3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-23 22:42:37 +01:00
Commit Graph

2757 Commits

Author SHA1 Message Date
Marcel Holtmann
16c489490c build: Fix issue with incorrect ReadWritePaths in unit files 2019-08-03 09:52:28 +02:00
Marcel Holtmann
30821979f6 netconfig: Use different includes that also work on older systems 2019-08-02 20:33:43 +02:00
Tim Kourt
18c339beab resolve: Add resolvconf as DNS manager
Enable the systems that use resolvconf as DNS manager to be
configurable by iwd.
2019-08-02 06:24:00 -05:00
James Prestwood
8053152730 wsc: fix station lookup by ifindex
The station was being lookup up using the wdev ID rather than the
interface index.
2019-08-02 02:23:05 -05:00
Matthias Schoepfer
4ae5c38be8 iwd.service.in: remove PrivateDevices=true
Previously, the option PrivateDevices=true disabled access to
/dev/rfkill, which lead to:
  'iwctl adapter phy0 set-property Powered {off|on}'
to fail.

This patch explicitly allows access to /dev/rfkill
2019-08-01 01:55:12 -05:00
James Prestwood
236211af60 rtnlutil: fix compiler error
src/rtnlutil.c: In function ‘rtnl_route_add’:
./ell/util.h:248:2: error: ‘rtmmsg’ may be used uninitialized in
	this function [-Werror=maybe-uninitialized]
2019-07-31 12:39:41 -05:00
Denis Kenzior
66b5541970 netconfig: make ROUTE_PRIORITY_OFFSET a uint32_t
Also move it up into the static variable block
2019-07-31 12:38:40 -05:00
Denis Kenzior
1fd0dbb74b netconfig: Store rtm_protocol value directly
Instead of using a flag ipv4_static, just store the value of the rtm
protocol directly inside netconfig object.  This allows us to simplify
the logic quite significantly and avoid repeating the conditional
expression needlessly
2019-07-31 04:38:54 -05:00
Tim Kourt
2eded67c62 netconfig: Install connected and gateway routes
The routes are installed as a result of a successful installation
of the IP addresses. The gateway is fetched with netconfig_ipv4_get_gateway
helper function according to the origin of the installed IP address.

The route priority offset can be set in main.conf. The default value
of 300 is used if the offset isn’t set.
2019-07-31 03:53:32 -05:00
Denis Kenzior
be5219883c rtnlutil: Simplify error handling 2019-07-31 03:53:01 -05:00
Tim Kourt
cce59ad7f1 rtnlutil: Add connected and gateway route API
The API allows to add connected and gateway routes to the main
routing table.

rtnl_route_ipv4_add_gateway() is equivalent to the following
example 'ip route' command:
ip route add default via 10.0.0.1 dev wlan0 proto dhcp src 10.0.0.2 metric 339

rtnl_route_ipv4_add_connected()  is equivalent to the following
example 'ip route' command:
sudo ip route add 10.0.0.0/24 dev wlan0 proto dhcp src 10.0.0.2 scope link

The 'ip route' output from the above commands looks as follows:

rtnl_route_ipv4_add_connected():
10.0.0.0/24 dev wlan0 proto dhcp scope link src 10.0.0.2

rtnl_route_ipv4_add_gateway():
default via 10.0.0.1 dev wlan0 proto dhcp src 10.0.0.2 metric 339
2019-07-31 03:49:35 -05:00
Tim Kourt
a91136d4b9 netconfig: Install\uninstall DNS addresses
The DNS addresses are installed as a result of a successful
installation of the IP addresses. The DNS lists are fetched
with netconfig_ipv4_get_dns helper function according to the
origin of the installed IP address.
2019-07-31 03:42:53 -05:00
Tim Kourt
372240fe8c netconfig: Refactor Install/Uninstall for IPv4 addresses 2019-07-31 03:42:01 -05:00
Tim Kourt
72e6598c6e netconfig: Switch IPv4 DHCP event handler to use ifaddr helper 2019-07-31 03:41:47 -05:00
Tim Kourt
10791d02aa netconfig: Remove no longer used static address loader
Note: there will be provided the separate helper functions for
fetching gateway and dns
2019-07-31 03:39:47 -05:00
Tim Kourt
a4a7f88ace netconfig: Refactor station state changed event logic
iwd reconfigures the wireless interfaces with respective
connection events. Each supported network protocol is
reconfigured. The address for each protocol is
selected as static or dynamic based on availability.
2019-07-31 03:38:19 -05:00
Tim Kourt
dd188bf97a netconfig: Add helper for IPv4 addresses
netconfig_ipv4_get_ifaddr helper function allows to fetch IPv4
addresses from static or dynamic sources. The origin of the addresses
is noted in 'ipv4_is_static' flag.
2019-07-31 03:35:51 -05:00
Tim Kourt
c13b0971bb netconfig: Add 'ipv4' to ipv4-specific function names 2019-07-31 03:27:38 -05:00
James Prestwood
30fc736b62 network: update several APIs to be const 2019-07-30 14:47:37 -05:00
James Prestwood
e2bed192f6 util: knownnetworks: move timespec_compare into util 2019-07-30 14:44:38 -05:00
James Prestwood
3f794a1f20 iwd: netdev: deprecate ControlPortOverNL80211
control_port_over_nl80211 should now be used instead.
2019-07-30 14:41:49 -05:00
James Prestwood
37369f1d5e iwd: station: deprecate ManagementFrameProtection
management_frame_protection should now be used instead.
2019-07-30 14:41:49 -05:00
James Prestwood
1fdea9b2d3 scan: station: parse HS20 version in scan results
For (Re)Association the HS20 indication element was passed exactly as
it was found in the scan results. The spec defines what bits can be
set and what cannot when this IE is used in (Re)Association. Instead
of assuming the AP's IE conforms to the spec, we now parse the IE and
re-build it for use with (Re)Association.

Since the full IE is no longer used, it was removed from scan_bss, and
replaced with a bit for HS20 support (hs20_capable). This member is
now used the same as hs20_ie was.

The version parsed during scan results is now used when building the
(Re)Association IE.
2019-07-24 00:22:46 -05:00
James Prestwood
6088c06507 ie: add parser/builder for hotspot indication element
The parser fully parses the IE and returns the version, Domain ID,
and PPS MO ID. This is meant to be used with an IE in scan results.

The builder only takes the version number, and assumes DGAF disabled,
and no Domain ID or PPS MO ID.
2019-07-24 00:13:27 -05:00
Tim Kourt
5478034eb7 network: Check for already connected network
Check if the requested network is already connected,
if so return success.
2019-07-23 17:19:12 -05:00
Tim Kourt
d0ee923dda station: Disconnect, if needed, on a new connection attempt
Previously, iwd used to throw net.connman.iwd.Busy when connection
attempt was made while connected. The new behavior allows iwd to
seamlessly disconnect from the connected network and attempt a new
connection.
2019-07-23 17:19:12 -05:00
James Prestwood
55491f5c02 network: add boolean for hs20 support
Since NAI realms, Roaming Consortium and HESSID are defined in 802.11,
they are not a guarentee that the network is Hotspot 2.0. The indication
element in addition to these IE's gives a better idea of Hotspot 2.0
support. Now, when a BSS is added this is_hs20 boolean will get set to
true if the HS20 IE was found in the BSS.

Now, if is_hs20 is set AND one of NAI realms, roaming consortium, or
HESSID is set we know this is a hotspot 2.0 network.
2019-07-21 15:17:05 -05:00
Denis Kenzior
46b85c00c1 netconfig: Use uint32 instead of unsigned int
For consistency, the type used to obtain the new length should be the
same as the passed in len parameter, which is uint32_t
2019-07-21 07:06:17 -05:00
Denis Kenzior
d8c058f25f netconfig: Use uint32_t len instead of int 2019-07-21 07:05:51 -05:00
Tim Kourt
18119537f7 netconfig: Unify static and dynamic addressing APIs 2019-07-21 07:05:15 -05:00
Tim Kourt
2d007a25b6 netconfig: Differentiate the origin of the addresses.
The origin of the addresses is later used with the route
installations for the convenience of the user.
2019-07-21 07:05:14 -05:00
Tim Kourt
1c7e803dbb rtnlutil: Add utility to DUMP ipv4 routes 2019-07-21 07:04:32 -05:00
Tim Kourt
83db65e929 rtnlutil: Add utility to extract route attributes 2019-07-20 06:51:46 -05:00
Tim Kourt
56670755c1 netconfig: Refactor rtnl error handling
Keep the rtnl destruction code in one place as it will have a
few more usages in the future.
2019-07-20 05:53:15 -05:00
James Prestwood
fd1a267313 scan: free hs20_ie 2019-07-18 23:35:35 -05:00
James Prestwood
0241fe81df sae: check minimum anti-clogging token size
It is possible for a zero-length anti-clogging token payload to cause
IWD to abort. If the length passed into sae_process_anti_clogging was
1, l_memdup would be called with a size of -1. This will cause malloc
to abort.

Fix this by checking for a minimum packet length and dropping the
packet if the length is too small.
2019-07-18 23:34:03 -05:00
Denis Kenzior
fe3858f738 station: Fix typo 2019-07-17 09:00:39 -05:00
James Prestwood
3c27528523 scan: station: add HS20 indication element to (Re)Association
The HS20 indication element should always be included during
(Re)Association per the spec. This removes the need for a
dedicated boolean, and now the hs20_ie can be used instead.
2019-07-16 21:14:41 -05:00
Denis Kenzior
4948bfac20 station: Add support for ProtocolVersion
ProtocolVersion in the EAPoL group can be used to force a particular
EAPoL version if the RADIUS server on a given network requires it
2019-07-16 12:00:45 -05:00
James Prestwood
a1699b1587 hotspot: add length check for roaming consortium
The hotspot spec specifically mentions the roaming consortium OI be
3 or 5 bytes long. This requirement also prevents potential buffer
overflows if the user were to configure a long roaming consortium OI.
2019-07-16 12:00:35 -05:00
Denis Kenzior
0f6d1ece78 eapol: Remove eapol_sm_set_protocol_version
Handshake state will now pick reasonable defaults
2019-07-15 21:45:58 -05:00
Denis Kenzior
d984c605f7 handshake: Add handshake_state_set_protocol_version 2019-07-15 21:45:12 -05:00
Denis Kenzior
f7e23b3512 eapolutil: Add 2010 EAP protocol version 2019-07-15 21:24:05 -05:00
Denis Kenzior
7ba4f53c57 scan: Make sure to reset triggered for aborted scans
If the scan was triggered and later aborted, make sure to reset the
triggered value when the CMD_NEW_SCAN_RESULTS event comes in.

src/station.c:station_enter_state() Old State: disconnected, new state: connecting
src/scan.c:scan_notify() Scan notification 33
src/station.c:station_netdev_event() Associating
src/scan.c:scan_notify() Scan notification 34
Aborting (signal 11) [/home/denkenz/iwd-master/src/iwd]
++++++++ backtrace ++++++++
 #0  0x7efd4d6a2ef0 in /lib64/libc.so.6
 #1  0x42b20d in scan_notify() at src/scan.c:1383
2019-07-15 15:58:03 -05:00
Denis Kenzior
5ff23af29e scan: Add extra scan_cancel debugs 2019-07-15 14:53:47 -05:00
James Prestwood
2c19085ccd anqp: move ANQP parsers into anqputil
This allows monitor to use the ANQP parser utils without depending
on netdev.
2019-07-15 14:53:44 -05:00
Tim Kourt
6efc94ff5a resolve: Fix message argument
Previously, the argument was incorrectly passed by reference
instead of by value.
2019-07-15 14:06:26 -05:00
Denis Kenzior
f557c7e6cd treewide: Use nl80211cmd_to_string
Using integer ids for event notifications received was hard to debug.
Use the nl80211cmd_to_string function to prettify these.
2019-07-15 14:06:26 -05:00
Denis Kenzior
bb61e971e5 nl80211cmd: Introduce new utility 2019-07-15 14:06:26 -05:00
James Prestwood
090ac03100 ie: expose vendor OUIs
In the same fashion as the WSC WFA OUI, ie.[ch] will now expose the
other vendor OUIs to avoid duplication across multiple files in IWD
as well as used in iwmon.
2019-07-15 12:42:22 -05:00
Andrew Zaborowski
213d75b9bb scan: Process P2P IEs from scan results 2019-07-15 12:40:44 -05:00
Andrew Zaborowski
cf684fdfa1 scan: Add option to use the NO_CCK scan flag
P2P probe requests are to be sent at min 6.0 Mb/s using OFDM,
specifically the 802.11b rates are prohibited (section 2.4.1 in Wi-Fi
P2p Technical Spec v1.7), some of which use CCK modulation.  This is
already the default for 5G but for 2.4G the drivers generally do this
if we set the NL80211_ATTR_TX_NO_CCK_RATE flags with
NL80211_CMD_TRIGGER_SCAN.
2019-07-15 11:36:34 -05:00
James Prestwood
85131f4827 hotspot: make hotspot dir not hidden 2019-07-15 11:13:55 -05:00
James Prestwood
8bcb8e870e ie: fix incorrect length check for hotspot indication
The length check was incorrectly assuming that PPS MO ID or
ANQP Domain ID would be present in the IE. Both these are optional
and without then the minimum length is 5 bytes, not 7.
2019-07-12 18:51:57 -05:00
James Prestwood
993d9cbf6b station: check hs20_capable first before ANQP
If a BSS is not a hotspot 2.0 BSS then there is no reason to bother
checking configuration files.
2019-07-12 18:51:36 -05:00
James Prestwood
b406a57ca4 station: anqp: add more debug logging 2019-07-12 16:41:56 -05:00
James Prestwood
7286a12240 station: build roaming consortium IE for netdev_connect
Per the hotspot 2.0 spec, if a matching roaming consortium OI is
found it should be added to the (Re)Association request. vendor_ies
can now be provided to netdev_connect, which get appended to the IE
attribute.
2019-07-12 16:13:50 -05:00
James Prestwood
f57ba70235 netdev: Allow to send extra vendor IEs when connecting 2019-07-12 16:13:01 -05:00
James Prestwood
79a9fdf123 hotspot: add API to get a matching roaming consortium
This API will attempt to find a matching roaming consortium OI
if present in the config file. A single matching OI is returned
or NULL if one was not found.
2019-07-12 14:13:25 -05:00
James Prestwood
27d670f432 hotspot: allow roaming consortium OI matching
Hotspot 2.0 network providers allow 'roaming' between a users home
network and other providers networks, assuming they are part of the
same roaming consortium. The roaming consortium is advertised as an
IE in beacon/probe frames.

In terms of the hotspot config files this is similar to HESSID, where
if the AP advertises the roaming consortium IE, and the config file
matches we do not need to do ANQP in order to connect.
2019-07-12 14:10:57 -05:00
James Prestwood
aeae6abcbb network: add roaming consortium IE to network object
This is duplicated when the first scan_bss is added to a network
object that contains the IE. Any future BSS's added will not re-add
the IE. Its assumed that all BSS's under a network will contain the
same roaming consortium OIs.
2019-07-12 14:05:36 -05:00
James Prestwood
9dcb6946c5 scan: parse roaming consortium IE 2019-07-12 14:03:36 -05:00
James Prestwood
ac933ad966 ie: add parsing/building for roaming consortium
Parses up to 3 (the max) roaming consortium OIs out of the roaming
consortium IE. If more OIs are available via ANQP the 'num_anqp_out'
value will be set to indicate how many more OIs are available.

Builds according to the hotspot 2.0 spec using the vendor specific
IE.
2019-07-12 14:02:18 -05:00
Eduardo Abinader
094a9ecdfa main: print version arg 2019-07-12 09:36:34 -05:00
Denis Kenzior
de131b54b8 netdev: Use RRM & send RM Enabled Capabilities IE
If supported by the wiphy and if the target AP supports Radio Management
capability, then send the relevant IE and set the USE_RRM flag on
nl80211
2019-07-10 17:01:31 -05:00
Denis Kenzior
fcb2d123bc netdev: Send extended capabilities IE on connect 2019-07-10 17:01:31 -05:00
Denis Kenzior
37610cf868 wiphy: Parse driver extended capabilities 2019-07-10 17:01:31 -05:00
Denis Kenzior
eb86da3b4b wiphy: Add wiphy_rrm_capable 2019-07-10 16:46:29 -05:00
Denis Kenzior
7b48da5df2 ie: Update Capability field defines 2019-07-10 16:46:05 -05:00
Andrew Zaborowski
14a1e322b4 p2putil: Builders for P2P action frames 2019-07-08 22:08:36 -05:00
Andrew Zaborowski
cd3c0ad155 p2putil: Builders for management frames P2P payloads 2019-07-08 22:08:15 -05:00
Andrew Zaborowski
67f91605eb p2putil: Parsers for P2P action frames
Add parsers for P2P-related Action frames and Public Action frames.
2019-07-08 22:04:12 -05:00
Andrew Zaborowski
81d17b3d43 p2putil: Parsers for management frames P2P payloads 2019-07-08 22:03:53 -05:00
Andrew Zaborowski
1f637cb054 p2putil: Add P2P frame type structures and utilities
Declare structures to hold the parsed contents of the P2P IEs and WSC
IEs in P2P-related frames and add functions to free memory used by
those structures.
2019-07-08 22:03:20 -05:00
Andrew Zaborowski
42c7ab0bae p2putil: Add P2P attribute parsers
Define structs and types for most P2P attributes and p2p_parse_attrs
similar to wsc_parse_attrs -- a generic parser for attributes in a P2P
IE payload.  This parser may write into the provided buffer even on
error but it's private to p2putil.c.  The local callers will take care
of keeping the user-provided buffers untouched on error.
2019-07-08 21:39:59 -05:00
Andrew Zaborowski
614fc0261f p2putil: Add P2P-related declarations and iterator
Add enums defining the values from the spec that we're going to be using
and add an iterator for P2P payload attributes similar to wsc_attr_iter.
2019-07-08 13:58:35 -05:00
Andrew Zaborowski
79dd14cb24 wscutil: Add wsc_build_p2p_attrs
Add a utility for building the simplified WSC IEs used in P2P action
frames and public action frames.  Only three types of WSC attributes are
mandatory in those frames (but different subsets are needed by different
frame types) so add a single utility for building those IEs.  We may
need to add some more optional attributes to those IEs later.
2019-07-08 13:46:53 -05:00
Andrew Zaborowski
cc913a6ff6 wscutil: Make wsc_parse_attrs public for P2P 2019-07-08 13:45:54 -05:00
Andrew Zaborowski
f8a51fe4c1 wscutil: Make the primary device type parser public
The P2P IE parsers can take advantage of this function
2019-07-08 13:43:24 -05:00
Andrew Zaborowski
5a40c49c44 mpdu: Validate action frame minimum length
Action frames must at least have the Category byte
2019-07-08 13:42:22 -05:00
Andrew Zaborowski
3bd265e02f ie: Add ie_tlv_encapsulate_p2p_payload 2019-07-08 13:41:18 -05:00
Andrew Zaborowski
5cb07ff116 ie: Add ie_tlv_extract_p2p_payload 2019-07-08 13:37:47 -05:00
Andrew Zaborowski
b3a395091d scan: Switch all uses of ifindex to wdev_id
The ifindex is used to index the netdevs in the system (wlan, ethernet,
etc.) but we can also do wifi scanning on interfaces that have no
corresponding netdev object, like the P2P-device virtual interfaces.
Use the wdev id's to reference interfaces, the nl80211 api doesn't care
whether we use a NL80211_ATTR_IFINDEX or NL80211_ATTR_WDEV.  Only
wireless interfaces have a wdev id.
2019-07-08 11:53:00 -05:00
Andrew Zaborowski
ec60b51d01 scan: Fix sc->get_scan_cmd_id logic
Save the actual cmd_id returned from l_genl_family_dump and zero it in
the get_scan_done.  There's no need to zero it in scan_cancel because
get_scan_done gets called automatically.
2019-07-08 11:30:51 -05:00
Andrew Zaborowski
5223dee050 scan: Reference scan_context directly from scan_results
Store the scan_context pointer in scan_results directly instead of
storing the ifindex.  We now cancel ongoing GET_SCAN commands when the
scan_context is being freed so there's no point going through the extra
step of looking up the scan_context by ifindex inside the command
callback to guard against non-existent scan_contexts.
2019-07-08 11:23:21 -05:00
Andrew Zaborowski
8cada9d1fc netdev: Add netdev_get_wdev_id 2019-07-08 11:19:32 -05:00
Tim Kourt
bc45f98f36 resolve: systemd reset DNS names for interface 2019-07-03 17:10:24 -05:00
James Prestwood
5ca3c4495e resolve: fix crash in resolve_exit
method.ops is NULL, which causes method.ops->exit to crash. This
adds a check that method.ops is not NULL before dereferencing.

