3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-28 12:12:32 +01:00
Commit Graph

1667 Commits

Author SHA1 Message Date
Denis Kenzior
99b5c67c88 device: Update State when Mode is changed 2018-08-19 22:41:07 -05:00
Denis Kenzior
5a6c19988c device/netdev: Properly implement mode switching 2018-08-19 22:07:15 -05:00
Denis Kenzior
3628003296 wsc: Do not check device mode
There's no longer a need to do that since WSC is only created in station
mode.
2018-08-19 22:06:02 -05:00
Denis Kenzior
cc9fc8de67 knownnetworks: Fix leak of fswatch
==7330== 112 bytes in 1 blocks are still reachable in loss record 1 of 1
==7330==    at 0x4C2CF8F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7330==    by 0x14CF7D: l_malloc (util.c:62)
==7330==    by 0x152A25: l_io_new (io.c:172)
==7330==    by 0x16B217: l_fswatch_init (fswatch.c:171)
==7330==    by 0x16B217: l_fswatch_new (fswatch.c:198)
==7330==    by 0x13B9D9: known_networks_init (knownnetworks.c:401)
==7330==    by 0x110020: main (main.c:439)
2018-08-19 22:05:31 -05:00
Denis Kenzior
93985103bb device: Use netdev->iftype instead of device_mode 2018-08-19 20:39:37 -05:00
Denis Kenzior
ae223fe06c netdev: Don't bother switching iftype on shutdown 2018-08-19 20:16:16 -05:00
Denis Kenzior
52e0a7ce83 netdev: Remove redundant typedefs
Unify command specific typedefs which had the same signature into a
single netdev_command_cb_t
2018-08-19 18:25:23 -05:00
Denis Kenzior
f6eb571b67 device: Set autoconnect only if triggered via D-Bus 2018-08-18 00:41:25 -05:00
Denis Kenzior
b7fd5023f0 device: Honor autoconnect setting on power up
If the device Powered state is toggled, honor the autoconnect setting
instead of always going into AUTOCONNECT mode
2018-08-18 00:40:45 -05:00
Denis Kenzior
996a6d2546 netdev/device: Combine watches
There was somewhat overlapping functionality in the device_watch
infrastructure as well as the netdev_event_watch.  This commit combines
the two into a single watch based on the netdev object and cleans up the
various interface additions / removals.

With this commit the interfaces are created when the netdev/device is
switched to Powered=True state AND when the netdev iftype is also in the
correct state for that interface.  If the device is brought down, then
all interfaces except the .Device interface are removed.

This will make it easy to implement Device.Mode property properly since
most nl80211 devices need to be brought into Powered=False state prior
to switching the iftype.
2018-08-18 00:38:56 -05:00
Denis Kenzior
da52bcd109 netdev: Rework netdev_init/exit 2018-08-17 23:47:20 -05:00
Denis Kenzior
b3e937e11a main: Rework initialization order
Group together all the configuration settings / reading code together
for more readability.

Initialize eap, eapol and rfkill before device
2018-08-17 23:35:09 -05:00
Denis Kenzior
c5b19dc747 main: Don't call wsc_exit twice 2018-08-17 16:45:05 -05:00
Denis Kenzior
28916dc5ca netdev: Add netdev_get_device 2018-08-17 14:59:01 -05:00
Denis Kenzior
3788156f39 netdev: Don't use device_get_ifindex in join_adhoc
This is pointless as the ifindex is already available on the netdev
object.
2018-08-17 14:42:07 -05:00
Denis Kenzior
3c28c5c24c netdev: Don't crash on operstate callbacks
The way that netdev_set_linkmode_and_operstate was used resulted in
potential crashes when the netdev was destroyed.  This is because netdev
was given as data to l_netlink_send and could be destroyed between the
time of the call and the callback.  Since the result of calls to
netdev_set_linkmode_and_operstate is inconsequential, it isn't really
worthwhile tracking these calls in order to cancel them.

This patch simplies the handling of these rtnl calls, makes sure that
netdev isn't passed as user data and rewrites the
netdev_set_linkmode_and_operstate signature to be more consistent with
rtnl_set_powered.
2018-08-17 14:10:13 -05:00
Denis Kenzior
ec437661b8 netdev: Don't set userdata for getlink 2018-08-17 14:10:13 -05:00
Denis Kenzior
015e8625bf netdev: Make sure set_powered calls are cancelable
Since all netdevs share the rtnl l_netlink object, it was possible for
netdevs to be destroyed with outstanding commands still executing on the
rtnl object.  This can lead to crashes and other nasty situations.

This patch makes sure that Powered requests are always tracked via
set_powered_cmd_id and the request is canceled when netdev is destroyed.
This also implies that netdev_set_powered can now return an -EBUSY error
in case a request is already outstanding.
2018-08-17 14:10:13 -05:00
Denis Kenzior
c530667ed1 device: Send .Aborted error if property set fails
If a property setting is canceled before the callback is generated, then
generate an .Aborted error the the method return
2018-08-17 14:10:13 -05:00
Denis Kenzior
3a9b1f2e38 device: Return an error if netdev_set_powered fails
netdev_set_powered could in theory return an error.  So handle this
case by returning an error from the property set call.
2018-08-17 14:10:13 -05:00
James Prestwood
b9fac0fd14 sae: fix sae to not hard code peer address
SAE is meant to work in a peer-to-peer fashion where neither side acts
as a dedicated authenticator or supplicant. This was not the case with
the current code. The handshake state authenticator address was hard
coded as the destination address for all packets, which will not work
when mesh comes into play. This also made unit testing the full SAE
procedure with two sae_sm's impossible.

This patch adds a peer address element to sae_sm which is filled with
either aa/spa based on the value of handshake->authenticator
2018-08-15 13:26:45 -05:00
James Prestwood
986f66a3c6 eapol: removed authenticator bit and auth register
This removes the authenticator bit in eapol_sm as well as unifies
eapol_register_authenticator and eapol_register. Taking advantage
of the handshake state authenticator bit we no longer have a need
for 2 separate register functions.

ap, and adhoc were also updated to set the authenticator bit in
the handshake and only use eapol_register to register their sm's.

netdev was updated to use the authenticator bit when choosing the
correct key address for adhoc.
2018-08-15 12:40:38 -05:00
James Prestwood
2036d36313 handshake: introduce authenticator bit
Both SAE and adhoc can benefit from knowing whether the handshake state
is an authenticator or a supplicant. It will allow both to easily
obtain the remote address rather than sorting out if aa/spa match the
devices own address.
2018-08-15 12:40:35 -05:00
Denis Kenzior
1f512ff85c device: Move device_init/device_exit to iwd.h 2018-08-14 14:57:19 -05:00
Denis Kenzior
47beec30f9 network: Implement Network.KnownNetwork property 2018-08-14 14:57:16 -05:00
Denis Kenzior
1c27aa5f1d knownnetworks: move known_networks_init/exit to iwd.h 2018-08-14 13:36:48 -05:00
Denis Kenzior
e6b3691c9e knownnetworks: Expose known_network_get_path
So that it can be used to implement Network.KnownNetwork property
2018-08-14 13:35:23 -05:00
James Prestwood
dd1885de11 sae: remove double sc increment
The send confirm counter is incremented before calling sae_send_confirm
in all cases, but the function itself was also incrementing sc after
sending the packet. This isn't critical to the successful execution of
SAE as the AP just uses the sc value in the packet but it did violate
the 802.11 spec.
2018-08-14 13:13:50 -05:00
James Prestwood
fd8671e9c5 netdev: added sae functionality to netdev
In order to plug SAE into the existing connect mechanism the actual
CMD_CONNECT message is never sent, rather sae_register takes care
of sending out CMD_AUTHENTICATE. This required some shuffling of
code in order to handle both eapol and sae. In the case of non-SAE
authentication everything behaves as it did before. When using SAE
an sae_sm is created when a connection is attempted but the eapol_sm
is not. After SAE succeeds it will start association and then create
the eapol_sm and start the 4-way handshake.

This change also adds the handshake SAE events to device and
initializes SAE in main.
2018-08-14 10:37:52 -05:00
James Prestwood
220fb61128 sae: implementation
SAE (Simultaneous Authentication of Equals) takes place during
authentication, and followed by EAPoL/4-way handshake. This
module handles the entire SAE commit/confirm exchange. This was
done similar to eapol.

SAE begins when sae_register is called. At this point a commit
message will be created and sent out which kicks off the SAE
authentication procedure.

The commit/confirm exchange is very similar to EAP-PWD, so all
the ecc utility functions could be re-used as-is. A few new ecc
utility functions were added to conform to the 80211 'blinding'
technique for computing the password element.
2018-08-13 20:40:59 -05:00
James Prestwood
920b307431 network: require Passphrase on psk files
For an SAE network, the raw passphrase is required. For this reason,
known network psk files should now always contain a 'Passphrase' entry.

