently
* capable of SAE since it requires ability to send
* Authenticate and Associate frames (which is given by
* support_cmds_auth_assoc). FullMAC drivers require
* SAE offload which we do not support nor supported
* in any upstream driver as of this time.
*/
if (!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) ||
!wiphy->support_cmds_auth_assoc) {
l_debug("No HW WPA3 support, trying WPA2");
goto wpa2_personal;
}
if (info.akm_suites &
IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256)
return IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256;
if (info.akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256)
return IE_RSN_AKM_SUITE_SAE_SHA256;
}
wpa2_personal:
if ((info.akm_suites & IE_RSN_AKM_SUITE_FT_USING_PSK) &&
bss->rsne && bss->mde_present &&
wiphy->support_cmds_auth_assoc)