3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-23 06:02:37 +01:00
Commit Graph

4013 Commits

Author SHA1 Message Date
James Prestwood
995c34450e eapol: implement rekey support for authenticator
The only changes required was to set the secure bit for message 1,
reset the frame retry counter, and change the 2/4 verifier to use
the rekey flag rather than ptk_complete. This is because we must
set ptk_complete false in order to detect retransmissions of the
4/4 frame.

Initiating a rekey can now be done by simply calling eapol_start().
2023-01-18 15:39:36 -06:00
James Prestwood
d504b74c61 manager: handle -ENODEV special in interface callback
If IWD ends up dumping wiphy's twice (because of NEW_WIPHY event
soon after initial dump) it will also try and dump interfaces
twice leading to multiple DEL_INTERFACE calls. The second attempt
will fail with -ENODEV (since the interface was already deleted).
Just silently fail with this case and let the other DEL_INTERFACE
path handle the re-creation.
2023-01-17 13:11:53 -06:00
James Prestwood
6957b5fdf0 wiphy: prevent multiple wiphy registrations
With really badly timed events a wiphy can be registered twice. This
happens when IWD starts and requests a wiphy dump. Immediately after
a NEW_WIPHY event comes in (presumably when the driver loads) which
starts another dump. The NEW_WIPHY event can't simply be ignored
since it could be a hotplug (e.g. USB card) so to fix this we can
instead just prevent it from being registered.

This does mean both dumps will happen but the information will just
be added to the same wiphy object.
2023-01-17 13:11:38 -06:00
James Prestwood
d8ca993a1c station: cancel roam timer when FT starts
Past commits should address any potential problems of the timer
firing during FT, but its still good practice to cancel the timer
once it is no longer needed, i.e. once FT has started.
2023-01-13 17:00:26 -06:00
James Prestwood
fdd5d166b5 station: check for FT work in station_cannot_roam
If station has already started FT ensure station_cannot_roam takes
that into account. Since the state has not yet changed it must also
check if the FT work ID is set.
2023-01-13 17:00:21 -06:00
James Prestwood
155c266d6c station: add checks to prevent multiple roam scans
Under the following conditions IWD can accidentally trigger a second
roam scan while one is already in progress:

 - A low RSSI condition is met. This starts the roam rearm timer.
 - A packet loss condition is met, which triggers a roam scan.
 - The roam rearm timer fires and starts another roam scan while
   also overwriting the first roam scan ID.
 - Then, if IWD gets disconnected the overwritten roam scan gets
   canceled, and the roam state is cleared which NULL's
   station->connected_network.
 - The initial roam scan results then come in with the assumption
   that IWD is still connected which results in a crash trying to
   reference station->connected_network.

This can be fixed by adding a station_cannot_roam check in the rearm
timer. If IWD is already doing a roam scan station->preparing_roam
should be set which will cause it to return true and stop any further
action.

Aborting (signal 11) [/usr/libexec/iwd]
iwd[426]: ++++++++ backtrace ++++++++
iwd[426]: #0  0x7f858d7b2090 in /lib/x86_64-linux-gnu/libc.so.6
iwd[426]: #1  0x443df7 in network_get_security() at ome/locus/workspace/iwd/src/network.c:287
iwd[426]: #2  0x421fbb in station_roam_scan_notify() at ome/locus/workspace/iwd/src/station.c:2516
iwd[426]: #3  0x43ebc1 in scan_finished() at ome/locus/workspace/iwd/src/scan.c:1861
iwd[426]: #4  0x43ecf2 in get_scan_done() at ome/locus/workspace/iwd/src/scan.c:1891
iwd[426]: #5  0x4cbfe9 in destroy_request() at ome/locus/workspace/iwd/ell/genl.c:676
iwd[426]: #6  0x4cc98b in process_unicast() at ome/locus/workspace/iwd/ell/genl.c:954
iwd[426]: #7  0x4ccd28 in received_data() at ome/locus/workspace/iwd/ell/genl.c:1052
iwd[426]: #8  0x4c79c9 in io_callback() at ome/locus/workspace/iwd/ell/io.c:120
iwd[426]: #9  0x4c62e3 in l_main_iterate() at ome/locus/workspace/iwd/ell/main.c:476
iwd[426]: #10 0x4c6426 in l_main_run() at ome/locus/workspace/iwd/ell/main.c:519
iwd[426]: #11 0x4c6752 in l_main_run_with_signal() at ome/locus/workspace/iwd/ell/main.c:645
iwd[426]: #12 0x405987 in main() at ome/locus/workspace/iwd/src/main.c:600
iwd[426]: #13 0x7f858d793083 in /lib/x86_64-linux-gnu/libc.so.6
iwd[426]: +++++++++++++++++++++++++++
2023-01-13 17:00:04 -06:00
James Prestwood
c31ae041a2 eapol: detect message 2/4 retransmits
If the authenticator has already set an snonce then the packet must
be a retransmit. Handle this by sending 3/4 again but making sure
to not reset the frame counter.
2023-01-13 09:13:52 -06:00
James Prestwood
0930d0dffc eapol: relax secure bit check on 2/4
Old wpa_supplicant versions do not set the secure bit on 2/4 during
rekeys which causes IWD to reject the message and eventually time out.
Modern versions do set it correctly but even Android 13 (Pixel 5a)
still uses an ancient version of wpa_supplicant which does not set the
bit.

Relax this check and instead just print a warning but allow the message
to be processed.
2023-01-11 16:08:45 -06:00
James Prestwood
b373d1fa69 netdev: support HANDSHAKE_EVENT_REKEY_COMPLETE
In try_handshake_complete() we return early if all the keys had
been installed before (initial associations). For rekeys we can
now emit the REKEY_COMPLETE event which lets AP mode reset the
rekey timer for that station.
2023-01-11 16:07:50 -06:00
James Prestwood
70e3a43475 netdev: unset ptk_installed flag for TK
When the TK is installed the 'ptk_installed' flag was never set to
zero. For initial associations this was fine (already zero) but for
rekeys the flag needs to be unset so try_handshake_complete knows
if the key was installed. This is consistent with how gtk/igtk keys
work as well.
2023-01-11 16:06:02 -06:00
James Prestwood
c66e5ce8fc handshake: add event for rekey success
Rekeys for station mode don't need to know when complete since
there is nothing to do once done. AP mode on the other hand needs
to know if the rekey was successful in order to reset/set the next
rekey timer.
2023-01-11 16:05:55 -06:00
James Prestwood
2429ab958d eapol: set secure on message 2/4 properly
The second handshake message was hard coded with the secure bit as
zero but for rekeys the secure bit should be set to 1. Fix this by
changing the 2/4 builder to take a boolean which will set the bit
properly.

