3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-23 06:02:37 +01:00
Commit Graph

2676 Commits

Author SHA1 Message Date
Andrew Zaborowski
e6de4b10ad frame-xchg: Add facility to keep retransmitting after ACK
In some cases a P2P peer will ACK our frame but not reply on the first
attempt, and other implementations seem to handle this by going back to
retransmitting the frame at a high rate until it gets ACKed again, at
which point they will again give the peer a longer time to tx the
response frame.  Implement the same logic here by adding a
retries_on_ack parameter that takes the number of additional times we
want to restart the normal retransmit counter after we received no
response frame on the first attempt.  So passing 0 maintains the
current behaviour, 1 for 1 extra attempt, etc.

In effect we may retransmit a frame about 15 * (retry_on_ack + 1) *
<in-kernel retransmit limit> times.  The kernel/driver retransmits a
frame a number of times if there's no ACK (I've seen about 20 normally)
at a high frequency, if that fails we retry the whole process 15 times
inside frame-xchg.c and if we still get no ACK at any point, we give up.
If we do get an ACK, we wait for a response frame and if we don't get
that we will optionally reset the retry counter and restart the whole
thing retry_on_ack times.
2020-03-20 10:13:42 -05:00
James Prestwood
e10c6ada12 doc: document AlwaysRandomizeAddress and AddressOverride 2020-03-18 18:15:16 -05:00
James Prestwood
f13fd9d61f netdev: honor handshake->spa if set
In order to support AlwaysRandomizeAddress and AddressOverride, station will
set the desired address into the handshake object. Then, netdev checks if
this was done and will use that address rather than generate one.
2020-03-18 18:15:16 -05:00
James Prestwood
e7777c3422 station: support full MAC randomization and override
This patch adds two new options to a network provisioning file:

AlwaysRandomizeAddress={true,false}

If true, IWD will randomize the MAC address on each connection to this
network. The address does not persists between connections, any new
connection will result in a different MAC.

AddressOverride=<MAC>

If set, the MAC address will be set to <MAC> assuming its a valid MAC
address.

These two options should not be used together, and will only take effect
if [General].AddressRandomization is set to 'network' in the IWD
config file.

If neither of these options are set, and [General].AddressRandomization
is set to 'network', the default behavior remains the same; the MAC
will be generated deterministically on a per-network basis.
2020-03-18 18:15:16 -05:00
James Prestwood
33251ccd20 util: add util_is_valid_sta_address
Checks that that address is neither broadcast or group
2020-03-18 18:15:16 -05:00
Andrew Zaborowski
66657a5706 p2putil: Tolerate GO Neg Response with empty Channel List
Work around a parse error in GO Negotiation with some P2P devices.
2020-03-18 13:50:32 -05:00
Andrew Zaborowski
22d7a3c629 frame-xchg: Optimize frame_watch_remove_by_handler scenarios
Since frame_watch_remove_by_handler only forgets a given function +
user data pointers, and doesn't remove the frame prefixes added in the
kernel, we can avoid later re-registering those prefixes with the
kernel by keeping them in our local watchlist, and only replacing the
handler pointer with a dummy function.
2020-03-18 13:49:42 -05:00
Andrew Zaborowski
9e18552fe7 watchlist: Allow watch CBs to call watchlist_destroy
If during WATCHLIST_NOTIFY{,_MATCHES,_NO_ARGS} one of the watch
notify callback triggers a call to watchlist_destroy, give up calling
remaining watches and destroy the watchlist without crashing.  This is
useful in frame-xchg.c (P2P use case) where a frame watch may trigger
a move to a new state after receiving a specific frame, and remove one
group of frame watches (including its watchlist) to create a different
group.
2020-03-18 13:49:22 -05:00
James Prestwood
a2006a3d29 doc: document AddressRandomization=network option 2020-03-18 13:10:41 -05:00
James Prestwood
5a1b1184fc netdev: support per-network MAC addresses
For privacy reasons its advantageous to randomize or mask
the MAC address when connecting to networks, especially public
networks.

