3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-10-30 16:49:24 +01:00
Commit Graph

2377 Commits

Author SHA1 Message Date
Tim Kourt
aafa4d50bb eap-tls: Migrate to eap-tls-common framework
The conversion transitions EAP-TLS implementation to use a
common Phase 1 implementation shared among all TLS based
EAP methods.
2018-12-05 11:53:59 -06:00
Tim Kourt
645b72be06 eap-tls-common: Validate successful loading of keys/certs 2018-12-05 11:33:47 -06:00
Tim Kourt
f1f826ee81 eap-tls-common: Handle packet payload 2018-12-05 11:33:06 -06:00
Andrew Zaborowski
b375191c61 scan: Drop the wiphy_id scan callback parameter 2018-12-04 10:36:17 -06:00
Andrew Zaborowski
e4858d6da3 scan: Refactor scan request and periodic scan logic
This should not change the behaviour except for fixing a rare crash
due to scan_cancel not working correctly when cancelling the first scan
request in the queue while a periodic scan was running, and potentially
other corner cases.  To be able to better distinguish between a periodic
scan in progress and a scan request in progress add a sc->current_sr
field that points either at a scan request or is NULL when a periodic
scan is in ongoing.  Move the triggered flag from scan_request and
scan_preiodic directly to scan_context so it's there together with
start_cmd_id.  Hopefully make scan_cancel simpler/clearer.

Note sc->state and sc->triggered have similar semantics so one of them
may be easily removed.  Also the wiphy_id parameter to the scan callback
is rather useless, note I temporarily pass 0 as the value on error but
perhaps it should be dropped.
2018-12-04 10:32:57 -06:00
Tim Kourt
f07119b33a eap-tls-common: Add tunnel API for send, close 2018-12-04 10:25:24 -06:00
Tim Kourt
6490ecd615 eap-tls-common: Add accessors for variant data and ver 2018-12-04 10:23:49 -06:00
Tim Kourt
663cf9931e eap-tls-common: Expose PRF 2018-12-04 10:22:00 -06:00
Tim Kourt
8dc9276800 eap-tls-common: Make send empty response func. public 2018-12-04 10:21:28 -06:00
Tim Kourt
779f668ab9 eap-tls-common: Introduce variant data and reset API 2018-12-04 10:19:55 -06:00
Tim Kourt
bb98101bd4 eap-tls-common: Handle response retransmission 2018-12-04 10:19:20 -06:00
Tim Kourt
9df7785fee eap-tls-common: Add phase 2 failure flag
This flag is used by the extensions to signal the failure
during phase 2 execution.
2018-12-04 10:18:53 -06:00
Tim Kourt
c1f791afc4 eap-tls-common: Handle common tunnel ready cb 2018-12-04 10:18:11 -06:00
Tim Kourt
c2d3a84e3a eap-tls-common: Add method completion flag
This flag prevents methods from restarting
2018-12-04 10:16:36 -06:00
Tim Kourt
c35c91ad20 eap-tls-common: Add support for fragmented response 2018-12-04 10:14:39 -06:00
Tim Kourt
718f967d17 eap-tls-common: Add basic send response 2018-12-04 10:13:24 -06:00
Tim Kourt
802891fcc3 eap-tls-common: Add tunneled data handling 2018-12-04 10:04:07 -06:00
Tim Kourt
edfc070d96 eap-tls-common: Add tls tunnel 2018-12-04 10:03:07 -06:00
Tim Kourt
c865eaa141 eap-tls-common: Add support for the fragmented requests 2018-12-03 14:31:16 -06:00
Tim Kourt
36e2252606 eap-tls-common: Add basic request handling
This also introduces the version negotiation
2018-12-03 14:31:16 -06:00
Tim Kourt
7aa35bf6c7 eap-tls-common: Introduce eap_tls_variant_ops
eap_tls_variant_ops will allow methods such as TTLS, PEAP,
etc. to specify their own handlers for the Phase 2 operations.
2018-12-03 14:31:16 -06:00
Andrew Zaborowski
47bb5b5f72 network: Generate the PSK as soon as we have a passphrase
In the name of failing earlier try to generate the PSK from the
passphrase as soon as we receive the passphrase or read it from the
file, mainly to validate it has the right number of characters.
The passphrase length currently gets validates inside
crypto_psk_from_passphrase which will be called when we receive a new
passphrase from the agent or when the config file has no PSK in it.  We
do not do this when there's already both the PSK and the passphrase
available in the settings -- we can add that separately if needed.
2018-12-03 14:17:30 -06:00
Andrew Zaborowski
0d3f16ec5e scan: Call .destroy in scan_request_free
The main difference with this is that scan_context removal will also
trigger the .destroy calls.  Normally there won't be any requests left
during scan_context but if there were any we should call destroy on
them.
2018-12-03 11:42:32 -06:00
Denis Kenzior
5b3ae4c40c wsc: Only add WSC interface if netdev is UP 2018-11-29 11:45:20 -06:00
Denis Kenzior
9e1ba84f26 device: Restore device Powered state
After wiphy comes out of the rfkill state and is again powered, restore
the device state to Powered if needed.
2018-11-29 11:34:07 -06:00
Denis Kenzior
0dd8114970 wiphy: Add wiphy state watch add / remove 2018-11-29 11:22:50 -06:00
Denis Kenzior
9be982b460 wiphy: Introduce wiphy_new 2018-11-29 11:22:07 -06:00
Denis Kenzior
52771de1a5 eapol: Further relax PMKID check
If we haven't sent a PMKID, and we're not running EAP, then ignore
whatever PMKID the AP sends us.  Frequently the APs send us garbage in
this field.  For PSK and related AKMs, if the PMK is wrong, then we
simply fail to generate a proper MIC and the handshake would fail at a
later stage anyway.
2018-11-28 19:06:33 -06:00
Tim Kourt
0536a9bdd5 scan: Fix failure handling in common scan triggering logic
Fix incorrect usage of the caller’s scan triggered callback.
In case of a failure, destroy scan request and notify caller
about the issue by returning zero scan id instead of calling
callers’ scan triggered callback with an error code.
2018-11-26 18:16:11 -06:00
Shaleen Jain
d9c89e89c6 iwd.service: restart service on crash 2018-11-26 14:38:07 -06:00
Andreas Henriksson
b6910e1210 build: only enable backtrace(3) in maintainer mode
Using backtrace() is of no use when building with PIE (which most
distro compilers do by default) and prevents catching the coredump
for later retracing, which is needed since distros usually don't
install debug symbols by default either.

