3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 13:02:44 +01:00
Commit Graph

3626 Commits

Author SHA1 Message Date
Andrew Zaborowski
2c33cf2b33 scan: Reset sp.timeout in destroy callback 2019-05-01 11:47:50 -05:00
Andrew Zaborowski
09e31282b3 scan: Drop check that always true 2019-05-01 11:45:41 -05:00
Andrew Zaborowski
32dc69ffab scan: Add static qualifiers, remove initializers 2019-05-01 11:45:25 -05:00
Marcel Holtmann
35743fa32a eap: Use l_malloc to avoid variable-length array bound is unknown error 2019-04-30 17:11:39 +02:00
Marcel Holtmann
1ca82f4e49 monitor: Fix length parameter of strncpy for kernel names 2019-04-30 16:59:28 +02:00
James Prestwood
6ac189315a eapol: allow FILS PTK rekeys
As with FILS GTK rekeys, the PTK rekeys use AES-SIV to encrypt and
do not use a MIC
2019-04-26 16:06:53 -05:00
James Prestwood
83212f9b23 eapol: change eapol_create_common to support FILS
FILS needs to allocate an extra 16 bytes of key data for the AES-SIV
vector. Instead of leaving it up to the caller to figure this out (as
was done with the GTK builder) eapol_create_common can allocate the
extra space since it knows the MIC length.

This also updates _create_gtk_2_of_2 as it no longer needs to create
an extra data array.
2019-04-26 14:00:12 -05:00
James Prestwood
4209837c0d auto-t: update testFILS to do PTK rekeys 2019-04-26 12:40:13 -05:00
James Prestwood
00cbd171f1 fils: add support for PMKID derivation
FILS defines its own derivation for the PMKID, which is just a
SHA256 or SHA384 hash of the ERP data. Setting the PMKID will
allow FILS PTK rekeys.
2019-04-26 12:40:02 -05:00
James Prestwood
4f7d7684a3 eapol: add common function for AES-SIV
To avoid duplicate code in PTK/GTK rekeys a common function was
added which performs the encryption in place in the key frame.
2019-04-26 12:36:37 -05:00
James Prestwood
2fd755c285 eapol: update eapol_key_handle to work with FILS rekeys
Since FILS does not use a MIC, the 1/4 handler would always get called
for FILS PTK rekeys. We can use the fact that message 1/4 has no MIC as
well as no encrypted data to determine which packet it is. Both no MIC
and no encrypted data means its message 1/4. Anything else is 3/4.
2019-04-26 12:35:53 -05:00
James Prestwood
a70ef82432 unit: update test-{crypto,eapol} with PTK changes
Updated to use l_checksum_type instead of boolean
2019-04-26 12:31:04 -05:00
James Prestwood
028e755d42 handshake: allow SHA384 PTK derivation (for FILS)
For FILS rekeys, we still derive the PTK using the 4-way handshake.
And for FILS-SHA384 we need the SHA384 KDF variant when deriving.

This change adds both FILS-SHA256 and FILS-SHA384 to the checks
for determining the SHA variant.
2019-04-26 12:28:51 -05:00
James Prestwood
62097e7d82 crypto: allow PTK derivation using SHA384
crypto_derive_pairwise_ptk was taking a boolean to decide whether to
use SHA1 or SHA256, but for FILS SHA384 may also be required for
rekeys depending on the AKM.

crypto_derive_pairwise_ptk was changed to take l_checksum_type instead
of a boolean to allow for all 3 SHA types.
2019-04-26 12:28:40 -05:00
James Prestwood
e999aa02a1 unit: update test-eapol with _verify_ptk_3_of_4 change 2019-04-26 12:24:53 -05:00
James Prestwood
733679ff7f eapol: Update _verify_ptk_3_of_4 to work with no MIC
A similar change was made to _verify_gtk_1_of_2 in order for
verification to work when no MIC is being used (FILS rekeys)
2019-04-26 12:24:42 -05:00
James Prestwood
8ceb4a31ef ie: remove unused struct declaration 2019-04-26 12:23:36 -05:00
James Prestwood
a6d7907a61 auto-t: fix FILS-384 autotest
This new test was merged during the time when testutil was not working
properly, so it was never verified to work with respect to testutil
(testing for 'connected' has always worked).

Since testFILS has 2 hostapd interfaces test_interface_connected was
defaulting to the incorrect interface for the SHA384 test. Now, the
explicit interfaces are passed in when checking for connectivity.
2019-04-26 12:22:58 -05:00
James Prestwood
78b5f56516 ap: update to use new TLV builder APIs
AP still relies on the get_data/set_length semantics. Its more convenient
to still use these since it avoids the need for extra temporary buffers
when building the rates IE.
2019-04-23 12:56:20 -05:00
James Prestwood
856b21d9ba fils: update TLV builder code to use new APIs 2019-04-23 12:56:20 -05:00
James Prestwood
a89e064d91 unit: update test-ie to use new builder APIs 2019-04-23 12:56:20 -05:00
James Prestwood
d2e7d47c84 ie: fix ie_tlv_builder semantics
The TLV builder APIs were not very intuative, and in some (or all)
cases required access to the builder structure directly, either to
set the TLV buffer or to get the buffer at the end.

