3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-11-06 20:19:24 +01:00
Commit Graph

7239 Commits

Author SHA1 Message Date
James Prestwood
0f5da071fa auto-t: increase timeout in testPSK-roam
This was causing random failures and increasing the timeout seems
to be a lot more reliable.
2023-05-22 09:35:15 -05:00
James Prestwood
563ecc63e8 auto-t: modify PSK-roam test to use FT failure path
This adds another radio so IWD hits the FT failure path after
authentication to the first BSS fails. This causes a wiphy work
item to be rescheduled which previously was unsafe.
2023-05-22 09:35:08 -05:00
James Prestwood
23f0f5717c station: allow roaming before netconfig finishes
If IWD connects under bad RF conditions and netconfig takes
a while to complete (e.g. slow DHCP), the roam timeout
could fire before DHCP is done. Then, after the roam,
IWD would transition automatically to connected before
DHCP was finished. In theory DHCP could still complete after
this point but any process depending on IWD's connected
state would be uninformed and assume IP networking is up.

Fix this by stopping netconfig prior to a roam if IWD is not
in a connected state. Then, once the roam either failed or
succeeded, start netconfig again.
2023-05-07 18:04:08 -05:00
Denis Kenzior
6c39a2f53f AUTHORS: Mention Ronan's contributions 2023-05-07 18:03:40 -05:00
Ronan Pigott
3687f7947b client: avoid segfault in iwctl quit
iwctl quit (running quit non-interactively) isn't a useful command,
but it shouldn't segfault. Let's avoid calling readline functions if
we haven't initialized readline in this run.
2023-05-07 18:03:11 -05:00
Marcel Holtmann
68089783b6 build: Require at least libedit >= 3.1 when selected 2023-05-03 19:31:04 +02:00
Marcel Holtmann
38f5aff139 linux: Update nl80211.h from Linux 6.3 2023-05-02 20:39:32 +02:00
James Prestwood
b080854d3e dpp: fix incorrect offchannel usage as configurator
When acting as a configurator the enrollee can start on a different
channel than IWD is connected to. IWD will begin the auth process
on this channel but tell the enrollee to transition to the current
channel after the auth request. Since a configurator must be
connected (a requirement IWD enforces) we can assume a channel
transition will always be to the currently connected channel. This
allows us to simply cancel the offchannel request and wait for a
response (rather than start another offchannel).

Doing this improves the DPP performance and reduces the potential
for a lost frame during the channel transition.

This patch also addresses the comment that we should wait for the
auth request ACK before canceling the offchannel. Now a flag is
set and IWD will cancel the offchannel once the ACK is received.
2023-04-30 13:03:48 -05:00
James Prestwood
6c97ebb813 ft: fix double free when disconnecting mid-FT
If IWD gets a disconnect during FT the roaming state will be
cleared, as well as any ft_info's during ft_clear_authentications.
This includes canceling the offchannel operation which also
destroys any pending ft_info's if !info->parsed. This causes a
double free afterwards. In addition the l_queue_remove inside the
foreach callback is not a safe operation either.

To fix this don't remove the ft_info inside the offchannel
destroy callback. The info will get freed by ft_associate regardless
of the outcome (parsed or !parsed). This is also consistent with
how the onchannel logic works.

Log and crash backtrace below:

iwd[488]: src/station.c:station_try_next_transition() 5, target aa:46:8d:37:7c:87
iwd[488]: src/wiphy.c:wiphy_radio_work_insert() Inserting work item 16668
iwd[488]: src/wiphy.c:wiphy_radio_work_insert() Inserting work item 16669
iwd[488]: src/wiphy.c:wiphy_radio_work_done() Work item 16667 done
iwd[488]: src/wiphy.c:wiphy_radio_work_next() Starting work item 16668
iwd[488]: src/netdev.c:netdev_mlme_notify() MLME notification Remain on Channel(55)
iwd[488]: src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)
iwd[488]: src/netdev.c:netdev_link_notify() event 16 on ifindex 5
iwd[488]: src/netdev.c:netdev_mlme_notify() MLME notification Deauthenticate(39)
iwd[488]: src/netdev.c:netdev_deauthenticate_event()
iwd[488]: src/netdev.c:netdev_mlme_notify() MLME notification Disconnect(48)
iwd[488]: src/netdev.c:netdev_disconnect_event()
iwd[488]: Received Deauthentication event, reason: 6, from_ap: true
iwd[488]: src/station.c:station_disconnect_event() 5
iwd[488]: src/station.c:station_disassociated() 5
iwd[488]: src/station.c:station_reset_connection_state() 5
iwd[488]: src/station.c:station_roam_state_clear() 5
iwd[488]: double free or corruption (fasttop)