It should be noted that hostapd doesn't check this bit so EAPoL
worked just fine, but IWD's checks are more strict.
2023-01-11 15:48:17 -06:00
Denis Kenzior
eda02fb929 eap-peap: Fix failures with session resumption
The PEAP RFC wants implementations to enforce that Phase2 methods have
been successfully completed prior to accepting a successful result TLV.
However, when TLS session resumption is used, some servers will skip
phase2 methods entirely and simply send a Result TLV with a success
code.  This results in iwd (erroneously) rejecting the authentication
attempt.

Fix this by marking phase2 method as successful if session resumption is
being used.
2023-01-03 09:58:29 -06:00
James Prestwood
58d70a8c10 ap: support setting country IE
This adds a builder which sets the country IE in probes/beacons.
The IE will use the 'single subband triplet sequence' meaning
dot11OperatingClassesRequired is false. This is much easier to
build and doesn't require knowing an operating class.

The IE itself is variable in length and potentially could grow
large if the hardware has a weird configuration (many different
power levels or segmentation in supported channels) so the
overall builder was changed to take the length of the buffer and
warnings will be printed if any space issues are encountered.
2023-01-03 09:16:46 -06:00
James Prestwood
71c921fb42 nl80211util: parse TX power in frequency attributes 2023-01-03 09:16:35 -06:00
James Prestwood
76a94b4cc8 band: add tx_power to frequency info attributes 2023-01-03 09:16:32 -06:00
James Prestwood
1a20e37100 wiphy: add wiphy_get_frequency_info_list
Gets the entire list of frequency attributes advertised. This is
needed for AP mode to create a country IE which includes subband
triplet fields.
2023-01-03 09:16:16 -06:00
James Prestwood
553052a337 band: validate channel/freq conversions with E-4
IWD's channel/frequency conversions use simple math to convert and
have very minimal checks to ensure the input is valid. This can
lead to some channels/frequencies being calculated which are not
in IWD's E-4 table, specifically in the 5GHz band.

This is especially noticable using mac80211_hwsim which includes
some obscure high 5ghz frequencies which are not part of the 802.11
spec.

To fix this calculate the frequency or channel then iterate E-4
operating classes to check that the value actually matches a class.
2022-12-30 11:39:35 -06:00
James Prestwood
1c1ad68a63 ap: build HT Capabilities/Operation elements
If supported this will include the HT capabilities and HT
operations elements in beacons/probes. Some shortcuts were taken
here since not all the information is currently parsed from the
hardware. Namely the HT operation element does not include the
basic MCS set. Still, this will at least show stations that the
AP is capable of more than just basic rates.

The builders themselves are structured similar to the basic rates
builder where they build only the contents and return the length.
The caller must set the type/length manually. This is to support
the two use cases of using with an IE builder vs direct pointer.
2022-12-30 11:36:53 -06:00
James Prestwood
65236f7231 ap: generate chandef for starting AP
To include HT support a chandef needs to be created for whatever
frequency is being used. This allows IWD to provide a secondary
channel to the kernel in the case of 40MHz operation. Now the AP
will generate a chandef when starting based on the channel set
in the user profile (or default).

If HT is not supported the chandef width is set to 20MHz no-HT,
otherwise band_freq_to_ht_chandef is used.
2022-12-30 11:36:26 -06:00
James Prestwood
e9ea7b45c9 ap: include WMM parameter IE
The WMM parameter IE is expected by the linux kernel for any AP
supporting HT/VHT etc. IWD won't actually use WMM and its not
clear exactly why the kernel uses this restriction, but regardless
it must be included to support HT.
2022-12-30 11:36:00 -06:00
James Prestwood
cda4f42a7b band: generate HT chandef from frequency
For AP mode its convenient for IWD to choose an appropriate
channel definition rather than require the user provide very
low level parameters such as channel width, center1 frequency
etc. For now only HT is supported as VHT/HE etc. require
additional secondary channel frequencies.

The HT API tries to find an operating class using 40Mhz which
complies with any hardware restrictions. If an operating class is
found that is supported/not restricted it is marked as 'best' until
a better one is found. In this case 'better' is a larger channel
width. Since this is HT only 20mhz and 40mhz widths are checked.
2022-12-30 11:35:29 -06:00
James Prestwood
1d4130f41b wiphy: add wiphy_supports_uapsd 2022-12-27 11:33:25 -06:00
James Prestwood
28f5297b78 band: add band_chandef_width_to_string 2022-12-27 11:33:18 -06:00
James Prestwood
9e01563e8c wiphy: add getter for HT capabilities
This adds some additional parsing to obtain the AMPDU parameter
byte as well as wiphy_get_ht_capabilities() which returns the
complete IE (combining the 3 separate kernel attributes).
2022-12-27 10:59:10 -06:00
James Prestwood
d87ba1f486 band: add ampdu_params value
This is the last bit of information the kernel exposes about the
hardware's HT capabilities.
2022-12-27 10:52:06 -06:00
James Prestwood
ebac58e452 nl80211util: parse additional channel restriction flags 2022-12-27 10:51:50 -06:00
James Prestwood
ad02cbee13 ap: make supported rates a common builder.
The supported rates IE was being built in two places. This makes that
code common. Unfortunately it needs to support both an ie builder
and using a pointer directly which is why it only builds the contents
of the IE and the caller must set the type/length.
2022-12-27 10:50:56 -06:00
Andrew Zaborowski
14290e0b9a netconfig: Don't load settings in netconfig_new
Move the l_netconfig_set_route_priority() and
l_netconfig_set_optimistic_dad_enabled() calls from netconfig_new, which
is called once for the l_netconfig object's lifetime, to
netconfig_load_settings, which is called before every connection attempt.
This is needed because we clean up the l_netconfig configuration by calling
l_netconfig_reset_config() at different points in connection setup and
teardown so we'd reset the route priority that we've set in netconfig_new,
back to 0 and never reload it.
2022-12-27 10:46:30 -06:00
James Prestwood
2ba0ad212e wiphy: remove disabled_freqs and related dump code
The disabled_freqs list is being removed and replaced with a new
list in the band object. This completely removes the need for
the pending_freqs list as well since any regdom related dumps
can just overwrite the existing frequency list.
2022-12-20 14:10:17 -06:00
James Prestwood
cf6c958a97 ap: use wiphy_get_frequency_info
Replace disabled/supported frequency list with the new
wiphy_get_frequency_info()
2022-12-16 16:37:24 -06:00
James Prestwood
58383bda0c station: use wiphy_get_frequency_info
Remove uses of supported/disabled scan_freq_set's and replace
with the equivalent calls to wiphy_get_frequency_info() and
wiphy_band_is_disabled().
2022-12-16 16:37:16 -06:00
James Prestwood
7d8ba43212 wiphy: add getter for frequency/band info
This adds two new APIs:

wiphy_get_frequency_info(): Used to get information about a given
frequency such as disabled/no-IR. This can also be used to check
if the frequency is supported (NULL return is unsupported).

wiphy_band_is_disabled(): Checks if a band is disabled. Note that
an unsupported band will also return true. Checking support should
be done with wiphy_get_supported_bands()
2022-12-16 16:36:51 -06:00
James Prestwood
3a87b6c518 wiphy: don't parse dumps from unregistered wiphy's
There is no reason to parse these since IWD won't use them.
2022-12-16 16:36:49 -06:00
James Prestwood
16b420e2ff wiphy: remove pending_freqs from wiphy_regdom_is_updating
We can determine this info based on the dump IDs.
2022-12-16 16:36:47 -06:00
James Prestwood
95fa101861 wiphy: parse/store frequency info in band object
As additional frequency info is needed it doesn't make sense to
store a full list of frequencies for every attribute (i.e.
supported, disabled, no-IR, etc).

This changes nl80211_parse_supported_frequencies to take a list
of frequency attributes where each index corresponds to a channel,
and each value can be filled with flag bits to signal any
limitations on that frequency.

wiphy.c then had to be updated to use this rather than the existing
scan_freq_set lists. This, as-is, will break anything using
wiphy_get_disabled_freqs().
2022-12-16 16:36:46 -06:00
James Prestwood
fce6234fbf band: introduce new method of tracking frequencies
Currently the wiphy object keeps track of supported and disabled
frequencies as two separate scan_freq_set's. This is very expensive
and limiting since we have to add more sets in order to track
additional frequency flags (no-IR, no-HT, no-HE etc).

Instead we can refactor how frequencies are stored. They will now
be part of the band object and stored as a list of flag structures
where each index corresponds to a channel
2022-12-16 16:36:44 -06:00
James Prestwood
a1d30fe1cb station: remove early FT-over-DS action
IWD was optimizing FT-over-DS by authenticating to multiple BSS's
at the time of connecting which then made future roams slightly
faster since they could jump right into association. So far this
hasn't posed a problem but it was reported that some AP's actually
enforce a reassociation timeout (included in 4-way handshake).

Hostapd itself does no such enforcement but anything external to
hostapd could monitor FT events and clear the cache if any exceeded
this timeout.

For now remove the early action frames and treat FT-over-DS the
same as FT-over-Air. In the future we could parse the reassociation
timeout, batch out FT-Action frames and track responses but for the
time being this just fix the issue at a small performance cost.
2022-12-14 16:14:29 -06:00
James Prestwood
6a616df125 ft: gate FT-over-DS with a wiphy work item
Queue the FT action just like we do with FT Authenticate which makes
it able to be used the same way, i.e. call ft_action() then queue
the ft_associate work right away.

A timer was added to end the work item in case the target never
responds.
2022-12-14 16:13:13 -06:00
James Prestwood
59a0947c76 util: add scan_freq_set_remove
Removes one frequency from a scan_freq_set object.
2022-12-14 15:37:01 -06:00
James Prestwood
ea93e74a06 scan: remove early supported check for 6ghz in wiphy watch
If the regdom updates during a periodic scan the results will be
delayed until after the update in order to, potentially, add 6GHz
frequencies since they may become available. The delayed results
happen regardless of 6GHz support but scan_wiphy_watch() was
returning early if 6GHz was not supported causing the scan request
to never complete.
2022-12-13 14:18:48 -06:00
Alvin Šipraga
ed357d78b3 scan: call scan_finished() when periodic scans get aborted
The blamed commit argues that the periodic scan callback doesn't do
anything useful in the event of an aborted scan, but this is not
entirely true. In particular, the callback is responsible for re-arming
the periodic scan timer. Make sure to call scan_finished() so that iwd's
periodic scanning logic continues unabated even when a periodic scan is
aborted.

Also remove the periodic boolean member of struct scan_request, as it
serves no purpose anymore.

Fixes: 6051a14952 ("scan: Don't callback on SCAN_ABORTED")
2022-12-12 15:55:01 -06:00
James Prestwood
3c6a0647b3 doc: document 5GHz AP support 2022-12-09 14:59:32 -06:00
James Prestwood
9d003ae585 ap: select rates from hardware capabilities
Rather than a list of static rates, choose what the hardware
advertises. For the case of CCK rates only include rates 11mbps
or lower.
2022-12-09 14:59:20 -06:00
James Prestwood
c6792a4bcc ap: add support for 5GHz frequencies in AP mode
This enables IWD to use 5GHz frequencies in AP mode. Currently
6GHz is not supported so we can assume a [General].Channel value
36 or above indicates the 5GHz band.

It should be noted that the system will probably need a regulatory
domain set in order for 5GHz to be allowed in AP mode. This is due
to world roaming (00) restricting any/all 5GHz frequencies. This
can be accomplished by setting main.conf [General].Country=CC to
the country this AP will operate in.
2022-12-09 14:58:51 -06:00
James Prestwood
3cd93505d6 wiphy: use enum band_freq with rates getter
wiphy_get_supported_rates expected an enum defined in the nl80211
header but the argument type was an unsigned int, not exactly
intuitive to anyone using the API. Since the nl80211 enum value
was only used in a switch statement it could just as well be IWD's
internal enum band_freq.