This patch allows netdev to generate a new MAC address on a
per-network basis. The generated MAC will remain the same when
connecting to the same network. This allows reauthentications
or roaming to work, and not have to fully re-connect (which would
be required if the MAC changed on every connection).

Changing the MAC requires bringing the interface down. This does
lead to potential race conditions with respect to external
processes. There are two potential conditions which are explained
in a TODO comment in this patch.
2020-03-18 13:10:41 -05:00
James Prestwood
f96f8ba4a0 manager: remove warning for AddressRandomization option
Since the 'network' value is handled inside netdev we don't want this warning
being printed.
2020-03-18 13:10:41 -05:00
James Prestwood
1f14782857 wiphy: add _generate_address_from_ssid
This API is being added to support per-network MAC address
generation. The MAC is generated based on the network SSID
and the adapters permanent address using HMAC-SHA256. The
SHA digest is then constrained to make it MAC address
compliant.

Generating the MAC address like this will ensure that the
MAC remains the same each time a given SSID is connected to.
2020-03-18 13:10:41 -05:00
Andrew Zaborowski
60bb42087a frame-xchg: Allow frame_xchg_stop calls inside frame callbacks
Make sure a frame callback is free to call frame_xchg_stop without
causing a crash.  Frame callback here means the one that gets
called if our tx frame was ACKed and triggered a respone frame that
matched one of the provided prefixes, within the given time.

All in all a frame callback is allowed to call either
frame_xchg_stop or frame_xchg_startv or neither.  Same applies to
the final callback (called when no matching responses received).
2020-03-17 15:45:07 -05:00
Andrew Zaborowski
f1aa208edf frame-xchg: Allow calling frame_xchg_stop from the callback
Don't crash if the user calls frame_xchg_stop(wdev) from inside the
frame exchange's final callback.  That call is going to be redundant but
it's convenient to do this inside a cleanup function for a given wdev
without having to check whether any frame exchange was actually running.
2020-03-17 15:44:56 -05:00
Andrew Zaborowski
9147a6b726 frame-xchg: Fix frame_watch_item_remove_by_handler 2020-03-17 15:44:22 -05:00
Andrew Zaborowski
a18c75d375 frame-xchg: Actually free duplicate watches
Fix a potential leak when we need to drop an existing watch because it's
being replaced with a new one.
2020-03-17 15:44:10 -05:00
Andrew Zaborowski
9ff1c4da3a cleanup: Remove extra empty lines 2020-03-17 15:35:22 -05:00
James Prestwood
85fd9f50f7 netdev: fix auth protocols not setting ->connected
This causes netdev to think another supplicant is running when it
recieves a connect event due to an auth protocol running.
2020-03-13 23:52:26 -05:00
James Prestwood
421af060f8 netdev: update use of l_rtnl_set_mac
This API was updated to take an extra boolean which will
automatically power up the device while changing the MAC
address. Since this is what IWD does anyways we can avoid
the need for an intermediate callback and go right into
netdev_initial_up_cb.
2020-03-12 10:46:06 -05:00
Louis Whitburn
eb7845ec29 eap-tls-common: Don't fail with omitted EAP-TLS-CACert
iwd would fail to connect using EAP-TLS when no CA certificate was
provided as it checked for successful loading of the CA certificate
instead of the client certificate when attempting to load the client
certificate.
2020-03-09 22:25:33 -05:00
James Prestwood
ca9110e8c2 network: enforce max EAP/pkey password length 2020-03-06 13:08:25 -06:00
James Prestwood
d40a8d1a6d eap-gtc: limit password length to maximum
The password for EAP-GTC is directly used in an EAP response. The
response buffer is created on the stack so an overly large password
could cause a stack overflow.
2020-03-06 13:08:05 -06:00
James Prestwood
301d8473df iwd: define a maximum password length 2020-03-06 13:07:58 -06:00
James Prestwood
77cfb615e5 eap: check MTU when loading identity
If the MTU was set very low an identity could exceed the maximum.
2020-03-06 12:17:09 -06:00
Denis Kenzior
53ea9adfb5 netdev: Fix disconnect event coming out of order
mac80211 drivers seem to send the disconnect event which is triggered by
CMD_DISCONNECT prior to the CMD_DISCONNECT response.  However, some
drivers, namely brcmfmac, send the response first and then send the
disconnect event.  This confused iwd when a connection was immediately
triggered after a disconnection (network switch operation).

