3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-10-30 00:29:23 +01:00
Commit Graph

218 Commits

Author SHA1 Message Date
Denis Kenzior
af375a1cde scan: Don't crash on scan_cancel
If scan_cancel is called on a scan_request that is 'finished' but with
the GET_SCAN command still in flight, it will trigger a crash as
follows:
Received Deauthentication event, reason: 2, from_ap: true
src/station.c:station_disconnect_event() 11
src/station.c:station_disassociated() 11
src/station.c:station_reset_connection_state() 11
src/station.c:station_roam_state_clear() 11
src/scan.c:scan_cancel() Trying to cancel scan id 6 for wdev 200000002
src/scan.c:scan_cancel() Scan is at the top of the queue, but not triggered
src/scan.c:get_scan_done() get_scan_done
Aborting (signal 11) [/home/denkenz/iwd-master/src/iwd]
++++++++ backtrace ++++++++
 #0  0x7f9871aef3f0 in /lib64/libc.so.6
 #1  0x41f470 in station_roam_scan_notify() at /home/denkenz/iwd-master/src/station.c:2285
 #2  0x43936a in scan_finished() at /home/denkenz/iwd-master/src/scan.c:1709
 #3  0x439495 in get_scan_done() at /home/denkenz/iwd-master/src/scan.c:1739
 #4  0x4bdef5 in destroy_request() at /home/denkenz/iwd-master/ell/genl.c:676
 #5  0x4c070b in l_genl_family_cancel() at /home/denkenz/iwd-master/ell/genl.c:1960
 #6  0x437069 in scan_cancel() at /home/denkenz/iwd-master/src/scan.c:842
 #7  0x41dc2e in station_roam_state_clear() at /home/denkenz/iwd-master/src/station.c:1594
 #8  0x41dd2b in station_reset_connection_state() at /home/denkenz/iwd-master/src/station.c:1619
 #9  0x41dea4 in station_disassociated() at /home/denkenz/iwd-master/src/station.c:1644

The happens because get_scan_done callback is still called as a result of
l_genl_cancel.  Add a re-entrancy guard in the form of 'canceled'
variable in struct scan_request.  If set, get_scan_done will skip invoking
scan_finished.

It isn't clear what 'l_queue_peek_head() == results->sr' check was trying
to accomplish.  If GET_SCAN dump was scheduled, then it should be
reported.  Drop it.
2022-01-19 16:37:21 -06:00
Denis Kenzior
e1593df4bd scan: Call scan_finished if results->sr is NULL
results->sr is set to NULL for 'opportunistic' scans which were
triggered externally.  See scan_notify() for details.  However,
get_scan_done would only invoke scan_finished (and thus the periodic
scan callback sc->sp.callback) only if the scan queue was empty.  It
should do so in all cases.
2022-01-19 16:37:21 -06:00
Denis Kenzior
44a7bc640b scan: Remove work_started variable
With the introduction of wiphy_radio_work_is_running we no longer need
to track this separately.
2022-01-18 13:04:12 -06:00
James Prestwood
34348fcb42 scan: don't print notification if sc is not found
If this scan is not for any IWD wdev's don't print
2022-01-12 12:46:15 -06:00
James Prestwood
217bb6dc65 scan: don't special case periodic scan work
Periodic scans were handled specially where they were only
started if no other requests were pending in the scan queue.
This is fine, and what we want, but this can actually be
handled automatically by nature of the wiphy work queue rather
than needing to check the request queue explicitly.

Instead we can insert periodic scans at a lower priority than
other scans. This puts them at the end of the work queue, as
well as allows future requests to jump ahead if a periodic scan
has not yet started.

Eventually, once all pending scans are done, the peridoic scan
may begin. This is no different than the preivous behavior and
avoids the need for any special checks once scan requests
complete.

One check was added to address the problem of the periodic scan
timer firing before the scan could even start. Currently this
happened to be handled fine in scan_periodic_queue, as it checks
the queue length. Since this check was removed we must see check
for this condition inside scan_periodic_timeout.
2022-01-11 12:37:13 -06:00
James Prestwood
c7a6730d28 scan: set scan priority via scan_common
This adds a priority argument to scan_common rather than hard
coding it when inserting the work item and uses the newly
defined wiphy priority for scanning.
2022-01-11 12:36:36 -06:00
Denis Kenzior
372a1c05e6 scan: Simplify debug statement
l_debug will already print the function name, so including it in the
printed string is redundant
2022-01-11 11:07:33 -06:00
Denis Kenzior
5cb7591bc0 treewide: Use __func__ when possible
Instead of hard-coding the function name in l_warn/l_error statements,
use '__func__'
2022-01-11 11:07:33 -06:00
Denis Kenzior
fe95cbe077 treewide: Various style fixups
- Mostly problems with whitespace:
	- Use of spaces instead of tabs
	- Stray spaces before closing ')
	- Missing spaces

- Missing 'void' from function declarations & definitions that
  take no arguments.