If a psk file is found without a Passphrase entry the agent will be asked
for the Passphrase before connecting. This will update the legacy psk
file with the Passphrase entry.
2018-08-13 20:40:59 -05:00
Denis Kenzior
70acf2dcb4 device: rename SignalLevelChanged to Changed 2018-08-13 20:40:59 -05:00
Denis Kenzior
51c6d2d391 storage: use rename instead of unlink, link, unlink 2018-08-10 14:42:33 -05:00
Denis Kenzior
cbc149c7ed knownnetworks: Avoid unnecessary known object removal
Due to the quirk in how storage_network_sync implements file writing,
iwd was generating unnecessary KnownNetwork removal events (and
preventing certain test cases from passing successfully)

storage_network_sync tries to perform atomic writes by writing to a
temporary storage location first, unlinking the existing file and
renaming the tmp file as the original.

This generates a set of inotify events which confuses the current
implementation.
2018-08-10 12:17:40 -05:00
Denis Kenzior
c38b77d0c0 network: Fix syncing the PSK on 1st connection
The previous change did not consider the case of the PSK being written
for the very first time.  In this case storage_network_open would return
NULL and an empty file would be written.

Change this so that if storage_network_open fails, then the current
network settings are written to disk and not a temporary.
2018-08-10 12:13:44 -05:00
Andrew Zaborowski
abeed797c0 network: Reload settings in network_sync_psk
Reload the network settings from disk before calling
storage_network_sync in network_sync_psk to avoid potentially
overwriting changes made to the storage by user since the connection
attempt started.  This won't account for all situations but it
covers some of them and doesn't cost us much.
2018-08-10 09:44:16 -05:00
Andrew Zaborowski
3065e0768c knownnetworks: Add KnownNetwork.Hidden boolean property 2018-08-10 09:43:31 -05:00
Denis Kenzior
14693065d7 netdev: Use EAPoL over nl80211 if CONTROL_PORT set
Our logic would set CONTROL_PORT_OVER_NL80211 even in cases where
CONTROL_PORT wasn't used (e.g. for open networks).  While the kernel
ignored this attribute in this case, it is nicer to set this only if
CONTROL_PORT is intended to be used.
2018-08-09 15:20:27 -05:00
James Prestwood
d2d2b59f25 netdev: break out FT associate into common function
SAE will require some of the same CMD_ASSOCIATE building code that
FT currently uses. This breaks out the common code from FT into
netdev_build_cmd_associate_common.
2018-08-09 15:20:10 -05:00
James Prestwood
43b70b37d9 eapol: added key description type 0
This also required passing in the akm suite in case the key description
version was zero. In the zero case the akm must be checked. For now this
only supports the SAE akm.
2018-08-09 15:05:56 -05:00
James Prestwood
d256e97b32 device: added SUITE_SAE_SHA256 to _select_akm_suite 2018-08-09 14:57:41 -05:00
Jordan Glover
87d74db156 net.connman.iwd.service: Change SystemdService name to iwd.service
This allows to activate iwd service through dbus even when service
isn't enabled.
2018-08-09 10:45:16 -05:00
Andrew Zaborowski
4b4875e6cf knownnetworks: Watch filesystem events in STORAGEDIR
Update the known networks list and network properties on file creations,
removals and modifications.  We watch for these filesystem events using
ell's fswatch and react accordingly.
2018-08-09 10:35:37 -05:00
Andrew Zaborowski
ca270e9de2 network: Drop actions to be handled by filesystem watch 2018-08-09 10:27:28 -05:00
Andrew Zaborowski
5f79acfd8d storage: Expose get_network_file_path in the header 2018-08-09 10:25:56 -05:00
Andrew Zaborowski
549021b5dd eap-gtc: Fix reading secret from settings
This makes testEAP-PEAP-GTC pass for me by re-adding the check for the
GTC-Secret setting which was replaced with the check for the secrets
list in 3d2285ec7e.
2018-08-08 19:43:08 -05:00
Andrew Zaborowski
4ffb97faa1 eap: Add secret cache policy types
eap_append_secret now takes a new cache_policy parameter which can be
used by the EAP method to signal that the value received from the agent
is to never be cached, i.e. each value can only be used once.  The
parameter value should be EAP_CACHE_NEVER for this and we use this in
value EAP-GTC where the secret tokens are one time use.  The
EAP_CACHE_TEMPORARY value is used in other methods, it preserves the
default behaviour where a secret can be cached for as long as the
network stays in range (this is the current implementation more than a
design choice I believe, I didn't go for a more specific enum name as
this may still change I suppose).
2018-08-08 19:43:05 -05:00
James Prestwood
f68cca43da handshake: add setter for PMKID
SAE generates the PMKID during the authentication process, rather than
generating it on-the-fly using the PMK. For this reason SAE needs to be
able to set the PMKID once its generated. A new flag was also added
(has_pmkid) which signifies if the PMKID was set or if it should be
generated.
2018-08-08 16:03:17 -05:00
James Prestwood
0b452b9200 ecc: added Y^2 and legendre API's
SAE requires checking a values legendre symbol. Also added a helper
for computing Y^2, or, calculating the sum for the X side of the
equation.
2018-08-07 17:40:55 -05:00
James Prestwood
35278ae108 network: save passphrase in network
SAE needs access to the raw passphrase, not the PSK which network
saves. This changes saves the passphrase in network and handshake
objects, as well as adds getters to both objects so SAE can retrieve
the passphrase.
2018-08-07 17:39:16 -05:00
Denis Kenzior
7da345a9a5 mpdu: Also update comment to reflect 2016 spec 2018-08-07 17:23:26 -05:00
James Prestwood
4f8a722580 mpdu: added reason codes from more recent (2016) spec 2018-08-07 17:20:14 -05:00
James Prestwood
ff197edfc4 main: reordered plugin init/exit
This fixes improper cleanup when ofono leaves the bus after a simauth
instance has been cleaned up. The problem was that the plugin
exit was being called after the simauth module, causing there to
be stale simauth instances that were no longer valid. Now plugins
cleanup before simauth.

This fix fixes the print seen when iwd exits:

"Auth provider queue was not empty on exit!"
2018-08-07 17:18:23 -05:00
Denis Kenzior
8102b33634 wiphy: Support Adapter.SupportedModes property 2018-08-07 17:10:26 -05:00
Denis Kenzior
33e83b8c7c wiphy: Parse & report supported interface types 2018-08-07 16:45:17 -05:00
Denis Kenzior
6e6797cbde dbus: Add dbus_iftype_to_string 2018-08-07 16:19:39 -05:00
Denis Kenzior
9c6f3ef5c0 netdev: synchronize iftypes with nl80211
Make sure the netdev iftype enumeration is the same as nl80211
2018-08-07 16:12:12 -05:00
Denis Kenzior
6f2fbe32f9 wiphy: Add wiphy_supports_adhoc_rsn 2018-08-07 15:38:15 -05:00
Denis Kenzior
59697ead34 dbus: Remove unused functions 2018-08-07 15:38:15 -05:00
Jordan Glover
ed59c1af7f iwd.service: Order iwd before network.target
This ensures the unit will be stopped after network.target on shutdown
and any network filesystems will be unmounted before iwd is killed.
2018-08-06 15:46:19 -05:00
Marcel Holtmann
28573c90d1 build: Add support for systemd D-Bus activation 2018-08-06 22:37:22 +02:00
Andreas Henriksson
0573c6b5fb src: Fix spelling errors spotted by lintian
The debian package checking tool lintian spotted a bunch
of spelling errors in the built binaries.
2018-08-06 12:29:06 -05:00
Andrew Zaborowski
17c35dd1bc knownnetworks: Add back removing network files
This step apparently got lost during the refactoring in
97913c6f9a.
2018-08-01 10:32:32 -05:00
Andrew Zaborowski
e1634baae4 storage: Take enum security instead of string as parameter
Make the network_storage_* functions uniformly accept an enum value
instead of a string so that he conversion to string doesn't need to
happen in all callers.
2018-08-01 09:38:52 -05:00
Andrew Zaborowski
ac527d88c6 network: Actually remove the seen_time field 2018-08-01 09:32:41 -05:00
James Prestwood
3d2285ec7e eap-gtc: added support for agent in gtc
Now, EAP-GTC behaves similar to MSCHAPv2 where check_settings allows
for missing EAP-Identity and GTC-Secret fields. Either or both can be
missing and the agent will request the missing fields.
2018-07-31 14:35:36 -05:00
Andrew Zaborowski
00a643f093 knownnetworks: Drop the old KnownNetworks DBus interface 2018-07-31 11:52:38 -05:00
Andrew Zaborowski
e7e6cc3064 knownnetworks: Move ForgetNetwork() to KnownNetwork object
Remove the KnownNetworks.ForgetNetwork(ssid, security) method and add a
KnownNetwork.Forget() method on Known Network's DBus objects.
2018-07-31 11:52:35 -05:00
Andrew Zaborowski
c651bed28f knownnetworks: DBus objects for KnownNetworks
Add ObjectManager objects with properties for each Known Network so that
signals are emitted for creation or removal of a Known Network and a
Property Changed is emitted on LastConnectedTime change.  Remove the
ListKnownNetworks method from the old KnownNetworks interface.