This also allows modules which do not reference nl80211.h to use
wiphy_get_supported_rates().
2022-12-09 14:58:42 -06:00
Denis Kenzior
bce3ab2bf2 man: Update wording
Change wording to say that IPv6 support is enabled by default.  No
functional changes.

Fixes: 00baa75e96 ("netconfig: Enable IPV6 support by default")
2022-12-08 09:21:10 -06:00
Marcel Holtmann
27a00a6806 build: Add documention of manual pages to systemd service file 2022-11-18 10:50:31 +01:00
Alvin Šipraga
e192a237b6 scan: retry scan based on scan done events per wiphy, not wdev
If a CMD_TRIGGER_SCAN request fails with -EBUSY, iwd currently assumes
that a scan is ongoing on the underlying wdev and will retry the same
command when that scan is complete. It gets notified of that completion
via the scan_notify() function, and kicks the scan logic to try again.

However, if there is another wdev on the same wiphy and that wdev has a
scan request in flight, the kernel will also return -EBUSY. In other
words, only one scan request per wiphy is permitted.

As an example, the brcmfmac driver can create an AP interface on the
same wiphy as the default station interface, and scans can be triggered
on that AP interface.

If -EBUSY is returned because another wdev is scanning, then iwd won't
know when it can retry the original trigger request because the relevant
netlink event will arrive on a different wdev. Indeed, if no scan
context exists for that other wdev, then scan_notify will return early
and the scan logic will stall indefinitely.

Instead, and in the event that no scan context matches, use it as a cue
to retry a pending scan request that happens to be destined for the same
wiphy.
2022-11-17 16:50:45 -06:00
Denis Kenzior
00baa75e96 netconfig: Enable IPV6 support by default 2022-11-17 10:33:02 -06:00
Denis Kenzior
2f1c2930f0 station: Add dependency on known_networks module
The previous commit added an invocation of known_networks_watch_add, but
never updated the module dependency graph.

Fixes: a793a41662 ("station, eapol: Set up eap-tls-common for session caching")
2022-11-17 10:17:07 -06:00
Andrew Zaborowski
a793a41662 station, eapol: Set up eap-tls-common for session caching
Use eap_set_peer_id() to set a string identifying the TLS server,
currently the hex-encoded SSID of the network, to be used as group name
and primary key in the session cache l_settings object.  Provide pointers
to storage_eap_tls_cache_{load,sync} to eap-tls-common.c using
eap_tls_set_session_cache_ops().  Listen to Known Network removed
signals and call eap_tls_forget_peer() to have any session related to
the network also dropped from the cache.
2022-11-17 10:09:54 -06:00
Andrew Zaborowski
ef81917e8d eap-tls: Add session caching
Use l_tls_set_session_cache() to enable session cache/resume in the
TLS-based EAP methods.  Sessions for all 802.1x networks are stored in
one l_settings object.

eap_{get,set}_peer_id() API is added for the upper layers to set the
identifier of the authenticator (or the supplicant if we're the
authenticator, if there's ever a use case for that.)

eap-tls-common.c can't call storage_eap_tls_cache_{load,sync}()
or known_networks_watch_add() (to handle known network removals) because
it's linked into some executables that don't have storage.o,
knownnetworks.o or common.o so an upper layer (station.c) will call
eap_tls_set_session_cache_ops() and eap_tls_forget_peer() as needed.
2022-11-17 10:04:56 -06:00
Andrew Zaborowski
e63c5bf4f8 storage: Refactor storage_tls_session_{load,sync}
Minor changes to these two methods resulting from two rewrites of them.
Actual changes are:
 * storage_tls_session_sync parameter is const,
 * more specific naming,
 * storage_tls_session_load will return an empty l_settings instead of
   NULL so eap-tls-common.c doesn't have to handle this.

storage.c makes no assumptions about the group names in the l_settings
object and keeps no reference to that object, eap-tls-common.c is going
to maintain the memory copy of the cache since this cache and the disk
copy of it are reserved for EAP methods only.
2022-11-17 10:04:12 -06:00
Marcel Holtmann
b4406cce82 scan: Add support for separate 6Ghz band modifier 2022-11-14 11:07:10 -06:00
Andrew Zaborowski
644586e273 storage: Add TLS session cache file read/write utils
Add storage_tls_session_cache_{load,sync} similar to
storage_known_frequencies_{load,sync}.
2022-11-09 14:26:38 -06:00
James Prestwood
55924fbb56 ap: change PairwiseCiphers to string array
A comma separated list as a string was ok for pure display purposes
but if any processing needed to be done on these values by external
consumers it really makes more sense to use a DBus array.
2022-11-04 12:03:27 -05:00
James Prestwood
606769dbea ap: update Scanning property when AP starts
This wasn't being updated meaning the property is missing until a
scan is issued over DBus.