Fix this by making sure that connected variable isn't set until the
connect event is actually processed, and ignore disconnect events which
come after CMD_DISCONNECT has alredy succeeded.
2020-02-28 10:25:04 -06:00
Andrew Zaborowski
dd2677402a ap: React to NL80211_CMD_STOP_AP events
These events will tell use when our AP gets stopped without our request,
for example due to suspend/resume.
2020-02-17 12:27:54 -06:00
Andrew Zaborowski
87a198111a frame-xchg: Don't use l_genl for additional nl80211 sockets
For nl80211 sockets other than our main l_genl object use socket io
directly, to avoid creating many instances of l_genl.  The only reason
we use multiple sockets is to work around an nl80211 design quirk that
requires closing the socket to unregister management frame watches.
Normally there should not be a need to create multiple sockets in a
program.
2020-02-17 12:23:13 -06:00
Andrew Zaborowski
0d62b5a2fc frame-xchg: Add a frame exchange API
Add a little state machine and a related API, to simplify sending out a
frame, receiving the Ack / No-ack status and (if acked) waiting for a
response frame from the target device, one of a list of possible
frame prefixes.  The nl80211 API for this makes it complicated
enough that this new API seems to be justified, on top of that there's a
quirk when using the brcmfmac driver where the nl80211 response
(containing the operation's cookie), the Tx Status event and the response
Frame event are received from nl80211 in reverse order (not seen with
other drivers so far), further complicating what should be a pretty
simple task.
2020-02-17 10:45:40 -06:00
Andrew Zaborowski
ff7abdb89d frame-xchg: Try to call a handler only once per frame
Try to better deduplicate the frame watches.  Until now we'd check if
we'd already registered a given frame body prefix with the kernel, or a
matching more general prefix (shorter).  Now also try to check if we
have already have a watch with the same callback pointer and user_data
value, and:

 * an identical or shorter (more general) prefix, in that case ignore
   the new watch completely.

 * a longer (more specific) prefix, in that case forget the existing
   watch.

The use case for this is when we have a single callback for multiple
watches and multiple frame types, and inside that callback we're looking
at the frame body again and matching it to frame types.  In that case
we don't want that function to be called multiple times for one frame
event.
2020-02-17 10:42:55 -06:00
Daniel Wagner
a40503427e rtnlutil: Remove used rtnlutil
The rtnl code has been added to ELL. There is caller left in iwd,
therefore remove the rtnlutil file.
2020-02-17 09:08:50 -06:00
Daniel Wagner
280658c73b netconfig: Use ell's rtnl API 2020-02-17 09:08:50 -06:00
Daniel Wagner
0af1207a6c netdev: Use ell's rtnl APIs 2020-02-17 09:08:50 -06:00
Andrew Zaborowski
1896ac2d73 frame-xchg: Use both group_id and wdev_id when removing group
In frame_watch_group_remove I forgot to actually match the group to be
removed by both wdev_id and group_id.  group_ids are unique only in the
scope of one wdev.
2020-02-07 15:41:14 -06:00
Andrew Zaborowski
053c1ca2a2 frame-xchg: Add new groups to watch_groups list
I forgot to actually add new groups being created in
frame_watch_group_get to the watch_groups queue, meaning that we'd
re-create the group every time a new watch was added to the group.
2020-02-07 15:34:14 -06:00
Andrew Zaborowski
16cc2386f1 nl80211util: Handle NL80211_ATTR_ACK flag in parser
If this attribute is included in the nl80211_parse_attrs parameters, set
the corresponding bool to true if flag was present and false if not.
2020-02-07 15:26:35 -06:00
Tim Kourt
49607880fc peap: Fail auth. if invalid compound MAC is received
Since the interoperability with the Windows server has been achieved,
witch back to failing authentication if invalid compound MAC is
received.
2020-02-06 15:18:04 -06:00
Tim Kourt
bdf328320d peap: Ensure TLV uniqueness
Processing the duplicated TLVs while connecting to a malicious AP may lead
to overflow of the response buffer. This patch ensures that the
duplicated TLVs are not parsed.
2020-02-06 10:28:39 -06:00
Denis Kenzior
4f745ff930 manager: Fix initialization for blacklisted drivers
The pending wiphy state 'use_default' variable was not set early enough
in some circumstances resulting in weird behavior for blacklisted
drivers.  Fix this by adding a manager_wiphy_dump_done callback which
will properly initialize the use_default value.