Note this breaks clients that used the known networks interface.
2018-07-31 10:58:03 -05:00
Andrew Zaborowski
319b6416de network: Stop tracking network last seen times
Drop the corresponding network_info field, function and D-Bus property.
The last seen times didn't seem useful but if a client needs them it can
probably implement the same logic with the information already available
through DBus.
2018-07-31 10:55:32 -05:00
Denis Kenzior
6be0f55d85 ap/adhoc: Don't crash on eapol_sm_free
If the sm object (or the handshake object) is NULL, don't call the
corresponding function.

0  0x7fb6cd37da80 in /lib64/libc.so.6
1  0x414764 in eapol_sm_destroy() at eapol.c:673
2  0x42e402 in ap_sta_free() at ap.c:97
3  0x439dbe in l_queue_clear() at /home/parallels/wrk/iwd/ell/queue.c:109
4  0x439e09 in l_queue_destroy() at /home/parallels/wrk/iwd/ell/queue.c:83
5  0x42e4bf in ap_reset() at ap.c:132
6  0x42e519 in ap_free() at ap.c:147
7  0x447456 in interface_instance_free() at /home/parallels/wrk/iwd/ell/dbus-service.c:513
8  0x449be0 in _dbus_object_tree_remove_interface() at /home/parallels/wrk/iwd/ell/dbus-service.c:1595
9  0x449ced in _dbus_object_tree_object_destroy() at /home/parallels/wrk/iwd/ell/dbus-service.c:787
10 0x40fb8c in device_free() at device.c:2717
11 0x405cdb in netdev_free() at netdev.c:605
12 0x439dbe in l_queue_clear() at /home/parallels/wrk/iwd/ell/queue.c:109
13 0x439e09 in l_queue_destroy() at /home/parallels/wrk/iwd/ell/queue.c:83
14 0x40aac2 in netdev_shutdown() at netdev.c:4483
15 0x403b75 in iwd_shutdown() at main.c:80
16 0x43d9f3 in signal_callback() at /home/parallels/wrk/iwd/ell/signal.c:83
17 0x43d4ee in l_main_iterate() at /home/parallels/wrk/iwd/ell/main.c:376
18 0x43d5ac in l_main_run() at /home/parallels/wrk/iwd/ell/main.c:419
19 0x40379b in main() at main.c:454
20 0x7fb6cd36788a in /lib64/libc.so.6
2018-07-30 09:07:58 -05:00
Tim Kourt
ece63270e7 adhoc: expose property 'Started' property on the Dbus 2018-07-30 09:00:57 -05:00
Tim Kourt
dda350a93d ap: expose property 'Started' property on the Dbus 2018-07-30 09:00:57 -05:00
Andrew Zaborowski
215162a49e network: Don't free known networks in network_info_put
Fix a double free resulting from network.c freeing a known network when
it goes out of range due to a missing check.
2018-07-30 08:55:27 -05:00
Andrew Zaborowski
97913c6f9a network: Refactor and move Known Networks management
Until now network.c managed the list of network_info structs including
for known networks and networks that are seen in at least one device's
scan results, with the is_known flag to distinguish known networks.
Each time the list was processed though the code was either interested
in one subset of networks or the other.  Split the list into a Known
Networks list and the list of other networks seen in scans.  Move all
code related to Known Networks to knownnetworks.c, this simplifies
network.h.  It also gets rid of network_info_get_known which actually
returned the list of all network_infos (not just for known networks),
which logically should have been private to network.c.  Update device.c
and scan.c to use functions specific to Known Networks instead of
filtering the lists by the is_known flag.

This will also allow knownnetworks.c to export DBus objects and/or
properties for the Known Networks information because it now knows when
Known Networks are added, removed or modified by IWD.
2018-07-25 09:40:14 -05:00
Andrew Zaborowski
c2abc212ad network: Make networks_connected return void
The return value from network_connected is not checked and even if one
of the storage operations fails the function should probably continue
so only print a message on error.
2018-07-23 11:46:49 -05:00
Andrew Zaborowski
ea2b83e5a7 ap: Remove unused psk field 2018-07-23 11:46:15 -05:00
James Prestwood
a68e958f29 ap: fixed crash in AP
If the device mode it toggled from 'ap' back to 'station' without actually
starting the access point ap_free attempts to zero out the psk, which
causes a crash because it had never been allocated (Start() never was
called). Since ap->psk is actually never used this was removed. Also added
a memset to zero out the pmk on cleanup.

This is the crash observed:

++++++++ backtrace ++++++++
0  0x7f6ffe978a80 in /lib64/libc.so.6
1  0x7f6ffe9d6766 in /lib64/libc.so.6
2  0x42dd51 in memset() at /usr/include/bits/string3.h:90
3  0x42ddd9 in ap_free() at src/ap.c:144
4  0x445ec6 in interface_instance_free() at ell/dbus-service.c:513
5  0x448650 in _dbus_object_tree_remove_interface() at ell/dbus-service.c:1595
6  0x40d980 in device_set_mode_sta() at src/device.c:2113
7  0x447d4c in properties_set() at ell/dbus-service.c:1861
8  0x448a33 in _dbus_object_tree_dispatch() at ell/dbus-service.c:1691
9  0x442587 in message_read_handler() at ell/dbus.c:285
10 0x43cac9 in io_callback() at ell/io.c:123
11 0x43bf5e in l_main_iterate() at ell/main.c:376
12 0x43c01c in l_main_run() at ell/main.c:419
13 0x40379d in main() at src/main.c:460
14 0x7f6ffe96288a in /lib64/libc.so.6
+++++++++++++++++++++++++++
2018-07-19 11:21:43 -05:00
Denis Kenzior
46a797043a ie: Add AKMs from 802.11-2016 2018-07-19 11:09:08 -05:00
Denis Kenzior
c4a2654703 ie: Split RSN & WPA akm suite builders 2018-07-19 10:56:46 -05:00
Denis Kenzior
438af4aebc ie: Don't fail RSNE parsing with unknown AKMs 2018-07-19 10:36:18 -05:00
Denis Kenzior
c37146d403 wsc: Rework wsc_init & wsc_exit
- wsc module does not need nl80211 any longer, so remove it.
- Move wsc_init & wsc_exit declarations to iwd.h and remove wsc.h
- re-arrange how wsc_init & wsc_exit is called inside main.c.
2018-07-17 19:19:09 -05:00
Denis Kenzior
17bfbbd397 main: Re-arrange _exit order
The plugin_exit was in the wrong place, it should be triggered in case
genl creation fails.  Also adhoc_exit was in the wrong sequence compared
to _init()
2018-07-17 19:15:08 -05:00
Denis Kenzior
6b58ab1a08 main: Simplify sim_auth_init
There's no real reason why sim_auth_init should fail, so simplify the
procedure and move declarations to iwd.h
2018-07-17 19:12:48 -05:00
James Prestwood
8cf44499d1 device: added DEVICE_EVENT_MODE_CHANGED
Rather than have device.c manage the creation/removal of
AP/AdHoc interfaces this new event was introduced. Now
anyone can listen for device events and if the mode changes
handle accordingly. This fixes potential memory leaks
in WSC when switching modes as well.
2018-07-17 18:52:59 -05:00
James Prestwood
bf3a171e3a device: added ad-hoc mode
As with station/ap, a new mode was added for ad-hoc
2018-07-17 16:55:59 -05:00
James Prestwood
682c844239 main: added adhoc init to main 2018-07-17 16:46:21 -05:00
James Prestwood
55cb9aa2e9 adhoc: adhoc implementation 2018-07-17 16:46:18 -05:00
James Prestwood
88bd69269e netdev: add join_adhoc/leave_adhoc API's
These will issue a JOIN/LEAVE_IBSS to the kernel. There is
a TODO regarding network configuration. For now, only the
SSID is configurable. This configuration is also required
for AP, but needs to be thought out. Since the current
AP Dbus API has nothing related to configuration items
such as freq/channel or RSN elements they are hard coded,
and will be for Ad-Hoc as well (for now).
2018-07-17 16:25:33 -05:00
James Prestwood
e10d79b53f netdev: ensure proper iftype on connect/disconnect
Now that the device mode can be changed, netdev must check that
the iftype is correct before starting a connection or disconnecting.
netdev_connect, netdev_connect_wsc, and netdev_disconnect now check
that the iftype is station before continuing.
2018-07-17 16:16:17 -05:00
James Prestwood
515985afed netdev: choose correct address on NEW_KEY/SET_STATION
With the introduction of Ad-Hoc, its not as simple as choosing
aa/spa addresses when setting the keys. Since Ad-Hoc acts as
both the authenticator and supplicant we must check how the netdev
address relates to the particular handshake object as well as
choose the correct key depending on the value of the AA/SPA address.
802.11 states that the higher of the two addresses is to be used
to set the key for the Ad-Hoc connection.

A simple helper was added to choose the correct addressed based on
netdev type and handshake state. netdev_set_tk also checks that
aa > spa in the handshake object when in Ad-Hoc mode. If this is
true then the keys from that handshake are used, otherwise return
and the other handshake key will be used (aa will be > spa).