Rather than duplicate all the property changed calls they were all
factored out into a helper function.
2022-11-04 12:02:52 -05:00
James Prestwood
c89c37378b netconfig: add global MulticastDNS option
Adds the MulticastDNS option globally to main.conf. If set all
network connections (when netconfig is enabled) will set mDNS
support into the resolver. Note that an individual network profile
can still override the global value if it sets MulticastDNS.
2022-11-03 14:02:31 -05:00
James Prestwood
b627f99800 ap: update Frequency property on started
This was forgotten when adding the property
2022-11-03 09:23:24 -05:00
James Prestwood
0363d51c5c ap: add PairwiseCiphers/GroupCipher to dbus interface
Expose these values on the DBus interface so clients can view them.
2022-11-03 09:22:56 -05:00
James Prestwood
2b64b493d0 doc: document PairwiseCiphers/GroupCiphers AP settings 2022-11-03 09:22:33 -05:00
James Prestwood
7d4d868236 p2p: limit ciphers to CCMP
The limitation of cipher selection in ap.c was done so to allow p2p to
work. Now with the ability to specify ciphers in the AP config put the
burden on p2p to limit ciphers as it needs which is only CCMP according
to the spec.
2022-11-03 09:22:16 -05:00
James Prestwood
262685e818 ap: add profile settings PairwiseCiphers/GroupCipher
These can now be optionally provided in an AP profile and provide a
way to limit what ciphers can be chosen. This still is dependent on
what the hardware supports.
2022-11-03 09:21:39 -05:00
James Prestwood
5f84a78638 ie: add group/pairwise lists of supported ciphers
The validation of these ciphers for station is done when parsing
the BSS RSNE but for AP mode there is no such validation and
potentially any supported cipher could be chosen, even if its
incompatible for the type of key.
2022-11-03 09:21:33 -05:00
James Prestwood
a4678949f9 wiphy: add wiphy_get_supported_ciphers
Similar to wiphy_select_cipher but returns all supported ciphers
included in the mask rather than just one.
2022-11-03 09:21:27 -05:00
James Prestwood
069d6d1d9c json: update internal type definition to match JSMN
Fixes: ceda955ba7 ("shared: Update JSMN to latest version")
2022-11-02 15:02:58 -05:00
Marcel Holtmann
4ffcde8125 json: Set defines before including shared/jsmn.h 2022-11-02 11:25:35 +01:00
James Prestwood
d4da6b5bec netdev: parse michael MIC failure message
This event indicates a security issue. The proper handling would be
to rekey but for now at least provide some information to the user.
2022-11-01 15:56:20 -05:00
James Prestwood
9f1fa53aae nl80211util: add key type/idx to nl80211_parse_attrs 2022-11-01 15:56:17 -05:00
James Prestwood
53469c5c0d netdev: fix key setting for authenticators
The netdev_copy_tk function was being hard coded with authenticator
set to false. This isn't important for any ciphers except TKIP but
now that AP mode supports TKIP it needs to be fixed.
2022-11-01 15:52:56 -05:00
James Prestwood
707b12abf8 netdev: add more info to key setting debug messages
Specify that the ifindex is being printed and print the key ID
as well.
2022-11-01 15:52:39 -05:00
James Prestwood
0f95c97649 ap: add frequency to AP interface 2022-11-01 15:48:59 -05:00
James Prestwood
5d8b86ff7c eapol: add TKIP support in AP mode
Though TKIP is deprecated and insecure its trivial to support it in
AP mode as we already do in station. This is only to allow AP mode
for old hardware that may only support TKIP. If the hardware supports
any higher level cipher that will be chosen automatically.
2022-10-26 14:20:25 -05:00
James Prestwood
4da101da92 eapol: choose key descriptor version in AP mode
The key descriptor version was hard coded to HMAC_SHA1_AES which
is correct when using IE_RSN_AKM_SUITE_PSK + CCMP. ap.c hard
codes the PSK AKM but still uses wiphy to select the cipher. In
theory there could be hardware that only supports TKIP which
would then make IWD non-compliant since a different key descriptor
version should be used with PSK + TKIP (HMAC_MD5_ARC4).

Now use a helper to sort out which key descriptor should be used
given the AKM and cipher suite.
2022-10-26 14:18:00 -05:00
Andrew Zaborowski
639e2a6fa3 netconfig: Avoid generating events after netconfig_reset
Similarly to l_netconfig track whether IWD's netconfig is active (from
the moment of netconfig_configure() till netconfig_reset()) using a
"started" flag and avoid handling or emitting any events after "started"
is cleared.

This fixes an occasional issue with the Netconfig Agent backend where
station would reset netconfig, netconfig would issue DBus calls to clear
addresses and routes, station would go into DISCONNECTING, perhaps
finish and go into DISCONNECTED and after a while the DBus calls would
come back with an error which would cause a NETCONFIG_EVENT_FAILED
causing station to call netdev_disconnct() for a second time and
transition to and get stuck in DISCONNECTING.
2022-10-26 14:16:22 -05:00
Andrew Zaborowski
72c2a94df9 netconfig: Print addresses added and removed to debug log 2022-10-26 14:15:59 -05:00
Denis Kenzior
75ec7d8076 ap: Limit pairwise and group ciphers to CCMP|TKIP 2022-10-26 14:14:39 -05:00
Denis Kenzior
7584b38562 wiphy: Support more group management cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
d1acc80331 netdev: Support more IGTK cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
17131c860a ie: Support more group management cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
ecadc72bcd wiphy: Support GCMP|CCMP-256 cipher suites 2022-10-24 11:05:24 -05:00
Denis Kenzior
fb9bcdadec station: Use IE_CIPHER_IS_GCMP_CCMP 2022-10-24 11:05:24 -05:00
Denis Kenzior
e61cada28f ie: Add IE_CIPHER_IS_GCMP_CCMP inline
Similar to IE_AKM_IS_* functions
2022-10-24 11:05:24 -05:00
Denis Kenzior
b3c3b08785 netdev: Add support for CCMP|GCMP-256
These are similar to CCMP/GCMP, just a different key size which is
already taken care of by calling crypto_cipher_key_len
2022-10-24 11:05:24 -05:00
Denis Kenzior
5998043bd2 ie: Add support for GCMP|CCMP-256 2022-10-24 11:05:24 -05:00
Denis Kenzior
8799d5a393 station: diagnostic: implement PairwiseCipher 2022-10-24 11:05:24 -05:00
Denis Kenzior
81b9eb515e wiphy: Support GCMP cipher suite 2022-10-24 11:05:24 -05:00
Denis Kenzior
4c30bd68ea wiphy: Generalize supported cipher dumper
To make it easier to support additional ciphers in the future.
2022-10-24 11:05:24 -05:00
Denis Kenzior
8040826079 ie: add ie_rsn_cipher_suite_to_string 2022-10-24 11:05:24 -05:00
Denis Kenzior
150856c315 ie: Add support for GCMP cipher suite 2022-10-24 11:05:24 -05:00
Denis Kenzior
d643964fed netdev: Add support for setting GCMP keys 2022-10-24 11:05:24 -05:00
Denis Kenzior
7ab97db9a9 netdev: Build RSN attributes in a common function
Both CMD_ASSOCIATE and CMD_CONNECT paths were using very similar code to
build RSN specific attributes.  Use a common function to build these
attributes to cut down on duplicated code.