This change adds a new API, ie_tlv_builder_set_data, which both sets
the length for the current TLV and copies the TLV data in one go.
This will avoid the need for memcpy(ie_tlv_builder_get_data(...),...)

ie_tlv_builder_finalize was also changed to return a pointer to the
start of the build buffer. This will eliminate the need to access
builder.tlv after building the TLVs.

ie_tlv_builder_init was changed to take an optional buffer to hold
the TLV data. Passing NULL/0 will build the TLV in the internal
buffer. Passing in a pointer and length will build into the passed
in buffer.
2019-04-23 12:56:20 -05:00
Andrew Zaborowski
1521b57ec9 autotests: Use device.name instead of a hardcoded interface 2019-04-22 18:20:06 -05:00
Andrew Zaborowski
c73575585b autotests: Remove del wd at the end function pattern
Don't use del wd to dereference the IWD instance at the end of the function
where it has been defined in the first place as at this point wd is about
to have its reference count decreased anyway (the variable's scope is
ending) so it's pointless (but didn't hurt).

Relying on the __del__ destructor to kill the IWD process in those tests
it has been started in the constructor is a bit of a hack in the first
place, because the destructor is called on garbage collection and even
through CPython does this on the refcount reaching 0, this is not
documented and there's no guideline on when it should happen or if it
should happen at all.  So it could be argued that we should keep the del
wd statemenets to be able to easily replace all of them with a call to a
new method.  But most of them are not placed so that they're guaranteed
to happen on test success or failure.  It would probably be easier to do
this and other housekeeping in a base class and make the tests its
subclasses.  Also some of these tests don't really need to launch iwd
themselves, since IWD now tracks changes in the known network files I
think IWD only really needs to be killed between tests when main.conf
changes.
2019-04-22 18:20:01 -05:00
Andrew Zaborowski
f456ac49dc autotests: Use hostapd_map in place of wiphy_map
In the tests that only want to iterate over the hostapd interfaces,
simplify the pattern of walking through the whole wiphy_map tree by
instead using the hostapd_map variable which is already filtered to only
contain hostapd interfaces.
2019-04-22 18:16:14 -05:00
Andrew Zaborowski
576d8ad123 autotests: In testutil obtain interface list dynamically
For the interface connectivity tests obtain the lists of interfaces in
use directly from the IWD class, which has the current list from DBus
properties.
2019-04-22 18:16:11 -05:00
Andrew Zaborowski
14d69873b0 wiphy: Add wiphy_create_complete
Let manager.c signal to wiphy.c when the wiphy parsing from the genl
messages is complete.  When we query for existing wiphy using the
GET_WIPHY dump command we get many genl messages per wiphy, on a
notification we only get one message.  So after wiphy_create there may
be one or many calls to wiphy_update_from_genl.  wiphy_create_complete
is called after all of them, so wiphy.c can be sure it's done with
parsing the wiphy attributes when in prints the new wiphy summary log
message, like it did before manager.c was added.

I had wrongly assumed that all the important wiphy attributes were in
the first message in the dump, but NL80211_ATTR_EXT_FEATURES was not and
wasn't being parsed which was breaking at least testRSSIAgent.
2019-04-22 16:34:51 -05:00
Andrew Zaborowski
0a196025f2 autotests: Remove unneded loops
The hostapd_map dictionary is indexed by the interface name so there's
no point iterating over it to find that entry whose name matches, we can
look up by the name directly.  Simplify code.
2019-04-22 16:34:36 -05:00
Andrew Zaborowski
e13c749d1e autotests: Update the wiphy_map and hostapd_map structs
In the test utilties updated the wiphy_map struct built from the
TEST_WIPHY_LIST variable to parse the new format and to use a new
structure where each wiphy is a namedtuple and each interface under it
also contains a reference to that wiphy.  The 'use' field is now
assigned to the wiphy instead of to the interface.
2019-04-22 16:34:17 -05:00
Andrew Zaborowski
d1c4921b86 test-runner: Only create/remove interfaces for hostapd
Move the interface creation code from configure_hw_radios to
configure_hostapd_instaces so as not to create unneeded interfaces on
the wiphys that IWD is going to manage.  We pass a wiphy whitelist to
IWD later and IWD now creates the interfaces it needs on those managed
wiphys.  Change TEST_WIPHY_LIST format to only include the interface
name for the wiphys used by hostapd.