The station/ap mode behaves exactly the same as before.
2018-07-17 11:13:53 -05:00
James Prestwood
27430287ab dbus: added Ad-Hoc dbus interface 2018-07-17 10:53:08 -05:00
James Prestwood
42fe517d4e netdev: added station watch
For Ad-Hoc networks, the kernel takes care of auth/assoc
and issues a NEW_STATION event when that is complete. This
provides a way to notify when NEW_STATION events occur as
well as forward the MAC of the station to Ad-Hoc.

The two new API's added:
 - netdev_station_watch_add()
 - netdev_station_watch_remove()
2018-07-17 10:50:34 -05:00
James Prestwood
54cd428c94 netdev: Add IFTYPE_ADHOC interface type
netdev_set_iftype and get_iftype were also changed to
account for all three interface types.
2018-07-17 10:49:10 -05:00
Denis Kenzior
efecce772f eapol: Fix memory allocation issues
When the EAPOL-Key data field is encrypted using AES Wrap, check
that the data field is large enough before calculating the expected
plaintext length.

Previously, if the encrypted data field was smaller than 8 bytes, an
integer underflow would occur when calculating the expected plaintext
data length. This would cause iwd to try to allocate a huge amount of
memory, which causes it to abort and terminate. If the data field was
equal to 8 bytes, iwd would try to allocate 0 bytes of memory, making
l_new return NULL, which subsequently causes iwd to crash on a NULL
pointer deference.

Reported-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-07-16 10:51:13 -05:00
Denis Kenzior
57c3aa2589 scan: Fix triggered flag setting
triggered flag was being reset to false in all cases.  However, due to
how scan_finished logic works, it should have remained true if no more
commands were left to be sent (e.g. the scan was finished).
2018-07-13 12:34:59 -05:00
Tim Kourt
d83dda410d device: fix incomplete variable replacement 2018-07-13 11:41:49 -05:00
Christian Hesse
22e5ba2133 device: make the output less verbose
Having hidden SSIDs or SSIDs with non-UTF8 characters around make iwd
flood the logs with messages. Make iwd less verbose and show these
messages with enabled debug output only.
2018-07-13 10:39:02 -05:00
Tim Kourt
9ff2e59e40 scan: add hidden networks into periodic scan
In addition, the periodic scan can now alternate between the
active or passive modes. The active mode is enabled by existence of
the known hidden networks and observation of them in the
previous scan result.
2018-07-11 17:29:47 -05:00
Tim Kourt
ec8afb0af1 scan: add todo comment for randomization flag 2018-07-11 17:24:17 -05:00
Denis Kenzior
48e9f2aee0 scan: Break up logic into utility functions
Some fairly common logic was duplicated across functions.  Split it up
into common utilities
2018-07-11 17:20:06 -05:00
Denis Kenzior
dfe74ea8ff scan: Use a cast instead of an extra function 2018-07-11 16:30:45 -05:00
Tim Kourt
c33deb7a0a scan: add hidden networks into the scan requests
To support an auto-connect for the hidden networks and having
a limited number of SSIDs that can be appended into a probe
request, introduced a concept of a command batch. Now, scan request
may consist of a series of commands. The commands in the batch
are triggered sequentially. Once we are notified about the
results from a previous command, a consequent command in the
batch is triggered. The collective results are reported once
the batch is complete. On a command failure, the batch
processing is canceled and scan request is removed
2018-07-11 16:30:41 -05:00
Denis Kenzior
87108984bc network: set Hidden=true for new hidden networks 2018-07-11 16:09:42 -05:00
Denis Kenzior
d744915534 device: Rework device_hidden_network_scan_results
Rework the logic slightly to simplify the need for error labels.  Also
the connect_pending variable might not have been properly reset to NULL
in case of error, so make sure we reset it prior to calling into
network_connect_new_hidden_network
2018-07-11 15:59:51 -05:00
Tim Kourt
d8c8ebdf3a device: enable connection to the hidden networks
1) Change signature of process_bss to return a confirmation
   that bss has been added to a network otherwise we can
   discard it.

2) Implements logic for the discovery and connection to
   a hidden network.
2018-07-11 15:36:14 -05:00
Tim Kourt
72c6862255 network: add network info accessors
This adds the accessors for the hidden field in network
info. In addition, it provides a lookup of the network infos
by ssid and security type.
2018-07-11 15:20:55 -05:00
Tim Kourt
d2feb535a5 network: implement a counter for the hidden networks 2018-07-11 10:36:40 -05:00
Tim Kourt
f7a30106bf scan: initial support for the direct probe request
This enables the discovery of the hidden networks
2018-07-11 10:25:24 -05:00
Tim Kourt
d1a8e191e9 network: introduce connect API for the hidden nets 2018-07-11 10:19:43 -05:00
James Prestwood
bbad6b4ec9 ap: use netdev_del_station API
Removes del station code from AP in favor of netdev_del_station.
2018-07-03 16:45:29 -05:00
James Prestwood
4a2b80ee97 netdev: expose netdev_del_station
This removes the need for duplicate code in AP/netdev for issuing
a DEL_STATION command. Now AP can issue a DEL_STATION with
netdev_del_station, and specify to either disassociate or deauth
depending on state.
2018-07-03 16:45:29 -05:00
James Prestwood
b2f27f3abe netdev: fixed key setting failure
If netdev fails to set the keys, there was no way for device/ap to
know. A new handshake event was added for this. The key setting
failure function was also fixed to support both AP/station iftypes.
It will now automatically send either a disconnect or del_station
depending on the interface type.

In similar manner, netdev_handshake_failed was also modified to
support both AP/station iftypes. Now, any handshake event listeners
should call netdev_handshake_failed upon a handshake failure
event, including AP.
2018-07-03 16:45:25 -05:00
James Prestwood
d4e521027b device: add debug prints for mode switching
Its useful to know when the device has switched modes
2018-07-03 16:15:54 -05:00
Denis Kenzior
5b8f052524 device: Don't return an error on no state change
If device is already disconnected or in autoconnect mode, don't return
an error if .Disconnect is called.  Instead simply silently return
success after disabling autoconnect.
2018-07-03 16:13:39 -05:00
Denis Kenzior
73e0394d7f device: Use dbus_error_from_errno in .Disconnect 2018-07-03 16:12:04 -05:00
Denis Kenzior
8bbe85787c device: Fix memory leak when aborting a connection
==1058== 231 (32 direct, 199 indirect) bytes in 1 blocks are definitely lost in loss record 10 of 10
==1058==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1058==    by 0x452472: l_malloc (util.c:62)
==1058==    by 0x456324: l_settings_new (settings.c:83)
==1058==    by 0x427D45: storage_network_open (storage.c:262)
==1058==    by 0x42806C: network_settings_load (network.c:75)
==1058==    by 0x428C2F: network_autoconnect (network.c:490)
==1058==    by 0x4104E9: device_autoconnect_next (device.c:194)
==1058==    by 0x410E38: device_set_scan_results (device.c:393)
==1058==    by 0x410EFA: new_scan_results (device.c:414)
==1058==    by 0x424A6D: scan_finished (scan.c:1012)
==1058==    by 0x424B88: get_scan_done (scan.c:1038)
==1058==    by 0x45DC67: destroy_request (genl.c:134)
2018-07-03 15:45:29 -05:00
Tim Kourt
5f69aba32b eap-peap: add warning for the missing M flag 2018-07-02 20:28:08 -05:00
James Prestwood
9e32ea5e80 ap: removed unused ap_event enum 2018-07-02 15:34:26 -05:00
Denis Kenzior
fb1296e9c0 network: Add network_info_get_known 2018-07-02 13:03:03 -05:00
James Prestwood
8ed043533a wsc: register for handshake events
This is a fixup for the AP code merge. wsc.c never registered
for handshake events, so in case of failure it was never calling
netdev_handshake_failed, which caused a double free.
2018-07-02 12:29:08 -05:00
Denis Kenzior
057b019550 network: Use __device_connect_network
In network_autoconnect, use the low-level version of
device_connect_network
2018-07-02 12:28:10 -05:00
Denis Kenzior
a1a6c2d7d6 device: Introduce __device_connect_network
The version with '__' prefix is the raw version that returns errnos.
The version without '__' prefix deals with D-Bus error conversion.
2018-07-02 12:25:47 -05:00
Denis Kenzior
31081f98e7 dbus: Add dbus_error_from_errno 2018-07-02 12:24:33 -05:00
Denis Kenzior
7f844a2520 eapol: Relax key_iv checks
Many APs don't send properly zerod key_iv elements in EAPoL-Key frames.
In the past iwd has complained, but this broken behavior is so
prevalent, that it is likely a lost cause.

This patch takes out these warnings
2018-07-01 20:57:38 -05:00
Denis Kenzior
1c9a1ea46d eapol: Handle all zero PMKID 2018-07-01 20:48:11 -05:00
Denis Kenzior
7676aa2107 netdev: Allow iwd.conf to specify PAE over NL80211
Right now iwd uses Control Port over NL80211 feature if the kernel /
driver supports it.  On some kernels this feature is still buggy, so add
an iwd.conf entry to allow the user to override id.