Fixes:

Aborting (signal 11) [/home/jprestwo/iwd/src/iwd]
++++++++ backtrace ++++++++
0  0x7f016b59cf20 in /lib/x86_64-linux-gnu/libc.so.6
1  0x432057 in resolve_exit() at /home/jprestwo/iwd/src/resolve.c:295
2  0x403b61 in iwd_modules_exit() at /home/jprestwo/iwd/src/main.c:195
3  0x7f016b57fb97 in /lib/x86_64-linux-gnu/libc.so.6
+++++++++++++++++++++++++++
2019-07-03 13:02:28 -05:00
James Prestwood
e8d91f15a1 hotspot: allow HESSID without NAIRealmNames
The original idea was to allow the provisioning file to include HESSID
without the NAIRealmNames. Configuring this way would allow for ANQP
to be skipped completely, assuming the AP advertises its HESSID.

The way the code was written still required NAIRealmNames to be
provided in the provisioning file.
2019-07-03 13:02:28 -05:00
Tim Kourt
25ec69b358 resolve: systemd set DNS names 2019-07-02 19:12:49 -05:00
Tim Kourt
c1a1828872 resolve: Add systemd plugin skeleton
Systemd plugin is using systemd-resolved Dbus service to
manage the address resolution entries.
2019-07-02 19:11:52 -05:00
Tim Kourt
01fe343825 resolve: Add framework for resolution services
The framework enables the service specific implementations
to provide its own variations for the DNS installation tasks.
The selection of the address resolution service can be done
through dns_resolve_method setting.
2019-07-02 19:11:14 -05:00
Tim Kourt
20466cd735 resolve: Introduce resolve module
The module is responsible for the configuration of the address
resolution services. It will consist of the multiple service
specific plugins such as: systemd-resolved plugin, dnsmasq
plugin, etc.
2019-07-02 19:09:57 -05:00
Denis Kenzior
bd4446070f manager: Create interfaces with a random mac
If supported by the driver, we can create an interface directly with a
random MAC if configured to do so.  If the driver does not have this
capability, then tell netdev to perform the necessary logic as part of
the interface initialization procedure.
2019-07-02 15:47:05 -05:00
Denis Kenzior
8b375e1b28 netdev: Add logic to randomize address on creation 2019-07-02 15:47:05 -05:00
Denis Kenzior
ec38545a68 rtnlutil: Add utility to set MAC address 2019-07-02 15:47:05 -05:00
Denis Kenzior
f4402ef56e wiphy: Add wiphy_generate_random_address 2019-07-02 15:47:05 -05:00
Denis Kenzior
f72d9c2999 wiphy: Add wiphy_get_name 2019-07-02 15:47:05 -05:00
Denis Kenzior
209cdce51c hotspot: Fix crash
#0  0x7f5e25e71930 in /lib64/libc.so.6
 #1  0x446faa in hs20_config_free() at src/hotspot.c:63
 #2  0x469542 in l_queue_clear() at ell/queue.c:109
 #3  0x4694e7 in l_queue_destroy() at ell/queue.c:83
 #4  0x4475c1 in hotspot_exit() at src/hotspot.c:273
 #5  0x403170 in iwd_modules_exit() at src/main.c:195
 #6  0x404085 in main() at src/main.c:531
 #7  0x7f5e25e5cbde in /lib64/libc.so.6
2019-07-02 15:47:05 -05:00
Denis Kenzior
1c22847cf2 wiphy: Obtain permanent mac address from sysfs 2019-07-02 15:47:05 -05:00
Denis Kenzior
1e9f9e61f1 wiphy: Remove unused regulatory query / notifications
Regulatory domain management is now completely handled by the kernel, so
iwd doesn't really need to query or be aware of changes to this.  This
may change in the future, but for now this code has not been used and
can be safely gotten rid of.
2019-07-02 15:47:05 -05:00
Denis Kenzior
6414be86db wiphy: Remove protocol features query
We run on newer kernels which are guaranteed to have split wiphy dump
support.  So no point in actually querying this.
2019-07-02 15:47:05 -05:00
James Prestwood
8c0e1f62fc network: allow connections to hotspot networks 2019-06-26 23:16:38 -05:00
James Prestwood
23a7a5a614 station: allow connections to Hotspot networks
After a scan, station can now pause future scans and start ANQP requests
to discover Hotspot's NAI realm. This lets us check if the AP's NAI realm
matches any stored hotspot configuration files. If so we can connect to
this network. If the network provides an HESSID and a matching one is
found in a hotspot provisioning file we can skip ANQP and directly connect
as this is expected to be our 'home network'
2019-06-26 23:16:23 -05:00
James Prestwood
99ce41b405 netdev: remove anqp_request functionality 2019-06-26 23:09:49 -05:00
James Prestwood
3979785703 main: add anqp_init/exit 2019-06-26 23:09:47 -05:00
James Prestwood
0bde59ca13 anqp: move request functionality into anqp.c
The actual ANQP request was handled by netdev, but in the case of P2P
their may be no netdev. For this reason all functionality needed for
an ANQP request has been moved into anqp.c. There are still a few netdev
references, which need to be removed when P2P is introduced. Leaving them
in for now as its still going to work as a first pass implementation
2019-06-26 23:09:23 -05:00
James Prestwood
be9e926c6a nl80211util: move CMD_FRAME builder into nl80211util
This will be needed outside of netdev
2019-06-26 22:52:56 -05:00
James Prestwood
3d1f1eb21c main: create .hotspot directory if it does not exist 2019-06-26 14:29:48 -05:00
James Prestwood
537fcd12ca anqp: rework NAI Realm parsing
The initial ANQP parser design did not work well with how the hotspot
implementation was turning out. For one, much care was taken into parsing
the EAP credentials which are not really required. The assumption is
that any hotspot network will already be provisioned, so checking that
the EAP parameters match is a bit overkill. Instead only the NAI Realms
will be checked. This greatly simplifies the NAI realm parser, as now it
can just return a string list of realms instead of the full EAP
credential info.
2019-06-26 14:28:07 -05:00
James Prestwood
a5f2710d05 hotspot: add hotspot module
This module will be in charge of managing Hotspot provisioning files
stored under the .hotspot/ directory. This includes a dir watch to
handle file changes/removal as well as an API to match a network
object to a hotspot provisioning file.
2019-06-26 14:25:11 -05:00
James Prestwood
701a5cc41e network: store HESSID and NAI Realms in network object
Hotspot networks are supposed to include an HESSID in the scan
results. This is more or less an identifier for the overall
network. In addition, the NAI Realms can be obtained via ANQP
and should be the same for each BSS. Since both HESSID and NAI
realms should be the same for a given network in range we can
store these values in the network object itself. This also allows
us to easily find hotspot configuration files by looking at
the HESSID/NAI Realms directly in the network object as opposed
to individual scan_bss's.
2019-06-26 13:23:22 -05:00
James Prestwood
d63c8290a9 scan: add suspend/resume scan APIs
In order to do ANQP efficiently IWD needs the ability to suspend scanning
temporarily. This is because both scanning and ANQP go offchannel and must
remain off channel for some amount of time. This cannot be done
simultaneously and if e.g. ANQP is requested after a scan is already
pending, the kernel will wait till that scan finishes before sending out
the frame.
2019-06-26 13:09:48 -05:00
James Prestwood
45130ec5ee scan: parse interworking element 2019-06-26 13:07:24 -05:00
Denis Kenzior
f0848cc44a rtnlutil: Don't use explicit_bzero
Use memset instead.  explicit_bzero should only be used when we're
wiping a secret just prior to the encopassing storage being freed.  The
compiler would usually optimize away the memset, leaving the secrets
around.

In rtnlutil we're simply zeroing the structure prior to filling it, so
the use of explicit_bzero is not needed and brings confusion to the
reader since no secrets are being wiped.
2019-06-26 10:43:38 -05:00
Tim Kourt
0706a357a4 station: Integrate netconfig into station creation and removal 2019-06-26 10:40:59 -05:00
Tim Kourt
56e4dc549a netconfig: Enable config. with static IPv4 addresses 2019-06-26 10:39:50 -05:00
Tim Kourt
d80d1d5f1a netconfig: Implement address installation and removal 2019-06-26 10:38:14 -05:00
Tim Kourt
6aabd80051 rtnlutil: Utils to Add/Remove IPv4 addresses 2019-06-26 10:36:59 -05:00
Tim Kourt
b70ff5d091 netconfig: Add station state watch
netconfig is interested in three station states: connected,
disconnected and connected after it has roamed. On connected
it tries to obtain a new DHCP lease, on disconnected it stops
the DHCP client and discards all addresses from interface, on
connected after roaming it will try to request a previously
issued address.
2019-06-26 10:34:35 -05:00
Tim Kourt
3d40f3a38b netconfig: Introduce IPv4 DHCP client
The client is used to obtain and configure the dynamic IPv4
addresses for the network.
2019-06-26 10:28:18 -05:00
Tim Kourt
1368851611 netconfig: Obtain all currently assigned IPv4 addresses 2019-06-26 10:27:27 -05:00
Tim Kourt
9b0838d07c netconfig: Subscribe for IPv4 link address notifications
iwd keeps track of the addresses assigned to the managed
interfaces. The list of assigned IPv4/IPv6 addresses is stored
in ifaddr_list inside of netconfig. The tracking of the IP
addresses will help to remove them from an interface once they
are no longer valid.
2019-06-26 10:27:00 -05:00
Tim Kourt
f3f343c04b rtnlutil: Add parser for ifaddrmsg struct
Its purpose is to extract interface label, ip, and
broadcast addresses out of ifaddrmsg rntl message.
2019-06-26 10:26:26 -05:00
Tim Kourt
4e3e1fbf60 netconfig: Introduce netconfig module
netconfig module will be responsible for the orchestration
of the network configuration with the IP addresses.

iwd creates one netconfig structure per interface index.
The purpose of this struct is to hold all of the interface
related addressing states such as: assigned dhcp
clients, known addresses, routes, etc.
2019-06-26 10:25:57 -05:00
Denis Kenzior
397699c9c5 manager: Fix memory leak 2019-06-21 12:22:48 -05:00
James Prestwood
2fd58141a4 scan: fix formatting in scan.h
Replaced two 8-spaced indentation to tabs.
2019-06-18 13:29:27 -05:00
James Prestwood
baf6b3ee4d netdev: optimize GAS request timeout
A not-yet-merged kernel patch will enable the FRAME_WAIT_CANCEL
event to be emitted when a CMD_FRAME duration expires. This can
shortcut the ridiculously long timeout that is required making
GAS requests with no response drastically quicker to handle.
2019-06-14 17:42:13 -05:00
James Prestwood
1e33eaa072 scan: free osen IE 2019-06-14 17:41:57 -05:00
James Prestwood
3a8b9a5d0c netdev: support basic ANQP requests
This adds a new API netdev_anqp_request which will send out a GAS
request, parses the GAS portion of the response and forwards the
ANQP response to the callers callback.
2019-06-14 17:40:39 -05:00
James Prestwood
bed116e319 scan: add new hs20_capable member to scan_bss
If the BSS is Hotspot 2.0 capable this will get set
2019-06-14 16:24:38 -05:00
James Prestwood
cb8d592b13 scan: parse Advertisement Protocol Element
This IE tells us what Advertisement Protocols the AP supports. This
is only here to look for ANQP support, so all this does is iterate
through all other Advertisement Protocol tuples looking for ANQP.
If found, anqp_capable is set in the scan_bss
2019-06-14 16:22:36 -05:00
Denis Kenzior
b8d60bb848 anqp: Fix l_strlcpy usage 2019-06-14 16:22:22 -05:00
James Prestwood
2ce5277f6d anqp: added utility for parsing ANQP responses
Currently these are geared to support the WiFi Alliance Hotspot 2.0
ANQP elements, which all fall under the vendor specific ANQP element.

anqp_iter_next behaves similar to the genl parsers, where the id, length
and data will be returned as out parameters. Currently there is only
vendor support for Hotspot 2.0. anqp_iter_is_hs20 can be used to setup
the subtype, length, and data pointer to parse any Hotspot 2.0 ANQP
elements. From here the subtype can be checked and a vendor specific
parser for that subtype can be used to parse the data, e.g.
hs20_parse_osu_provider_nai.
2019-06-14 16:09:29 -05:00
James Prestwood
77a6b49803 wiphy: parse OFFCHANNEL_TX_OK attribute
The wiphy can indicate if it supports sending offchannel frames. This
allows us to bail out of a Hotspot connection early if this is not
supported.
2019-06-14 13:33:35 -05:00
James Prestwood
e38cbcd31b station: support OSEN IE setting in handshake
The check for MFP is now skipped for OSEN as it should not be set for
this AKM.
2019-06-10 18:25:01 -05:00
James Prestwood
c62ca4e185 scan: update vendor specific IE parsing to handle WFA
The vendor specific IE was being parsed only to check if the AP supported
WPA, which used a Microsoft OUI. Hotspot/OSEN uses neither WPA or RSN
(although its nearly identical to RSN) so the we also need to check for
this Wifi-Alliance OUI and set bss->osen (new) if found.
2019-06-10 18:23:21 -05:00
James Prestwood
d3baec4eee eapol: add eapol_find_osen
The OSEN AKM uses the vendor specific IE, so when finding the RSNE
element we need to handle it specially to ensure that its both
a vendor specific element and it matches the WFA OUI since other
vendor specific elements may be included.
2019-06-10 18:22:44 -05:00
James Prestwood
058d65c686 handshake: handle OSEN AKM when setting IEs 2019-06-10 18:21:57 -05:00
James Prestwood
b09dbcd5ac ie: add parser/builder to handle OSEN
The OSEN AKM is nearly identical to the RSN IE, but differs slightly.
For one, OSEN is encapsulated into the vendor specific IE, and includes
the WFA OUI before the 'normal' RSN elements. OSEN also does not include
a WPA version, since its not technically WPA/WPA2.

Some of the RSN parsing was made common so both RSN/OSEN parsing could
use it.
2019-06-10 18:03:10 -05:00
James Prestwood
08a3775821 station: fix compiler error after bss_free change 2019-06-10 15:19:11 -05:00
James Prestwood
0ec9618b5f station: remove print in bss_free
In environments with many APs, the debug log is spammed with this print,
which isn't particularly useful to the average user.
2019-06-10 14:15:02 -05:00
James Prestwood
039ae3659b eapol: handshake: add OSEN AKM
The handshake procedure for OSEN is part of the 'AKM_DEFINED' group
of AKMs.
2019-06-07 17:10:49 -05:00
James Prestwood
5d3b37e2e4 ie: add is_ie_wfa_ie
This checks if an IE tagged as vendor specific is a WiFi-Alliance
OUI. This is similar to how is_ie_wpa_ie works.
2019-06-07 16:15:09 -05:00
James Prestwood
2e0fed3d77 ie: add IE_RSN_AKM_SUITE_OSEN 2019-06-07 16:15:07 -05:00
James Prestwood
75e6ee98f3 handshake: simplify IE setters
The handshake object had 4 setters for authenticator/supplicant IE.
Since the IE ultimately gets put into the same buffer, there really
only needs to be a single setter for authenticator/supplicant. The
handshake object can deal with parsing to decide what kind of IE it
is (WPA or RSN).
2019-06-07 14:22:36 -05:00
James Prestwood
f6df93d358 crypto: add OSEN AKM
OSEN (OSU Server-Only authenticated layer 2 Encryption Network) is
required for the WiFi Alliance Hotspot Specification.
2019-06-07 14:22:33 -05:00
James Prestwood
6ee479f022 eap-tls: add new EAP method for Anonymous TLS
This adds the WiFi Alliance 'Anonymous TLS' EAP type.
2019-06-06 13:29:11 -05:00
James Prestwood
233804d7fc eap-tls-common: allow for EAP_TYPE_EXPANDED in TLS
The Hotspot 2.0 spec introduces 'Anonymous EAP-TLS' as a new EAP method
to be used with OSEN/Hotspot. The protocol details of this aren't
relevant to this patch, but one major difference is that it uses the
expanded EAP type rather than the TLS type. Since the common TLS code
was written with only EAP_TYPE_TLS in mind the vendor ID/type cause the
EAP packet to be malformed when using the expanded EAP type.

To handle this the common TLS code now checks the EAP type, and if its
expanded we shift the payload 7 bytes further to account for the extra
header data.
2019-06-06 13:29:11 -05:00
James Prestwood
f3ad319e59 ie: add advertisement protocol definitions
802.11 defines GAS (generic advertisement service) which can be used
to query supported advertisement protocols from an AP before
authentication/association. Hotspot/OSEN only care about the ANQP
protocol, but the way the IE is structured potentially requires
iterating through several tuples before you reach the ANQP protocol
identifier. Because of this we define all protocol identifiers.
2019-06-05 16:53:11 -05:00
Denis Kenzior
c80d32a162 ap: Convert to IWD_MODULE 2019-05-28 14:43:42 -05:00
Denis Kenzior
eeac3e8f40 adhoc: Convert to IWD_MODULE 2019-05-28 14:24:37 -05:00
Denis Kenzior
a9e3b3e906 scan: Convert to IWD_MODULE 2019-05-28 14:12:25 -05:00
Denis Kenzior
d74fcfd25c storage: Use L_TFR instead of TFR 2019-05-28 14:06:22 -05:00
Denis Kenzior
57748347b0 treewide: Use L_TFR macro 2019-05-24 11:52:40 -05:00
Denis Kenzior
865492df8c ft: Fix endianness issues
The use of mmpdu_association_response members marked as __le requires
the relevant endianness conversion.
2019-05-23 16:59:34 -05:00
Denis Kenzior
360ec1488d fils: Fix endianness issues
Using mmpdu_associate_response and mmpdu_authenticate structure
members marked __le requires the relevant endianness conversion.
2019-05-23 16:59:14 -05:00
Denis Kenzior
e53bd17992 owe: Fix endianness issues
Using mmpdu_associate_response structure members marked __le requires
the relevant endianness conversion.
2019-05-23 16:58:59 -05:00
Denis Kenzior
85bd019c85 sae: Fix endianness issues
The use of mmpdu_authentication and mmpdu_association_response members
marked as __le requires the relevant endianness conversion.
2019-05-23 16:56:45 -05:00
James Prestwood
628c079e55 station: netdev: allow FILS-FT AKMs
This adds some checks for the FT_OVER_FILS AKMs in station and netdev
allowing the FILS-FT AKMs to be selected during a connection.