Note that we still remove interfaces just before removing the hwsim
radios on exit, it seems like there's no point removing the interfaces
in that case.
2019-04-22 16:33:40 -05:00
Andrew Zaborowski
20faa37467 test-runner: Futher fix for the SETUP group support
Drop a pointless asignment of has_hw_conf to false when it's already
false, fix index when accessing radio_conf_list.  Apparently the SETUP
group is not used in any of our test and wasn't tested itself so could
as well have removed the code.
2019-04-22 16:33:40 -05:00
Andrew Zaborowski
1462d68eb6 test-runner: Check radio_conf_list is not null
The option may be present but may not parse correctly as a list in which
case has_hw_conf will be true but radio_conf_list will be NULL and we
might crash.
2019-04-22 16:33:40 -05:00
Andrew Zaborowski
fcd5b8b54f test-runner: Drop unused wiphy.interface_index 2019-04-22 16:33:16 -05:00
James Prestwood
6ea74d77cc eap-sim: derive session-ID for ERP 2019-04-22 16:31:19 -05:00
James Prestwood
2cbdc1aa43 eap-aka: derive Session-ID for ERP 2019-04-22 16:31:14 -05:00
James Prestwood
00bbc62dfb auto-t: FILS autotest 2019-04-22 16:27:25 -05:00
James Prestwood
0a1f6a1d7c unit: update test-sae to free SM
This unit test was relying on the bad behavior of SAE to
free the SM internally. Now we explicitly free the SM in
each test.
2019-04-22 16:26:11 -05:00
James Prestwood
e7219cbcc5 netdev: free SAE SM once protocol has completed
SAE was behaving inconsitently with respect to freeing the state.
It was freeing the SM internally on failure, but requiring netdev
free it on success.

This removes the call to sae_sm_free in sae.c upon failure, and
instead netdev frees the SM in the complete callback in all cases
regardless of success or failure.
2019-04-22 16:26:11 -05:00
James Prestwood
ea571bc6ac netdev: free OWE SM once protocol has completed
The OWE SM is not needed once the OWE protocol completes. We can
free it immediately in netdev_owe_complete (unless retrying).
2019-04-22 16:25:31 -05:00
James Prestwood
5cc0148e7f station: enable FILS support
station will now check if ERP has cached keys for FILS when building
the handshake, as well as get the ERP cache and set it into the
handshake object.
2019-04-22 14:56:48 -05:00
James Prestwood
b125976fea netdev: add FILS support
From netdev's prospective FILS works the same as OWE/SAE where we create
a fils_sm and forward all auth/assoc frames into the FILS module. The
only real difference is we do not start EAPoL once FILS completes.
2019-04-22 14:55:41 -05:00
James Prestwood
73c9a126bd fils: implementation for FILS
FILS (Fast Initial Link Setup) allows a station to negotiate a PTK during
authentication and association. This allows for a faster connection as
opposed to doing full EAP and the 4-way. FILS uses ERP (EAP Reauth Protocol)
to achieve this, but encapsulates the ERP data into an IE inside
authenticate frames. Association is then used to verify both sides have
valid keys, as well as delivering the GTK/IGTK.

FILS will work similar to SAE/OWE/FT where netdev registers a fils_sm, and
then forwards all Auth/Assoc frame data to and from the FILS module.
2019-04-22 14:55:02 -05:00
James Prestwood
91cdd86e0d handshake: add ERP cache object to handshake
Keeping the ERP cache on the handshake object allows station.c to
handle all the ERP details and encapsulate them into a handshake.
FILS can then use the ERP cache right from the handshake rather
than getting it itself.
2019-04-22 14:55:02 -05:00
James Prestwood
bc7b12d1a4 wiphy: handle FILS AKMs
wiphy_select_akm needed to be updated to take a flag, which can be
set to true if there are known reauth keys for this connection. If
we have reauth keys, and FILS is available we will choose it.
2019-04-19 15:05:23 -05:00
James Prestwood
0ffc5af09c auto-t: add group renegotiate test to OWE 2019-04-19 13:52:31 -05:00
James Prestwood
b829daaab7 owe: fix group renegotiation to not reauthenticate
If the AP send an associate with an unsupported group status, OWE
was completely starting over and sending out an authenticate frame
when it could instead just resend the associate frame with a
different group.
2019-04-19 13:52:28 -05:00
James Prestwood
17e3a5ee3c handshake: add setter for PTK
With FILS support coming there needs to be a way to set the PTK directly.
Other AKMs derive the PTK via the 4-way handshake, but FILS computes the
PTK on its own.
2019-04-18 10:55:24 -05:00
Denis Kenzior
b768e26f1d Revert "mschaputil: use util_get_username"
This reverts commit 1e337259ce.

Using util_get_username was wrong in this context.  MSCHAPv2 expects us
to only strip the domain name from identities of the form
domain\identity.  util_get_username would also strip identities of the
form username@domain.com.
2019-04-18 10:46:56 -05:00
James Prestwood
349acf292f eapol: fix kek length for FILS rekeys (SHA384)
FILS-SHA384 got overlooked and the kek length was being hard coded
to 32 bytes when encrypting the key data. There was also one occurence
where the kek_len was just being set incorrectly.
2019-04-17 19:33:55 -05:00
James Prestwood
e940fc9282 handshake: add handshake_state_get_kek_len 2019-04-17 19:33:51 -05:00