This patch thus only enables backtrace() when --enable-maintainer-mode
is passed and also tries to explicitly disable PIE.
2018-11-26 14:32:04 -06:00
Andrew Zaborowski
95c05d447b scan: Fix confusing identation 2018-11-21 11:28:48 -06:00
Denis Kenzior
e609981b61 eap-tls-common: Update to private key API changes 2018-11-21 11:28:34 -06:00
Andrew Zaborowski
299af7fc39 eap-tls, ttls, peap: Update for private key API changes 2018-11-21 11:25:03 -06:00
Tim Kourt
bdcff2cdde eap: Add accessors for the method name and type 2018-11-19 17:10:53 -06:00
Tim Kourt
87c411f816 eap-tls-common: Introduce a common tls state and load settings 2018-11-19 17:10:53 -06:00
Tim Kourt
514d442db1 eap-tls-common: Add check for phase one settings 2018-11-19 17:10:53 -06:00
Denis Kenzior
1e6df6a226 ecdh: Fix warning 2018-11-19 14:27:17 -06:00
James Prestwood
c3abfde025 ecdh: make key byte ordering consistent
ECDH was expecting the private key in LE, but the public key in BE byte ordering.
For consistency the ECDH now expect all inputs in LE byte ordering. It is up to
the caller to order the bytes appropriately.