Inside netdev_connect_event we actually have to skip parsing the IEs
because FILS itself takes care of this (needs to handle them specially)
2019-05-23 15:27:29 -05:00
James Prestwood
e583b1d243 fils: update to handle FILS-FT
FILS unfortunately is a special case when it comes to fast transition.
We have to process the FT IEs internally since we cannot trigger the
same initial mobility association code path (via netdev).
2019-05-23 15:26:34 -05:00
James Prestwood
5ca4fa9b9e wiphy: allow both FILS-FT AKMs to be chosen 2019-05-23 15:23:46 -05:00
James Prestwood
7f7a5c861d ft: update for larger MIC/FILS-FT 2019-05-23 15:23:46 -05:00
James Prestwood
1accf534dc ie: allow 24 byte FTE MIC
FT over FILS-SHA384 uses a 24 byte FT MIC rather than the 16 byte MIC
used for all other AKMs. This change allows both the FT builder/parser
to handle both lengths of MIC. The mic length is now passed directly
into ie_parse_fast_bss_transition and ie_build_fast_bss_transition
2019-05-23 15:23:08 -05:00
James Prestwood
4097a49669 eapol: add FILS-FT AKMs to eapol_start
This will prevent FILS-FT from starting the 4-way handshake as it
does for regular FILS
2019-05-22 16:29:23 -05:00
James Prestwood
5d2b995175 handshake: update FT derivation functions for FILS-FT
FILS-FT could derive a longer PMKR0/R1 key, as well as uses a special
xxkey that it derives during FILS.
2019-05-22 16:15:23 -05:00
James Prestwood
0e9ed03e60 handshake: update key getters for FILS-FT
FILS-FT is a special case with respect to the PTK keys. The KCK getter
was updated to handle both FT-FILS AKMs, by returning the offset in
the PTK to the special KCK generated during FILS. A getter for the KCK
length was added, which handles the SHA384 variant. The PTK size was
also updated since FILS-FT can generate an additional 56 bytes of PTK
2019-05-22 16:14:51 -05:00
James Prestwood
bc381bd8c3 crypto: update FT derivation functions to use sha384
FILS-FT requires the SHA384 KDF to derive the FT keys
2019-05-22 16:14:14 -05:00
James Prestwood
aafb3fa7ed handshake: add key for FILS-FT in handshake_state
FILS derives its own FT key, for use as xxkey during fast transition.
2019-05-22 16:14:01 -05:00
James Prestwood
e109e1b1cf crypto: pass xxkey length for crypto_derive_pmk_r0
FILS-FT has a special derivation for xxkey, and depending on AKM
the key may be 32 or 48 bytes long.
2019-05-22 16:13:57 -05:00
James Prestwood
4c32dd09f6 fils: add forgotten break 2019-05-22 16:13:08 -05:00
Denis Kenzior
03ff5ef7d0 device: Convert to using IWD_MODULE 2019-05-22 10:20:10 -05:00
Denis Kenzior
978e538f81 station: Convert to use IWD_MODULE 2019-05-22 10:20:10 -05:00
Denis Kenzior
23b278ef52 wsc: Convert to use IWD_MODULE 2019-05-22 10:20:10 -05:00
Denis Kenzior
4cfcb9c88d network: Convert to use IWD_MODULE 2019-05-22 10:20:10 -05:00
Denis Kenzior
800d57d095 knownnetworks: Convert to IWD_MODULE 2019-05-22 10:20:10 -05:00
Denis Kenzior
546c3c26d3 simauth: Convert to use IWD_MODULE 2019-05-22 10:20:08 -05:00
Denis Kenzior
b8f6899f40 blacklist: Convert to use IWD_MODULE 2019-05-22 09:58:04 -05:00
Denis Kenzior
a1d9c07f2f erp: Convert to using IWD_MODULE 2019-05-19 13:07:13 -05:00
Denis Kenzior
2386fa7938 main: Add IWD_MODULE macro 2019-05-19 13:05:06 -05:00
Denis Kenzior
8dced8b7f7 main: Update to the new genl api 2019-05-17 17:10:18 -05:00
Andrew Zaborowski
08ec88671a manager: Also delete interfaces without an ifindex, cleanup 2019-05-13 14:10:49 -05:00
Andrew Zaborowski
0b109c52b7 netdev: Add missing initialization
ifaddr is not guaranteed to be initialized, I'm not sure why there was
no compiler warning.  Also replace a | with a || for boolean conditions
and merge the wiphy check with that line.
2019-05-13 14:10:49 -05:00
Andrew Zaborowski
b86af171f0 netdev: Don't warn on genl messages not matching a netdev
This is going to be a normal situation when we start using interfaces
without an ifindex.
2019-05-13 14:10:49 -05:00
Andrew Zaborowski
925095f835 netdev: Drop remaining whitelist/blacklist code 2019-05-13 14:10:49 -05:00
Andrew Zaborowski
236dc14a3d station: Cancel the roam scan in station_free
We'd remove the roam timeout but not scancel the roam scan in
station_free, instead call station_roam_state_clear which does both
things.
2019-05-10 19:19:21 -05:00
Andrew Zaborowski
b560ca6173 scan: Make sure request is unqueued in scan_cancel
We were forgetting to handle the case of scan requests that are not at the
top of the queue.
2019-05-10 19:19:07 -05:00
Andrew Zaborowski
157d5f9f47 scan: Check if an external scan flushed intermediate results
When handling a scan finished event for a scan we haven't started check
that we were not halfway through a scan request that would have its
results flushed by the external scan.
2019-05-10 19:19:02 -05:00
Marcel Holtmann
51553415bd erp: Include src/missing.h for explicit_bzero 2019-05-10 11:06:52 +02:00
Marcel Holtmann
cab0bc29c4 sae: Include src/missing.h for explicit_bzero 2019-05-10 11:01:32 +02:00
James Prestwood
c0c8faf32f ft: netdev: station: support FT-over-DS
FT-over-DS is a way to do a Fast BSS Transition using action frames for
the authenticate step. This allows a station to start a fast transition
to a target AP while still being connected to the original AP. This,
in theory, can result in less carrier downtime.

The existing ft_sm_new was removed, and two new constructors were added;
one for over-air, and another for over-ds. The internals of ft.c mostly
remain the same. A flag to distinguish between air/ds was added along
with a new parser to parse the action frames rather than authenticate
frames. The IE parsing is identical.

Netdev now just initializes the auth-proto differently depending on if
its doing over-air or over-ds. A new TX authenticate function was added
and used for over-ds. This will send out the IEs from ft.c with an
FT Request action frame.

The FT Response action frame is then recieved from the AP and fed into
the auth-proto state machine. After this point ft-over-ds behaves the
same as ft-over-air (associate to the target AP).

Some simple code was added in station.c to determine if over-air or
over-ds should be used. FT-over-DS can be beneficial in cases where the
AP is directing us to roam, or if the RSSI falls below a threshold.
It should not be used if we have lost communication to the AP all
(beacon lost) as it only works while we can still talk to the original
AP.
2019-05-09 13:38:34 -05:00
James Prestwood
a432ceeee4 netdev: modify netdev_send_action_frame for ft-over-ds
To support FT-over-DS this API needed some slight modifications:

- Instead of setting the DA to netdev->handshake->aa, it is just set to
  the same address as the 'to' parameter. The kernel actually requires
  and checks for these addresses to match. All occurences were passing
  the handshake->aa anyways so this change should have no adverse
  affects; and its actually required by ft-over-ds to pass in the
  previous BSSID, so hard coding handshake->aa will not work.

- The frequency is is also passed in now, as ft-over-ds needs to use
  the frequency of the currently connected AP (netdev->frequency get
  set to the new target in netdev_fast_transition. Previous frequency
  is also saved now).

- A new vector variant (netdev_send_action_framev) was added as well
  to support sending out the FT Request action frame since the FT
  TX authenticate function provides an iovec of the IEs. The existing
  function was already having to prepend the action frame header to
  the body, so its not any more or less copying to do the same thing
  with an iovec instead.
2019-05-09 13:32:45 -05:00
James Prestwood
03807e12e1 ft: netdev: move Authenticate IE building into ft.c
Since FT already handles processing the FT IE's (and building for
associate) it didn't make sense to have all the IE building inside
netdev_build_cmd_ft_authenticate. Instead this logic was moved into
ft.c, and an iovec is now passed from FT into
netdev_ft_tx_authenticate. This leaves the netdev command builder
unburdened by the details of FT, as well as prepares for FT-over-DS.
2019-05-09 12:22:01 -05:00
Andrew Zaborowski
36c08b9508 manager: Disable touching interfaces for some drivers
Blacklist some drivers known to crash when interfaces are deleted or
created so that we don't even attempt that before falling back to using
the default interface.
2019-05-08 11:52:52 -05:00
Andrew Zaborowski
ac2eeab570 wiphy: Add wiphy_get_driver api
Read the driver name for each wiphy from sysfs if available.  I didn't
find a better way to obtain the driver name for a phy than by reading
the dir name that the "driver" symlink points at.  For an existing
netdev this can be done using the SIOCETHTOOL ioctl.
2019-05-08 11:52:25 -05:00
Andrew Zaborowski
7ce8d9d8b6 manager: Fix iteration over wiphy setup states
manager_interface_dump_done would use manager_create_interfaces() at the
end of the loop iterating over pending_wiphys.  To prevent it from
crashing make sure manager_create_interfaces never frees the pending
wiphy state and instead make the caller check whether it needs to be
freed so it can be done safely inside loops.
2019-05-08 11:52:14 -05:00
Andrew Zaborowski
8db47ed21d scan: Use scan requests for the periodic scans, refactor
Instead of having two separate types of scans make the periodic scan
logic a layer on top of the one-off scan requests, with minimum code to
account for the lower priority of those scans and the fact that periodic
scans also receive results from external scans.  Also try to simplify
the code for both the periodic and one-off scans.  In the SCAN_RESULTS
and SCAN_ABORT add more complete checks of the current request's state
so we avoid some existing crashes related to external scans.

scan_send_next_cmd and start_next_scan_request are now just one function
since their funcionality was similar and start_next_scan_request is used
everywhere.  Also the state after the trigger command receives an EBUSY
is now the same as when a new scan is on top of the queue so we have
fewer situations to consider.

This code still does not account for fragmented scans where an external
scan between two or our fragments flushes the results and we lose some
of the results, or for fragmented scans that take over 30s and the
kernel expires some results (both situations are unlikely.)
2019-05-08 11:31:02 -05:00
James Prestwood
ce7df37132 netdev: remove in_ft checks and set_use_eapol_start
In both netdev_{authenticate,associate}_event there is no need to check
for in_ft at the start since netdev->ap will always be set if in_ft is
set.

There was also no need to set eapol_sm_set_use_eapol_start, as setting
require_handshake implies this and achieves the same result when starting
the SM.
2019-05-07 15:50:05 -05:00
James Prestwood
567f35c32f netdev: ft: refactor FT into an auth-proto
Since FT operates over Authenticate/Associate, it makes the most sense
for it to behave like the other auth-protos.

This change moves all the FT specific processing out of netdev and into
ft.c. The bulk of the changes were strait copy-pastes from netdev into
ft.c with minor API changes (e.g. remove struct netdev).

The 'in_ft' boolean unforunately is still required for a few reasons:

 - netdev_disconnect_event relies on this flag so it can ignore the
   disconnect which comes in when doing a fast transition. We cannot
   simply check netdev->ap because this would cause the other auth-protos
   to not handle a disconnect correctly.
 - netdev_associate_event needs to correctly setup the eapol_sm when
   in FT mode by setting require_handshake and use_eapol_start to false.
   This cannot be handled inside eapol by checking the AKM because an AP
   may only advertise a FT AKM, and the initial mobility association
   does require the 4-way handshake.
2019-05-07 14:19:26 -05:00
James Prestwood
87346212c9 ft: rename ftutil to ft (prep for auth-proto)
Now the 'ft' module, previously ftutil, will be used to drive FT via
the auth-proto virtual class. This renaming is in preparation as
ftutil will become obsolete since all the IE building/processing is
going to be moved out of netdev. The new ft.c module will utilize
the existing ftutil functionality, but since this is now a full blown
auth protocol naming it 'ft' is better suited.
2019-05-07 14:09:08 -05:00
James Prestwood
d1286200e9 netdev: move connect completion into netdev_connect_event
The duplicate/similar code in netdev_associate_event and
netdev_connect_event leads to very hard to follow code, especially
when you throw OWE/SAE/FILS or full mac cards into the mix.
Currently these protocols finish the connection inside
netdev_associate_event, and set ignore_connect_event. But for full
mac cards we must finish the connection in netdev_connect_event.

In attempt to simplify this, all connections will be completed
and/or the 4-way started in netdev_connect_event. This satisfies
both soft/full mac cards as well as simplifies the FT processing
in netdev_associate_event. Since the FT IEs can be processed in
netdev_connect_event (as they already are to support full mac)
we can assume that any FT processing inside netdev_associate_event
is for a fast transition, not initial mobility association. This
simplifies netdev_ft_process_associate by removing all the blocks
that would get hit if transition == false.

Handling FT this way also fixes FT-SAE which was broken after the
auth-proto changes since the initial mobility association was
never processed if there was an auth-proto running.
2019-05-07 12:12:17 -05:00
Tim Kourt
e282d1fedf netdev: use rtnlutil for linkmode/operstate 2019-05-06 13:21:36 -05:00
Tim Kourt
5104e6752f rtnlutil: Introduce rtnl utility
The rtnl utility will encapsulate a collection of functions for rtnl ops.
2019-05-06 13:21:15 -05:00
James Prestwood
b0ef0a79a8 erp: zero keys on free 2019-05-03 14:53:57 -05:00
James Prestwood
08f2ccedee sae: netdev: update to use auth_proto concepts
SAE was a bit trickier than OWE/FILS because the initial implementation
for SAE did not include parsing raw authenticate frames (netdev skipped
the header and passed just the authentication data). OWE/FILS did not
do this and parse the entire frame in the RX callbacks. Because of this
it was not as simple as just setting some RX callbacks. In addition,
the TX functions include some of the authentication header/data, but
not all (thanks NL80211), so this will require an overhaul to test-sae
since the unit test passes frames from one SM to another to test the
protocol end-to-end (essentially the header needs to be prepended to
any data coming from the TX functions for the end-to-end tests).
2019-05-03 14:42:38 -05:00
James Prestwood
34a0f833a4 owe: netdev: update to use auth_proto concepts 2019-05-03 14:37:11 -05:00
James Prestwood
869cac4bec eapol: remove eapol_set_started, no longer needed 2019-05-03 14:37:11 -05:00
James Prestwood
8317b96e7d fils: netdev: update to use auth_proto concepts 2019-05-03 14:37:11 -05:00
Denis Kenzior
f0de2516ea erp: Return const void * instead 2019-05-03 14:17:17 -05:00
James Prestwood
8c11fdabcc erp: remove 'complete' callback
Since ERP is only used for FILS and not behaving in the 'normal' ERP
fashion (dealing with actual EAP data, timeouts etc.) we can structure
ERP as a more synchronous protocol, removing the need for a complete
callback.

Now, erp_rx_packet returns a status, so FILS can decide how to handle
any failures. The complete callback was also removed in favor of a
getter for the RMSK (erp_get_rmsk). This allows FILS to syncronously
handle ERP, and potentially fail directly in fils_rx_authenticate.
2019-05-03 14:11:57 -05:00
James Prestwood
d02c038a0d eapol: allow FILS to use eapol_start
A new eapol API was added specifically for FILS (eapol_set_started). Since
either way is special cased for FILS, its a bit cleaner to just check the
AKM inside eapol_start and, if FILS, dont start any timeouts or start the
handshake (effectively what eapol_set_started was doing).
2019-05-03 14:08:28 -05:00
James Prestwood
11443c03bc auth-proto: introduce auth-proto concept
This is a new concept applying to any protocol working over authenticate
and/or associate frames (OWE/SAE/FILS). All these protocols behave
similarly enough that they can be unified into a handshake driver
structure.

Now, each protocol will initialize this auth_proto structure inside
their own internal data. The auth_proto will be returned from
the initializer which netdev can then use to manage the protocol by
forwarding authenticate/associate frames into the individual drivers.

The auth_proto consists only of function pointers:

start - starts the protocol
free  - frees the driver data
rx_authenticate - receive authenticate frame
rx_associate - receive associate frame
auth_timeout - authenticate frame timed out
assoc_timeout - associate frame timed out
2019-05-03 13:53:50 -05:00
Andrew Zaborowski
7bc553e470 manager: Add use_default_if setting
If the setting is true we'll not attempt to remove or create
interfaces on any wiphys and will only use the default interface
(if it exists).  If false, force us managing the interfaces.  Both
values override the auto logic.
2019-05-02 10:47:45 -05:00
Andrew Zaborowski
06eb3bbf6a manager: Set state->use_default in manager_rx_cmd_new_wiphy
Make sure this gets set both when we discover a wiphy through a netlink
event in runtime, and when we dump all wiphys on startup.
2019-05-02 10:47:45 -05:00
Andrew Zaborowski
922f4a30dd netdev: Check connected when handling Associate
An unexpected Associate event would cause iwd to crash when accessing
netdev->handshake->mde.  netdev->handshake is only set if we're
attempting to connect or connected somewhere so check netdev->connected
first.
2019-05-02 10:37:30 -05:00
Andrew Zaborowski
2c33cf2b33 scan: Reset sp.timeout in destroy callback 2019-05-01 11:47:50 -05:00
Andrew Zaborowski
09e31282b3 scan: Drop check that always true 2019-05-01 11:45:41 -05:00
Andrew Zaborowski
32dc69ffab scan: Add static qualifiers, remove initializers 2019-05-01 11:45:25 -05:00
Marcel Holtmann
35743fa32a eap: Use l_malloc to avoid variable-length array bound is unknown error 2019-04-30 17:11:39 +02:00
James Prestwood
6ac189315a eapol: allow FILS PTK rekeys
As with FILS GTK rekeys, the PTK rekeys use AES-SIV to encrypt and
do not use a MIC
2019-04-26 16:06:53 -05:00
James Prestwood
83212f9b23 eapol: change eapol_create_common to support FILS
FILS needs to allocate an extra 16 bytes of key data for the AES-SIV
vector. Instead of leaving it up to the caller to figure this out (as
was done with the GTK builder) eapol_create_common can allocate the
extra space since it knows the MIC length.

This also updates _create_gtk_2_of_2 as it no longer needs to create
an extra data array.
2019-04-26 14:00:12 -05:00
James Prestwood
00cbd171f1 fils: add support for PMKID derivation
FILS defines its own derivation for the PMKID, which is just a
SHA256 or SHA384 hash of the ERP data. Setting the PMKID will
allow FILS PTK rekeys.
2019-04-26 12:40:02 -05:00
James Prestwood
4f7d7684a3 eapol: add common function for AES-SIV
To avoid duplicate code in PTK/GTK rekeys a common function was
added which performs the encryption in place in the key frame.
2019-04-26 12:36:37 -05:00
James Prestwood
2fd755c285 eapol: update eapol_key_handle to work with FILS rekeys
Since FILS does not use a MIC, the 1/4 handler would always get called
for FILS PTK rekeys. We can use the fact that message 1/4 has no MIC as
well as no encrypted data to determine which packet it is. Both no MIC
and no encrypted data means its message 1/4. Anything else is 3/4.
2019-04-26 12:35:53 -05:00
James Prestwood
028e755d42 handshake: allow SHA384 PTK derivation (for FILS)
For FILS rekeys, we still derive the PTK using the 4-way handshake.
And for FILS-SHA384 we need the SHA384 KDF variant when deriving.

This change adds both FILS-SHA256 and FILS-SHA384 to the checks
for determining the SHA variant.
2019-04-26 12:28:51 -05:00
James Prestwood
62097e7d82 crypto: allow PTK derivation using SHA384
crypto_derive_pairwise_ptk was taking a boolean to decide whether to
use SHA1 or SHA256, but for FILS SHA384 may also be required for
rekeys depending on the AKM.

crypto_derive_pairwise_ptk was changed to take l_checksum_type instead
of a boolean to allow for all 3 SHA types.
2019-04-26 12:28:40 -05:00
James Prestwood
733679ff7f eapol: Update _verify_ptk_3_of_4 to work with no MIC
A similar change was made to _verify_gtk_1_of_2 in order for
verification to work when no MIC is being used (FILS rekeys)
2019-04-26 12:24:42 -05:00
James Prestwood
8ceb4a31ef ie: remove unused struct declaration 2019-04-26 12:23:36 -05:00
James Prestwood
78b5f56516 ap: update to use new TLV builder APIs
AP still relies on the get_data/set_length semantics. Its more convenient
to still use these since it avoids the need for extra temporary buffers
when building the rates IE.
2019-04-23 12:56:20 -05:00
James Prestwood
856b21d9ba fils: update TLV builder code to use new APIs 2019-04-23 12:56:20 -05:00
James Prestwood
d2e7d47c84 ie: fix ie_tlv_builder semantics
The TLV builder APIs were not very intuative, and in some (or all)
cases required access to the builder structure directly, either to
set the TLV buffer or to get the buffer at the end.

This change adds a new API, ie_tlv_builder_set_data, which both sets
the length for the current TLV and copies the TLV data in one go.
This will avoid the need for memcpy(ie_tlv_builder_get_data(...),...)

ie_tlv_builder_finalize was also changed to return a pointer to the
start of the build buffer. This will eliminate the need to access
builder.tlv after building the TLVs.

ie_tlv_builder_init was changed to take an optional buffer to hold
the TLV data. Passing NULL/0 will build the TLV in the internal
buffer. Passing in a pointer and length will build into the passed
in buffer.
2019-04-23 12:56:20 -05:00
Andrew Zaborowski
14d69873b0 wiphy: Add wiphy_create_complete
Let manager.c signal to wiphy.c when the wiphy parsing from the genl
messages is complete.  When we query for existing wiphy using the
GET_WIPHY dump command we get many genl messages per wiphy, on a
notification we only get one message.  So after wiphy_create there may
be one or many calls to wiphy_update_from_genl.  wiphy_create_complete
is called after all of them, so wiphy.c can be sure it's done with
parsing the wiphy attributes when in prints the new wiphy summary log
message, like it did before manager.c was added.