- Wrong indentation level
2022-01-11 11:07:05 -06:00
James Prestwood
967c95829f scan: fix double space 2022-01-11 08:57:05 -06:00
James Prestwood
9c732cb32d scan: move scan_freq_set* into util
This will allow scan_freq_set utilities to be used in any
modules requiring unit testing
2021-11-30 12:29:06 -06:00
James Prestwood
24494e978c scan: remove scan APIs refactored into band.c 2021-11-29 17:08:32 -06:00
James Prestwood
56ea2c4d15 treewide: update scan utility usage to use band_* 2021-11-29 17:07:44 -06:00
James Prestwood
945710fae1 scan: parse configurator connectivity element
This element has no data and indicates the AP supports configuring
stations via DPP while also serving current stations.
2021-11-29 17:03:31 -06:00
James Prestwood
ea23556a40 scan: use signal strength if bss ranks are equal
If two BSS's end up with the same rank sort them based on signal
strength so IWD still prefers the higher strength BSS.
2021-11-08 13:49:50 -06:00
James Prestwood
d4e3ec52b2 scan: keep track of HS20 DGAF Disable bit in scan_bss 2021-11-04 14:29:46 -05:00
James Prestwood
6852cf0a3e ie: parse DGAF Disable bit from HS20 indication element 2021-11-04 14:29:25 -05:00
James Prestwood
fd85192a54 scan: parse Proxy ARP bit from extended capabilities 2021-11-04 14:27:55 -05:00
James Prestwood
885c4c9632 scan: use oper_class/channel for OWE hidden scans
If these are included in the OWE transition IE use them to scan
for the OWE hidden network.
2021-09-22 14:40:10 -05:00
James Prestwood
e798d4fe9d scan: validate OWE transition operating class/channel
If the IE's operating class and channel doesn't validate don't bother
storing the IE at all.
2021-09-22 14:39:33 -05:00
James Prestwood
22ff2a5f79 scan: use structure for OWE transition parsing
This changes scan_bss from using separate members for each
OWE transition element data type (ssid, ssid_len, and bssid)
to a structure that holds them all.

This is being done because OWE transition has option operating
class and channel bytes which will soon be parsed. This would
end up needing 5 separate members in scan_bss which is a bit
much for a single IE that needs to be parsed.

This makes checking the presense of the IE more convenient
as well since it can be done with a simple NULL pointer check
rather than having to l_memeqzero the BSSID.
2021-09-22 13:52:44 -05:00
James Prestwood
a6c4972290 scan: add scan API specifically for OWE transition networks
Specifically OWE networks with multiple open/hidden BSS's are troublesome
to scan for with the current APIs. The scan parameters are limited to a
single SSID and even if that was changed we have the potential of hitting
the max SSID's per scan limit. In all, it puts the burden onto the caller
to sort out the SSIDs/frequencies to scan for.

Rather than requiring station to handle this a new scan API was added,
scan_owe_hidden() which takes a list of open BSS's and will automatically
scan for the SSIDs in the OWE transition IE for each.

It is slightly optimized to first check if all the hidden SSID's are the
same. This is the most likely case (e.g. single pair or single network)
and a single scan command can be used. Otherwise individual scan commands
are queued for each SSID/frequency combo.
2021-09-17 17:59:43 -05:00
James Prestwood
a94c0ed29e scan: keep track of OWE Transition element 2021-09-16 11:21:32 -05:00
James Prestwood
df6221bcb2 scan: allow non-utf8 SSIDs to be scanned for
IWD has restricted SSIDs to only utf8 so they can be displayed but
with the addition of OWE transition networks this is an unneeded
restriction (for these networks). The SSID of an OWE transition
network is never displayed to the user so limiting to utf8 isn't
required.