Fixes: c4b2f10483 ("manager: Handle missing NEW_WIPHY events")
2020-02-05 14:27:05 -06:00
Denis Kenzior
360f66f71c manager: Also set retry when using default interfaces 2020-02-05 09:14:47 -06:00
Denis Kenzior
8530396fb3 manager: Add brcmfmac to the blacklist
brcmfmac does not allow the removal of the default / primary interface.
So there isn't much point in having iwd attempt this.

Another issue is that brcmfmac _does_ allow the deletion of non-default
interfaces.  So starting iwd on a system with a station & ap interface
active can result in iwd attempting to delete all the interfaces.  Given
the above, it succeeds in deleting the ap interface but not the station
one.  In strange circumstances it might end up thinking that the ap
interface is the 'default' and trying to use it, whereas it was just
successfully removed.
2020-02-04 16:00:46 -06:00
Denis Kenzior
f168fb2e16 manager: Fix valgrind complaint
==192== Conditional jump or move depends on uninitialised value(s)
==192==    at 0x4531D3: l_queue_find (queue.c:346)
==192==    by 0x42F1F8: manager_config_notify (manager.c:667)
==192==    by 0x45A895: process_multicast (genl.c:970)
==192==    by 0x45A895: received_data (genl.c:1037)
==192==    by 0x4577B2: io_callback (io.c:126)
==192==    by 0x456B0D: l_main_iterate (main.c:473)
==192==    by 0x456BCB: l_main_run (main.c:520)
==192==    by 0x456DDA: l_main_run_with_signal (main.c:642)
==192==    by 0x4034B0: main (main.c:497)
2020-02-04 11:05:10 -06:00
Andrew Zaborowski
fff6c97e99 frame-watch: Fix an l_queue_foreach_remove call
A pointer to the wdev_id is expected in this call inside
frame_watch_group_remove_wdev instead of a pointer to the pointer.
2020-02-04 10:46:57 -06:00
Andrew Zaborowski
1df4cb5be7 frame-watch: Actually unregister removed groups
Actually close the sockets for removed groups an free resources
2020-02-04 10:46:32 -06:00
Denis Kenzior
c4b2f10483 manager: Handle missing NEW_WIPHY events
The kernel emits NEW_WIPHY events whenever a new wiphy is registered.
Unfortunately these events are emitted under the 'legacy' semantics and
have a hard size limit of 4096 bytes.  Unfortunately, it is possible for
a NEW_WIPHY message to exceed this limit (ath10k cards seem to be
affected in particular), which results in the kernel never sending these
messages out.  This can lead to NEW_INTERFACE events being emitted with
a wiphy_id that had no corresponding NEW_WIPHY event emitted.  Such a
sequence can confuse iwd's hardware detection logic, particularly during
hot-plug or system boot.