I had wrongly assumed that all the important wiphy attributes were in
the first message in the dump, but NL80211_ATTR_EXT_FEATURES was not and
wasn't being parsed which was breaking at least testRSSIAgent.
2019-04-22 16:34:51 -05:00
James Prestwood
6ea74d77cc eap-sim: derive session-ID for ERP 2019-04-22 16:31:19 -05:00
James Prestwood
2cbdc1aa43 eap-aka: derive Session-ID for ERP 2019-04-22 16:31:14 -05:00
James Prestwood
e7219cbcc5 netdev: free SAE SM once protocol has completed
SAE was behaving inconsitently with respect to freeing the state.
It was freeing the SM internally on failure, but requiring netdev
free it on success.

This removes the call to sae_sm_free in sae.c upon failure, and
instead netdev frees the SM in the complete callback in all cases
regardless of success or failure.
2019-04-22 16:26:11 -05:00
James Prestwood
ea571bc6ac netdev: free OWE SM once protocol has completed
The OWE SM is not needed once the OWE protocol completes. We can
free it immediately in netdev_owe_complete (unless retrying).
2019-04-22 16:25:31 -05:00
James Prestwood
5cc0148e7f station: enable FILS support
station will now check if ERP has cached keys for FILS when building
the handshake, as well as get the ERP cache and set it into the
handshake object.
2019-04-22 14:56:48 -05:00
James Prestwood
b125976fea netdev: add FILS support
From netdev's prospective FILS works the same as OWE/SAE where we create
a fils_sm and forward all auth/assoc frames into the FILS module. The
only real difference is we do not start EAPoL once FILS completes.
2019-04-22 14:55:41 -05:00
James Prestwood
73c9a126bd fils: implementation for FILS
FILS (Fast Initial Link Setup) allows a station to negotiate a PTK during
authentication and association. This allows for a faster connection as
opposed to doing full EAP and the 4-way. FILS uses ERP (EAP Reauth Protocol)
to achieve this, but encapsulates the ERP data into an IE inside
authenticate frames. Association is then used to verify both sides have
valid keys, as well as delivering the GTK/IGTK.

FILS will work similar to SAE/OWE/FT where netdev registers a fils_sm, and
then forwards all Auth/Assoc frame data to and from the FILS module.
2019-04-22 14:55:02 -05:00
James Prestwood
91cdd86e0d handshake: add ERP cache object to handshake
Keeping the ERP cache on the handshake object allows station.c to
handle all the ERP details and encapsulate them into a handshake.
FILS can then use the ERP cache right from the handshake rather
than getting it itself.
2019-04-22 14:55:02 -05:00
James Prestwood
bc7b12d1a4 wiphy: handle FILS AKMs
wiphy_select_akm needed to be updated to take a flag, which can be
set to true if there are known reauth keys for this connection. If
we have reauth keys, and FILS is available we will choose it.
2019-04-19 15:05:23 -05:00
James Prestwood
b829daaab7 owe: fix group renegotiation to not reauthenticate
If the AP send an associate with an unsupported group status, OWE
was completely starting over and sending out an authenticate frame
when it could instead just resend the associate frame with a
different group.
2019-04-19 13:52:28 -05:00
James Prestwood
17e3a5ee3c handshake: add setter for PTK
With FILS support coming there needs to be a way to set the PTK directly.
Other AKMs derive the PTK via the 4-way handshake, but FILS computes the
PTK on its own.
2019-04-18 10:55:24 -05:00
Denis Kenzior
b768e26f1d Revert "mschaputil: use util_get_username"
This reverts commit 1e337259ce.

Using util_get_username was wrong in this context.  MSCHAPv2 expects us
to only strip the domain name from identities of the form
domain\identity.  util_get_username would also strip identities of the
form username@domain.com.
2019-04-18 10:46:56 -05:00
James Prestwood
349acf292f eapol: fix kek length for FILS rekeys (SHA384)
FILS-SHA384 got overlooked and the kek length was being hard coded
to 32 bytes when encrypting the key data. There was also one occurence
where the kek_len was just being set incorrectly.
2019-04-17 19:33:55 -05:00
James Prestwood
e940fc9282 handshake: add handshake_state_get_kek_len 2019-04-17 19:33:51 -05:00
Denis Kenzior
89017afdb2 crypto: Skip aes-ctr decryption for in_len = 16
If the input length is 16 bytes, this means aes_siv_decrypt should
only be verifying the 16 byte SIV and not decrypting any data. If
this is the case, we can skip over the whole AES-CTR portion of
AES-SIV and only verify the SIV.
2019-04-17 18:59:27 -05:00
James Prestwood
799a29d37c eapol: only check for snonce if MIC is used
In eapol_key_handle, 'have_snonce' is checked before decrypting the
key data. For FILS, there will be no snonce so this check can be
skipped if mic_len == 0.
2019-04-17 18:40:46 -05:00
James Prestwood
c21f3cd2a4 eapol: allow FILS GTK handshake
The GTK handshake for FILS uses AES-SIV to encrypt the key data, and
does away with the MIC completely. Now, when finalizing the 2/2 GTK
packet we check the MIC length, and if zero we assume FILS is being
used and we use AES-SIV to encrypt the key data.

For FILS, there is no actual data being encrypted for GTK 2/2 (hence
why the input data length is zero). This results in only the SIV
being generated, which essentially serves the same purpose as a MIC.
2019-04-17 18:40:46 -05:00
James Prestwood
a6640f1b7a eapol: allow eapol_decrypt_key_data to work with FILS
FILS falls under the 'AKM defined' key descriptor, and uses AES-SIV.
2019-04-17 18:40:46 -05:00
James Prestwood
368d6714b9 eapol: allow _create_gtk_2_of_2 to work without MIC
FILS does not use a MIC, as well as requires encrypted data on GTK 2/2.
This updates eapol_create_gtk_2_of_2 to pass in extra data to
eapol_create_common, which will reserve room for this encrypted data.
Extra data is only reserved if mic_len == 0.
2019-04-17 18:40:46 -05:00
James Prestwood
ca63ac2342 eapol: allow eapol_create_common to work with no MIC
FILS does not use a MIC in EAPoL frames and also requires encrypted
data on all EAPoL frames. In the common builder the mic_len is now
checked and the flags are set appropriately.
2019-04-17 18:40:46 -05:00
James Prestwood
62e20ca285 eapol: pass mic_len in gtk 1/2 verify
FILS authentication does away with the MIC, so checking for key_mic
in the eapol key frame does not allow FILS to work. Now we pass in
the mic_len to eapol_verify_gtk_1_of_2, and if it is non-zero we can
check that the MIC is present in the frame.
2019-04-17 18:40:46 -05:00
James Prestwood
82eeef1c29 eapol: add eapol_set_started
FILS does not require an eapol_sm for authentication, but rekeys
are still performed using the 4-way handshake. Because of this
FILS needs to create a eapol_sm in a 'started' state, but without
calling eapol_start as this will initialize EAP and create handshake
timeouts.

This allows EAPoL to wait for any 4-way packets, and handle them
as rekeys.
2019-04-17 18:40:46 -05:00
James Prestwood
433373fe28 eapol: cache ERP keys on EAP success 2019-04-17 17:06:25 -05:00
James Prestwood
7f502ff16f main: initialize erp 2019-04-17 17:06:25 -05:00
James Prestwood
d938d362b2 erp: ERP implementation and key cache move
ERP (EAP Reauthentication Protocol) allows a station to quickly
reauthenticate using keys from a previous EAP authentication.

This change both implements ERP as well as moves the key cache into
the ERP module.

ERP in its current form is here to only support FILS. ERP is likely not
widespread and there is no easy way to determine if an AP supports ERP
without trying it. Attempting ERP with a non-ERP enabled AP will actually
result in longer connection times since ERP must fail and then full EAP
is done afterwards. For this reason ERP was separated from EAP and a
separate ERP state machine must be created. As it stands now, ERP cannot
be used on its own, only with FILS.
2019-04-17 17:06:25 -05:00
James Prestwood
5e28b314a7 crypto: add aes_siv_{encrypt,decrypt}
FILS requires AES-SIV for rekeys
2019-04-17 13:55:11 -05:00
Tim Kourt
1c04707487 station: Add quick scan
Quick scan uses a set of frequencies associated with the
known networks. This allows to reduce the scan latency.
At this time, the frequency selection follows a very simple
logic by taking all known frequencies from the top 5 most
recently connected networks.
If connection isn't established after the quick scan attempt,
we fall back to the full periodic scan.
2019-04-16 18:16:04 -05:00
Tim Kourt
5c9138ed7d knownnetworks: Add lookup API for recent frequencies
The returned scan_freq_set contains the known frequencies from
the top most recently connected networks.
2019-04-16 18:14:35 -05:00
Denis Kenzior
02b3ab6793 manager: Run an interface dump on startup
Instead of handling NEW_WIPHY events and WIHPY_DUMP events in a similar
fashion, split up the paths to optimize iwd startup time.  There's
fundamentally no reason to wait a second (and eat up file-descriptor
resources for timers unnecessarily) when we can simply start an
interface dump right after the wiphy dump.

In case a new wiphy is added in the middle of a wiphy dump, we will
likely get a new wiphy event anyway, in which case a setup_timeout will
be created and we will ignore this phy during the interface dump
processing.

This also optimizes the case of iwd being re-started, in which case
there are no interfaces present.
2019-04-16 17:51:00 -05:00
Denis Kenzior
d99242846c manager: Split up new_wiphy dumps & events
Separate out the two types of NEW_WIPHY handlers into separate paths and
factor out the common code into a utility function.

Dumps of CMD_NEW_WIPHY can be split up over several messages, while
CMD_NEW_WIPHY events (generated when a new card is plugged in) are
stuffed into a single message.

This also prepares ground for follow-on commits where we will handle the
two types of events differently.
2019-04-16 17:51:00 -05:00
Denis Kenzior
1b08602727 manager: Make sure to not leak msg on failure:wq 2019-04-16 17:51:00 -05:00
Denis Kenzior
d85e6eedff manager: Don't try to create pending_state more than once 2019-04-16 17:51:00 -05:00
Denis Kenzior
5cfc6e513d netdev: Fix crash
src/netdev.c:netdev_create_from_genl() Skipping duplicate netdev wlp2s0[3]
Aborting (signal 11) [/home/denkenz/iwd/src/iwd]
++++++++ backtrace ++++++++
 #0  0x7fc4c7a4e930 in /lib64/libc.so.6
 #1  0x40ea13 in netdev_getlink_cb() at src/netdev.c:4654
 #2  0x468cab in process_message() at ell/netlink.c:183
 #3  0x4690a3 in can_read_data() at ell/netlink.c:289
 #4  0x46681d in io_callback() at ell/io.c:126
 #5  0x4651cd in l_main_iterate() at ell/main.c:473
 #6  0x46530e in l_main_run() at ell/main.c:516
 #7  0x465626 in l_main_run_with_signal() at ell/main.c:642
 #8  0x403df8 in main() at src/main.c:513
 #9  0x7fc4c7a39bde in /lib64/libc.so.6
2019-04-16 17:51:00 -05:00
Andrew Zaborowski
467b6341d8 manager: Handle interface white/blacklists
Mirror netdev.c white/blacklist logic.  If either or both the whitelist
and the blacklist are given also fall back to not touching the existing
interface setup on the wiphy.
2019-04-16 17:51:00 -05:00
Andrew Zaborowski
9e079ba4fc manager: Fallback to old logic for some drivers
If we get an error during DEL_INTERFACE or NEW_INTERFACE we may be
dealing with a driver that doesn't implement virtual interfaces or
doesn't implement deleting the default interface.  In this case fall
back to using the first usable interface that we've detected on this
wiphy.

There's at least one full-mac driver that doesn't implement the cfg80211
.del_virtual_intf and .add_virtual_intf methods and at least one that
only allows P2P interfaces to be manipulated.  mac80211 drivers seem to
at least implement those methods but I didn't check to see if there are
driver where they'd eventually return EOPNOTSUPP.
2019-04-16 17:51:00 -05:00
Andrew Zaborowski
2ea9db9cae netdev: Drop netdev creation logic 2019-04-16 17:51:00 -05:00
Andrew Zaborowski
d907593c08 manager: Create an interface on each wiphy and register netdevs
This is probably the trickiest part in this patchset.  I'm introducing a
new logic where instead of using the interfaces that we find present
when a wiphy is detected, which would normally be the one default
interface per wiphy but could be 0 or more than one, we create one
ourselves with the socket owner attribute and use exactly one for
Station, AP and Ad-Hoc modes.  When IWD starts we delete all the
interfaces on existing wiphys that we're going to use (as determined by
the wiphy white/blacklists) or freshly hotplugged ones, and only then we
register the interface we're going to use meaning that the wiphy's
limits on the number of concurrent interfaces of each type should be at
0.  Otherwise we'd be unlikely to be abe to create the station interface
as most adapters only allow one.  After that we ignore any interfaces
that may be created by other processes as we have no use for multiple
station interfaces.

At this point manager.c only keeps local state for wiphys during
the interface setup although when we start adding P2P code we will be
creating and removing interfaces multiple times during the wiphy's
runtime and may need to track it here or in wiphy.c.  We do not
specifically check the interface number limits received during the wiphy
dump, if we need to create any interfaces and we're over the driver's
maximum for that specific iftype we'll still attempt it and report error
if it fails.

I tested this and it seems to work with my laptop's intel card and some
USB hotplug adapters.
2019-04-16 17:51:00 -05:00
Denis Kenzior
edade7f19c netdev: Fix handshake failures on FT-PSK + FullMac
The latest refactoring ended up assuming that FT related elements would
be handled in netdev_associate_event.  However, FullMac cards (that do
not generate netdev_associate_event) could still connect using FT AKMs
and perform the Initial mobility association.  In such cases the FTE
element was required but ended up not being set into the handshake.
This caused the handshake to fail during PTK 1_of_4 processing.

Fix this by making sure that FTE + related info is set into the
handshake, albeit with a lower sanity checking level since the
elements have been processed by the firmware already.

Note that it is currently impossible for actual FTs to be performed on
FullMac cards, so the extra logic and sanity checking to handle these
can be skipped.
2019-04-15 17:32:12 -05:00
Tim Kourt
c44da22470 wiphy: Add freq set constrain API 2019-04-15 12:34:36 -05:00
Tim Kourt
5be3de7484 knownnetworks: Add known frequencies
Add functionality to read and parse the known frequencies
from permanent storage on start of the service. On service
shutdown, we sync the known frequencies back to the permanent
storage.
2019-04-15 12:30:13 -05:00
Tim Kourt
c3e79a4f2a network: Introduce a concept of known frequencies
Each known network (previously connected) will have a set
of known frequencies associated with it, e.g. a set of
frequencies from all BSSs observed. The list of known
frequencies is sorted with the most recently observed
frequency in the head.
2019-04-15 12:29:48 -05:00
Tim Kourt
8881910662 station: Start removing scan results based on age
Previously, the scan results were disregarded once the new
ones were available. To enable the scan scenarios where the
new scan results are delivered in parts, we introduce a
concept of aging BSSs and will remove them based on
retention time.
2019-04-15 12:25:30 -05:00
Tim Kourt
e01368b848 scan: Add randomization of SN for probe requests 2019-04-11 16:57:07 -05:00
Tim Kourt
b1d77d52b9 scan: Use randomization flag only for active scans 2019-04-11 16:56:44 -05:00
Tim Kourt
91105768e0 knownnetworks: Enable setting Autoconnect property over DBus 2019-04-11 12:09:27 -05:00
Denis Kenzior
5a28504d9e manager: Simplify logic 2019-04-11 12:09:07 -05:00
Denis Kenzior
72158e66da main: Move manager initialization
The order of wiphy / netdev dumps matters.  So to preserve the old
behavior, move manager initialization up.
2019-04-11 12:09:07 -05:00
Andrew Zaborowski
65109ec46d wiphy: Drop wiphy creation logic 2019-04-11 11:20:04 -05:00
Andrew Zaborowski
530a449337 manager: Add new file for wiphy/interface management
Add manager.c, a new file where the wiphy and interface creation/removal
will be handled and interface use policies will be implemented.  Since
not all kernel-side nl80211 interfaces are tied to kernel-side netdevs,
netdev.c can't manage all of the interfaces that we will be using, so
the logic is being moved to a common place where all interfaces on a
wiphy will be managed according to the policy, device support for things
like P2P and user enabling/disabling/connecting with P2P which require
interfaces to be dynamically added and removed.
2019-04-11 11:17:52 -05:00
Andrew Zaborowski
4a969294f7 wiphy: Add wiphy_create/wiphy_destroy API
Add wiphy_create, wiphy_update_from_genl and wiphy_destroy that together
will let a new file command the wiphy creation, updates and deletion
with the same functionality the current config notification handler
implements in wiphy.c.
2019-04-11 11:15:10 -05:00
Andrew Zaborowski
fd0892baf0 wiphy: Make wiphy_parse_id_and_name public 2019-04-11 11:13:28 -05:00
Andrew Zaborowski
c06754a978 wiphy: Drop name_len from wiphy_parse_id_and_name
As mentioned in code comments the name is NUL-terminated so there's no
need to return the length path, which was ignored in some occasions
anyway.  Consistently treat it as NUL-terminated but also validate.
2019-04-11 11:11:52 -05:00
Andrew Zaborowski
8f910518c4 netdev: Make netdev_create_from_genl, netdev_destroy public
Make netdev_create_from_genl public and change signature to return the
created netdev or NULL.  Also add netdev_destroy that destroys and
unregisters the created netdevs.  Both will be used to move the
whole interface management to a new file.
2019-04-11 11:04:16 -05:00
Andrew Zaborowski
ceb605a2cc dbus: Add p2p iftypes in dbus_iftype_to_string 2019-04-11 11:01:09 -05:00
Tim Kourt
531bb3f0b5 knownnetworks: Load Autoconnect along with other settings
Previously, 'Autoconnect' setting was loaded only at the
connection time, this patch makes autoconnect to load along
with other settings.
2019-04-11 10:55:22 -05:00
James Prestwood
43c1bdfd62 sae: check if server point/scalar is valid
Reported-By: Mathy Vanhoef <Mathy.Vanhoef@nyu.edu>
2019-04-11 10:19:54 -05:00
James Prestwood
9192f506d3 eap-pwd: check if server point/scalar is valid
Reported-By: Mathy Vanhoef <Mathy.Vanhoef@nyu.edu>
2019-04-11 10:19:38 -05:00
James Prestwood
f9d92d6cdd eap: add eap_get_identity 2019-04-10 16:57:07 -05:00
James Prestwood
81fc6a687e handshake: add flag for FILS support
The handshake_state only holds a single AKM value. FILS depends on the AP
supporting EAP as well as FILS. The first time IWD connects, it will do a
full EAP auth. Subsequent connections (assuming FILS is supported) will use
FILS. But if the AP does not support FILS there is no reason to cache the
ERP keys.

This adds the supp_fils to the handshake_state. Now, station.c can set this
flag while building the handshake. This flag can later be checked when
caching the ERP keys.
2019-04-10 16:57:05 -05:00
James Prestwood
e963e64f9b eap: export session ID as key materials
ERP/FILS requires the session ID which is derived internally to an
EAP method.
2019-04-10 16:55:29 -05:00
James Prestwood
5df84a6933 erpcache: implementation for ERP key cache
This allows IWD to cache ERP keys after a full EAP run. Caching
allows IWD to quickly connect to the network later on using ERP or
FILS.

The cache will contain the EAP Identity, Session ID, EMSK, SSID and
optionally the ERP domain. For the time being, the cache entry
lifetimes are hard coded to 24 hours. Eventually the cache should
be written to disk to allow ERP/FILS to work after a reboot or
IWD restart.
2019-04-10 13:58:13 -05:00
James Prestwood
1e337259ce mschaputil: use util_get_username 2019-04-08 16:28:56 -05:00
Denis Kenzior
86ce4a8b09 util: Add qualifying comments 2019-04-08 16:28:37 -05:00
James Prestwood
abcc9f1647 util: add APIs to get username/domain from identity
mschaputil already had similar functionality, but ERP will need this
as well. These two functions will also handle identities with either
'@' or '\' to separate the user and domain.
2019-04-08 16:26:25 -05:00
Denis Kenzior
44ebf10bb9 eap: Make sure identity is not NULL 2019-04-08 16:25:31 -05:00
Denis Kenzior
716e3f0cda eap: Add eap_free_common
Many operations performed during an error in load_settings were the same
as the ones performed when freeing the eap object.  Add eap_free_common
to unify these.
2019-04-08 16:24:18 -05:00
James Prestwood
875c6f27e7 eap: enforce max identity lengths
EAP identites are recommended to follow RFC 4282 (The Network Access
Identifier). This RFC recommends a maximum NAI length of 253 octets.
It also mentions that RADIUS is only able to support NAIs of 253
octets.

