3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-11-22 14:49:24 +01:00
Commit Graph

3863 Commits

Author SHA1 Message Date
Denis Kenzior
2f1c2930f0 station: Add dependency on known_networks module
The previous commit added an invocation of known_networks_watch_add, but
never updated the module dependency graph.

Fixes: a793a41662 ("station, eapol: Set up eap-tls-common for session caching")
2022-11-17 10:17:07 -06:00
Andrew Zaborowski
a793a41662 station, eapol: Set up eap-tls-common for session caching
Use eap_set_peer_id() to set a string identifying the TLS server,
currently the hex-encoded SSID of the network, to be used as group name
and primary key in the session cache l_settings object.  Provide pointers
to storage_eap_tls_cache_{load,sync} to eap-tls-common.c using
eap_tls_set_session_cache_ops().  Listen to Known Network removed
signals and call eap_tls_forget_peer() to have any session related to
the network also dropped from the cache.
2022-11-17 10:09:54 -06:00
Andrew Zaborowski
ef81917e8d eap-tls: Add session caching
Use l_tls_set_session_cache() to enable session cache/resume in the
TLS-based EAP methods.  Sessions for all 802.1x networks are stored in
one l_settings object.

eap_{get,set}_peer_id() API is added for the upper layers to set the
identifier of the authenticator (or the supplicant if we're the
authenticator, if there's ever a use case for that.)

eap-tls-common.c can't call storage_eap_tls_cache_{load,sync}()
or known_networks_watch_add() (to handle known network removals) because
it's linked into some executables that don't have storage.o,
knownnetworks.o or common.o so an upper layer (station.c) will call
eap_tls_set_session_cache_ops() and eap_tls_forget_peer() as needed.
2022-11-17 10:04:56 -06:00
Andrew Zaborowski
e63c5bf4f8 storage: Refactor storage_tls_session_{load,sync}
Minor changes to these two methods resulting from two rewrites of them.
Actual changes are:
 * storage_tls_session_sync parameter is const,
 * more specific naming,
 * storage_tls_session_load will return an empty l_settings instead of
   NULL so eap-tls-common.c doesn't have to handle this.

storage.c makes no assumptions about the group names in the l_settings
object and keeps no reference to that object, eap-tls-common.c is going
to maintain the memory copy of the cache since this cache and the disk
copy of it are reserved for EAP methods only.
2022-11-17 10:04:12 -06:00
Marcel Holtmann
b4406cce82 scan: Add support for separate 6Ghz band modifier 2022-11-14 11:07:10 -06:00
Andrew Zaborowski
644586e273 storage: Add TLS session cache file read/write utils
Add storage_tls_session_cache_{load,sync} similar to
storage_known_frequencies_{load,sync}.
2022-11-09 14:26:38 -06:00
James Prestwood
55924fbb56 ap: change PairwiseCiphers to string array
A comma separated list as a string was ok for pure display purposes
but if any processing needed to be done on these values by external
consumers it really makes more sense to use a DBus array.
2022-11-04 12:03:27 -05:00
James Prestwood
606769dbea ap: update Scanning property when AP starts
This wasn't being updated meaning the property is missing until a
scan is issued over DBus.