While here, also start using ie_rsn_cipher_suite_to_cipher instead of
assuming that the pairwise / group ciphers can only be CCMP or TKIP.
2022-10-24 11:05:24 -05:00
Denis Kenzior
59ace1b691 ie: Skip unknown pairwise ciphers 2022-10-24 11:05:24 -05:00
Denis Kenzior
ec3085e932 crypto: Add new cipher definitions 2022-10-24 11:05:24 -05:00
Denis Kenzior
f1a713a0fa ie: Simplify implementation
Instead of copy-pasting the same basic operation (memcpy & assignment),
use a goto and a common path instead.  This should also make it easier
for the compiler to optimize this function.
2022-10-24 11:05:24 -05:00
Denis Kenzior
94ecdc799a ie: Rename _BIP to _BIP_CMAC 2022-10-24 11:05:24 -05:00
Denis Kenzior
201b85e8da crypto: Rename BIP to BIP_CMAC
To match the spec more closely.  Several additional BIP algorithms are
being introduced, including BIP_GMAC_128|256 and BIP_CMAC_256.
2022-10-24 11:05:24 -05:00
Denis Kenzior
b85b92b3ee eapol: More strictly validate key_descriptor_version 2022-10-24 11:05:24 -05:00
Denis Kenzior
7f2aa40bba ap: Fix spurious warning message
The warning message would be printed even if no setting was present

Fixes: ac976c6f71 ("ap: Remove support for deprecated APRanges setting")
2022-10-24 11:05:24 -05:00
James Prestwood
ba6a48018c station: constrain known frequencies before roam scan
The known frequency list may include frequencies that once were
allowed but are now disabled due to regulatory restrictions. Don't
include these frequencies in the roam scan.
2022-10-11 14:31:20 -05:00
James Prestwood
887073b5d9 station: skip disabled frequencies in neighbor report
Use the disabled frequency list to check if the neighbor report is
including a frequency which IWD cannot use.
2022-10-11 14:30:43 -05:00
Peter Shkenev
6b81b6e46a station: remove excess if clause
No functional changes are intended.
2022-10-10 13:41:29 -05:00
James Prestwood
3bc5728815 station: add two debug events for FT
These events are sent if IWD fails to authentiate
(ft-over-air-roam-failed) or if it falls back to over air after
failing to use FT-over-DS (try-ft-over-air)
2022-10-06 09:00:53 -05:00
Andrew Zaborowski
72e7d3ceb8 station: Handle NETCONFIG_EVENT_FAILED
If IPv4 setup fails and the netconfig logic gives up, continue as if the
connection had failed at earlier stages so that autoconnect can try the
next available network.
2022-10-03 10:29:54 -05:00
Denis Kenzior
ac976c6f71 ap: Remove support for deprecated APRanges setting
In preparation for 2.0 release, remove settings that were marked
deprecated during 1.x cycle.
2022-09-29 12:59:16 -05:00
James Prestwood
bead4745ac ap: include PROBE_RESP attribute if required by driver
Certain drivers support/require probe response offloading which
IWD did not check for or properly handle. If probe response
offloading is required the probe response frame watch will not
be added and instead the ATTR_PROBE_RESP will be included with
START_AP.

The head/tail builders were reused but slightly modified to check
if the probe request frame is NULL, since it will be for use with
START_AP.
2022-09-28 16:23:12 -05:00
James Prestwood
06ec89d6b8 wiphy: add wiphy_supports_probe_resp_offload
Parse the AP probe response offload attribute during the dump. If
set this indicates the driver expects the probe response attribute
to be included with START_AP.
2022-09-28 16:23:00 -05:00
James Prestwood
59d36cf24f ft: optimize clearing authentications
Clearing all authentications during ft_authenticate was a very large
hammer and may remove cached authentications that could be used if
the current auth attempt fails.

For example the best BSS may have a problem and fail to authenticate
early with FT-over-DS, then fail with FT-over-Air. But another BSS
may have succeeded early with FT-over-DS. If ft_authenticate clears
all ft_infos that successful authentication will be lost.
2022-09-28 16:20:16 -05:00
James Prestwood
edf556cc7b station: add two new roaming states (FT/FW)
This adds two new station states to differentiate between
reassociation (ROAMING), Fast transition (FT_ROAMING) or a firmare
based roam (FW_ROAMING).
2022-09-28 16:19:24 -05:00
James Prestwood
9efcea3604 station: check disassociation bits for AP roaming
AP roaming was structured such that any AP roam request would
force IWD to roam (assuming BSS's were found in scan results).
This isn't always the best behavior since IWD may be connected
to the best BSS in range.

Only force a roam if the AP includes one of the 3 disassociation/
termination bits. Otherwise attempt to roam but don't set the
ap_directed_roaming flag which will allows IWD to stay with the
current BSS if no better candidates are found.
2022-09-28 12:35:45 -05:00
James Prestwood
f3b31e48e0 station: reorder AP roam logic
There are a few checks that can be done prior to parsing the
request, in addition the explicit check for preparing_roam was
removed since this is taken care of by station_cannot_roam().
2022-09-28 12:35:06 -05:00
James Prestwood
8d224624fc ft: fix ft_associate to verify if authentication succeeded
ft_associate was only checking the presence of the info structure,
not if it actually succeeded to authenticate.
2022-09-28 12:34:08 -05:00
James Prestwood
ae0fa6207e ft: clear ft_info inside offchannel destroy
Once offchannel completes we can check if the info structure was
parsed, indicating authentication succeeded. If not there is no
reason to keep it around since IWD will either try another BSS or
fail.
2022-09-28 12:32:49 -05:00
James Prestwood
8758cc8948 station: handle ROAMING state in disconnect event
This both adds proper handling to the new roaming logic and fixes
a potential bug with firmware roams.

The new way roaming works doesn't use a connect callback. This
means that any disconnect event or call to netdev_connect_failed
will result in the event handler being called, where before the
connect callback would. This means we need to handle the ROAMING
state in the station disconnect event so IWD properly disassociates
and station goes out of ROAMING.