Because of this, IWD should not allow EAP identities larger than 253
bytes. This change adds a check in eap_load_settings to verify the
identity does not exceed this limit.
2019-04-08 16:18:47 -05:00
James Prestwood
e9618d97a8 crypto: add kdf_sha384
FILS requires the SHA384 KDF variant.
2019-04-05 17:58:03 -05:00
James Prestwood
a71adcc243 netdev: skip associate event when not in OWE/FT
The associate event is only important for OWE and FT. If neither of
these conditions (or FT initial association) are happening we do
not need to continue further processing the associate event.
2019-04-05 17:35:31 -05:00
James Prestwood
c416db0708 common: fix missing PSK_SHA256 AKM
This AKM was lost while moving all the AKM checks into a the macros
2019-04-05 17:32:01 -05:00
Denis Kenzior
8f9ed66bdd mpdu: Rework validate_mgmt_ies
802.11 mandates that IEs inside management frames are presented in a
given order.  However, in the real world, many APs seem to ignore the
rules and send their IEs in seemingly arbitrary order, especially when
it comes to VENDOR tags.  Change this function to no longer be strict in
enforcing the order.

Also, drop checking of rules specific to Probe Responses.  These will
have to be handled separately (most likely by the AP module) since
802.11-2016, Section 11.1.4.3.5 essentially allows just about anything.
2019-04-05 16:31:26 -05:00
Denis Kenzior
83af5b0170 mpdu: Drop unused argument 2019-04-05 16:29:59 -05:00
James Prestwood
050db0b054 netdev: fix association failure path
In netdev_associate_event the ignore_connect_event was getting set true,
but afterwards there were still potential failure paths. Now, once in
assoc_failed we explicitly set ignore_connect_event to false so the
the failure can be handled properly inside netdev_connect_event
2019-04-05 13:41:29 -05:00
James Prestwood
5359b54c37 eap-private: add initiate/finish EAP types 2019-04-05 12:13:30 -05:00
James Prestwood
8f3627646a mpdu: add auth algorithms for FILS 2019-04-05 12:07:37 -05:00
James Prestwood
e15cb7133a handshake: handle FILS AKMs in handshake_get_key_sizes 2019-04-05 12:07:34 -05:00
James Prestwood
9b83f3d2db common: put all PSK AKM's into macro
The list of PSK/8021x AKM's in security_determine was getting long,
and difficult to keep under 80 characters. This moves them all into
two new macros, AKM_IS_PSK/AKM_IS_8021X.
2019-04-05 12:06:00 -05:00
James Prestwood
a2e711faf4 ie: crypto: add FILS AKMs
ie_rsn_info had to be updated to allow for 32 bit AKM values rather than
16 bit.
2019-04-04 16:11:07 -05:00
James Prestwood
cb9a0ed922 ie: add FILS IEs 2019-04-04 16:09:13 -05:00
James Prestwood
bde01b1826 eap-pwd: update hkdf_extract usage to cast constants
On some architectures, va_arg was behaving strangely with constant values
passed as lengths. Casting any constant lengths to size_t fixes the issue.
2019-04-04 14:01:19 -05:00
Denis Kenzior
b8dd39ded0 sae: Fix argument type passed via va_args
The function expects a size_t argument, but on some ARM systems this was
getting confused and failing.
2019-04-04 13:37:01 -05:00
James Prestwood
c985da04ca sae: fix potential infinite loop
It was assumed that the hunt-and-peck loop was guarenteed to find
a PWE. This was incorrect in terms of kernel support. If a system
does not have support for AF_ALG or runs out of file descriptors
the KDFs may fail. The loop continued to run if found == false,
which is also incorrect because we want to stop after 20 iterations
regarless of success.

This changes the loop to a for loop so it will always exit after
the set number of iterations.
2019-04-04 11:20:12 -05:00
Marcel Holtmann
23041a44dd build: Add missing HAVE_CONFIG_H guards and include config.h 2019-04-04 14:02:38 +02:00
Denis Kenzior
6ecc3a20b8 scan: Fix warning
CC       src/scan.o
src/scan.c: In function ‘scan_bss_compute_rank’:
src/scan.c:1048:4: warning: this decimal constant is unsigned only in ISO C90
    factor = factor * data_rate / 2340000000 +
2019-04-03 11:54:41 -05:00
Denis Kenzior
5c9e6b255f util: Remove container_of 2019-04-03 11:49:36 -05:00
Denis Kenzior
aca70beeff netdev: Use l_container_of 2019-04-03 11:49:36 -05:00
Denis Kenzior
b97d3f2a82 eapol: Use l_container_of 2019-04-03 11:49:36 -05:00
Marcel Holtmann
3f3e778719 build: Add support for including fallbacks for missing defines 2019-04-03 18:34:22 +02:00
Marcel Holtmann
923ac09cb6 owe: Add missing include for config.h 2019-04-03 18:33:36 +02:00
Tim Kourt
71efd05f4e eap: Rename EAP TLS type to follow common nomenclature 2019-04-02 14:34:37 -05:00
Tim Kourt
967983c638 station: Allow to disable roaming 2019-04-01 18:38:18 -05:00
Tim Kourt
734c9ad2f6 station: Split autoconnect state into two sub states
The auto-connect state will now consist of the two phases:
STATION_STATE_AUTOCONNECT_QUICK and STATION_STATE_AUTOCONNECT_FULL.
The auto-connect will always start with STATION_STATE_AUTOCONNECT_QUICK
and then transition into STATION_STATE_AUTOCONNECT_FULL if no
connection has been established. During STATION_STATE_AUTOCONNECT_QUICK
phase we take advantage of the wireless scans with the limited number
of channels on which the known networks have been observed before.
This approach allows to shorten the time required for the network
sweeps, therefore decreases the connection latency if the connection
is possible. Thereafter, if no connection has been established after
the first phase we transition into STATION_STATE_AUTOCONNECT_FULL and
do the periodic scan just like we did before the split in
STATION_STATE_AUTOCONNECT state.
2019-04-01 16:04:20 -05:00
Tim Kourt
405785cd0b scan: Add scan_freq_set_merge API 2019-04-01 15:29:33 -05:00
Tim Kourt
e5baa98a32 station: Encapsulate setter for 'scanning' property 2019-04-01 15:25:44 -05:00
Tim Kourt
33aa07e9ce station: rename scan_id to dbus_scan_id 2019-04-01 15:23:24 -05:00
Tim Kourt
395d8b9ea0 station: Refactor station_scan_destroy closer to its usage
The function is also renamed to reflect its usage
2019-04-01 15:21:12 -05:00
Tim Kourt
e4a5972b42 station: Separate scan and dbus logic 2019-04-01 15:18:51 -05:00
Tim Kourt
47900d34bc scan: Add scan_freq_set param into scan_passive 2019-04-01 15:18:37 -05:00
Tim Kourt
0d3eb7d27b scan: Make scan_freq_set_foreach const correct 2019-04-01 14:28:42 -05:00
James Prestwood
62748e567d ie: remove 80+80 column in vht_width_map
For simplicity 160Mhz and 80+80Mhz were grouped together when
parsing the VHT capabilities, but the 80+80 bits were left in
vht_widht_map. This could cause an overflow when getting the
width map.
2019-03-22 17:48:43 -05:00
Andrew Zaborowski
3ca8a18b4e network: Clear psk and passphrase copies before freeing 2019-03-22 14:04:08 -05:00
Andrew Zaborowski
05d556d493 eap-pwd: Memzero copies of secrets
Note that PK and PWE are also considered secret but their buffers
will need to be cleared in l_ecc_point_free in ell.
2019-03-22 13:04:50 -05:00
James Prestwood
588848651a wiphy: enforce MFP requirement on SAE connections
wiphy_select_akm will now check if BIP is supported, and if MFPR is
set in the scan_bss before returning either SAE AKMs. This will allow
fallback to another PSK AKM (e.g. hybrid APs) if any of the requirements
are not met.
2019-03-22 12:11:05 -05:00
Andrew Zaborowski
fa7db4be4d eap,eapol,crypto: Replace uses of memset with explicit_bzero
Replace existing uses of memset to clear secrets with explicit_bzero to
make sure it doesn't get optimized away.  This has some side effects as
documented in gcc docs but is still recommended.

In eap_secret_info_free make sure we clear both strings in the case of
EAP_SECRET_REMOTE_USER_PASSWORD secrets.
2019-03-21 20:28:14 -05:00
James Prestwood
45a51613c4 netdev: add conf option to set RSSI threshold
Environments with several AP's, all at low signal strength may
want to lower the roaming RSSI threshold to prevent IWD from
roaming excessively. This adds an option 'roam_rssi_threshold',
which is still defaulted to -70.
2019-03-21 11:03:25 -05:00
Andrew Zaborowski
970ce050fe eap-mschapv2: Check hexstring parses in load_settings
load_settings is assumed to do minimum error checking to avoid crashing
on invalid input.
2019-03-21 09:37:26 -05:00
Andrew Zaborowski
94043d6bcb eap-mschapv2: Memzero copies of secrets 2019-03-21 09:36:46 -05:00
Andrew Zaborowski
881fbd1d80 crypto: Memzero copies of secrets 2019-03-21 09:33:40 -05:00
Andrew Zaborowski
13f09be1a0 wsc: Memzero secrets after use
Also printing keys with l_debug conditional on an environment variable
as someone wanting debug logs, or leaving debug on accidentally, does
not necessarily want the keys in the logs and in memory.
2019-03-19 14:14:39 -05:00
James Prestwood
2042fe7a73 netdev: fix WPS test (with ControlPortOverNL80211 on)
At some point the connect command builder was modified, and the
control port over NL80211 check was moved to inside if (is_rsn).
For WPS, no supplicant_ie was set, so CONTROL_PORT_OVER_NL80211
was never set into CMD_CONNECT. This caused IWD to expect WPS
frames over netlink, but the kernel was sending them over the
legacy route.
2019-03-19 14:03:27 -05:00
Christian Rebischke
6e44295fe2 iwd.service: Harden systemd service file
This commit hardens the iwd.service.in template file for systemd
services. The following is a short explanation for each added directive:

+PrivateTmp=true

If true, sets up a new file system namespace for the executed processes
and mounts private /tmp and /var/tmp directories inside it that is not
shared by processes outside of the namespace.

+NoNewPrivileges=true

If true, ensures that the service process and all its children can never
gain new privileges through execve() (e.g. via setuid or setgid bits, or
filesystem capabilities).

+PrivateDevices=true

If true, sets up a new /dev mount for the executed processes and only
adds API pseudo devices such as /dev/null, /dev/zero or /dev/random (as
well as the pseudo TTY subsystem) to it, but no physical devices such as
/dev/sda, system memory /dev/mem, system ports /dev/port and others.

+ProtectHome=yes

If true, the directories /home, /root and /run/user are made
inaccessible and empty for processes invoked by this unit.

+ProtectSystem=strict

If set to "strict" the entire file system hierarchy is mounted
read-only, except for the API file system subtrees /dev, /proc and /sys
(protect these directories using PrivateDevices=,
ProtectKernelTunables=, ProtectControlGroups=).

+ReadWritePaths=/var/lib/iwd/

Sets up a new file system namespace for executed processes. These
options may be used to limit access a process might have to the file
system hierarchy. Each setting takes a space-separated list of paths
relative to the host's root directory (i.e. the system running the
service manager). Note that if paths contain symlinks, they are resolved
relative to the root directory set with RootDirectory=/RootImage=.
Paths listed in ReadWritePaths= are accessible from within
the namespace with the same access modes as from outside of
it.

+ProtectControlGroups=yes

If true, the Linux Control Groups (cgroups(7)) hierarchies accessible
through /sys/fs/cgroup will be made read-only to all processes of the
unit.

+ProtectKernelModules=yes

If true, explicit module loading will be denied. This allows module
load and unload operations to be turned off on modular kernels.

For further explanation to all directives see `man systemd.directives`
2019-03-19 14:00:46 -05:00
James Prestwood
dee6703122 sae: check group number on UNSUPP_FINITE_CYCLIC_GROUP
Hostapd has now been updated to include the group number when rejecting
the connection with UNSUPP_FINITE_CYCLIC_GROUP. We still need the existing
len == 0 check because old hostapd versions will still behave this way.
2019-03-19 13:59:29 -05:00
Andrew Zaborowski
2133e8a9fc eap-ttls: Memzero copies of secrets
The AVP buffers are cleared because some plaintext secrets get written
into them.
2019-03-19 11:46:51 -05:00
Andrew Zaborowski
14572c0f1a mschaputil: Memzero copies of secrets 2019-03-19 11:43:49 -05:00
Andrew Zaborowski
0bf3ae97d7 eap-mschapv2: Drop mschapv2_nt_password_hash, use mschap_nt_password_hash
The two functions looked identical, drop mschapv2_nt_password_hash and
update callers to use mschap_nt_password_hash from mschaputil.c/.h.
2019-03-19 11:34:23 -05:00
Denis Kenzior
570abd7bfb eapol: Convert memsets to explicit_bzero
We were wiping out certain secrets via memset.  Convert them to
explicit_bzero just in case the compiler decides to optimize them out.
2019-03-19 11:25:22 -05:00
Andrew Zaborowski
f76e10799f eapol,handshake: Memzero copies of secrets 2019-03-19 11:20:40 -05:00
Andrew Zaborowski
c682847249 eap-md5: Memzero copies of secrets 2019-03-19 11:11:16 -05:00
Andrew Zaborowski
8954c62bcf eap-sim: Memzero secrets after use
Also slightly simplify eap_aka_prf_prime and other functions.
2019-03-19 11:05:11 -05:00
Andrew Zaborowski
b1317d3984 eap-aka: Memzero secrets after use 2019-03-19 11:04:29 -05:00
Andrew Zaborowski
28840b29a8 simutil: Memzero secrets after use
Also slightly simplify eap_aka_prf_prime and other functions.
2019-03-19 11:03:33 -05:00
Andrew Zaborowski
c80b239b93 simutil: Optimize l_checksum usage
The checksum object was created / destroyed repeatedly.  It was
sufficient to simply call checksum_reset since the key was never
changed.
2019-03-19 11:02:55 -05:00
Andrew Zaborowski
aa7abb44c5 eap-gtc: Memzero copies of secrets
The single-use password is apparently sent in plaintext over the network
but at least try to prevent it from staying in the memory until we know
it's been used.
2019-03-19 10:56:24 -05:00
Andrew Zaborowski
5306e37279 eap-tls,eap-peap: Memzero copies of secrets 2019-03-19 10:54:18 -05:00
Andrew Zaborowski
a090b1ef52 netdev: Update Associate IEs with the values actually sent
station.c generates the IEs we will need to use for the
Authenticate/Associate and EAPoL frames and sets them into the
handshake_state object.  However the driver may modify some of them
during CMD_CONNECT and we need to use those update values so the AP
isn't confused about differing IEs in diffent frames from us.

Specifically the "wl" driver seems to do this at least for the RSN IE.
2019-03-19 09:46:32 -05:00
James Prestwood
a983ca0c33 eap-pwd: fix buffer overflow for larger groups
The KDF function processes data in 32 byte chunks so for groups which
primes are not divisible by 32 bytes, you will get a buffer overflow
when copying the last chunk of data.

Now l_checksum_get_digest is limited to the bytes remaining in the
buffer, or 32, whichever is the smallest.
2019-03-19 09:44:36 -05:00
James Prestwood
0288c537a2 eapol: have eapol_encrypt_key_data return length/error
Since eapol_encrypt_key_data already calculates the key data length and
encodes it into the key frame, we can just return this length and avoid
having to obtain it again from the frame.
2019-03-18 18:02:37 -05:00
James Prestwood
3863fa3670 eap-pwd: mitigate potential timing attacks in EAP-PWD
Similar to SAE, EAP-PWD derives an ECC point (PWE). It is possible
for information to be gathered from the timing of this derivation,
which could be used to to recover the password.

This change adapts EAP-PWD to use the same mitigation technique as
SAE where we continue to derive ECC points even after we have found
a valid point. This derivation loop continues for a set number of
iterations (20 in this case), so anyone timing it will always see
the same timings for every run of the protocol.
2019-03-18 11:29:40 -05:00
Tim Kourt
58522fe98f storage: Allow load/sync known freqs. to file 2019-03-15 17:50:29 -05:00
Andrew Zaborowski
2b544541bc scan: Drop notify callback's ifindex parameter
This is not used by any of the scan notify callback implementations and
for P2P we're going to need to scan on an interface without an ifindex
so without this the other changes should be mostly contained in scan.
2019-03-15 12:17:53 -05:00
Tim Kourt
5e95e30e41 scan: Fix misinterpretation of the channel as frequency 2019-03-14 20:11:32 -05:00
Andrew Zaborowski
154e9f63bc wiphy, netdev: Add enum values for P2P-related iftypes
Also add a mask parameter to wiphy_get_supported_iftypes to make sure
the SupportedModes property only contains the values that can be used
as Device.Mode.
2019-03-11 18:03:40 -05:00
Andrew Zaborowski
e344df432b wiphy: Fix printing supported iftypes
dbus_iftype_to_string returns NULL for unknown iftypes, the strdup will
also return NULL and ret[i] will be assigned a NULL.  As a result
the l_strjoinv will not print the known iftypes that might have come
after that and will the l_strfreev will leak the strduped strings.
2019-03-11 18:03:38 -05:00
Andrew Zaborowski
98623edd7d scan: Drop remaining sched scan code 2019-03-11 17:49:15 -05:00
Andrew Zaborowski
d0ccb8496a scan: Fix tracking external scans in sc->state
sc->state would get set when the TRIGGERED event arrived or when the
triggered callback for our own SCAN_TRIGGER command is received.
However it would not get reset to NOT_RUNNING when the NEW_SCAN_RESULTS
event is received, instead we'd first request the results with GET_SCAN
and only reset sc->state when that returns.  If during that command a
new scan gets triggered, the GET_SCAN callback would still reset
sc->state and clobber the value set by the new scan.

To fix that repurpose sc->state to only track that period from the
TRIGGERED signal to the NEW_SCAN_RESULTS signal.  sc->triggered can be
used to check if we're still waiting for the GET_SCAN command and
sc->start_cmd_id to check if we're waiting for the scan to get
triggered, so one of these three variables will now always indicate if
a scan is in progress.
2019-03-11 17:28:41 -05:00
Denis Kenzior
e295b73c4c netdev: Fix crash when aborting a connection
We can crash if we abort the connection, but the connect command has
already gone through.  In this case we will get a sequence of
authenticate_event, associate_event, connect_event.  The first and last
events don't crash since they check whether netdev->connected is true.
However, this causes an annoying warning to be printed.

Fix this by introducing an 'aborting' flag and ignore all connection
related events if it is set.

++++++++ backtrace ++++++++
2019-03-08 16:28:15 -06:00
Tim Kourt
4b9abde3e5 scan: Optimize frequency set foreach logic 2019-03-07 16:27:24 -06:00
James Prestwood
ef06f06cfb owe: handle all non-zero status codes in owe_rx_associate
Now that the OWE failure/retry is handled in netdev, we can catch
all associate error status' inside owe_rx_associate rather than only
catching UNSUPP_FINITE_CYCLIC_GROUP.
2019-03-05 16:20:40 -06:00
James Prestwood
e3f4bfb428 netdev: process association in netdev_associate_event
Apart from OWE, the association event was disregarded and all association
processing was done in netdev_connect_event. This led to
netdev_connect_event having to handle all the logic of both success and
failure, as well as parsing the association for FT and OWE. Also, without
checking the status code in the associate frame there is the potential
for the kernel to think we are connected even if association failed
(e.g. rogue AP).