For now the default is to disable this feature until it is more stable.
2018-07-01 20:41:34 -05:00
James Prestwood
fd79297553 device/ap: Moved AP dbus interface into ap.c
Now, a user can setup an AP as follows:

- Set device "Mode" to ap (ap interface will appear on bus)
- call "Start()" on AP interface

Issuing "Stop()" on the AP interface will stop and cleanup
the internal AP structures, but the AP interface will remain
up. To shutdown completely the device Mode must be switched
back to station. If the AP interface is running, the Mode can
directly be switched to station without calling Stop; this
has the same effect and will take down the AP interface.
2018-06-29 18:28:28 -05:00
Tim Kourt
9976007dd8 eap-peap: Relax the M bit requirement
Some of the PEAP server implementation brake the protocol
and don’t set the M flag for the first packet during the
fragmented transmission. To stay compatible with such
devices, we relax this requirement in iwd.
2018-06-29 17:39:50 -05:00
James Prestwood
d5dd1a4e90 wsc: fixed comment typo 2018-06-29 16:41:13 -05:00
James Prestwood
1d8869fbb7 dbus: define AccessPoint interface
net.connman.iwd.AccessPoint interface was added
2018-06-29 14:26:07 -05:00
Tim Kourt
1fff705160 device: use direct probe request in roam scans
This takes care of the roaming for the hidden networks.
In addition, it limits the noise responses from the
other networks.
2018-06-29 13:53:39 -05:00
Tim Kourt
5ded4890a6 network: introduce the concept of hidden networks 2018-06-29 13:51:12 -05:00
Tim Kourt
1ffc99c343 scan: add ssid parameter
ssid – is used for the direct probe requests
2018-06-29 13:48:09 -05:00
Tim Kourt
d91b81bc11 dbus: add AlreadyProvisioned and NotHidden errors 2018-06-29 13:46:33 -05:00
Tim Kourt
28c6a37db0 scan: rename scan triggered callback 2018-06-28 15:56:46 -05:00
Tim Kourt
27e305c9d2 device: change scan command logic
This patch allows alternating between the passive and active
scans taking into consideration an existence of the known
hidden networks and previous observation of them in the scan
results, as well as an ability to randomize the MAC address.
2018-06-28 15:44:57 -05:00
Denis Kenzior
5828073cd5 scan: Add randomize_mac_addr_hint
This will be used by the scanning code to enable mac address
randomization if supported by the hardware / kernel.
2018-06-28 15:41:29 -05:00
Tim Kourt
ef5110869b network: Add stub for network_info_has_hidden 2018-06-28 15:06:11 -05:00
Denis Kenzior
961c3e849d eap-peap: Print alert number 2018-06-28 13:23:13 -05:00
Tim Kourt
8ea4f82166 device: introduce seen_hidden_networks flag
This flag indicates whether the hidden networks were
observed in the scan results. We drop the hidden network BSSs
after the flag is set.
2018-06-28 11:37:10 -05:00
Tim Kourt
3781c157db util: Add util_ssid_is_hidden 2018-06-28 11:37:06 -05:00
Tim Kourt
a681e845a6 scan: change signature of scan_build_cmd
This allows scan_build_cmd to take advantage of a full
scan context. For example to check the feature availability
of wiphy, etc.
2018-06-28 11:25:30 -05:00
Tim Kourt
bece39619b scan: fix scan state check
The state of scan is split between the two variables sc->state
and sc->start_cmd_id. Not checking start_cmd_id used to cause
sending a scan request while periodic scan was just triggered
resulting in EBUSY.
2018-06-28 11:13:45 -05:00
James Prestwood
93a113f551 ap: remove ap_error_deauth_sta
Instead of manually sending a deauth/disassociate to a station
during an error or removal, the kernel can do it automatically
with DEL_STATION by including the MGMT_SUBTYPE attribute. This
removes the need for ap_error_deauth_sta and introduces
ap_deauthenticate_sta. Now AP can be explicit when it chooses
to deauth or disassociate.
2018-06-28 11:12:11 -05:00
Tim Kourt
48b7ed1e47 dbus: Add error msg for the service set overlap
The intended usage of this error is to notify a client
application about the presence of the multiple overlapping
network sessions.
2018-06-27 19:37:30 -05:00
James Prestwood
92f1ceb3ce netdev/eapol: removed eapol deauthenticate
This removes the need for the eapol/netdev deauthenticate function.
netdev_handshake_failed was exposed so device.c could issue the
disconnect.
2018-06-27 16:17:14 -05:00
James Prestwood
4ed30ff661 ap: removed code that was moved to eapol
All handshake packet handling has been removed from ap and
moved to eapol. After association, the AP registers a new
authenticator state machine which handles the AP side of
the handshake. AP will receive a handshake event once the
4-way handshake is complete.
2018-06-27 14:21:16 -05:00
James Prestwood
9d4f1b4ca6 eapol: moved AP authenticator into eapol
Includes:
 - support for handling ptk 2/4 and 4/4. Also sending 1/4 and 3/4.
 - new API to register an authenticator SM. This automatically
   sends 1/4 to kick off authentication with an sta.
2018-06-22 14:40:20 -05:00
James Prestwood
b81a9482b4 netdev: added checks for station/ap iftype
These checks allow both a station and authenticator to use
the same netdev key install functions. For NEW_KEY and
SET_STATION, the iftype is checked and either handshake->aa
or ->spa is used as the station address for the KEY/STATION
commands. Also, in the failure cases, a disconnect command
is issued only if the iftype is station as this doesn't
apply to AP.
2018-06-22 14:33:32 -05:00
James Prestwood
aac00bf33a handshake: remove handshake related netdev events
Handshake related netdev events were removed in favor of
handshake events. Now events will be emitted on the handshake
object related to the 4-way handshake and key settings. Events
are:

HANDSHAKE_EVENT_STARTED
HANDSHAKE_EVENT_SETTING_KEYS
HANDSHAKE_EVENT_COMPLETE
HANDSHAKE_EVENT_FAILED

Right now, since netdev only operates in station mode, nothing
listens for COMPLETE/FAILED, as device/wsc gets notified by the
connect_cb when the connection was successful. The COMPLETE/
FAILED were added in preperation for AP moving into eapol/netdev.
2018-06-22 14:21:50 -05:00
Denis Kenzior
c5893f7da8 network: Fix memory leak in network_set_psk
==1057== 32 bytes in 1 blocks are definitely lost in loss record 1 of 1
==1057==    at 0x4C2AF0F: malloc (vg_replace_malloc.c:299)
==1057==    by 0x15E9A2: l_malloc (util.c:62)
==1057==    by 0x15EA9D: l_memdup (util.c:121)
==1057==    by 0x133D9A: network_set_psk (network.c:350)
==1057==    by 0x13BD29: wsc_try_credentials (wsc.c:136)
==1057==    by 0x13C121: wsc_connect_cb (wsc.c:220)
==1057==    by 0x110FAF: netdev_connect_failed (netdev.c:525)
==1057==    by 0x16AAF4: process_unicast (genl.c:390)
==1057==    by 0x16AF03: received_data (genl.c:509)
==1057==    by 0x166CB6: io_callback (io.c:123)
==1057==    by 0x16580D: l_main_iterate (main.c:376)
==1057==    by 0x16594B: l_main_run (main.c:423)
2018-06-21 20:14:00 -05:00
Denis Kenzior
3df790e3c5 handshake: Switch to superclass api 2018-06-21 20:10:07 -05:00
Denis Kenzior
b5e01226cb netdev: Remove un-needed pairwise set_key call
This seems to be no longer needed as the kernel looks up the key by the
sta specific key index.
2018-06-21 20:10:07 -05:00
James Prestwood
2177b22caa handshake: Add utility to generate a new anonce
AP EAPoL state machine will need to generate the anonce, so as
with snonce, an API was added to do that.
2018-06-20 14:04:54 -05:00
James Prestwood
b059a699ab netdev: refactored code to prep for AP code
Added several helpers for code that will be reused by AP
2018-06-20 14:02:07 -05:00
Denis Kenzior
d76cf840ed eap-ttls: Rename eap to phase2_eap for clarity 2018-06-20 13:55:15 -05:00
Denis Kenzior
a217b4f8b9 eap-ttls: Remove eap_new calls after load_settings
load_settings ensures that ttls->eap is correctly initialized.  So this
code should be treated as an error condition.

We also do not support EAP chaining, so remove that logic as well
2018-06-20 13:55:15 -05:00
Denis Kenzior
2fe2ed61e1 netdev: Set netdev->type to NL80211 enum 2018-06-20 08:23:22 -05:00
James Prestwood
0b5a3da2ef netdev: fixed netdev_set_iftype
While this would issue a SET_INTERFACE to the kernel it would
not actually set netdev->type, so netdev_get_iftype would
return incorrectly.
2018-06-19 16:13:39 -05:00
Antonio Quartulli
1de8d18883 main: don't crash if DBus is not running
dbus_init() currently does not check for the g_dbus object being
properly initialized and this leads to crashes when dbus is not yet
running.