With firmware roams netdev gets an event which transitions station
into ROAMING. Then netdev issues GET_SCAN. During this time a
disconnect event could come in which would end up in
station_disconnect_event since there is no connect callback. This
needs to be handled the same and let IWD transition out of the
ROAMING state.
2022-09-28 12:24:03 -05:00
James Prestwood
5181d20986 ft: remove auth-proto/ft_sm
This is no longer used.
2022-09-27 17:28:37 -05:00
James Prestwood
5e731527e5 netdev: remove FT auth proto
This removes the FT auth-proto from netdev and all associated helpers
and APIs.
2022-09-27 17:28:17 -05:00
James Prestwood
ad59fb6249 netdev: ft: complete FT refactor
This finalizes the refactor by moving all the handshake prep
into FT itself (most was already in there). The netdev-specific
flags and state were added into netdev_ft_tx_associate which
now avoids any need for a netdev API related to FT.

The NETDEV_EVENT_FT_ROAMED event is now emitted once FT completes
(netdev_connect_ok). This did require moving the 'in_ft' flag
setting until after the keys are set into the kernel otherwise
netdev_connect_ok has no context as to if this was FT or some
other connection attempt.

In addition the prev_snonce was removed from netdev. Restoring
the snonce has no value once association begins. If association
fails it will result in a disconnect regardless which requires
a new snonce to be generated
2022-09-27 17:18:38 -05:00
James Prestwood
0e6aaea2a9 station: try multiple roam candidates
This converts station to using ft_action/ft_authenticate and
ft_associate and dropping the use of the netdev-only/auth-proto
logic.

Doing this allows for more flexibility if FT fails by letting
IWD try another roam candidate instead of disconnecting.
2022-09-27 17:02:31 -05:00
James Prestwood
ceebf0dc53 station: handle NETDEV_EVENT_FT_ROAMED 2022-09-27 17:01:48 -05:00
James Prestwood
07a9fc6c09 ft: update action response parsing to include header
Now the full action frame including the header is provided to ft
which breaks the existing parser since it assumes the buffer starts
at the body of the message.
2022-09-27 16:51:07 -05:00
James Prestwood
8833a7377e netdev: hook in RX for FT-Action/Authentication/Association
This forwards Action, Authentication and Association frames to
ft.c via their new hooks in netdev.

Note that this will break FT-over-Air temporarily since the
auth-proto still is in use.
2022-09-27 16:48:15 -05:00
James Prestwood
e12f198255 station: create list of roam candidates
The current behavior is to only find the best roam candidate, which
generally is fine. But if for whatever reason IWD fails to roam it
would be nice having a few backup BSS's rather than having to
re-scan, or worse disassociate and reconnect entirely.

This patch doesn't change the roam behavior, just prepares for
using a roam candidate list. One difference though is any roam
candidates are added to station->bss_list, rather than just the
best BSS. This shouldn't effect any external behavior.

The candidate list is built based on scan_bss rank. First we establish
a base rank, the rank of the current BSS (or zero if AP roaming). Any
BSS in the results with a higher rank, excluding the current BSS, will
be added to the sorted station->roam_bss_list (as a new 'roam_bss'
entry) as well as stations overall BSS list. If the resulting list is
empty there were no better BSS's, otherwise station can now try to roam
starting with the best candidate (head of the roam list).
2022-09-27 16:42:29 -05:00
James Prestwood
391607de93 ft: implement offchannel authentication
A new API was added, ft_authenticate, which will send an
authentication frame offchannel via CMD_FRAME. This bypasses
the kernel's authentication state allowing multiple auth
attempts to take place without disconnecting.
2022-09-27 16:38:29 -05:00
James Prestwood
dfdc9fdb3b netdev: add FT TX frame hook
A netdev hook for FT to send out frames. This will be used both for
FT-over-DS action frames and FT-over-Air authentication.
2022-09-27 16:38:05 -05:00
James Prestwood
cd3f82ce8c ft: netdev: prep for FT isolation into ft.c
Currently netdev handles caching FT auth information and uses FT
parsers/auth-proto to manage the protocol. This sets up to remove
this state machine from netdev and isolate it into ft.c.

This does not break the existing auth-proto (hence the slight
modifications, which will be removed soon).

Eventually the auth-proto will be removed from FT entirely, replaced
just by an FT state machine, similar to how EAPoL works (netdev hooks
to TX/RX frames).
2022-09-27 16:36:19 -05:00
Denis Kenzior
4c6cc29f4a station: Match on BSSID and SSID when roaming 2022-09-27 11:47:47 -05:00
Denis Kenzior
803e2d6dd2 station: Match on BSSID and SSID on Roamed event
Since APs might operate multiple SSIDs on the same BSSID, it is not
enough to match on the BSSID only.
2022-09-27 10:59:11 -05:00
Denis Kenzior
fd035cba9a station: Lookup preauth target on the network
There may be situations (due to Multi-BSS operation) where an AP might
be advertising multiple SSIDs on the same BSSID.  It is thus more
correct to lookup the preauthentication target on the network object
instead of the station bss_list.  It used to be that the network list of
bsses was not updated when roam scan was performed.  Hence the lookup
was always performed on the station bss_list.  But this is no longer the
case, so it is safer to lookup on the network object directly on the
network.
2022-09-27 10:37:53 -05:00
James Prestwood
a484b928ac netdev: differentiate connect/auth timeouts
The warnings in the authenticate and connect events were identical
so it could be difficult knowing which print it was if IWD is not
in debug mode (to see more context). The prints were changed to
indicate which event it was and for the connect event the reason
attribute is also parsed.