This change introduces two flags into netdev, expect_connect_failure and
ignore_connect_event. All the FT processing that was once in
netdev_connect_event has now been moved into netdev_associate_event, as
well as non-FT associate frame processing. The connect event now only
handles failure cases for soft/half MAC cards.

Note: Since fullmac cards rely on the connect event, the eapol_start
and netdev_connect_ok were left in netdev_connect_event. Since neither
auth/assoc events come in on fullmac we shouldn't have any conflict with
the new flags.

Once a connection has completed association, EAPoL is started from
netdev_associate_event (if required) and the ignore_connect_event flag can
be set. This will bypass the connect event.

If a connection has failed during association for whatever reason, we can
set expect_connect_failure, the netdev reason, and the MPDU status code.
This allows netdev_connect_event to both handle the error, and, if required,
send a deauth telling the kernel that we have failed (protecting against the
rogue AP situation).
2019-03-05 16:02:52 -06:00
James Prestwood
5027bd3d0b ftutil: add associate parser
Helper to obtain RSNE, MDE, and FTE from associate frame.
2019-03-05 11:44:41 -06:00
James Prestwood
210b8645b7 netdev: remove OWE handling from netdev_connect_event
OWE processing can be completely taken care of inside
netdev_authenticate_event and netdev_associate_event. This removes
the need for OWE specific checks inside netdev_connect_event. We can
now return early out of the connect event if OWE is in progress.
2019-03-01 17:16:17 -06:00
James Prestwood
cd6e32bf90 station: temporarily blacklist BSS for certain status codes
Several Auth/Assoc failure status codes indicate that the connection
failed for reasons such as bandwidth issues, poor channel conditions
etc. These conditions should not result in the BSS being blacklisted
since its likely only a temporary issue and the AP is not actually
"broken" per-se.

This adds support in station.c to temporarily blacklist these BSS's
on a per-network basis. After the connection has completed we clear
out these blacklist entries.
2019-03-01 13:13:08 -06:00
James Prestwood
64dedd9aa5 network: add APIs to blacklist BSS's per-network
Certain error conditions require that a BSS be blacklisted only for
the duration of the current connection. The existing blacklist
does not allow for this, and since this blacklist is shared between
all interfaces it doesnt make sense to use it for this purpose.

Instead, each network object can contain its own blacklist of
scan_bss elements. New elements can be added with network_blacklist_add.
The blacklist is cleared when the connection completes, either
successfully or not.

Now inside network_bss_select both the per-network blacklist as well as
the global blacklist will be checked before returning a BSS.
2019-03-01 13:08:01 -06:00
James Prestwood
3af51558f2 netdev: pass event data to netdev events
Several netdev events benefit from including event data in the callback.
This is similar to how the connect callback works as well. The content
of the event data is documented in netdev.h (netdev_event_func_t).

By including event data for the two disconnect events, we can pass the
reason code to better handle the failure in station.c. Now, inside
station_disconnect_event, we still check if there is a pending connection,
and if so we can call the connect callback directly with HANDSHAKE_FAILED.
Doing it this way unifies the code path into a single switch statment to
handle all failures.

In addition, we pass the RSSI level index as event data to
RSSI_LEVEL_NOTIFY. This removes the need for a getter to be exposed in
netdev.h.
2019-02-28 18:26:45 -06:00
Tim Kourt
a5424829b6 scan: Standardize nomenclature between scan triggers 2019-02-28 18:25:44 -06:00
Tim Kourt
c5d6b70520 scan: Deprecate scan_send_start()
On successful send, scan_send_start(..) used to set msg to NULL,
therefore the further management of the command by the caller was
impossible. This patch removes wrapper around l_genl_family_send()
and lets the callers to take responsibility for the command.
2019-02-28 18:25:15 -06:00
James Prestwood
8fed50a448 netdev: station: fix status/reason code in callbacks
This change cleans up the mess of status vs reason codes. The two
types of codes have already been separated into different enumerations,
but netdev was still treating them the same (with last_status_code).

A new 'event_data' argument was added to the connect callback, which
has a different meaning depending on the result of the connection
(described inside netdev.h, netdev_connect_cb_t). This allows for the
removal of netdev_get_last_status_code since the status or reason
code is now passed via event_data.

Inside the netdev object last_status_code was renamed to last_code, for
the purpose of storing either status or reason. This is only used when
a disconnect needs to be emitted before failing the connection. In all
other cases we just pass the code directly into the connect_cb and do
not store it.

All ocurrences of netdev_connect_failed were updated to use the proper
code depending on the netdev result. Most of these simply changed from
REASON_CODE_UNSPECIFIED to STATUS_CODE_UNSPECIFIED. This was simply for
consistency (both codes have the same value).

netdev_[authenticate|associate]_event's were updated to parse the
status code and, if present, use that if their was a failure rather
than defaulting to UNSPECIFIED.
2019-02-28 13:38:36 -06:00
Andrew Zaborowski
6017dc5730 eap-ttls: Check phase2-method is non-NULL in load_settings
Even though .check_settings in our EAP method implementations does the
settings validation, .load_settings also has minimum sanity checks to
rule out segfaults if the settings have changed since the last
.check_settings call.
2019-02-28 13:02:26 -06:00
Tim Kourt
8f09a0c937 wiphy: Add accessor for supported frequencies 2019-02-28 10:53:04 -06:00
Tim Kourt
9f52036b85 scan: Let ELL to handle the message sizing 2019-02-28 10:52:53 -06:00
James Prestwood
d6abf62946 netdev: remove unneeded disconnect for OWE failure
If OWE fails in association there is no reason to send a disconnect
since its already known that we failed. Instead we can directly
call netdev_connect_failed
2019-02-27 16:29:18 -06:00
James Prestwood
51f21c1c9b mpdu: remove invalid reason codes 2019-02-27 16:16:25 -06:00
James Prestwood
e5e2922eee netdev: sae: owe: update to use new status codes 2019-02-27 16:15:23 -06:00
James Prestwood
ffd8e81774 mpdu: add new status code enum
mpdu.h reason codes were being abused as status codes for Auth/Assoc
protocols. This adds a whole new enum for status codes.
2019-02-27 16:15:12 -06:00
Tim Kourt
45e5c42726 scan: Add ref to cmd to make it reusable on failure 2019-02-27 16:14:22 -06:00
Denis Kenzior
917815e99a netdev: netdev_setting_keys_failed takes an errno
Instead of sending a reason_code to netdev_setting_keys_failed, make it
take an errno (negative) instead.  Since key setting failures are
entirely a system / software issue, and not a protocol issue, it makes
no sense to use a protocol error code.
2019-02-27 14:22:42 -06:00
Tim Kourt
8e44760c34 scan: Fix scan request retry logic
While triggering scan, we leave the scan command in the queue,
so it can be replayed in the case of a busy device.
2019-02-26 18:02:48 -06:00
Tim Kourt
8fc7c0e5c4 scan: Rename request triggered cb 2019-02-26 17:16:52 -06:00
James Prestwood
df923cd962 scan: increase rate factor range
The rate factor range was quite small. This increases the range a bit,
which should make higher throughput AP's preferred more.
2019-02-26 12:35:56 -06:00
James Prestwood
a0d8511331 scan: allow 5G factor to be user configurable
Some users may need their own control over 2.4/5GHz preference. This
adds a new user option, 'rank_5g_factor', which allows users to increase
or decrease their 5G preference.
2019-02-26 12:35:50 -06:00
James Prestwood
49b02907a8 ie: scan: use VHT rates in scan ranking
This adds support for parsing the VHT IE, which allows a BSS supporting
VHT (80211ac) to be ranked higher than a BSS supporting only HT/basic
rates. Now, with basic/HT/VHT parsing we can calculate the theoretical
maximum data rate for all three and rank the BSS based on that.
2019-02-25 15:07:41 -06:00
James Prestwood
ad2bf340a4 ie: scan: use HT rates in scan ranking
This adds HT IE parsing and data rate calculation for HT (80211n)
rates. Now, a BSS supporting HT rates will be ranked higher than
a basic rate BSS, assuming the RSSI is at an acceptable level.
2019-02-25 11:52:58 -06:00
James Prestwood
5ce6e173ba ie: make rate_rssi_map const 2019-02-25 11:47:54 -06:00
James Prestwood
7d7fcff03b ie: scan: take into account RSSI when parsing data rate
The spec dictates RSSI thresholds for different modulation schemes, which
correlate to different data rates. Until now were were ranking a BSS with
only looking at its advertised data rate, which may not even be possible
if the RSSI does not meet the threshold.

Now, RSSI is taken into consideration and the data rate returned from
parsing (Ext) Supported Rates IE(s) will reflect that.
2019-02-22 17:44:06 -06:00
James Prestwood
922e10e82c ie: add macro for calculating an IE's length
All over the place we do "ie[1] + 2" for getting the IE length. It
is much clearer to use a macro to do this. The macro also checks
for NULL, and returns zero in this case.
2019-02-22 17:41:11 -06:00
James Prestwood
c18b1289a5 ap: move ie_parse_supported_rates into ap.c
Supported rates will soon be parsed along with HT/VHT capabilities
to determine the best data rate. This will remove the need for the
supported_rates uintset element in scan_bss, as well as the single
API to only parse the supported rates IE. AP still does rely on
this though (since it only supports basic rates), so the parsing
function was moved into ap.c.
2019-02-22 17:41:01 -06:00
Andrew Zaborowski
dbd619c231 eap-tls-common: More complete certificate validation
In the methods' check_settings do a more complete early check for
possible certificate / private key misconfiguration, including check
that the certificate and the private key are always present or absent
together and that they actually match each other.  Do this by encrypting
and decrypting a small buffer because we have no better API for that.
2019-02-08 13:59:32 -06:00
Andrew Zaborowski
d9f0cc47d0 eap: Remove redundant error messages in .load_settings
A method's .check_settings method checks for inconsistent setting files
and prints readable errors so there's no need to do that again in
.load_settings, although at some point after removing the duplicate
error messages from the load_settings methods we agreed to keep minimum
checks that could cause a crash e.g. in a corner case like when the
setting file got modified between the check_settings and the
load_settings call.  Some error messages have been re-added to
load_settings after that (e.g. in
bb4e1ebd4f) but they're incomplete and not
useful so remove them.
2019-02-08 13:43:05 -06:00
Andrew Zaborowski
451a7e9b52 eap-ttls: Check Phase 2 method name is not NULL 2019-02-08 13:42:51 -06:00
Andrew Zaborowski
8dfb8e9207 handshake: Remove unused handshake_state_get_8021x_config 2019-02-08 13:42:44 -06:00
Tim Kourt
22318ebbd5 main: Ensure existence of the storage dir at startup
Previously, the storage dir has only been created after a successful
network connection, causing removal of Known Network interface from
Dbus and failure to register dir watcher until daemon is restarted.
2019-02-07 11:07:43 -06:00
Denis Kenzior
995cbc7ad3 mpdu: relax IE ordering requirements 2019-02-07 10:44:09 -06:00
Denis Kenzior
bd7f8bf613 eapol: Relax message 2 / 4 key_length check
Seems certain Apple implementations set the key length to 16, even
though it should be 0.
2019-02-07 10:13:17 -06:00
James Prestwood
bc9e70f9cd sae: fix length check and commit buffer size
A length check was still assuming the 256 bit ECC group. This
was updated to scale with the group. The commit buffer was also
not properly sized. This was changed to allow for the largest
ECC group supported.
2019-02-02 09:25:20 -06:00
James Prestwood
a4fdddc403 sae: allow other ECC groups and group negotiation
SAE was hardcoded to work only with group 19. This change fixes up the
hard coded lengths to allow it to work with group 20 since ELL supports
it. There was also good amount of logic added to support negotiating
groups. Before, since we only supported group 19, we would just reject
the connection to an AP unless it only supported group 19.

This did lead to a discovery of a potential bug in hostapd, which was
worked around in SAE in order to properly support group negotiation.

If an AP receives a commit request with a group it does not support it
should reject the authentication with code 77. According to the spec
it should also include the group number which it is rejecting. This is
not the case with hostapd. To fix this we needed to special case a
length check where we would otherwise fail the connection.
2019-02-01 15:57:26 -06:00
Denis Kenzior
c926b3fe80 eap-pwd: Remove unneeded cast 2019-01-31 12:41:58 -06:00
James Prestwood
bb28351c93 eap-pwd: Update EAP-PWD to allow larger ECC groups
Most of this work was already done after moving ECC into ELL, but
there were still a few places where the 256-bit group was assumed.
This allows the 384-bit group to be used, and theoretically any
other group added to ELL in the future.
2019-01-31 12:40:03 -06:00
James Prestwood
025ca0d4d3 network: allow network_bss_select to skip blacklist
If we have a BSS list where all BSS's have been blacklisted we still
need a way to force a connection to that network, instead of having
to wait for the blacklist entry to expire. network_bss_select now
takes a boolean 'fallback_to_blacklist' which causes the selection
to still return a connectable BSS even if the entire list was
blacklisted.

In most cases this is set to true, as these cases are initiated by
DBus calls. The only case where this is not true is inside
station_try_next_bss, where we do want to honor the blacklist.
This both prevents an explicit connect call (where all BSS's are
blacklisted) from trying all the blacklisted BSS's, as well as the
autoconnect case where we simply should not try to connect if all
the BSS's are blacklisted.

There are is some implied behavior here that may not be obvious:

On an explicit DBus connect call IWD will attempt to connect to
any non-blacklisted BSS found under the network. If unsuccessful,
the current BSS will be blacklisted and IWD will try the next
in the list. This will repeat until all BSS's are blacklisted,
and in this case the connect call will fail.

If a connect is tried again when all BSS's are blacklisted IWD
will attempt to connect to the first connectable blacklisted
BSS, and if this fails the connect call will fail. No more
connection attempts will happen until the next DBus call.
2019-01-31 12:36:58 -06:00
James Prestwood
45cc0fd918 network/station: add BSS blacklisting
If IWD fails to connect to a BSS we can attempt to connect to a different
BSS under the same network and blacklist the first BSS. In the case of an
incorrect PSK (MMPDU code 2 or 23) we will still fail the connection.

station_connect_cb was refactored to better handle the dbus case. Now the
netdev result switch statement is handled before deciding whether to send
a dbus reply. This allows for both cases where we are trying to connect
to the next BSS in autoconnect, as well as in the dbus case.
2019-01-30 13:23:38 -06:00
James Prestwood
da485179a6 station: refactor __station_connect_network
This makes __station_connect_network even less intelligent by JUST
making it connect to a network, without any state changes. This makes
the rekey logic much cleaner.

We were also changing dbus properties when setting the state to
CONNECTING, so those dbus property change calls were moved into
station_enter_state.
2019-01-30 13:23:36 -06:00
Denis Kenzior
cff0600621 station: Use station_disassociated instead
station_disconnect can trigger yet another netdev_disconnect call (which
would obviously fail since we're no longer connected)
2019-01-28 15:52:18 -06:00
Denis Kenzior
d51c3db4ce station: Simplify logic 2019-01-28 15:52:02 -06:00
James Prestwood
a2354f88a6 station/netdev: handle rekeying based on driver features
A new driver extended feature bit was added signifying if the driver
supports PTK replacement/rekeying. During a connect, netdev checks
for the driver feature and sets the handshakes 'no_rekey' flag
accordingly.

At some point the AP will decide to rekey which is handled inside
eapol. If no_rekey is unset we rekey as normal and the connection
remains open. If we have set no_rekey eapol will emit
HANDSHAKE_EVENT_REKEY_FAILED, which is now caught inside station. If
this happens our only choice is to fully disconnect and reconnect.
2019-01-28 15:49:57 -06:00
James Prestwood
8edaa23f8a eapol: emit HANDSHAKE_EVENT_REKEY_FAILED
If we receive handshake message 1/4 after we are already connected
the AP is attempting to rekey. This may not be allowed and if not
we do not process the rekey and emit HANDSHAKE_EVENT_REKEY_FAILED
so any listeners can handle accordingly.
2019-01-28 15:38:47 -06:00
James Prestwood
a76376cac4 handshake: add HANDSHAKE_EVENT_REKEY_FAILED
This event will be emitted from eapol if the AP is attempting to
rekey but the handshake object does not allow it (via no_rekey).
2019-01-28 15:37:21 -06:00
James Prestwood
2a7a756c9f handshake: add flag and setter to disallow rekeying 2019-01-28 15:36:51 -06:00
James Prestwood
e4f22f0a5d ap: fix crash when stopping AP
The AP structure was getting cleaned up twice. When the DBus stop method came
in we do AP_STOP on nl80211. In this callback the AP was getting freed in
ap_reset. Also when the DBus interface was cleaned up it triggered ap_reset.

Since ap->started gets set to false in ap_reset, we now check this and bail
out if the AP is already stopped.

Fixes:
++++++++ backtrace ++++++++
0  0x7f099c11ef20 in /lib/x86_64-linux-gnu/libc.so.6
1  0x43fed0 in l_queue_foreach() at ell/queue.c:441 (discriminator 3)
2  0x423a6c in ap_reset() at src/ap.c:140
3  0x423b69 in ap_free() at src/ap.c:162
4  0x44ee86 in interface_instance_free() at ell/dbus-service.c:513
5  0x451730 in _dbus_object_tree_remove_interface() at ell/dbus-service.c:1650
6  0x405c07 in netdev_newlink_notify() at src/netdev.c:4449 (discriminator 9)
7  0x440775 in l_hashmap_foreach() at ell/hashmap.c:534
8  0x4455d3 in process_broadcast() at ell/netlink.c:158
9  0x4439b3 in io_callback() at ell/io.c:126
10 0x442c4e in l_main_iterate() at ell/main.c:473
11 0x442d1c in l_main_run() at ell/main.c:516
12 0x442f2b in l_main_run_with_signal() at ell/main.c:644
13 0x403ab3 in main() at src/main.c:504
14 0x7f099c101b97 in /lib/x86_64-linux-gnu/libc.so.6
+++++++++++++++++++++++++++
2019-01-25 18:51:18 -06:00
James Prestwood
ed6f5ea55a blacklist: add blacklist.[ch] to build and main
This will allow for blacklisting a BSS if the connection fails. The
actual blacklist module is simple and must be driven by station. All
it does is add BSS addresses, a timestamp, and a timeout to a queue.
Entries can also be removed, or checked if they exist. The blacklist
timeout is configuratble in main.conf, as well as the blacklist
timeout multiplier and maximum timeout. The multiplier is used after
a blacklisted BSS timeout expires but we still fail to connect on the
next connection attempt. We multiply the current timeout by the
multiplier so the BSS remains in the blacklist for a larger growing
amount of time until it reaches the maximum (24 hours by default).
2019-01-24 17:29:15 -06:00
James Prestwood
475d1082d7 netdev: store mpdu status and add getter
Soon BSS blacklisting will be added, and in order to properly decide if
a BSS should be blacklisted we need the status code on a failed
connection. This change stores the status code when there is a failure
in netdev and adds a getter to retrieve later. In many cases we have
the actual status code from the AP, but in some corner cases its not
obtainable (e.g. an error sending an NL80211 command) in which case we
just default to MMPDU_REASON_CODE_UNSPECIFIED.

Rather than continue with the pattern of setting netdev->result and
now netdev->last_status_code, the netdev_connect_failed function was
redefined so its no longer used as both a NL80211 callback and called
directly. Instead a new function was added, netdev_disconnect_cb which
just calls netdev_connect_failed. netdev_disconnect_cb should not be
used for all the NL80211 disconnect commands. Now netdev_connect_failed
takes both a result and status code which it sets in the netdev object.
In the case where we were using netdev_connect_failed as a callback we
still need to set the result and last_status_code but at least this is
better than having to set those in all cases.
2019-01-24 16:54:39 -06:00
Marcel Holtmann
39ee15dbc3 build: Provide modules-load.d for loading pkcs8_key_parser module 2019-01-23 18:22:11 +01:00
Andrew Zaborowski
c9490ce657 crypto: Optimize hkdf_expand slightly
Remove an unneeded buffer and its memcpy, remove the now unneeded use of
l_checksum_digest_length and use l_checksum_reset instead of creating a
new l_checksum for each chunk.
2019-01-22 11:40:07 -06:00
James Prestwood
922506105e owe: allow group 20 + group negotiation
ELL ECC supports group 20 (P384) so OWE can also support it. This also
adds group negotiation, where OWE can choose a different group than the
default if the AP requests it.