Ensure g_dbus is properly initialized and return false otherwise.
In this case the caller can understand that something went wrong and
stop the initialization procedure.

Program received signal SIGSEGV, Segmentation fault.
0x00005555555bc089 in l_dbus_add_service_watch (dbus=0x0,
name=0x5555555e5b0a "org.ofono",
    connect_func=0x5555555aa81e <ofono_found>,
disconnect_func=0x5555555aa8e6 <ofono_disappeared>,
    user_data=0x0, destroy=0x0) at ell/dbus.c:1621
1621		if (!dbus->name_cache)
(gdb) bt
name=0x5555555e5b0a "org.ofono",
    connect_func=0x5555555aa81e <ofono_found>,
disconnect_func=0x5555555aa8e6 <ofono_disappeared>,
    user_data=0x0, destroy=0x0) at ell/dbus.c:1621
user_data=0x0) at ell/plugin.c:115
function=0x5555555b40fd <plugin_start>,
    user_data=0x0) at ell/queue.c:441
version=0x0) at ell/plugin.c:201
src/plugin.c:82
src/main.c:417
2018-06-15 10:59:07 -05:00
Denis Kenzior
8112806aca eap-mschapv2: Fix uninitialized use of memory
When the response structure is generated, not all of the memory was
initialized to 0.

==1045== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==1045==    at 0x5134D52: send (in /lib64/libc-2.25.so)
==1045==    by 0x168AB5: l_checksum_update (checksum.c:338)
==1045==    by 0x186777: tls_write_mac (tls-record.c:58)
==1045==    by 0x1869D1: tls_tx_record_plaintext (tls-record.c:120)
==1045==    by 0x186DEA: tls_tx_record (tls-record.c:201)
==1045==    by 0x185A3B: l_tls_write (tls.c:2064)
==1045==    by 0x14584F: eap_ttls_eap_tx_packet (eap-ttls.c:321)
==1045==    by 0x14236C: eap_send_response (eap.c:165)
==1045==    by 0x147904: eap_mschapv2_send_response (eap-mschapv2.c:468)
==1045==    by 0x147A10: eap_mschapv2_handle_challenge (eap-mschapv2.c:492)
==1045==    by 0x147E9A: eap_mschapv2_handle_request (eap-mschapv2.c:615)
==1045==    by 0x142693: __eap_handle_request (eap.c:240)
==1045==  Address 0x1ffeffe7f9 is on thread 1's stack
==1045==  in frame #4, created by tls_tx_record (tls-record.c:177)
==1045==  Uninitialised value was created by a stack allocation
==1045==    at 0x1477AE: eap_mschapv2_send_response (eap-mschapv2.c:443)
==1045==
==1045== Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s)
==1045==    at 0x5134E3B: sendmsg (in /lib64/libc-2.25.so)
==1045==    by 0x17F691: operate_cipher (cipher.c:356)
==1045==    by 0x17F9D8: l_cipher_encrypt (cipher.c:446)
==1045==    by 0x186BAA: tls_tx_record_plaintext (tls-record.c:152)
==1045==    by 0x186DEA: tls_tx_record (tls-record.c:201)
==1045==    by 0x185A3B: l_tls_write (tls.c:2064)
==1045==    by 0x14584F: eap_ttls_eap_tx_packet (eap-ttls.c:321)
==1045==    by 0x14236C: eap_send_response (eap.c:165)
==1045==    by 0x147904: eap_mschapv2_send_response (eap-mschapv2.c:468)
==1045==    by 0x147A10: eap_mschapv2_handle_challenge (eap-mschapv2.c:492)
==1045==    by 0x147E9A: eap_mschapv2_handle_request (eap-mschapv2.c:615)
==1045==    by 0x142693: __eap_handle_request (eap.c:240)
==1045==  Address 0x1ffeffe7f9 is on thread 1's stack
==1045==  in frame #4, created by tls_tx_record (tls-record.c:177)
==1045==  Uninitialised value was created by a stack allocation
==1045==    at 0x1477AE: eap_mschapv2_send_response (eap-mschapv2.c:443)
==1045==
2018-06-15 07:55:41 -05:00
Denis Kenzior
38952813dd storage: Simplify storage_network_open 2018-06-14 20:53:39 -05:00
Denis Kenzior
a2d8054218 eap: Separate private bits into eap-private.h 2018-06-14 20:01:19 -05:00
Denis Kenzior
f04869c3cf network: Use network_load_psk in network_connect_psk 2018-06-14 19:22:29 -05:00
Denis Kenzior
c25499a118 network: Rework autoconnect logic 2018-06-14 19:21:44 -05:00
Denis Kenzior
786365e2c7 eap: Add __eap_check_settings
Since PEAP & TTLS expect to use eap_check_settings recursively, make
them use a private version of that API that does not perform cleanup and
can contain side-effects.

eap_check_settings itself will guarantee that no side effects happen on
error.  It is meant to be used by code outside of the eap subsystem.
2018-06-14 19:21:44 -05:00
Denis Kenzior
e24d6b54d2 eap: Ensure that we don't return an empty queue 2018-06-14 17:02:09 -05:00
Denis Kenzior
250568025c network: Fix a bunch of double-frees
Missing secrets are freed by eap_send_agent_req() even in case of
failure, so it was erroneous to try to free them on error.

==1048== Invalid read of size 8
==1048==    at 0x1603EC: l_queue_clear (queue.c:101)
==1048==    by 0x1603B8: l_queue_destroy (queue.c:82)
==1048==    by 0x135328: network_connect_8021x (network.c:943)
==1048==    by 0x1354C4: network_connect (network.c:987)
==1048==    by 0x178DD2: _dbus_object_tree_dispatch (dbus-service.c:1690)
==1048==    by 0x16D32A: message_read_handler (dbus.c:285)
==1048==    by 0x166EC3: io_callback (io.c:123)
==1048==    by 0x165A1A: l_main_iterate (main.c:376)
==1048==    by 0x165B58: l_main_run (main.c:423)
==1048==    by 0x1102DA: main (main.c:458)
==1048==  Address 0x5461850 is 0 bytes inside a block of size 24 free'd
==1048==    at 0x4C2C13B: free (vg_replace_malloc.c:530)
==1048==    by 0x15ED03: l_free (util.c:136)
==1048==    by 0x1603C4: l_queue_destroy (queue.c:83)
==1048==    by 0x134BD5: eap_secret_request_free (network.c:719)
==1048==    by 0x134EF9: eap_send_agent_req (network.c:817)
==1048==    by 0x1352F7: network_connect_8021x (network.c:936)
==1048==    by 0x1354C4: network_connect (network.c:987)
==1048==    by 0x178DD2: _dbus_object_tree_dispatch (dbus-service.c:1690)
==1048==    by 0x16D32A: message_read_handler (dbus.c:285)
==1048==    by 0x166EC3: io_callback (io.c:123)
==1048==    by 0x165A1A: l_main_iterate (main.c:376)
==1048==    by 0x165B58: l_main_run (main.c:423)
2018-06-14 17:00:52 -05:00
Denis Kenzior
75b492eacc eap-peap: Fix double free 2018-06-14 16:01:50 -05:00
Denis Kenzior
eb1a183277 eap-ttls: Fix double free 2018-06-14 15:58:43 -05:00
Denis Kenzior
86fef093c0 eap-mschapv2: Optimize away some allocs/frees 2018-06-14 15:19:50 -05:00
Andrew Zaborowski
1a465aed4a eap: Allow methods to request the Identity from agent
In eap_check_settings move the check for the EAP-Identity setting so
that the method's check_setting call back has a chance to request it
from the agent.  Note the check can be also moved to the EAP methods
so that they are free to skip it if not NULL identity is ok.
2018-06-13 21:49:24 -05:00
Andrew Zaborowski
b9aaab9c63 eap-mschapv2: Drop unneeded UTF-8 validation
As report by Denis those strings have already gone through validation.
2018-06-13 21:49:07 -05:00
Andrew Zaborowski
66e332fd4a eap: Use l_settings_get_string where needed
Replace usages of l_settings_get_value with l_settings_get_string, which
will make sure the returned strings are unescaped but also allocates
memeory and forces us to use l_free on most of the strings.  Some of
these strings we explicitly set with l_settings_set_string() in our code
so when we retrieved them with l_settings_get_value() we would receive a
different string if there were any escapable characters in the string.
I didn't replace any of the l_settings_get_value() uses where we're just
checking whether a setting is present, or those which are hexstrings or
EAP method names assuming that they can't have any special characters,
although this isn't future proof.  I did use l_settings_get_string() for
file paths though.
2018-06-13 21:41:43 -05:00
Andrew Zaborowski
b8fde0c166 eap: Accept a second id parameter in eap_append_secret
Accept two setting IDs in eap_append_secret, first for the username and
second for the password in case of the EAP_SECRET_REMOTE_USER_PASSWORD
EAP secret type.  In all other cases only the first setting is used.
Until now for EAP_SECRET_REMOTE_USER_PASSWORD secrets we'd generate the
two setting names by adding different suffixes to the ID parameter.