Rather than duplicate all the property changed calls they were all
factored out into a helper function.
2022-11-04 12:02:52 -05:00
James Prestwood
c89c37378b netconfig: add global MulticastDNS option
Adds the MulticastDNS option globally to main.conf. If set all
network connections (when netconfig is enabled) will set mDNS
support into the resolver. Note that an individual network profile
can still override the global value if it sets MulticastDNS.
2022-11-03 14:02:31 -05:00
James Prestwood
b627f99800 ap: update Frequency property on started
This was forgotten when adding the property
2022-11-03 09:23:24 -05:00
James Prestwood
0363d51c5c ap: add PairwiseCiphers/GroupCipher to dbus interface
Expose these values on the DBus interface so clients can view them.
2022-11-03 09:22:56 -05:00
James Prestwood
2b64b493d0 doc: document PairwiseCiphers/GroupCiphers AP settings 2022-11-03 09:22:33 -05:00
James Prestwood
7d4d868236 p2p: limit ciphers to CCMP
The limitation of cipher selection in ap.c was done so to allow p2p to
work. Now with the ability to specify ciphers in the AP config put the
burden on p2p to limit ciphers as it needs which is only CCMP according
to the spec.
2022-11-03 09:22:16 -05:00
James Prestwood
262685e818 ap: add profile settings PairwiseCiphers/GroupCipher
These can now be optionally provided in an AP profile and provide a
way to limit what ciphers can be chosen. This still is dependent on
what the hardware supports.
2022-11-03 09:21:39 -05:00
James Prestwood
5f84a78638 ie: add group/pairwise lists of supported ciphers
The validation of these ciphers for station is done when parsing
the BSS RSNE but for AP mode there is no such validation and
potentially any supported cipher could be chosen, even if its
incompatible for the type of key.
2022-11-03 09:21:33 -05:00
James Prestwood
a4678949f9 wiphy: add wiphy_get_supported_ciphers
Similar to wiphy_select_cipher but returns all supported ciphers
included in the mask rather than just one.
2022-11-03 09:21:27 -05:00
James Prestwood
069d6d1d9c json: update internal type definition to match JSMN
Fixes: ceda955ba7 ("shared: Update JSMN to latest version")
2022-11-02 15:02:58 -05:00
Marcel Holtmann
4ffcde8125 json: Set defines before including shared/jsmn.h 2022-11-02 11:25:35 +01:00
James Prestwood
d4da6b5bec netdev: parse michael MIC failure message
This event indicates a security issue. The proper handling would be
to rekey but for now at least provide some information to the user.
2022-11-01 15:56:20 -05:00
James Prestwood
9f1fa53aae nl80211util: add key type/idx to nl80211_parse_attrs 2022-11-01 15:56:17 -05:00
James Prestwood
53469c5c0d netdev: fix key setting for authenticators
The netdev_copy_tk function was being hard coded with authenticator
set to false. This isn't important for any ciphers except TKIP but
now that AP mode supports TKIP it needs to be fixed.
2022-11-01 15:52:56 -05:00
James Prestwood
707b12abf8 netdev: add more info to key setting debug messages
Specify that the ifindex is being printed and print the key ID
as well.
2022-11-01 15:52:39 -05:00
James Prestwood
0f95c97649 ap: add frequency to AP interface 2022-11-01 15:48:59 -05:00
James Prestwood
5d8b86ff7c eapol: add TKIP support in AP mode
Though TKIP is deprecated and insecure its trivial to support it in
AP mode as we already do in station. This is only to allow AP mode
for old hardware that may only support TKIP. If the hardware supports
any higher level cipher that will be chosen automatically.
2022-10-26 14:20:25 -05:00
James Prestwood
4da101da92 eapol: choose key descriptor version in AP mode
The key descriptor version was hard coded to HMAC_SHA1_AES which
is correct when using IE_RSN_AKM_SUITE_PSK + CCMP. ap.c hard
codes the PSK AKM but still uses wiphy to select the cipher. In
theory there could be hardware that only supports TKIP which
would then make IWD non-compliant since a different key descriptor
version should be used with PSK + TKIP (HMAC_MD5_ARC4).

Now use a helper to sort out which key descriptor should be used
given the AKM and cipher suite.
2022-10-26 14:18:00 -05:00
Andrew Zaborowski
639e2a6fa3 netconfig: Avoid generating events after netconfig_reset
Similarly to l_netconfig track whether IWD's netconfig is active (from
the moment of netconfig_configure() till netconfig_reset()) using a
"started" flag and avoid handling or emitting any events after "started"
is cleared.