Fix this by re-dumping the wiphy if such a condition is detected.  This
has some interaction with blacklisted wiphys, so the wiphy objects are
now always tracked and marked as blacklisted.  Before, the blacklisted
wiphys were simply not added to the iwd list of tracked wiphys.
2020-02-04 10:42:07 -06:00
Denis Kenzior
6825721535 wiphy: Add wiphy_get_id 2020-02-03 17:37:28 -06:00
Denis Kenzior
fcdddf2b72 build: Support missing rawmemchr 2020-02-03 11:54:28 -06:00
Tim Kourt
dc4b7e327e peap: Add inner EAP key material into imsk calculation
For the inner EAP methods that support generation of the key material
include it into imck generation. This allows to cryptographically
bind the inner method with the tunnel.
2020-02-03 11:33:57 -06:00
Tim Kourt
c2078c703d eap-tls-common: Address PEAPv0 interoperability with Windows
Windows Server 2008 - Network Policy Server (NPS) generates an invalid
Compound MAC for Cryptobinding TLV when is used within PEAPv0 due to
incorrect parsing of the message containing TLS Client Hello.
Setting L bit and including TLS Message Length field, even for the
packets that do not require fragmentation, corrects the issue. The
redundant TLS Message Length field in unfragmented packets doesn't
seem to affect the other server implementations.
2020-02-03 11:33:02 -06:00
Andrew Zaborowski
55f9639ee3 manager: Retry the interface setup if we get an EBUSY
Sometimes, at least with brcmfmac, the default interface apparently
takes a moment to get created after the NEW_WIPHY event.  We didn't
really consider this case in the NEW_WIPHY handler and we've got a race
condition.  It fixes the following bug for me:
https://bugs.archlinux.org/task/63912 -- tested by removing and
re-modprobing the brcmfmac module rather than rebooting.

To work around this wait for the NEW_INTERFACE event and then retry the
setup.  We still do the initial attempt directly after NEW_WIPHY to
handle cases like wiphys with no default interfaces and pre-existing
wiphys.
2020-01-28 15:10:10 -06:00
Andrew Zaborowski
aec7c0f39c manager: Make sure all interface are processed after dump
In manager_interface_dump_done use l_queue_foreach_remove instead of
l_queue_remove_if to make sure we process all of the interfaces.
2020-01-27 15:00:23 -06:00
Denis Kenzior
03ccc454b7 knownneetworks: React to mtime updates
We track mtime as the 'LastConnectedTime' of the network, and also sort
the known network list according to the last connected time.
Unfortunately we were never reacting to ATTRIB changes, and so were
never updating the network_info->connected_time whenever a network was
connected to.

Rework the logic to address this.  This also fixes a small bug where the
connected_time was not set properly prior to removal / re-insertion of
the network_info.
2020-01-27 14:28:08 -06:00
Denis Kenzior
681172a999 storage: Add ability to preserve times
We use the mtime on the network profile as the 'Last Connected Time'.
When we update any property and sync the file to disk, the mtime was not
preserved (since we were creating a new temporary file instead of
modifying the old one).  This led to LastConnectedTime property change
being emitted / updated incorrectly when a writable property on the
KnownNetwork interface was updated.
2020-01-22 11:15:19 -06:00
Torstein Husebø
759dbdd37f treewide: fix typos 2020-01-21 16:03:28 -06:00
Denis Kenzior
b00d4f4ce6 wsc: Use macros to simplify reply code a bit 2020-01-17 12:50:23 -06:00
Denis Kenzior
30ec06edcc wsc: Remove stale comment
Known networks are now automatically updated through inotify mechanisms,
so this comment is no longer needed.
2020-01-17 12:50:23 -06:00
Denis Kenzior
ec15838215 wsc: Rework wsc_enrollee_destroy
Our design preference is to not call any callbacks in the _free/_destroy
method of a class (with the exception of explicit destroy callbacks
provided, if any).

Invoking the callback in this case was unnecessary: wsc_dbus_free was
already replying to pending connect / cancel messages.  The only other
thing the callback would attempt to do is to set station back into
autoconnect mode.  This was unnecessary as well since the netdev is
already down.