Allow non-utf8 SSIDs to be scanned for by including the length in
the scan parameters and not relying on strlen().
2021-09-16 11:20:46 -05:00
Denis Kenzior
9d045fae0e scan: Parse network cost IE info into scan_bss 2021-09-03 16:32:51 -05:00
James Prestwood
194b4cf60e scan: set force_default_sae_group if OUI matches 2021-08-25 13:04:15 -05:00
Denis Kenzior
78b9328db6 scan: Quiet down warning
Under certain conditions, access points with very low signal could be
detected.  This signal is too low to estimate a data rate and causes
this L_WARN to fire.  Fix this by returning a -ENETUNREACH error code in
case the signal is too low for any of the supported rates.
2021-07-28 09:53:21 -05:00
Denis Kenzior
bedf2b0596 knownnetworks: Commonize parser for common settings
Some network settings keys are set / parsed in multiple files.  Add a
utility to parse all common network configuration settings in one place.

Also add some defines to make sure settings are always saved in the
expected group/key.
2021-07-27 14:02:43 -05:00
Denis Kenzior
7fafb627d8 scan: Save off RSNXE if present 2021-07-14 09:55:49 -05:00
Denis Kenzior
709b77794b scan: Use wiphy_estimate_data_rate 2021-06-01 13:41:56 -05:00
Denis Kenzior
8679b82db4 scan: Simplify parsing logic
scan_parse_result used to parse the wdev and return this to the caller
where it was compared against the expected wdev.  Simplify this by
extract the wdev first, and proceeding with the bss parsing afterwards.
2021-06-01 13:41:56 -05:00
Alvin Šipraga
38ded68a38 scan: parse NL80211_BSS_LAST_SEEN_BOOTTIME in units of nanoseconds
NL80211_BSS_LAST_SEEN_BOOTTIME is expressed in nanoseconds, while BSS
timestamps are expressed in microseconds internally. Convert the
attribute to microseconds when using it to timestamp a BSS. This makes
iwd expire absent BSSes within 30 seconds as intended.

Fixes: 454cee12d4 ("scan: Use kernel-reported time-stamp if provided")
2021-05-26 10:20:48 -05:00
James Prestwood
3fde169001 scan: rework BSS ranking
It was observed that IWD's ranking for BSS's did not always
end up with the fastest being chosen. This was due to IWD's
heavy weight on signal strength. This is a decent way of ranking
but even better is calculating a theoretical data rate which
was also done and factored in. The problem is the data rate
factor was always outdone by the signal strength.

Intead remove signal strength entirely as this is already taken
into account with the data rate calculation. This also removes
the check for rate IEs. If no IEs are found the parser will
base the data rate soley on RSSI.

There were a few other factors removed which will be added back
when ranking *networks* rather than BSS's. WPA version (or open)
was removed as well as the privacy capability. These values really
should not differ between BSS's in the same SSID and as such
should be used for network ranking instead.
2021-05-19 09:32:17 -05:00
James Prestwood
e8c87c8b42 scan: add scan_get_firmware_scan
Adds support for getting firmware scan results from the kernel.
This is intended to be used after the firmware roamed automatically
and the scan result is require for handshake initialization.

The scan 'request' is competely separate from the normal scan
queue, though scan_results, scan_request, and the scan_context
are all used for consistency and code reuse.
2021-03-15 13:14:16 -05:00
Denis Kenzior
0c0d9e5696 iwd: Use test_bit from ell 2021-03-12 13:49:23 -06:00
Denis Kenzior
f7b5bd4a79 treewide: Use ell's useful.h header 2021-03-11 21:46:09 -06:00
Alvin Šipraga
ff82133050 scan: add InitialPeriodicScanInterval setting 2021-02-12 09:57:10 -06:00
Alvin Šipraga
88f2b44bba scan: add MaximumPeriodicScanInterval setting 2021-02-12 09:57:10 -06:00
Denis Kenzior
fa9ae4acb7 scan: Put an upper bound on the scan interval 2021-02-09 09:31:05 -06:00
Denis Kenzior
fb217479d2 netdev: Scan & Retry CMD_AUTHENTICATE
Handle situations where the BSS we're trying to connect to is no longer
in the kernel scan result cache.  Normally, the kernel will re-scan the
target frequency if this happens on the CMD_CONNECT path, and retry the
connection.