A check needed to be added in netdev in order for the negotiation to work.
The RFC says that if a group is not supported association should be rejected
with code 77 (unsupported finite cyclic group) and association should be
started again. This rejection was causing a connect event to be emitted by
the kernel (in addition to an associate event) which would result in netdev
terminating the connection, which we didn't want. Since OWE receives the
rejected associate event it can intelligently decide whether it really wants
to terminate (out of supported groups) or try the next available group.

This also utilizes the new MIC/KEK/KCK length changes, since OWE dictates
the lengths of those keys.
2019-01-17 15:24:56 -06:00
James Prestwood
d79b2b28ec eapol: use HMAC-SHA384 for OWE in MIC calculation 2019-01-17 15:20:28 -06:00
James Prestwood
7bfaf182e6 crypto: allow hkdf_expand/extract to use different SHA's
Rather than hard coding to SHA256, we can pass in l_checksum_type
and use that SHA. This will allow for OWE/SAE/PWD to support more
curves that use different SHA algorithms for hashing.
2019-01-17 15:20:28 -06:00
James Prestwood
90c39afd61 handshake: add OWE to get_ptk_size
OWE defines KEK/KCK lengths depending on group. This change adds a
case into handshake_get_key_sizes. With OWE we can determine the
key lengths based on the PMK length in the handshake.
2019-01-17 15:20:28 -06:00
James Prestwood
532c9a5521 eapol: Add OWE cases for different key lengths
In preparation for OWE supporting multiple groups eapol needed some
additional cases to handle the OWE AKM since OWE dictates the KEK,
KCK and MIC key lengths (depending on group).
2019-01-17 15:20:28 -06:00
James Prestwood
2c82d6b223 crypto: pass PMK length to crypto_derive_pairwise_ptk
Right now the PMK is hard coded to 32 bytes, which works for the vast
majority of cases. The only outlier is OWE which can generate a PMK
of 32, 48 or 64 bytes depending on the ECC group used. The PMK length
is already stored in the handshake, so now we can just pass that to
crypto_derive_pairwise_ptk
2019-01-17 15:20:28 -06:00
James Prestwood
6771a06463 crypto/handshake/eapol: Allow other PTK lengths
The crypto_ptk was hard coded for 16 byte KCK/KEK. Depending on the
AKM these can be up to 32 bytes. This changes completely removes the
crypto_ptk struct and adds getters to the handshake object for the
kck and kek. Like before the PTK is derived into a continuous buffer,
and the kck/kek getters take care of returning the proper key offset
depending on AKM.

To allow for larger than 16 byte keys aes_unwrap needed to be
modified to take the kek length.
2019-01-17 15:20:28 -06:00
James Prestwood
374b367ba4 eapol: allow 16, 24 and 32 byte MIC lengths
The MIC length was hard coded to 16 bytes everywhere, and since several
AKMs require larger MIC's (24/32) this needed to change. The main issue
was that the MIC was hard coded to 16 bytes inside eapol_key. Instead
of doing this, the MIC, key_data_length, and key_data elements were all
bundled into key_data[0]. In order to retrieve the MIC, key_data_len,
or key_data several macros were introduced which account for the MIC
length provided.

A consequence of this is that all the verify functions inside eapol now
require the MIC length as a parameter because without it they cannot
determine the byte offset of key_data or key_data_length.

The MIC length for a given handshake is set inside the SM when starting
EAPoL. This length is determined by the AKM for the handshake.
2019-01-17 15:20:28 -06:00
Tim Kourt
80d4e9b572 station: Default to active scan if MAC randomization is present
This patch also simplifies the scan type selection logic.
2019-01-16 15:05:38 -06:00
James Prestwood
55a7e9d82a pwd/sae/owe: update to use l_ecc_curve_get_ike_group 2019-01-16 15:05:06 -06:00
Tim Kourt
71b10ab271 scan: Enable the usage of MAC randomization flag 2019-01-16 13:02:25 -06:00
Tim Kourt
81d570572e wiphy: Add MAC randomization feature check API 2019-01-16 13:01:12 -06:00
James Prestwood
37cfec01a2 crypto: add hmac_sha384
To support OWE group 20, which uses HMAC-SHA384 for hashing the PMK
2019-01-15 15:07:26 -06:00
James Prestwood
8e7da821f9 handshake: store PMK length
Non-802.11 AKMs can define their own key lengths. Currently only OWE does
this, and the MIC/KEK/KCK lengths will be determined by the PMK length so
we need to save it.
2019-01-15 14:57:53 -06:00
Andrew Zaborowski
2600c446ab netdev: Skip a memcpy when no data to copy 2019-01-15 07:40:51 -06:00
Andrew Zaborowski
52b3268b78 netdev: Allow NULL prefix in netdev_frame_watch_add
Make sure we don't pass NULLs to memcmp or l_memdup when the prefix
buffer is NULL.  There's no point having callers pass dummy buffers if
they need to watch frames independent of the frame data.
2019-01-15 07:40:51 -06:00
Andrew Zaborowski
8aa306fddc eap-wsc: Use new l_key DH helper functions
Start using l_key_generate_dh_private and l_key_validate_dh_payload to
check for the disallowed corner case values in the DH private/public
values generated/received.
2019-01-14 15:20:50 -06:00
Tim Kourt
726bf9d8e4 eap: Make Identity optional
Some of the EAP methods don't require a clear-text identity to
be sent with the Identity Response packet. The mandatory identity
filed has resulted in unnecessary transmission of the garbage
values. This patch makes the Identity field to be optional and
shift responsibility to ensure its existence to the individual
methods if the field is required. All necessary identity checks
have been previously propagated to individual methods.
2019-01-11 17:36:33 -06:00
Denis Kenzior
782bd4a7ae network: Reset connected_time when forgetting
If a network is being forgotten, then make sure to reset connected_time.
Otherwise the rank logic thinks that the network is known which can
result in network_find_rank_index returning -1.

Found by sanitizer:
src/network.c:1329:23: runtime error: index -1 out of bounds for type
	'double [64]'
2019-01-11 17:28:10 -06:00
Denis Kenzior
e256cbaba9 eapol: Don't memcpy if no extra data
As reported by the sanitizer:

src/eapol.c:574:2: runtime error: null pointer passed as argument 2,
	which is declared to never be null
2019-01-11 17:10:47 -06:00
Denis Kenzior
30cf1aa376 mpdu: Fix buffer overflow reported by asan
==25412==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000000421ab0 at pc 0x000000402faf bp 0x7fffffffdb00 sp 0x7fffffffdaf0
READ of size 4 at 0x000000421ab0 thread T0
    #0 0x402fae in validate_mgmt_ies src/mpdu.c:128
    #1 0x403ce8 in validate_probe_request_mmpdu src/mpdu.c:370
    #2 0x404ef2 in validate_mgmt_mpdu src/mpdu.c:662
    #3 0x405166 in mpdu_validate src/mpdu.c:706
    #4 0x402529 in ie_order_test unit/test-mpdu.c:156
    #5 0x418f49 in l_test_run ell/test.c:83
    #6 0x402715 in main unit/test-mpdu.c:171
    #7 0x7ffff5d43ed9 in __libc_start_main (/lib64/libc.so.6+0x20ed9)
    #8 0x4019a9 in _start (/home/denkenz/iwd-master/unit/test-mpdu+0x4019a9)
2019-01-11 11:43:21 -06:00
James Prestwood
c2189bc67e sae: fix one-off error in sae_is_quadradic_residue
This fixes the valgrind warning:

==14804== Conditional jump or move depends on uninitialised value(s)
==14804==    at 0x402E56: sae_is_quadradic_residue (sae.c:218)
==14804==    by 0x402E56: sae_compute_pwe (sae.c:272)
==14804==    by 0x402E56: sae_build_commit (sae.c:333)
==14804==    by 0x402E56: sae_send_commit (sae.c:591)
==14804==    by 0x401CC3: test_confirm_after_accept (test-sae.c:454)
==14804==    by 0x408A28: l_test_run (test.c:83)
==14804==    by 0x401427: main (test-sae.c:566)
2019-01-11 11:19:17 -06:00
Tim Kourt
e57f46df30 eap-ttls: Add tunneled MSCHAPv2 support 2019-01-10 17:26:19 -06:00
Tim Kourt
fd2c34cebc eap-ttls: Use method object in phase2 reset/destroy 2019-01-10 17:23:18 -06:00
Tim Kourt
9d1e2fa85b eap-ttls: Change signature of Phase 2 reset method 2019-01-10 17:22:56 -06:00
Tim Kourt
f924974e62 eap-ttls: Allow NULL state for Phase 2 2019-01-10 17:22:42 -06:00
Tim Kourt
af297039b1 eap-ttls: Extract credentials into dedicated struct 2019-01-10 17:18:45 -06:00
Tim Kourt
bb4e1ebd4f eap-mschapv2: Warn if required fields are missing 2019-01-10 17:12:55 -06:00
Tim Kourt
bfb69e930f eap-mschapv2: Fix domain name usage in username
The domain name must be excluded from the username only for the NT
challenge calculations and left in place for everything else.
2019-01-10 17:12:28 -06:00
Tim Kourt
3a71cf458b mschaputil: Move generator of the hash of the pwd hash 2019-01-10 17:09:10 -06:00
Tim Kourt
c8f071c67c mschaputil: Rearrange ops to fail early 2019-01-10 17:07:59 -06:00
Tim Kourt
cd00416168 mschaputil: Exlude domain name from challenge generation 2019-01-10 17:07:38 -06:00
Tim Kourt
5d9d00fac3 mschaputil: Adapt mschapv2 to re-use mschap ops
In addition, it refactors code to use l_util_hexstring_upper
2019-01-10 17:04:52 -06:00
Tim Kourt
6ffa1cf58a mschaputil: Move mschapv2 funcs into common util 2019-01-10 16:48:45 -06:00
Denis Kenzior
9b722197ba ecc: Remove remaining ECC/ECDH files
ECC primitives have now been fully converted / moved to ell.
2019-01-10 16:27:09 -06:00
James Prestwood
73dd0602fd sae: verify peer element for valid point
The return from l_ecc_point_from_data was not being checked for NULL,
which would cause a segfault if the peer sent an invalid point.
This adds a check and fails the protocol if p_element is NULL, as the
spec defines.
2019-01-10 16:26:29 -06:00
James Prestwood
48f5a051bc sae: update SAE to use ELL API's 2019-01-10 14:28:02 -06:00
James Prestwood
1d66ee0dd5 eap-pwd: update to use ELL ECC API's 2019-01-10 14:27:10 -06:00
Denis Kenzior
12189fcf39 conf: Increase default eapool handshake timeout 2019-01-09 21:13:53 -06:00
Andrew Zaborowski
d242cfc9e9 owe: Update l_ecdh_generate_shared_secret parameters 2018-12-28 12:32:14 -06:00
Andrew Zaborowski
8f9408efc7 eap-tls-common: Call the new l_tls_start 2018-12-19 10:05:35 -06:00
Andrew Zaborowski
6bf365d9a4 eapol: Check handshake_state_get_pmkid return value
Don't proceed with the handshake if handshake_state_get_pmkid fails
(shouldn't happen, but it's an error situation)
2018-12-19 10:05:16 -06:00
Tim Kourt
9d9f8331fa eap-tls-common: Increase log level for the common warning 2018-12-17 14:07:07 -06:00
Tim Kourt
a98089ed65 eap-tls-common: Add missing data 2018-12-17 14:06:59 -06:00
Denis Kenzior
686f515e04 eap-ttls: Bump up buffer sizes to quiet warnings
src/eap-ttls.c:766:50: error: ‘Password’ directive output may be truncated writing 8 bytes into a region of size between 1 and 72 [-Werror=format-truncation=]
  snprintf(password_key, sizeof(password_key), "%sPassword", prefix);
                                                  ^~~~~~~~
In file included from /usr/include/stdio.h:862,
                 from src/eap-ttls.c:28:
/usr/include/bits/stdio2.h:64:10: note: ‘__builtin___snprintf_chk’ output between 9 and 80 bytes into a destination of size 72
   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        __bos (__s), __fmt, __va_arg_pack ());
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2018-12-17 11:21:55 -06:00
Andrew Zaborowski
961e6d1480 eap-tls: Replace l_pem_load_certificate() with newer functions
Stop using l_pem_load_certificate which has been removed from ell, use
the same functions to load certificate files to validate them as those
used by the TLS implementation itself.
2018-12-17 11:18:42 -06:00
Tim Kourt
cff86c8419 eap-ttls: Propagate status of challenge generator 2018-12-14 14:18:22 -06:00
James Prestwood
c2094c5e04 ecdh: remove ECDH and unit tests
ECDH was moved into ell and is no longer needed in IWD
2018-12-12 11:12:27 -06:00
James Prestwood
e11c157478 owe: updated to use ell ECDH/ECC API's 2018-12-12 11:12:24 -06:00
Tim Kourt
fb656ff87a eap-tls-common: Make databuf private 2018-12-11 17:09:51 -06:00
Andrew Zaborowski
529ae6e683 eap-tls: Check AP identity in tls ready callbck
Check that the TLS logic has verified the server is trusted by the CA if
one was configured.  This is more of an assert as ell intentionally only
allows empty certificate chains from the peer in server mode (if a CA
certficate is set) although this could be made configurable.
2018-12-10 12:04:56 -06:00
Andrew Zaborowski
57ce6d0ca5 station: Check network_get_psk/passphrase return values
Check the returned values are not NULL.
2018-12-10 12:04:53 -06:00
Tim Kourt
610f9d28f0 eap-ttls: Migrate to eap-tls-common framework
The conversion transitions EAP-TTLS implementation to use a
common Phase 1 implementation shared among all TLS based
EAP methods.
2018-12-05 22:57:36 -06:00
Tim Kourt
84eda62823 eap-tls-common: ACK first fragment with missing M bit 2018-12-05 22:55:02 -06:00
Tim Kourt
30dfe9225c eap-peap: Migrate to eap-tls-common framework
The conversion transitions EAP-PEAP implementation to use a
common Phase 1 implementation shared among all TLS based
EAP methods.
2018-12-05 22:31:17 -06:00
Tim Kourt
4b9970bd99 eap-tls-common: Add comment 2018-12-05 22:26:29 -06:00
Denis Kenzior
94b7a69146 eap-tls-common: Fix typo 2018-12-05 11:55:00 -06:00
Tim Kourt
aafa4d50bb eap-tls: Migrate to eap-tls-common framework
The conversion transitions EAP-TLS implementation to use a
common Phase 1 implementation shared among all TLS based
EAP methods.
2018-12-05 11:53:59 -06:00
Tim Kourt
645b72be06 eap-tls-common: Validate successful loading of keys/certs 2018-12-05 11:33:47 -06:00
Tim Kourt
f1f826ee81 eap-tls-common: Handle packet payload 2018-12-05 11:33:06 -06:00
Andrew Zaborowski
b375191c61 scan: Drop the wiphy_id scan callback parameter 2018-12-04 10:36:17 -06:00
Andrew Zaborowski
e4858d6da3 scan: Refactor scan request and periodic scan logic
This should not change the behaviour except for fixing a rare crash
due to scan_cancel not working correctly when cancelling the first scan
request in the queue while a periodic scan was running, and potentially
other corner cases.  To be able to better distinguish between a periodic
scan in progress and a scan request in progress add a sc->current_sr
field that points either at a scan request or is NULL when a periodic
scan is in ongoing.  Move the triggered flag from scan_request and
scan_preiodic directly to scan_context so it's there together with
start_cmd_id.  Hopefully make scan_cancel simpler/clearer.

Note sc->state and sc->triggered have similar semantics so one of them
may be easily removed.  Also the wiphy_id parameter to the scan callback
is rather useless, note I temporarily pass 0 as the value on error but
perhaps it should be dropped.
2018-12-04 10:32:57 -06:00
Tim Kourt
f07119b33a eap-tls-common: Add tunnel API for send, close 2018-12-04 10:25:24 -06:00
Tim Kourt
6490ecd615 eap-tls-common: Add accessors for variant data and ver 2018-12-04 10:23:49 -06:00
Tim Kourt
663cf9931e eap-tls-common: Expose PRF 2018-12-04 10:22:00 -06:00
Tim Kourt
8dc9276800 eap-tls-common: Make send empty response func. public 2018-12-04 10:21:28 -06:00
Tim Kourt
779f668ab9 eap-tls-common: Introduce variant data and reset API 2018-12-04 10:19:55 -06:00
Tim Kourt
bb98101bd4 eap-tls-common: Handle response retransmission 2018-12-04 10:19:20 -06:00
Tim Kourt
9df7785fee eap-tls-common: Add phase 2 failure flag
This flag is used by the extensions to signal the failure
during phase 2 execution.
2018-12-04 10:18:53 -06:00
Tim Kourt
c1f791afc4 eap-tls-common: Handle common tunnel ready cb 2018-12-04 10:18:11 -06:00
Tim Kourt
c2d3a84e3a eap-tls-common: Add method completion flag
This flag prevents methods from restarting
2018-12-04 10:16:36 -06:00
Tim Kourt
c35c91ad20 eap-tls-common: Add support for fragmented response 2018-12-04 10:14:39 -06:00
Tim Kourt
718f967d17 eap-tls-common: Add basic send response 2018-12-04 10:13:24 -06:00
Tim Kourt
802891fcc3 eap-tls-common: Add tunneled data handling 2018-12-04 10:04:07 -06:00
Tim Kourt
edfc070d96 eap-tls-common: Add tls tunnel 2018-12-04 10:03:07 -06:00
Tim Kourt
c865eaa141 eap-tls-common: Add support for the fragmented requests 2018-12-03 14:31:16 -06:00
Tim Kourt
36e2252606 eap-tls-common: Add basic request handling
This also introduces the version negotiation
2018-12-03 14:31:16 -06:00
Tim Kourt
7aa35bf6c7 eap-tls-common: Introduce eap_tls_variant_ops
eap_tls_variant_ops will allow methods such as TTLS, PEAP,
etc. to specify their own handlers for the Phase 2 operations.
2018-12-03 14:31:16 -06:00
Andrew Zaborowski
47bb5b5f72 network: Generate the PSK as soon as we have a passphrase
In the name of failing earlier try to generate the PSK from the
passphrase as soon as we receive the passphrase or read it from the
file, mainly to validate it has the right number of characters.
The passphrase length currently gets validates inside
crypto_psk_from_passphrase which will be called when we receive a new
passphrase from the agent or when the config file has no PSK in it.  We
do not do this when there's already both the PSK and the passphrase
available in the settings -- we can add that separately if needed.
2018-12-03 14:17:30 -06:00
Andrew Zaborowski
0d3f16ec5e scan: Call .destroy in scan_request_free
The main difference with this is that scan_context removal will also
trigger the .destroy calls.  Normally there won't be any requests left
during scan_context but if there were any we should call destroy on
them.
2018-12-03 11:42:32 -06:00
Denis Kenzior
5b3ae4c40c wsc: Only add WSC interface if netdev is UP 2018-11-29 11:45:20 -06:00
Denis Kenzior
9e1ba84f26 device: Restore device Powered state
After wiphy comes out of the rfkill state and is again powered, restore
the device state to Powered if needed.
2018-11-29 11:34:07 -06:00
Denis Kenzior
0dd8114970 wiphy: Add wiphy state watch add / remove 2018-11-29 11:22:50 -06:00
Denis Kenzior
9be982b460 wiphy: Introduce wiphy_new 2018-11-29 11:22:07 -06:00
Denis Kenzior
52771de1a5 eapol: Further relax PMKID check
If we haven't sent a PMKID, and we're not running EAP, then ignore
whatever PMKID the AP sends us.  Frequently the APs send us garbage in
this field.  For PSK and related AKMs, if the PMK is wrong, then we
simply fail to generate a proper MIC and the handshake would fail at a
later stage anyway.
2018-11-28 19:06:33 -06:00
Tim Kourt
0536a9bdd5 scan: Fix failure handling in common scan triggering logic
Fix incorrect usage of the caller’s scan triggered callback.
In case of a failure, destroy scan request and notify caller
about the issue by returning zero scan id instead of calling
callers’ scan triggered callback with an error code.
2018-11-26 18:16:11 -06:00
Shaleen Jain
d9c89e89c6 iwd.service: restart service on crash 2018-11-26 14:38:07 -06:00
Andreas Henriksson
b6910e1210 build: only enable backtrace(3) in maintainer mode
Using backtrace() is of no use when building with PIE (which most
distro compilers do by default) and prevents catching the coredump
for later retracing, which is needed since distros usually don't
install debug symbols by default either.