This change removes the callback invocation.  Since wsc_enrollee_destroy
is now just calling wsc_enrollee_free, remove this from the API and
expose wsc_enrollee_free instead.
2020-01-17 12:50:23 -06:00
Andrew Zaborowski
1f14941011 wsc: Accept extra IEs in wsc_enrollee_new 2020-01-17 12:50:23 -06:00
Andrew Zaborowski
ce16ba3bf8 wsc: Refactor WSC D-Bus interface logic
Split the WSC D-Bus interface class (struct wsc) into a base class
common to station mode and P2P mode (struct wsc_dbus) and station-
specific logic like scanning, saving the credentials as a known network
and triggering the station-mode connection (struct wsc_station_dbus).

Make the base class and its utilities public in wsc.h for P2P use.
2020-01-17 12:50:23 -06:00
Andrew Zaborowski
b10264dcc7 wsc: Split out enrollee state machine to own object
Create struct wsc_enrollee which is allocated with wsc_enrollee_new,
taking a done callback as a parameter.  The callback is always
called so there's no need for a separate destroy callback.  The object
only lives until the done callback happens so wsc_enrollee_cancel/destroy
can only be used before this.

Looks like the rest of the file is simplified thanks to this.
2020-01-17 12:50:23 -06:00
Andrew Zaborowski
02f7d425b3 netdev: Drop the netdev_frame_watch API 2020-01-16 11:38:01 -06:00
Andrew Zaborowski
baad7e5fd8 netdev: Switch to new frame watch API 2020-01-16 11:37:59 -06:00
Andrew Zaborowski
b234a8e614 rrm: Switch to new frame watch API 2020-01-16 11:37:57 -06:00
Andrew Zaborowski
b31a23785a device: Switch to new frame watch API 2020-01-16 11:37:55 -06:00
Andrew Zaborowski
4a61620a9b ap: Switch to new frame watch API 2020-01-13 11:49:08 -06:00
Andrew Zaborowski
6484b7dbb6 Add a new frame watch API
This new API is independent of netdev.c and allows actually
unregistering from receiving notifications of frames, although with some
quirks.  The current API only allowed the callback for a registration to
be forgotten but our process and/or the kernel would still be woken up
when matching frames were received because the kernel had no frame
unregister call.  In the new API you can supply a group-id paramter when
registering frames.  If it is non-zero the frame_watch_group_remove() call
can be used to remove all frame registrations that had a given group-id
by closing the netlink socket on which the notifications would be
received.  This means though that it's a slightly costly operation.

The file is named frame-xchg.c because I'm thinking of also adding
utilities for sending frames and waiting for one of a number of replies
and handling the acked/un-acked information.
2020-01-13 11:49:08 -06:00
Andrew Zaborowski
c6c45e0569 wscutil: Add wsc_build_m8_encrypted_settings 2020-01-09 14:03:45 -06:00
Andrew Zaborowski
c67219a292 wscutil: Add wsc_build_credential 2020-01-09 13:57:11 -06:00
Andrew Zaborowski
0f8a49501e wsc: Refactor store_credentials / try_credentials
Instead of taking the credentials from wsc object directly, have the
caller pass these in.  This makes it more consistent with how the
done_cb was done.
2020-01-06 15:23:55 -06:00
Andrew Zaborowski
25708fbb5c wsc: Refactor to separate station-specific code
Split the interface-specific logic from the core WSC logic.  The core
WSC code is the part that we can re-use between P2P and station and
doesn't include the D-Bus code, scanning for the target BSS or the
attempt to make a station mode connection.
2020-01-06 11:50:12 -06:00
Andrew Zaborowski
a716f46573 netdev: Replace bool randomize_mac with specific address
Allow netdev_create_from_genl callers to draw a random or non-random MAC
and pass it in the parameter instead of a bool to tell us to generating
the MAC locally.  In P2P we are generating the MAC some time before
creating the netdev in order to pass it to the peer during negotiation.
2020-01-06 11:27:38 -06:00
Tim Kourt
d9efacfbba peap: Ignore Crypto-Binding TLVs with invalid compound MACs
Some server implementation don't seem to provide the valid compound MACs.
In the meantime, iwd will ignore the invalid Crypto-Binding TLVs as their
usage is optional.
2019-12-18 23:46:49 -06:00
Denis Kenzior
83e535b643 netdev: Use nl80211_parse_attrs 2019-12-17 16:58:04 -06:00
Denis Kenzior
9ee2b4ea4a nl80211util: Support ATTR_MAC 2019-12-17 16:58:04 -06:00
Denis Kenzior
ab14515715 resolve: Fix invalid method name check
The intent was to check for the presence of the add_domain_name
operation, not add_dns operation.