5  0x0000555b3dbf44a4 in ft_info_destroy ()
6  0x0000555b3dbf45b3 in remove_ifindex ()
7  0x0000555b3dc4653c in l_queue_foreach_remove ()
8  0x0000555b3dbd0dd1 in station_reset_connection_state ()
9  0x0000555b3dbd37e5 in station_disassociated ()
10 0x0000555b3dbc8bb8 in netdev_mlme_notify ()
11 0x0000555b3dc4e80b in received_data ()
12 0x0000555b3dc4b430 in io_callback ()
13 0x0000555b3dc4a5ed in l_main_iterate ()
14 0x0000555b3dc4a6bc in l_main_run ()
15 0x0000555b3dc4a8e0 in l_main_run_with_signal ()
16 0x0000555b3dbbe888 in main ()
2023-04-30 13:00:03 -05:00
Marcel Holtmann
dd1000f245 build: Only compile unit test and tools when daemon is enabled 2023-04-25 16:09:45 +02:00
Marcel Holtmann
8f0420c533 build: Allow building with libedit instead readline 2023-04-21 06:33:02 +02:00
Marcel Holtmann
8f668cc3a8 client: Use _XOPEN_SOURCE define from strptime manual page 2023-04-21 06:32:11 +02:00
James Prestwood
e13e2a5636 common: add FT-8021X-SHA384 to AKM_IS_8021X
Without this the AKM shows up as WEP.
2023-04-16 13:01:01 -05:00
James Prestwood
ad769b718b handshake: remove hardcoded kek_len for FTE decode
The KEK length should be obtained with the getter to ensure the
AKM is taken into account
2023-04-16 13:00:41 -05:00
James Prestwood
590e8f4f13 eapol: add support for FT-8021X-SHA384
The SHA384 variant was not being checked for in any of the
MIC calculations/verifications or for EAPoL decryption.
2023-04-16 12:59:54 -05:00
James Prestwood
a952cc6a47 eapol: relax (but warn) on secure bit check in handshake 1/4
Hostapd commit bc36991791 now properly sets the secure bit on
message 1/4. This was addressed in an earlier IWD commit but
neglected to allow for backwards compatibility. The check is
fatal which now breaks earlier hostapd version (older than 2.10).

Instead warn on this condition rather than reject the rekey.

Fixes: 7fad6590bd ("eapol: allow 'secure' to be set on rekeys")
2023-04-16 11:27:22 -05:00
James Prestwood
44a37d7eae hwsim: properly cleanup rules queue
After adding prefix matching the rule structure contained allocated
memory which was not being cleaned up on exit if rules still
remained in the list (removing the rule via DBus was done correctly)
2023-04-16 11:26:54 -05:00
Denis Kenzior
8465dddcab build: Drop Werror=variadic-macros
The following commit:
80db8fd86c ("build: Use -Wvariadic-macros warning")
added a warning about variadic-macros.  But it isn't quite clear why
since variadic macros are used throghout iwd.  GCC doesn't honor this
option, but clang does.  Since there's no real reason to stop using
variadic macros at this time, drop this warning.
2023-04-13 22:20:58 -05:00
Denis Kenzior
b42923dc5d treewide: Prefer flexible arrays to zero-length arrays
https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html
2023-04-13 22:20:57 -05:00
James Prestwood
e0ea324f77 band: fix HT40+/- checks when creating chandef
The HT40+/- flags were reversed when checking against the 802.11
behavior flags.

HT40+ means the secondary channel is above (+) the primary channel
therefore corresponds to the PRIMARY_CHANNEL_LOWER behavior. And
the opposite for HT40-.

Reported-By: Alagu Sankar <alagusankar@gmail.com>
2023-04-09 11:36:35 -05:00
Marcel Holtmann
53911bf8e9 Release 2.4 2023-03-27 17:35:33 +02:00
Denis Kenzior
e82dac4b2d station: Fix potential buffer overflow
Use a more appropriate printf conversion string in order to avoid
unnecessary implicit conversion which can lead to a buffer overflow.
Reasons similar to commit:
98b758f893 ("knownnetworks: fix printing SSID in hex")
2023-03-17 15:52:22 -05:00
Denis Kenzior
dc38964e42 station: Use ft_authenticate_onchannel
In the case that the FT target is on the same channel as we're currently
operating on, use ft_authenticate_onchannel instead of ft_authenticate.
Going offchannel in this case can confuse some drivers.
2023-03-01 09:35:48 -06:00
Denis Kenzior
3345c56fbb ft: Introduce ft_authenticate_onchannel
Currently when we try FT-over-Air, the Authenticate frame is always
sent via offchannel infrastructure  We request the driver to go
offchannel, then send the Authenticate frame.  This works fine as long
as the target AP is on a different channel.  On some networks some (or
all) APs might actually be located on the same channel.  In this case
going offchannel will result in some drivers not actually sending the
Authenticate frame until after the offchannel operation completes.