Using the two different setting names automatically fixes the issues
with using the EAP Identity returned by the agent in EAP-MSCHAPv2 and
EAP-PWD.
2018-06-13 21:34:25 -05:00
Denis Kenzior
7877be328b netdev: Fix unneeded error negation
device.c expects errors to be negative for both set_powered and
set_4addr.
2018-06-13 21:25:01 -05:00
Antonio Quartulli
b415858698 device: add dbus interface for WDS property
The WDS dbus property of a Device directly maps to the 4ADDR property
of a real netdevice. It can be activated or deactivated at any point
in time.

The name WDS comes from the fact that this feature allows a STA
interface to be bridged and thus create a Wireless Distribution
System (the same name is used in OpenWRT and hostapd).

To implement this feature, the 'powered callback' data structure has
been renamed and re-used.
2018-06-13 21:16:22 -05:00
Antonio Quartulli
9476f78e2d netdev: add helper to set/unset 4ADDR property 2018-06-13 21:12:53 -05:00
Andrew Zaborowski
17ad048c8c device: On lost beacon always set roam_no_orig_ap
Even if we're already roaming or preparing to roam, setting this flag
may still affect some step of the roam sequence so set it anyway.
2018-06-13 12:13:45 -05:00
Andrew Zaborowski
660f321c3d eap-mschapv2: Fix password hash validation 2018-06-13 11:59:49 -05:00
Antonio Quartulli
896aa41082 netdev: handle netlink events on bridge ports
When a wifi interface is added/removed to/from a bridge, a
RTM_NEW/DELLINK event is issued. This is the same event used to signal
when an interface is created/deleted.

For this reason the event generated by the bridge code has to be
properly distinguished and handled accordingly. Failing to do so will
result in inconsistencies in iwd which will think an interface has been
deleted when it was actually not.

Detect incoming NEW/DELLINK bridge events and reacts accordingly. For
now, this simply means printing a simple message, as there is no
special logic in iwd for this yet.
2018-06-13 08:31:46 -05:00
James Prestwood
96374f47e5 eap-aka: added EAP reset_state 2018-06-12 11:09:10 -05:00
James Prestwood
789eb08bc9 eap-sim: added EAP reset_state 2018-06-12 11:09:10 -05:00
Denis Kenzior
e4bc7149c3 eap-tls: Implement reset_state method 2018-06-07 19:58:56 -05:00
Denis Kenzior
092ccb4372 eap-ttls: Add reset_state method 2018-06-07 19:53:42 -05:00
Denis Kenzior
1f3b120467 eap-peap: Add reset_state method 2018-06-07 19:43:25 -05:00
Denis Kenzior
6e242acddb eap-mschapv2: Implement reset_state 2018-06-07 17:10:59 -05:00
Denis Kenzior
ff7a581d36 eap: Don't destroy method on completion
Let the upper layers decide what to do when a method completes
2018-05-30 22:36:41 -05:00
Denis Kenzior
9bcb2b75ac eapol: On success, reset EAP state
Instead of destroying the EAP object, just reset its state in case the
EAP process completed successfully.  This allows EAP Reauthentication to
work.
2018-05-30 15:09:42 -05:00
Denis Kenzior
2722990e61 eap-pwd: Add .reset_state method 2018-05-30 15:04:20 -05:00
Denis Kenzior
5894051d6c eap: Introduce state reset
This is meant to reset the EAP state back to its original state without
affecting any state variables obtained through load_settings.  This can
be useful for EAP Reauthentication triggered by the AP.
2018-05-30 14:52:22 -05:00
Denis Kenzior
4c59569f0c scan: Move scan_get_security to common.c 2018-05-24 19:22:16 -05:00
Denis Kenzior
7c18e3cdfe iwd: Move network_init & network_exit to iwd.h 2018-05-24 19:22:12 -05:00
Denis Kenzior
e4ddf4cf19 ie: Add missing #include and forward declaration 2018-05-24 15:54:32 -05:00
Tim Kourt
c0daec7e8d scan: add wiphy into scan context
The added wiphy will later be used by the scan command
builder to identify the available features and get properties
2018-05-24 15:24:33 -05:00
Tim Kourt
8f17186666 scan: rename callback for the triggered scan 2018-05-24 15:24:33 -05:00
Denis Kenzior
3b4cc1bfe2 wiphy: Rename get_ext_feature API
to has_ext_feature
2018-05-24 15:24:16 -05:00
Tim Kourt
933eabb6ef wiphy: added accessor for the feature flags 2018-05-24 13:10:56 -05:00
Tim Kourt
367522fe8f netdev: added accessor for wiphy
Added an accessor to get wiphy associated with a network device
2018-05-24 13:07:00 -05:00
Denis Kenzior
e6adb36621 iwd.service: Use multi-user target 2018-05-22 11:28:02 -05:00
Denis Kenzior
2aba2f3ba9 main: Disable debug output by default
Instead use '-d' command line option.  This option uses an optional
argument.  Without an argument, '*' is assumed.  Otherwise you can
specify a glob string to match.  Any debug output that matches the glob
string will be printed.  e.g.:

src/iwd -d '*eap*'
2018-05-19 18:29:28 -05:00
James Prestwood
d54a8e56d3 netdev: print error if frame watch fails
The frame watch API had no callback, so if there was a failure
it would silently continue.
2018-05-18 12:54:40 -05:00
Denis Kenzior
6db257b937 eap: Dump unhandled EAP packets 2018-05-18 10:29:58 -05:00
Denis Kenzior
450ed03e21 eap: Fix crash
Some EAP servers might try to send us packets after the EAP connection
has been established.  When EAP succeeds we destroy the EAP object.  If
a new EAP request arrives we create a temporary EAP object to handle the
request (most likely to NAK it).  However, if the packet is not destined
to a particular method (e.g. it is a notification) the current logic can
result in a crash.

src/netdev.c:netdev_set_gtk() 3
==4300== Invalid read of size 8
==4300==    at 0x14204B: __eap_handle_request (eap.c:203)
==4300==    by 0x142339: eap_rx_packet (eap.c:287)
==4300==    by 0x12AEF9: eapol_rx_packet (eapol.c:1622)
==4300==    by 0x12BBBC: __eapol_rx_packet (eapol.c:2018)
==4300==    by 0x116D1E: netdev_pae_read (netdev.c:3121)
==4300==    by 0x16672B: io_callback (io.c:123)
==4300==    by 0x165239: l_main_iterate (main.c:376)
==4300==    by 0x16537D: l_main_run (main.c:423)
==4300==    by 0x10F95C: main (main.c:447)
==4300==  Address 0x30 is not stack'd, malloc'd or (recently) free'd
==4300==
2018-05-18 10:27:42 -05:00
Denis Kenzior
56eeaf7b7a eap: Fix invalid access
When the server sends an identity prompt or a notification, we were
trying to print from our local buffer, not from the actual packet.  The
relevant valgrind trace is:

src/netdev.c:netdev_mlme_notify() MLME notification 64
==4300== Conditional jump or move depends on uninitialised value(s)
==4300==    at 0x4C3006E: strnlen (vg_replace_strmem.c:425)
==4300==    by 0x508C513: vfprintf (vfprintf.c:1643)
==4300==    by 0x508EB75: buffered_vfprintf (vfprintf.c:2329)
==4300==    by 0x508C1A1: vfprintf (vfprintf.c:1301)
==4300==    by 0x167051: log_stderr (log.c:145)
==4300==    by 0x16756E: l_log_with_location (log.c:293)
==4300==    by 0x142173: __eap_handle_request (eap.c:235)
==4300==    by 0x142339: eap_rx_packet (eap.c:287)
==4300==    by 0x12AEF9: eapol_rx_packet (eapol.c:1622)
==4300==    by 0x12BBBC: __eapol_rx_packet (eapol.c:2018)
==4300==    by 0x116D1E: netdev_pae_read (netdev.c:3121)
==4300==    by 0x16672B: io_callback (io.c:123)
==4300==
EAP identity prompt: ""
2018-05-18 09:46:12 -05:00
John Zimmermann
3b4c1dd4d3 build: check for existence of execinfo.h
GLIBC is not necessarily the only library that provides execinfo.
With libexecinfo execinfo can be used also in other Libraries.
The patch lets the configure check the existence of the header
and the libexecinfo Library and uses them if avaible.