This patch thus only enables backtrace() when --enable-maintainer-mode
is passed and also tries to explicitly disable PIE.
2018-11-26 14:32:04 -06:00
Andrew Zaborowski
95c05d447b scan: Fix confusing identation 2018-11-21 11:28:48 -06:00
Denis Kenzior
e609981b61 eap-tls-common: Update to private key API changes 2018-11-21 11:28:34 -06:00
Andrew Zaborowski
299af7fc39 eap-tls, ttls, peap: Update for private key API changes 2018-11-21 11:25:03 -06:00
Tim Kourt
bdcff2cdde eap: Add accessors for the method name and type 2018-11-19 17:10:53 -06:00
Tim Kourt
87c411f816 eap-tls-common: Introduce a common tls state and load settings 2018-11-19 17:10:53 -06:00
Tim Kourt
514d442db1 eap-tls-common: Add check for phase one settings 2018-11-19 17:10:53 -06:00
Denis Kenzior
1e6df6a226 ecdh: Fix warning 2018-11-19 14:27:17 -06:00
James Prestwood
c3abfde025 ecdh: make key byte ordering consistent
ECDH was expecting the private key in LE, but the public key in BE byte ordering.
For consistency the ECDH now expect all inputs in LE byte ordering. It is up to
the caller to order the bytes appropriately.

This required adding some ecc_native2be/be2native calls in OWE
2018-11-19 13:46:28 -06:00
Andrew Zaborowski
d7dc6606de eap-tls, ttls, peap: Update for l_tls API changes 2018-11-19 13:03:38 -06:00
Denis Kenzior
53db703773 netdev: Fix style 2018-11-19 12:09:27 -06:00
Denis Kenzior
adb14dfca5 netdev: Fix typo 2018-11-19 11:53:30 -06:00
James Prestwood
576c6dc9f3 netdev/station: Add OWE support
The changes to station.c are minor. Specifically,
station_build_handshake_rsn was modified to always build up the RSN
information, not just for SECURITY_8021X and SECURITY_PSK. This is
because OWE needs this RSN information, even though it is still
SECURITY_NONE. Since "regular" open networks don't need this, a check
was added (security == NONE && akm != OWE) which skips the RSN
building.

netdev.c needed to be changed in nearly the same manor as it was for
SAE. When connecting, we check if the AKM is for OWE, and if so create
a new OWE SM and start it. OWE handles all the ECDH, and netdev handles
sending CMD_AUTHENTICATE and CMD_ASSOCIATE when triggered by OWE. The
incoming authenticate/associate events just get forwarded to OWE as they
do with SAE.
2018-11-19 11:51:02 -06:00
James Prestwood
8978f8c43f owe: added OWE module
This module is similar to SAE in that it communicates over authenticate
and associate frames. Creating a new OWE SM requires registering two TX
functions that handle sending the data out over CMD_AUTHENTICATE/ASSOCIATE,
as well as a complete function.

Once ready, calling owe_start will kick off the OWE process, first by
sending out an authenticate frame. There is nothing special here, since
OWE is done over the associate request/response.

After the authenticate response comes in OWE will send out the associate
frame which includes the ECDH public key, and then receive the AP's
public key via the associate response. From here OWE will use ECDH to
compute the shared secret, and the PMK/PMKID. Both are set into the
handshake object.

Assuming the PMK/PMKID are successfully computed the OWE complete callback
will trigger, meaning the 4-way handshake can begin using the PMK/PMKID
that were set in the handshake object.
2018-11-16 18:06:42 -06:00
James Prestwood
60555ece3b handshake: added OWE AKM to handshake_state_derive_ptk 2018-11-16 17:03:06 -06:00
James Prestwood
126993b9e3 eapol: Add OWE to MIC calculate/verify
This allows eapol to work with the OWE AKM type. Similar shortcuts were
taken as with SAE since, for now, both only support a single ECC group.
2018-11-16 17:02:13 -06:00
James Prestwood
d19b1bb85e wiphy: Handle OWE AKM for SECURITY_TYPE_NONE 2018-11-16 16:59:59 -06:00
James Prestwood
ef544dfc6e common: Classify OWE networks as open 2018-11-16 16:59:59 -06:00
James Prestwood
8740abb60e netdev: add translation for OWE AKM type 2018-11-16 16:59:59 -06:00
James Prestwood
3293bd9933 ie: add OWE AKM type
Added a new AKM suite, IE_RSN_AKM_SUITE_OWE.
2018-11-16 16:59:45 -06:00
Tim Kourt
e4a76018fd scan: Make periodic scan optional 2018-11-16 16:42:00 -06:00
James Prestwood
40685e8fe3 crypto: implement HKDF-Expand (RFC 5869)
This will be required by OWE
2018-11-16 16:38:28 -06:00
James Prestwood
0b42ca7c30 crypto: renamed hkdf_256
The RFC (5869) for this implementation defines two functions,
HKDF-Extract and HKDF-Expand. The existing 'hkdf_256' was implementing
the Extract function, so it was renamed appropriately. The name was
changed for consistency when the Expand function will be added in the
future.
2018-11-16 16:30:22 -06:00
James Prestwood
5811e72940 ecdh: added ECDH module 2018-11-16 16:25:17 -06:00
James Prestwood
9b204a8c7e ie: add IE_TYPE_OWE_DH_PARAM to IE list 2018-11-16 16:20:59 -06:00
Denis Kenzior
712a92cc4c network: Simplify is_rsn logic
In the current version SECURITY_PSK was handled inside the is_rsn block
while the SECURITY_8021X was off in its own block.  This was weird and a
bit misleading.  Simplify the code flow through the use of a goto and
decrease the nesting level.

Also optimize out unnecessary use of scan_bss_get_rsn_info
2018-11-15 11:37:20 -06:00
Denis Kenzior
5bfbdd5a01 network: Check Autoconnectable as the first condition 2018-11-15 11:31:39 -06:00
Denis Kenzior
c146490567 network: Introduce __bss_is_sae
This takes an rsn_info pointer directly so that some calls to
scan_bss_get_rsn_info can be optimized
2018-11-15 11:29:13 -06:00
Denis Kenzior
3d549e457d scan: make scan_bss_get_rsn_info const correct 2018-11-15 11:28:46 -06:00
James Prestwood
ad242a796a network: fix 8021x autoconnect
In network_autoconnect, when the network was SECURITY_8021X there was no
check (for SECURITY_PSK) before calling network_load_psk. Since the
provisioning file was for an 8021x network neither PreSharedKey or
Passphrase existed so this would always fail. This fixes the 8021x failure
in testConnectAutoconnect.
2018-11-15 11:20:06 -06:00
James Prestwood
07c870df55 station: only set 8021x config on 8021x networks
During the handshake setup, if security != SECURITY_PSK then 8021x settings
would get set in the handshake object. This didn't appear to break anything
(e.g. Open/WEP) but its better to explicitly check that we are setting up
an 8021x network.
2018-11-14 20:47:42 -06:00
Peter Seiderer
7d6e11ddd5 main: Fix __iwd_backtrace_init() availability detection
Check for HAVE_EXECINFO_H for all __iwd_backtrace_init usages.

Fixes:

  src/main.o: In function `main':
  main.c:(.text.startup+0x798): undefined reference to `__iwd_backtrace_init'
  collect2: error: ld returned 1 exit status
2018-11-10 19:09:14 +01:00
Denis Kenzior
6df62ab68e station: Update to the new GetHiddenAccessPoints API 2018-11-09 14:06:20 -06:00
Denis Kenzior
5f8c20f455 netdev: Enable ControlPortOverNL80211 by default 2018-11-09 11:52:09 -06:00
Denis Kenzior
8732a9f38a main: Add checks for asymmetric key support
Tell the user that Kernel 4.20 with asymmetric key support enabled is
required to support TLS based (EAP/PEAP/TTLS) WPA-Enterprise methods.
2018-11-09 11:50:29 -06:00
Tim Kourt
8c1992feb2 station: Introduce GetHiddenStations API call 2018-11-09 11:34:43 -06:00
Tim Kourt
f803b0439b station: Introduce an ordered list of hidden stations
A sorted list of hidden network BSSs observed in the recent scan
is kept for the informational purposes of the clients. In addition,
it has deprecated the usage of seen_hidden_networks variable.
2018-11-09 11:34:43 -06:00
Andrew Zaborowski
0b5dceab27 network: Don't require PSK if Passphrase present
Refactor the network->psk and network->passphrase loading and saving
logic to not require the PreSharedKey entry in the psk config file and
to generate network->psk lazily on request.  Still cache the computed
PSK in memory and in the .psk file to avoid recomputing it which uses
many syscalls.  While there update the ask_psk variable to
ask_passphrase because we're specifically asking for the passphrase.
2018-11-05 12:43:16 -06:00
Patrik Flykt
0b1e6cc3e5 scan: Log BSSID in messages
If there is an error with the BSSID information, log the BSSID
station address to catch the offending Access Point.
2018-11-05 12:29:41 -06:00
Patrik Flykt
7ec8fd6776 ie: Fix up broken Access Point with too many rates added
According to the specification, Supported rates IE is supposed
to have a maximum length of eight rate bytes. In the wild an
Access Point is found to add 12 bytes of data instead of placing
excess rate bytes in an Extended Rates IE.

BSS: len 480
    BSSID 44:39:C4:XX:XX:XX
    Probe Response: true
    TSF: 0 (0x0000000000000000)
    IEs: len 188
...
        Supported rates:
            1.0(B) 2.0(B) 5.5(B) 6.0(B) 9.0 11.0(B) 12.0(B) 18.0 Mbit/s
            24.0(B) 36.0 48.0 54.0 Mbit/s
            82 84 8b 8c 12 96 98 24 b0 48 60 6c              .......$.H`l
        DSSS parameter set: channel 3
            03
...

Any following IEs decode nicely, thus it seems that we can relax
Supported Rates IE length handling to support this thermostat.
2018-11-05 12:07:22 -06:00
Patrik Flykt
c68ae2f00b main: Log optimized implementations only when they exist
Log optimized implementations strings only when the hashmap contains
items in order to avoid an unnecessary line of text with no members
printed out.
2018-11-05 11:52:48 -06:00
Denis Kenzior
c4153941af netdev: Use l_genl_family_unicast_handler 2018-11-02 15:53:07 -05:00
James Prestwood
1d62f4ec0e eapol: remove unused public eapol functions from header
After moving AP EAPoL code into eapol.c there were a few functions that
no longer needed to be public API's. These were changed to static's and
the header definition was removed.
2018-11-02 14:05:44 -05:00
Marcel Holtmann
554e4f55db build: Fix includes for using with -std=c99 compiler option 2018-11-01 22:37:11 +01:00
Marcel Holtmann
72a64fa7fb build: Adjust to the latest ELL signal API changes 2018-11-01 22:09:19 +01:00
Andrew Zaborowski
e4222d0ebe eap-tls: Set upper limit on request size
Set an upper limit on a fragmented EAP-TLS request size similar to how
we do it in EAP-TTLS.  While there make the code more similar to the
EAP-TTLS flag processing to keep them closer in sync.  Note that the
spec suggests a 64KB limit but it's not clear if that is for the TLS
record or EAP request although it takes into account the whole TLS
negotiation so it might be good for both.
2018-11-01 15:04:56 -05:00
Andrew Zaborowski
0b71b034c1 eap-tls/ttls/peap: Conditionally enable TLS debugging
Print the TLS debug messages if IWD_TLS_DEBUG is set.
2018-11-01 15:04:56 -05:00
Marcel Holtmann
a011909556 main: Use l_main_run_with_signal instead of open coding it 2018-11-01 19:56:16 +01:00
Marcel Holtmann
38e831afa0 main: Make genl and nl80211 global variables static 2018-11-01 19:55:54 +01:00
Marcel Holtmann
013bae6d3d eapol: Make eapol_frame_watch_{add,remove} functions static 2018-11-01 10:27:22 +01:00
Marcel Holtmann
9335602ba0 network: Removed unneeded include for src/watchlist.h 2018-11-01 10:19:26 +01:00
Marcel Holtmann
e1c391a76b wsc: Removed unneeded include for src/watchlist.h 2018-11-01 10:17:54 +01:00
Denis Kenzior
7699c8ab1e eap-ttls: Handle redundant L flags
Some of the TTLS server implementations set the L flag in the fragment
packets other than the first one. To stay interoperable with such devices,
iwd is relaxing the L bit check.
2018-10-30 15:47:57 -05:00
Denis Kenzior
5cc60d18cc eap-md5: Add warning about deprecated settings key 2018-10-29 18:49:19 -05:00
Tim Kourt
99c685940a eap-md5: Standardize setting keys
Switch EAP-MD5 to use the common password setting key nomenclature.
The key name has been changed from PREFIX-MD5-Secret to PREFIX-Password.
Note: The old key name is supported.
In addition, this patch adds an ability to request Identity and/or
Password from user.
2018-10-29 18:46:07 -05:00
James Prestwood
b9029aaf65 adhoc: wait for both handshakes before adding peer
Adhoc was not waiting for BOTH handshakes to complete before adding the
new peer to the ConnectedPeers property. Actually waiting for the gtk/igtk
(in a previous commit) helps with this, but adhoc also needed to keep track
of which handshakes had completed, and only add the peer once BOTH were done.
This required a small change in netdev, where we memcmp the addresses from
both handshakes and only set the PTK on one.
2018-10-26 15:29:48 -05:00
James Prestwood
e678d6655f netdev: signal handshake complete after setting all keys
Currently, netdev triggers the HANDSHAKE_COMPLETE event after completing
the SET_STATION (after setting the pairwise key). Depending on the timing
this may happen before the GTK/IGTK are set which will result in group
traffic not working initially (the GTK/IGTK would still get set, but group
traffic would not work immediately after DBus said you were connected, this
mainly poses a problem with autotests).

In order to fix this, several flags were added in netdev_handshake_state:
ptk_installed, gtk_installed, igtk_installed, and completed. Each of these
flags are set true when their respective keys are set, and in each key
callback we try to trigger the handshake complete event (assuming all the
flags are true). Initially the gtk/igtk flags are set to true, for reasons
explained below.

In the WPA2 case, all the key setter functions are called sequentially from
eapol. With this change, the PTK is now set AFTER the gtk/igtk. This is
because the gtk/igtk are optional and only set if group traffic is allowed.
If the gtk/igtk are not used, we set the PTK and can immediately trigger the
handshake complete event (since gtk_installed/igtk_installed are initialized
as true). When the gtk/igtk are being set, we immediately set their flags to
false and wait for their callbacks in addition to the PTK callback. Doing it
this way handles both group traffic and non group traffic paths.

WPA1 throws a wrench into this since the group keys are obtained in a
separate handshake. For this case a new flag was added to the handshake_state,
'wait_for_gtk'. This allows netdev to set the PTK after the initial 4-way,
but still wait for the gtk/igtk setters to get called before triggering the
handshake complete event. As a precaution, netdev sets a timeout that will
trigger if the gtk/igtk setters are never called. In this case we can still
complete the connection, but print a warning that group traffic will not be
allowed.
2018-10-26 15:26:49 -05:00
Marcel Holtmann
9b2bb2723f crypto: Use full include path local includes 2018-10-26 21:35:27 +02:00
Marcel Holtmann
77710f9765 simauth: Use full include path local includes 2018-10-26 21:34:58 +02:00
Marcel Holtmann
515c130549 storage: Use full include path local includes 2018-10-26 21:34:00 +02:00
Marcel Holtmann
0b93fde3b4 wscutil: Use full include path local includes 2018-10-26 21:33:38 +02:00
Marcel Holtmann
162e6a19f6 watchlist: Use full include path local includes 2018-10-26 21:33:01 +02:00
Marcel Holtmann
1eaca1f8e1 mscaputil: Use full include path local includes 2018-10-26 21:32:20 +02:00
Marcel Holtmann
3fa63ede50 eapol: Use full include path local includes 2018-10-26 21:31:52 +02:00
Marcel Holtmann
c2d0517228 knownnetworks: Use full include path local includes 2018-10-26 21:30:44 +02:00
Marcel Holtmann
e92b976663 ecc: Use full include path local includes 2018-10-26 21:29:45 +02:00
Marcel Holtmann
42cfaeb265 sae: Use full include path local includes 2018-10-26 21:29:08 +02:00
Marcel Holtmann
785be02ee5 mpdu: Use full include path local includes 2018-10-26 21:28:10 +02:00
Marcel Holtmann
52f7f1dea2 handshake: Use full include path local includes 2018-10-26 21:27:01 +02:00
Marcel Holtmann
23a7fafec6 ie: Use full include path for local includes 2018-10-26 21:26:17 +02:00
Marcel Holtmann
be5bf7ee15 util: Only include <ell/ell.h> and use full include path 2018-10-26 21:24:20 +02:00
Denis Kenzior
a2efe2d2de eap-pwd: Warn if deprecated setting is used 2018-10-25 14:52:30 -05:00
Tim Kourt
df59d57f96 eap-pwd: Standardize setting keys
Switch EAP-PWD to use the common password setting key nomenclature.
2018-10-25 14:29:56 -05:00
Denis Kenzior
c256dbfbd8 eap-gtc: Warn if deprecated setting is used 2018-10-25 14:25:28 -05:00
Tim Kourt
c92f8231b2 eap-gtc: Standardize property keys
Switch EAP-GTC to use the common password setting key nomenclature.
2018-10-25 14:14:16 -05:00
Tim Kourt
e8de229223 ttls: add support for tunneled MS-CHAP 2018-10-24 16:33:06 -05:00
Tim Kourt
b46376980a mschaputil: Add MS CHAP utilities 2018-10-24 16:28:46 -05:00
Denis Kenzior
ae538eae7d netdev: Cancel ongoing rekey offload
We need to cancel an ongoing rekey offload in a few additional places
besides the netdev destructor.
2018-10-20 10:38:56 -05:00
Denis Kenzior
8501b2edb1 netdev: Add a TODO about Rekey Offload errors 2018-10-20 10:36:42 -05:00
Denis Kenzior
658362a349 netdev: Put command cancelation into a common function 2018-10-20 10:35:28 -05:00
Tim Kourt
e979bf97f1 netdev: add an ability to cancel hw rekey cmd
==1628== Invalid read of size 1
==1628==    at 0x405E71: hardware_rekey_cb (netdev.c:1381)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Address 0x5475208 is 312 bytes inside a block of size 320 free'd
==1628==    at 0x4C2ED18: free (vg_replace_malloc.c:530)
==1628==    by 0x43D94D: l_queue_clear (queue.c:107)
==1628==    by 0x43D998: l_queue_destroy (queue.c:82)
==1628==    by 0x40B431: netdev_shutdown (netdev.c:4765)
==1628==    by 0x403B17: iwd_shutdown (main.c:81)
==1628==    by 0x4419D2: signal_callback (signal.c:82)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Block was alloc'd at
==1628==    at 0x4C2DB6B: malloc (vg_replace_malloc.c:299)
==1628==    by 0x43CA4D: l_malloc (util.c:62)
==1628==    by 0x40A853: netdev_create_from_genl (netdev.c:4517)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
2018-10-20 10:29:52 -05:00
Marcel Holtmann
a59e162446 knownnetworks: Use l_dir_watch instead of l_fswatch 2018-10-19 19:14:05 +02:00
Marcel Holtmann
8f8a214fbd build: Use new l_tls_prf_get_bytes and remove ell/tls-private.h usage 2018-10-19 09:30:59 +02:00
Marcel Holtmann
467d3958b4 build: Use l_tls_prf_get_bytes instead of tls_prf_get_bytes 2018-10-19 08:46:57 +02:00
Marcel Holtmann
b27edce298 build: Use include "" instead of include <> for ell/tls-private.h 2018-10-19 08:24:57 +02:00
Denis Kenzior
d22e57c994 treewide: Remove use of key-private.h 2018-10-19 00:31:41 -05:00
Denis Kenzior
6e8f10f695 eap-ttls: Use iwd's version of align_len
No need to include ell's private bits unnecessarily
2018-10-19 00:20:47 -05:00
Denis Kenzior
770f3c6049 dbus: Remove unneeded include 2018-10-19 00:20:35 -05:00
Marcel Holtmann
1ee7de15c8 ttls: Fix truncated before the last format character 2018-10-14 11:35:48 +02:00
Marcel Holtmann
a3c1fa28da build: Rename nl80211_util.[ch] into nl80211util.[ch] 2018-10-14 05:41:06 +02:00