Work around this by introducing a new ft_authenticate variant that will
not request an offchannel operation first.
2023-03-01 09:30:24 -06:00
James Prestwood
62301b7918 ap: handle -ENOTSUP when getting the GTK
Some hardware does not support this, so use a zero RSC in this
case rather than failing the association.
2023-02-27 10:28:11 -06:00
James Prestwood
fb8ef45213 ap: check FULL_AP_CLIENT_STATE for NEW_STATION
nl80211 has a check which returns -EINVAL for NEW_STATION if this
feature is not enabled and the mask contains Authenticated/Associated
flags.
2023-02-27 10:27:39 -06:00
James Prestwood
c57071df65 ap: add DisableHT setting
This allows the user to disable HT explicitly in the AP profile
2023-02-27 10:26:26 -06:00
James Prestwood
62c99d7c33 doc: document DisableHT AP setting 2023-02-27 10:26:17 -06:00
James Prestwood
c7034aa41b netdev: check iftype in channel switch event
Some drivers send this event when starting AP mode which means
the handshake object is NULL, causing a crash.
2023-02-27 10:25:05 -06:00
James Prestwood
95652a30d1 monitor: print contents of beacon head/tail, and probe attributes 2023-02-27 10:25:05 -06:00
Denis Kenzior
e9db40bb42 AUTHORS: Mention Jiajie's contributions 2023-02-27 10:23:36 -06:00
Jiajie Chen
98b758f893 knownnetworks: fix printing SSID in hex
Force conversion to unsigned char before printing to avoid sign
extension when printing SSID in hex. For example, if there are CJK
characters in SSID, it will generate a very long string like
/net/connman/iwd/ffffffe8ffffffaeffffffa1.
2023-02-27 10:22:47 -06:00
Jiajie Chen
89309a8621 knownnetworks: fix potential out of bounds write
If a very long ssid was used (e.g. CJK characters in SSID), it might do
out of bounds write to static variable for lack of checking the position
before the last snprintf() call.
2023-02-27 10:22:34 -06:00
Denis Kenzior
5e0ff318e7 netdev: Add additional debugs 2023-02-27 10:22:13 -06:00
Denis Kenzior
17120dfc3b eapol: Add a debug to eapol_start entry point 2023-02-27 10:17:34 -06:00
Marcel Holtmann
ae0762786e Release 2.3 2023-02-02 13:55:28 +01:00
Andrew Zaborowski
ce3507558c eap-tls: Add FastReauthentication setting
Seeing that some authenticators can't handle TLS session caching
properly, allow the EAP-TLS-based methods session caching support to be
disabled per-network using a method specific FastReauthentication setting.
Defaults to true.

With the previous commit, authentication should succeed at least every
other attempt.  I'd also expect that EAP-TLS is not usually affected
because there's no phase2, unlike with EAP-PEAP/EAP-TTLS.
2023-01-30 10:19:58 -06:00
Andrew Zaborowski
5db06bf935 eap-tls: Drop cached session when phase2 fails
If we have a TLS session cached from this attempt or a previous
successful connection attempt but the overall EAP method fails, forget
the session to improve the chances that authentication succeeds on the
next attempt considering that some authenticators strangely allow
resumption but can't handle it all the way to EAP method success.
Logically the session resumption in the TLS layers on the server should
be transparent to the EAP layers so I guess those may be failed
attempts to further optimise phase 2 when the server thinks it can
already trust the client.
2023-01-30 09:42:59 -06:00
James Prestwood
967702e166 ap: correct extra IEs length calculation for WMM IE
The extra IE length for the WMM IE was being set to 26 which is
the HT IE length, not WMM. Fix this and use the proper size for
the WMM IE of 50 bytes.