(also fixes compilation if execinfo is not avaible)
2018-05-17 17:42:28 -05:00
Tim Kourt
42c5d96219 network: load settings for the open networks
iwd was auto-connecting to the open networks despite having
Autoconnect=false flag set in the network configuration file.
This patch enables iwd to load the configuration files for the
open networks during the auto-connect attempt to take advantage
of the Autoconnect flag.
2018-05-10 12:47:40 -05:00
Tim Kourt
46abfc7813 wiphy: add support for MAX_NUM_SCAN_SSIDS 2018-05-08 19:17:40 -05:00
James Prestwood
2f0c37dae6 eap-pwd: use ecc byte conversion API's 2018-05-04 19:33:55 -05:00
James Prestwood
db690ebe73 ecc: added byte conversion functions
EAP-PWD was hard coded to only work on LE architectures. This
adds 2 conversion functions to go from network byte order (BE)
to any native architecture, and vise versa.
2018-05-04 19:33:55 -05:00
James Prestwood
71902e2291 eap-pwd: fix 32 bit build warnings from debug prints
Printing size_t as %lu works on 64 bit architectures but shows a
compile warning on 32 bit. The %zu modifier fixes this.
2018-05-04 12:48:02 -05:00
James Prestwood
322f32295d eap-pwd: fixup some minor bounds checking issues 2018-05-03 14:46:29 -05:00
Denis Kenzior
6a28cd5527 main: Check and print missing kernel options 2018-05-03 14:45:26 -05:00
Denis Kenzior
bfe4fcffd3 eap-mschapv2: Check for MD4 support 2018-05-03 14:45:00 -05:00
Denis Kenzior
a65e5e0800 eap-pwd: Don't leak on failure 2018-05-03 12:57:23 -05:00
Denis Kenzior
5cf358cd4f eap-pwd: Fixup minor style issues 2018-05-03 12:55:45 -05:00
James Prestwood
d10369cf60 eap-pwd: core EAP-PWD code 2018-05-03 10:50:30 -05:00
James Prestwood
fdee72dffc ecc: added ecc implementation for EAP-PWD
The file, src/ecc.c was taken from the bluez project:
https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/src/shared/ecc.c

There were minor changes made, e.g. changing some functions to globals
for access in EAP-PWD as well as removing some unneeded code. There was
also some code appended which allows for point addition, modulus inverse
as well as a function to compute a Y value given an X.
2018-05-03 10:27:53 -05:00
Denis Kenzior
b8c80060d3 wiphy: Update ext_features size 2018-05-01 20:46:06 -05:00
Denis Kenzior
92cf0446a1 netdev: Print handshake failure reason code 2018-05-01 20:46:06 -05:00
Denis Kenzior
9e8850c423 ap: Use EAPoL over NL80211 if available 2018-05-01 20:46:06 -05:00
Denis Kenzior
5d0f1bbb31 netdev: Handle Control Port TX path 2018-05-01 20:46:06 -05:00
Denis Kenzior
b5d48da4c7 netdev: Open PAE transport if needed
If Control Port over NL80211 is not supported, open up a PAE socket and
stuff it into an l_io on the netdev object.  Install a read handler on
the l_io and call __eapol_rx_packet as needed.
2018-05-01 20:46:03 -05:00
Denis Kenzior
ebc4e2cdf0 netdev: React to CONTROL_PORT unicast 2018-05-01 20:46:01 -05:00
Denis Kenzior
c31cf5d383 eapol: Fully separate eapol transport details
With the introduction of Control Port Over NL80211 feature, the
transport details need to be moved out of eapol and into netdev.c.
Whether a given WiFi hardware supports transfer of Control Port packets
over NL80211 is Wiphy and kernel version related, so the transport
decisions need to be made elsewhere.
2018-05-01 11:14:04 -05:00
Andrew Zaborowski
008965882d eap-mschapv2: Fix string start calculation 2018-04-30 10:47:31 -05:00
Andrew Zaborowski
b1d4db7cc8 eap: Return specific error when check_settings fails
Change the check_settings eap functions to return a negative errno and
return more granular Dbus error from the Connect method.
2018-04-30 10:45:28 -05:00
James Prestwood
071ef356db eap: add EAP-PWD method type 2018-04-27 11:14:30 -05:00
Andrew Zaborowski
56d3d40f30 eap: Wipe passphrase memory in TLS, TTLS, EAP
Wipe the passphrase memory in more places before freeing.
2018-04-26 11:27:22 -05:00
Andrew Zaborowski
6dc5d2c3ec eap-mschapv2: Load credentials obtained from agent
If needed load the username and password obtained from the agent and
received in the settings object.
2018-04-26 11:23:29 -05:00
Andrew Zaborowski
cb775819b8 network: Pass secrets to EAP methods
On connect add any secrets we've received through the agent to the
l_settings objects which the EAP methods will process in load_settings.
The settings object is modified but is never written to storage.  If
this was to change because some settings need to be saved to storage,
a new l_settings object might be needed with the union of the settings
from the file and the secrets so as to avoid saving the sensitive data.
2018-04-26 11:23:29 -05:00
James Prestwood
d1a13036d2 eap: fix EAP-SIM/AKA/AKA' after settings change
These EAP methods do not store the identity inside the settings file
since it is obtained from the SIM card, then provided to IWD via
get_identity method. If the get_identity method is implemented, do
not fail the settings check when EAP-Identity is missing.
2018-04-20 14:36:52 -05:00
Andrew Zaborowski
2382dc7ffa network: Validate 8021x settings and request passwords
Use eap_check_settings directly from network.c before we start the
connection attempt at netdev.c level, to obtain all of the required
passwords/passphrases through the agent.  This is in network.c because
here we can decide the policies for whether to call the agent in
autoconnect or only if we had a request from the user, also whether we
want to save any of that for later re-use (either password data or
kernel-side key serial), etc.

In this patch we save the credentials for the lifetime of the network
object in memory, and we skip the network if it requires any passphrases
we don't have while in autoconnect, same as with PSK networks where the
PSK isn't given in the settings.  Note that NetworkManager does pop up
the password window for PSK or EAP passwords even in autoconnect.

If EAP needs multiple passwords we will call the agent sequentially for
each.
2018-04-19 14:05:20 -05:00
Andrew Zaborowski
7541b595f9 eap-peap: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.  Then also call eap_check_settings to validate the inner
method's settings.
2018-04-19 13:23:03 -05:00
Andrew Zaborowski
86aa4e8af1 eap-gtc: Implement .check_settings
Only do the same validation that .load_settings would do for GTC.
2018-04-19 13:14:37 -05:00
Andrew Zaborowski
8650bddcfe eap-aka: Implement .check_settings
Also it seems aka->identity could not have been set at the time
it was used in the error message so I changed that error message
slightly.
2018-04-19 13:14:25 -05:00
Andrew Zaborowski
200312c4e5 eap-sim: Implement .check_settings 2018-04-19 13:13:58 -05:00
Andrew Zaborowski
d27b0d5b1e eap-ttls: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.  Then also call eap_check_settings to validate the inner
method's settings.
2018-04-19 13:13:07 -05:00
Andrew Zaborowski
8eea2c39d1 eap-tls: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.
2018-04-19 13:11:39 -05:00
Andrew Zaborowski
3b2b194170 eap-mschapv2: Implement .check_settings
Move the settings validation from .load_settings plus allow the
username/password to be supplied in the secrets l_queue instead of
in the l_settings.
2018-04-19 13:01:58 -05:00
Andrew Zaborowski
9134743a97 eap-md5: Implement .check_settings
Only do the same validation that .load_settings would do for MD5.
2018-04-19 13:00:44 -05:00
Andrew Zaborowski
246e76c7b0 eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any.  This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object.  We need to get all the needed EAP
credentials from the user before we even start connecting.

While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.

eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name.  The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.

Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list.  "value" is the actual value returned
by agent.  "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-19 13:00:12 -05:00
Andrew Zaborowski
15a037f633 agent: Add new request types
Add new agent.h methods and corresponding DBus methods to request
the 3 different EAP credential types from user.
2018-04-19 11:49:41 -05:00
Andrew Zaborowski
b862fd8fe1 agent: Check if callback has sent a new request
In agent_receive_reply we first call the callback for the pending
request (agent_finalize_pending) then try to send the next request
in the queue.  Check that the next request has not been sent already
which could happen if it has been just queued by the callback.
2018-04-19 11:45:03 -05:00
Andrew Zaborowski
c6e3140b38 device: Handle disconnect by AP and by SME events same way
The difference in the handlers was that in the
NETDEV_EVENT_DISCONNECT_BY_AP case we would make sure to reply
to a pending dbus Connect call.  We also need to do that for
NETDEV_EVENT_DISCONNECT_BY_SME.  This happens if another process
sends an nl80211 disconnect command while we're connecting.
2018-04-19 10:36:18 -05:00
Andrew Zaborowski
32d846470b device: Use active scans when connected
When we're connected we're advertising our hardware address anyway so
there's no benefit from using passive scanning.
2018-04-10 00:19:33 -05:00
Andrew Zaborowski
d9ae78b780 device: Drop unsupported bands from roam scan frequency set
The kernel will reject the TRIGGER_SCAN commands that include
frequencies not supported by the wiphy.
2018-04-10 00:19:30 -05:00
James Prestwood
c0739c1965 eap-gtc: add EAP-GTC method implementation 2018-04-04 09:42:28 -05:00
James Prestwood
d1c7f360d2 eap: add EAP_TYPE_GTC (6) type 2018-04-04 09:40:05 -05:00