Unfortunately, CMD_AUTHENTICATE path used for WPA3, OWE and FILS does
not have this scanning behavior.  CMD_AUTHENTICATE simply fails with
a -ENOENT error.  Work around this by trying a limited scan of the
target frequency and re-trying CMD_AUTHENTICATE once.
2021-02-08 11:53:29 -06:00
Denis Kenzior
454cee12d4 scan: Use kernel-reported time-stamp if provided 2021-02-03 13:35:46 -06:00
Denis Kenzior
ccbd32503b scan: Pass the frequencies scanned to notify cb 2021-02-03 13:34:44 -06:00
Denis Kenzior
f0e0060ddc scan: Make scan_freq_set_contains const-correct 2021-02-03 13:34:28 -06:00
Denis Kenzior
79928e69cb Revert "scan: Drop unused frequency list parsing"
This reverts commit 520ad56f83.
2021-02-03 13:34:23 -06:00
Denis Kenzior
304627e086 scan: Fix crash when a canceled scan gets aborted 2020-10-30 14:06:31 -05:00
Andrew Zaborowski
520ad56f83 scan: Drop unused frequency list parsing 2020-09-29 13:14:06 -05:00
Andrew Zaborowski
9335680cd8 scan: Add optional source_mac scan parameter
This is similar to randomize_mac_addr_hint but it sets a specific source
MAC address for our probe frames.
2020-09-09 13:02:02 -05:00
Denis Kenzior
b0fe62af5a scan: free wfd member
Found using lsan:

==29896==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 9 byte(s) in 1 object(s) allocated from:
    #0 0x7fcd41e0c710 in __interceptor_malloc /var/tmp/portage/sys-devel/gcc-8.2.0-r6/work/gcc-8.2.0/libsanitizer/asan/asan_malloc_linux.cc:86
    #1 0x606abd in l_malloc ell/util.c:62
    #2 0x460230 in ie_tlv_vendor_ie_concat src/ie.c:140
    #3 0x4605d1 in ie_tlv_extract_wfd_payload src/ie.c:216
    #4 0x4a8773 in scan_parse_bss_information_elements src/scan.c:1105
    #5 0x4a94a8 in scan_parse_attr_bss src/scan.c:1181
    #6 0x4a99f8 in scan_parse_result src/scan.c:1238
    #7 0x4abe4e in get_scan_callback src/scan.c:1451
    #8 0x6442d9 in process_unicast ell/genl.c:979
    #9 0x6453ff in received_data ell/genl.c:1087
    #10 0x62e1a4 in io_callback ell/io.c:126
    #11 0x628fca in l_main_iterate ell/main.c:473
    #12 0x6294e8 in l_main_run ell/main.c:520
    #13 0x629d8b in l_main_run_with_signal ell/main.c:642
    #14 0x40681b in main src/main.c:505
    #15 0x7fcd40a55bdd in __libc_start_main (/lib64/libc.so.6+0x21bdd)
2020-08-20 11:11:44 -05:00
Alvin Šipraga
bfd8cead95 treewide: guard compare functions against signed integer overflow
Besides being undefined behaviour, signed integer overflow can cause
unexpected comparison results. In the case of network_rank_compare(),
a connected network with rank INT_MAX would cause newly inserted
networks with negative rank to be inserted earlier in the ordered
network list. This is reflected in the GetOrderedMethods() DBus method
as can be seen in the following iwctl output:

  [iwd]# station wlan0 get-networks
    Network name                    Security  Signal
  ----------------------------------------------------
    BEOLAN                          8021x     **** }
    BeoBlue                         psk       ***  } all unknown,
    UI_Test_Network                 psk       ***  } hence assigned
    deneb_2G                        psk       ***  } negative rank
    BEOGUEST                        open      **** }
  > titan                           psk       ****
    Linksys05274_5GHz_dmt           psk       ****
    Lyngby-4G-4 5GHz                psk       ****
2020-08-14 10:55:30 -05:00
Andrew Zaborowski
1d852e10ad scan: Always allocate results->bss_list
Instead of creating the results->bss_list l_queue lazily, always create
one before sending the GET_SCAN command.  This is to make sure that an
empty list is passed to the scan callback (e.g. in station.c) instead of
a NULL.  Passing NULL has been causing difficult to debug crashes in
station.c, in fact I think I've been seeing them for over a year now
but can't be sure.  station_set_scan_results has been taking ownership
of the new BSS list and, if station->connected_bss was not on the list,
it would try to add it not realizing that l_queue_push_tail() was doing
nothing.  Always passing a valid list may help us prevent similar
problems in the future.

The crash might start with:
==120489== Invalid read of size 8
==120489==    at 0x425D38: network_bss_select (network.c:709)
==120489==    by 0x415BD1: station_try_next_bss (station.c:2263)
==120489==    by 0x415E31: station_retry_with_status (station.c:2323)
==120489==    by 0x415E31: station_connect_cb (station.c:2367)
==120489==    by 0x407E66: netdev_connect_failed (netdev.c:569)
==120489==    by 0x40B93D: netdev_connect_event (netdev.c:1801)
==120489==    by 0x40B93D: netdev_mlme_notify (netdev.c:3678)
2020-08-04 10:30:07 -05:00