This shouldn't have caused any problems prior as the tail length
is always allocated with 256 or 512 extra bytes of headroom.
2023-01-27 12:21:06 -06:00
Denis Kenzior
54a0683558 wiphy: Fix buffer overflow due to off-by-one error
Since channels numbers are used as indexes into the array, and given
that channel numbers start at '1' instead of 0, make sure to allocate a
buffer large enough to not overflow when the max channel number for a
given band is accessed.

src/manager.c:manager_wiphy_dump_callback() New wiphy phy1 added (1)
==22290== Invalid write of size 2
==22290==    at 0x4624B2: nl80211_parse_supported_frequencies (nl80211util.c:570)
==22290==    by 0x417CA5: parse_supported_bands (wiphy.c:1636)
==22290==    by 0x418594: wiphy_parse_attributes (wiphy.c:1805)
==22290==    by 0x418E20: wiphy_update_from_genl (wiphy.c:1991)
==22290==    by 0x464589: manager_wiphy_dump_callback (manager.c:564)
==22290==    by 0x4CBDDA: process_unicast (genl.c:944)
==22290==    by 0x4CC19C: received_data (genl.c:1056)
==22290==    by 0x4C7140: io_callback (io.c:120)
==22290==    by 0x4C5A97: l_main_iterate (main.c:476)
==22290==    by 0x4C5BDC: l_main_run (main.c:523)
==22290==    by 0x4C5F0F: l_main_run_with_signal (main.c:645)
==22290==    by 0x40503B: main (main.c:600)
==22290==  Address 0x4aa76ec is 0 bytes after a block of size 28 alloc'd
==22290==    at 0x48417B5: malloc (vg_replace_malloc.c:393)
==22290==    by 0x4BC4D1: l_malloc (util.c:62)
==22290==    by 0x417BE4: parse_supported_bands (wiphy.c:1619)
==22290==    by 0x418594: wiphy_parse_attributes (wiphy.c:1805)
==22290==    by 0x418E20: wiphy_update_from_genl (wiphy.c:1991)
==22290==    by 0x464589: manager_wiphy_dump_callback (manager.c:564)
==22290==    by 0x4CBDDA: process_unicast (genl.c:944)
==22290==    by 0x4CC19C: received_data (genl.c:1056)
==22290==    by 0x4C7140: io_callback (io.c:120)
==22290==    by 0x4C5A97: l_main_iterate (main.c:476)
==22290==    by 0x4C5BDC: l_main_run (main.c:523)
==22290==    by 0x4C5F0F: l_main_run_with_signal (main.c:645)
==22290==
2023-01-26 10:02:36 -06:00
Denis Kenzior
711a5ff5d1 monitor: dump IEs in FT/SAE Authenticate frames 2023-01-26 10:02:36 -06:00
Marcel Holtmann
605338f110 Release 2.2 2023-01-23 19:42:14 +01:00
Marcel Holtmann
a59a9c00fb build: Require at least version 0.56 when building with external ELL 2023-01-23 19:42:14 +01:00
Denis Kenzior
5612045407 ap: Fix member naming on big endian 2023-01-23 09:45:22 -06:00
James Prestwood
0c223892b1 doc: Document RekeyTimeout for AP profiles 2023-01-18 15:41:53 -06:00
James Prestwood
c5a281781d ap: support PTK rekeys
This adds support for rekeys to AP mode. A single timer is used and
reset to the next station needing a rekey. A default rekey timer of
600 seconds is used unless the profile sets a timeout.
2023-01-18 15:40:56 -06:00
James Prestwood
995c34450e eapol: implement rekey support for authenticator
The only changes required was to set the secure bit for message 1,
reset the frame retry counter, and change the 2/4 verifier to use
the rekey flag rather than ptk_complete. This is because we must
set ptk_complete false in order to detect retransmissions of the
4/4 frame.

Initiating a rekey can now be done by simply calling eapol_start().
2023-01-18 15:39:36 -06:00
James Prestwood
d504b74c61 manager: handle -ENODEV special in interface callback
If IWD ends up dumping wiphy's twice (because of NEW_WIPHY event
soon after initial dump) it will also try and dump interfaces
twice leading to multiple DEL_INTERFACE calls. The second attempt
will fail with -ENODEV (since the interface was already deleted).
Just silently fail with this case and let the other DEL_INTERFACE
path handle the re-creation.
2023-01-17 13:11:53 -06:00
James Prestwood
6957b5fdf0 wiphy: prevent multiple wiphy registrations
With really badly timed events a wiphy can be registered twice. This
happens when IWD starts and requests a wiphy dump. Immediately after
a NEW_WIPHY event comes in (presumably when the driver loads) which
starts another dump. The NEW_WIPHY event can't simply be ignored
since it could be a hotplug (e.g. USB card) so to fix this we can
instead just prevent it from being registered.

This does mean both dumps will happen but the information will just
be added to the same wiphy object.
2023-01-17 13:11:38 -06:00
James Prestwood
d8ca993a1c station: cancel roam timer when FT starts
Past commits should address any potential problems of the timer
firing during FT, but its still good practice to cancel the timer
once it is no longer needed, i.e. once FT has started.
2023-01-13 17:00:26 -06:00