This fixes an occasional issue with the Netconfig Agent backend where
station would reset netconfig, netconfig would issue DBus calls to clear
addresses and routes, station would go into DISCONNECTING, perhaps
finish and go into DISCONNECTED and after a while the DBus calls would
come back with an error which would cause a NETCONFIG_EVENT_FAILED
causing station to call netdev_disconnct() for a second time and
transition to and get stuck in DISCONNECTING.
2022-10-26 14:16:22 -05:00
Andrew Zaborowski
72c2a94df9 netconfig: Print addresses added and removed to debug log 2022-10-26 14:15:59 -05:00
Denis Kenzior
75ec7d8076 ap: Limit pairwise and group ciphers to CCMP|TKIP 2022-10-26 14:14:39 -05:00
Denis Kenzior
7584b38562 wiphy: Support more group management cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
d1acc80331 netdev: Support more IGTK cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
17131c860a ie: Support more group management cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
ecadc72bcd wiphy: Support GCMP|CCMP-256 cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
fb9bcdadec station: Use IE_CIPHER_IS_GCMP_CCMP 2022-10-24 11:05:24 -05:00
Denis Kenzior
e61cada28f ie: Add IE_CIPHER_IS_GCMP_CCMP inline
Similar to IE_AKM_IS_* functions
2022-10-24 11:05:24 -05:00
Denis Kenzior
b3c3b08785 netdev: Add support for CCMP|GCMP-256
These are similar to CCMP/GCMP, just a different key size which is
already taken care of by calling crypto_cipher_key_len
2022-10-24 11:05:24 -05:00
Denis Kenzior
5998043bd2 ie: Add support for GCMP|CCMP-256 2022-10-24 11:05:24 -05:00
Denis Kenzior
8799d5a393 station: diagnostic: implement PairwiseCipher 2022-10-24 11:05:24 -05:00
Denis Kenzior
81b9eb515e wiphy: Support GCMP cipher suite 2022-10-24 11:05:24 -05:00
Denis Kenzior
4c30bd68ea wiphy: Generalize supported cipher dumper
To make it easier to support additional ciphers in the future.
2022-10-24 11:05:24 -05:00
Denis Kenzior
8040826079 ie: add ie_rsn_cipher_suite_to_string 2022-10-24 11:05:24 -05:00
Denis Kenzior
150856c315 ie: Add support for GCMP cipher suite 2022-10-24 11:05:24 -05:00
Denis Kenzior
d643964fed netdev: Add support for setting GCMP keys 2022-10-24 11:05:24 -05:00
Denis Kenzior
7ab97db9a9 netdev: Build RSN attributes in a common function
Both CMD_ASSOCIATE and CMD_CONNECT paths were using very similar code to
build RSN specific attributes.  Use a common function to build these
attributes to cut down on duplicated code.

While here, also start using ie_rsn_cipher_suite_to_cipher instead of
assuming that the pairwise / group ciphers can only be CCMP or TKIP.
2022-10-24 11:05:24 -05:00
Denis Kenzior
59ace1b691 ie: Skip unknown pairwise ciphers 2022-10-24 11:05:24 -05:00
Denis Kenzior
ec3085e932 crypto: Add new cipher definitions 2022-10-24 11:05:24 -05:00
Denis Kenzior
f1a713a0fa ie: Simplify implementation
Instead of copy-pasting the same basic operation (memcpy & assignment),
use a goto and a common path instead.  This should also make it easier
for the compiler to optimize this function.
2022-10-24 11:05:24 -05:00
Denis Kenzior
94ecdc799a ie: Rename _BIP to _BIP_CMAC 2022-10-24 11:05:24 -05:00
Denis Kenzior
201b85e8da crypto: Rename BIP to BIP_CMAC
To match the spec more closely.  Several additional BIP algorithms are
being introduced, including BIP_GMAC_128|256 and BIP_CMAC_256.
2022-10-24 11:05:24 -05:00
Denis Kenzior
b85b92b3ee eapol: More strictly validate key_descriptor_version 2022-10-24 11:05:24 -05:00
Denis Kenzior
7f2aa40bba ap: Fix spurious warning message
The warning message would be printed even if no setting was present

Fixes: ac976c6f71 ("ap: Remove support for deprecated APRanges setting")
2022-10-24 11:05:24 -05:00