Note the resp_ies_len is also initialized to zero now. After making
the changes gcc was throwing a warning.
2022-09-26 22:14:13 -05:00
James Prestwood
4d062c73ea sae: add IWD_SAE_DEBUG for more SAE debug messages
SAE will now check for IWD_SAE_DEBUG and enable more debug logging
using the new macro, sae_debug.
2022-09-26 14:13:30 -05:00
James Prestwood
81ee935a48 offchannel: add priority to start call
This will let the caller specify their own priority.
2022-09-21 21:17:04 -05:00
James Prestwood
7d97869c1f wiphy: add new work priority for FT
FT is special in that it really should not be interrupted. Since
FRAME/OFFCHANNEL have the highest priority we run the risk of
DPP or some other offchannel operation interfering with FT.
2022-09-21 21:16:51 -05:00
James Prestwood
3d8865f2c0 nl80211util: include frame type with build_cmd_frame
The CMD_FRAME builder assumed action frames but can just as easily
be used with any frame type.
2022-09-21 21:16:07 -05:00
James Prestwood
abcacce4be netdev: add NETDEV_EVENT_FT_ROAMED
FT is now driven (mostly) by station which removes the connect
callback. Instead once FT is completed, keys set, etc. netdev
will send an event to notify station.
2022-09-21 21:16:01 -05:00
Andrew Zaborowski
a2f805a3ae netconfig: Update l_netconfig API calls
Since l_netconfig's DHCPv6 client instance no longer sets parameters on
the l_icmp6_client instance, call l_icmp6_client_set_nodelay() and
l_icmp6_client_set_debug() directly.  Also enable optimistic DAD to
speed up IPv6 setup if available.
2022-09-20 10:06:31 -05:00
Andrew Zaborowski
c084dcf6b8 netconfig: Drop D-Bus path from debug message
l_dbus_message_get_path(reply) is normally NULL in this callback so
don't bother printing it.
2022-09-20 10:06:24 -05:00
James Prestwood
bced9dcf4b frame-xchg: create global group enum
Only P2P utilizes groups for now but to avoid conflicts in group
numbers for other modules create a global list which can be added
to as needed.
2022-09-16 11:04:31 -05:00
James Prestwood
7f81ab9bbb station: don't set OCVC for FT AKMs
Using OCV in FT is now disabled, so if the AKM is FT don't set the
capability or AP's may reject FT attempts.
2022-09-16 11:02:17 -05:00
James Prestwood
0b6eb251d5 frame-xchg: add type to frame_xchg_prefix
All uses of frame-xchg were for action frames, and the frame type
was hard coded. Soon other frame types will be needed so the type
must now be specified in the frame_xchg_prefix structure.
2022-09-16 11:02:07 -05:00
James Prestwood
af9111355c mpdu: fix timestamp size in mpdu frames
Beacons, probe responses and timing advertisements were only using
1 byte for the timestamps which should be 8 bytes.
2022-09-15 16:15:35 -05:00
James Prestwood
945fbd5b91 station: scan before a forced roam
This will make the debug API more robust as well as fix issues
certain drivers have when trying to roam. Some of these drivers
may flush scan results after CMD_CONNECT which results in -ENOENT
when trying to roam with CMD_AUTHENTICATE unless you rescan
explicitly.

Now this will be taken care of automatically and station will first
scan for the BSS (or full scan if not already in results) and
attempt to roam once the BSS is seen in a fresh scan.

The logic to replace the old BSS object was factored out into its
own function to be shared by the non-debug roam scan. It was also
simplified to just update the network since this will remove the
old BSS if it exists.
2022-09-14 13:18:22 -05:00
Andrew Zaborowski
4cf655936e netconfig: Skip update if resolver data unchanged 2022-09-13 08:59:39 -05:00
Andrew Zaborowski
a4c0515e0f netconfig: Add NetworkConfigurationAgent DBus API
Add a second netconfig-commit backend which, if enabled, doesn't
directly send any of the network configuration to the kernel or system
files but delegates the operation to an interested client's D-Bus
method as described in doc/agent-api.txt.  This backend is switched to
when a client registers a netconfig agent object and is swiched away
from when the client disconnects or unregisters the agent.  Only one
netconfig agent can be registered any given time.
2022-09-13 08:57:55 -05:00
Andrew Zaborowski
11bae53408 netconfig: Re-add FILS handling
Load the settings from FILS IE data into our l_netconfig instance when
appropriate.
2022-09-13 08:56:50 -05:00
Andrew Zaborowski
fbdd4471a1 netconfig: Handle l_netconfig events
Add netconfig_event_handler() that responds to events emitted by
the l_netconfig object by calling netconfig_commit, tracking whether
we're connected for either address family and emitting
NETCONFIG_EVENT_CONNECTED or NETCONFIG_EVENT_FAILED as necessary.

NETCONFIG_EVENT_FAILED is a new event as until now failures would cause
the netconfig state machine to stop but no event emitted so that
station.c could take action.  As before, these events are only
emitted based on the IPv4 configuration state, not IPv6.
2022-09-13 08:55:31 -05:00
Andrew Zaborowski
b79c7d49cd netconfig: Add netconfig-commit API
Add netconfig-commit.c whose main method, netconfig_commit actually sets
the configuration obtained by l_netconfig to the system netdev,
specifically it sets local addresses on the interface, adds routes to the
routing table, sets DNS related data and may add entries to the neighbor
cache.  netconfig-commit.c uses a backend-ops type structure to allow
for switching backends.  In this commit there's only a default backend
that uses l_netconfig_rtnl_apply() and a struct resolve object to write
the configuration.

netconfig_gateway_to_arp is moved from netconfig.c to netconfig-commit.c
(and renamed.)  The struct netconfig definition is moved to netconfig.h
so that both files can access the settings stored in the struct.
2022-09-13 08:51:29 -05:00
Andrew Zaborowski
a8b1139dcb netconfig: Store pointer to netdev instead of ifindex
To avoid repeated lookups by ifindex, replace the ifindex member in
struct netconfig with a struct netdev pointer.  A struct netconfig
always lives shorter than the struct netdev.
2022-09-13 08:51:13 -05:00
Andrew Zaborowski
98ba09562e netconfig: Clean up netconfig_get_static{4,6}_address
* make the error handling simpler,
 * make error messages more consistent,
 * validate address families,
 * for IPv4 skip l_rtnl_address_set_noprefixroute()
   as l_netconfig will do this internally as needed.
 * for IPv6 set the default prefix length to 64 as that's going to be
   used for the local prefix route's prefix length and is a more
   practical value.
2022-09-13 08:47:14 -05:00
Andrew Zaborowski
b0b1a46779 netconfig: Keep configuration directly in struct l_netconfig
Drop all the struct netconfig members where we were keeping the parsed
netconfig settings and add a struct l_netconfig object.  In
netconfig_load_settings load all of the settings once parsed directly
into the l_netconfig object.  Only preserve the mdns configuration and
save some boolean values needed to properly handle static configuration
and FILS.  Update functions to use the new set of struct netconfig
members.

These booleans mirroring the l_netconfig state could be replaced by
adding l_netconfig getters for settings which currently only have
setters.
2022-09-13 08:46:05 -05:00