Fixes: 930528e35e ("resolve: Add systemd-resolved domain name installer")
2019-12-17 16:58:04 -06:00
Denis Kenzior
0e49561bb7 treewide: Use l_debug with at least one argument
By convention we should be passing at least an empty string to make it
clearer that no additional debug info is being printed
2019-12-17 16:15:05 -06:00
Denis Kenzior
3607ee0c7e netdev: Allow both -EOPNOTSUPP and -ENOTSUPP
It seems that the kernel uses -EOPNOTSUPP if the change_station
operation is not implemented by the driver.  However, some drivers do
implement change_station and choose to report -ENOTSUPP instead of
-EOPNOTSUPP.

To add to the confusion, EOPNOTSUPP and -ENOTSUPP are the same on some
systems (e.g. Gentoo).  Be paranoid and allow both errors to be ignored
when sending CMD_SET_STATION.

Fixes: 0238ffb8d9 ("netdev: Use -EOPNOTSUPP instead of -ENOTSUPP")
2019-12-17 16:10:46 -06:00
Tim Kourt
1f84c3b19a manpage: Add section about IPv4 static network configuration 2019-12-17 11:30:54 -06:00
Tim Kourt
f21d1aa78b peap: Add debug statements 2019-12-17 11:07:32 -06:00
Denis Kenzior
295e42f87a resolve: Don't try to set routing domains
The intent was to treat all domains as search domains, not routing
domains.

Fixes: 930528e35e ("resolve: Add systemd-resolved domain name installer")
2019-12-17 11:01:38 -06:00
James Prestwood
18c2c98ad5 rrm: fix bad sign for calculating RCPI
The first if case should be -10950, not 10950. Without the negative
this first case would get hit every time since signal strength values
are always negative.
2019-12-13 08:34:14 +01:00
Tim Kourt
8884fd8bbd peap: Add support for Crypto-Binding in PEAPv0
The Crypto Binding TLV is used to ensure that the EAP peer and the
EAP server participated in both the inner and the outer EAP
authentications of a PEAP authentication by cryptographically associating
the phase 1 and phase 2 authentications.

The usage of Crypto-Binding in PEAPv0 is optional and is triggered by
the reception of the Crypto-Binding TLV from the server.
2019-12-12 15:13:32 -06:00
Tim Kourt
8e5f838219 peap: Extend EAP Extensions to handle multiple TLVs
The handler for EAP Extensions has been modified to support multiple
TLV types instead of the single Result TLV. This will allow to handle
the other TLVs such as Crypto-Binding TLV.
2019-12-12 15:13:32 -06:00
Tim Kourt
fb338154a2 netconfig: Add IPv4 domain name helper and installer
The provided domain name helper allows to override the DHCP lease
option value with the static one from network configuration file.
2019-12-12 10:35:12 -06:00
Pinghao Wu
d510f332b6 eap-gtc: Try to auth even if request not Password
There are some server implementations that send requests that are
not "Password" but still want us send password. This commit modify
the behavior to send a warning and still try to auth with password.

This makes me able to auth with server in my school which sends
"Enter Aruba Login".

wpa_supplicant does not check if it is "Password".
2019-12-12 10:22:58 -06:00
Denis Kenzior
0238ffb8d9 netdev: Use -EOPNOTSUPP instead of -ENOTSUPP
The kernel uses -EOPNOTSUPP in the case of change_station operation not
being provided.  On most systems -EOPNOTSUPP is defined to be the same
as -ENOTSUPP, but seemingly not all systems.
2019-12-12 10:19:24 -06:00
Tim Kourt
930528e35e resolve: Add systemd-resolved domain name installer
The exposed DBus API is used to install doamin name into
sytemd-resolved.
2019-12-11 00:57:35 -06:00
Tim Kourt
1fd794a444 netconfig: Use CamelCase for IPv6 DNS setting 2019-12-11 00:57:29 -06:00
Tim Kourt
ac9c87d012 netconfig: Use CamelCase for IPv6 gateway setting 2019-12-11 00:57:29 -06:00
Tim Kourt
2414a3ae51 netconfig: Use CamelCase for IPv6 address settings 2019-12-11 00:57:29 -06:00
Tim Kourt
e7db478f97 netconfig: Use CamelCase for IPv4 DNS setting 2019-12-11 00:57:29 -06:00
Tim Kourt
994c1a4b5a netconfig: Use CamelCase for IPv4 gateway setting 2019-12-11 00:57:29 -06:00
Tim Kourt
0d9487d4ec netconfig: Use CamelCase for IPv4 address settings 2019-12-11 00:57:29 -06:00
Tim Kourt
1b483c3963 crypto: Add support for PRF+ SHA1
The PRF+ algorithm is based Internet Key Exchange (IKEv2) Protocol:
	https://www.ietf.org/rfc/rfc4306.txt
2019-12-09 01:47:11 -06:00
Tim Kourt
24b6a95366 peap: Rename AVPs to TLVs
Most of the literature seems to refer to AVPs as TLVs. Rename the
variables to follow the common nomenclature.
2019-12-09 01:39:41 -06:00
Tim Kourt
9bf0b756c8 peap: Delay key installation until success of Phase 2
Previously, the key was installed once the tunnel was created
despite the outcome of the second authentication phase. Now, the
key installation is delayed until the successful completion of
the second authentication phase. This excludes the unnecessary
operations in the case of a failure and key reinstallation with
cypro-binding in use.
2019-12-09 01:39:27 -06:00
Tim Kourt
5273a3b581 peap: Introduce PEAP state
Introduction of the state struct will allow to hold the additional
state variables related to the implementation of PEAP.
2019-12-09 01:38:59 -06:00
Andrew Zaborowski
cbbc247aa2 wsc: Declare the credentials structure in wsc.h 2019-12-08 21:48:33 -06:00
Denis Kenzior
738184d491 device/netdev: init scan in netdev instead of device
Commit 1057d8aa74 changed the device interface creation logic
from being unconditional inside netdev.c to instead use NETDEV_WATCH_*
events.  However, this broke the assumption that the device interface
was created before all others.  The effect is that the scan_wdev_add
might no longer be called prior to station interface being created.  Fix
this by moving scan_wdev_add/remove calls to netdev.c instead.

Fixes: 1057d8aa74 ("device: Move device creation from netdev.c to event watch")
2019-12-06 10:12:55 -06:00
Denis Kenzior
d2556a48b7 scan: Fix crash when scan is triggered outside iwd
#0  0x000055555558ee5d in scan_notify (msg=0x55555560b640, user_data=0x0) at src/scan.c:1706
 #1  0x00007ffff7f2c78c in ?? () from /usr/lib/libell.so.0
 #2  0x00007ffff7f299ec in ?? () from /usr/lib/libell.so.0
 #3  0x00007ffff7f28e4a in l_main_iterate () from /usr/lib/libell.so.0
 #4  0x00007ffff7f28efc in l_main_run () from /usr/lib/libell.so.0
 #5  0x00007ffff7f290b9 in l_main_run_with_signal () from /usr/lib/libell.so.0
 #6  0x00005555555639c4 in main (argc=1, argv=0x7fffffffec18) at src/main.c:497
2019-12-02 11:02:05 -06:00
Marcel Holtmann
9d8e74c1bc module: Declare functions as foo(void) instead of just foo() 2019-11-24 19:44:06 +01:00