This required adding some ecc_native2be/be2native calls in OWE
2018-11-19 13:46:28 -06:00
Andrew Zaborowski
d7dc6606de eap-tls, ttls, peap: Update for l_tls API changes 2018-11-19 13:03:38 -06:00
Denis Kenzior
53db703773 netdev: Fix style 2018-11-19 12:09:27 -06:00
Denis Kenzior
adb14dfca5 netdev: Fix typo 2018-11-19 11:53:30 -06:00
James Prestwood
576c6dc9f3 netdev/station: Add OWE support
The changes to station.c are minor. Specifically,
station_build_handshake_rsn was modified to always build up the RSN
information, not just for SECURITY_8021X and SECURITY_PSK. This is
because OWE needs this RSN information, even though it is still
SECURITY_NONE. Since "regular" open networks don't need this, a check
was added (security == NONE && akm != OWE) which skips the RSN
building.

netdev.c needed to be changed in nearly the same manor as it was for
SAE. When connecting, we check if the AKM is for OWE, and if so create
a new OWE SM and start it. OWE handles all the ECDH, and netdev handles
sending CMD_AUTHENTICATE and CMD_ASSOCIATE when triggered by OWE. The
incoming authenticate/associate events just get forwarded to OWE as they
do with SAE.
2018-11-19 11:51:02 -06:00
James Prestwood
8978f8c43f owe: added OWE module
This module is similar to SAE in that it communicates over authenticate
and associate frames. Creating a new OWE SM requires registering two TX
functions that handle sending the data out over CMD_AUTHENTICATE/ASSOCIATE,
as well as a complete function.

Once ready, calling owe_start will kick off the OWE process, first by
sending out an authenticate frame. There is nothing special here, since
OWE is done over the associate request/response.

After the authenticate response comes in OWE will send out the associate
frame which includes the ECDH public key, and then receive the AP's
public key via the associate response. From here OWE will use ECDH to
compute the shared secret, and the PMK/PMKID. Both are set into the
handshake object.

Assuming the PMK/PMKID are successfully computed the OWE complete callback
will trigger, meaning the 4-way handshake can begin using the PMK/PMKID
that were set in the handshake object.
2018-11-16 18:06:42 -06:00
James Prestwood
60555ece3b handshake: added OWE AKM to handshake_state_derive_ptk 2018-11-16 17:03:06 -06:00
James Prestwood
126993b9e3 eapol: Add OWE to MIC calculate/verify
This allows eapol to work with the OWE AKM type. Similar shortcuts were
taken as with SAE since, for now, both only support a single ECC group.
2018-11-16 17:02:13 -06:00
James Prestwood
d19b1bb85e wiphy: Handle OWE AKM for SECURITY_TYPE_NONE 2018-11-16 16:59:59 -06:00
James Prestwood
ef544dfc6e common: Classify OWE networks as open 2018-11-16 16:59:59 -06:00
James Prestwood
8740abb60e netdev: add translation for OWE AKM type 2018-11-16 16:59:59 -06:00
James Prestwood
3293bd9933 ie: add OWE AKM type
Added a new AKM suite, IE_RSN_AKM_SUITE_OWE.
2018-11-16 16:59:45 -06:00
Tim Kourt
e4a76018fd scan: Make periodic scan optional 2018-11-16 16:42:00 -06:00
James Prestwood
40685e8fe3 crypto: implement HKDF-Expand (RFC 5869)
This will be required by OWE
2018-11-16 16:38:28 -06:00
James Prestwood
0b42ca7c30 crypto: renamed hkdf_256
The RFC (5869) for this implementation defines two functions,
HKDF-Extract and HKDF-Expand. The existing 'hkdf_256' was implementing
the Extract function, so it was renamed appropriately. The name was
changed for consistency when the Expand function will be added in the
future.
2018-11-16 16:30:22 -06:00
James Prestwood
5811e72940 ecdh: added ECDH module 2018-11-16 16:25:17 -06:00
James Prestwood
9b204a8c7e ie: add IE_TYPE_OWE_DH_PARAM to IE list 2018-11-16 16:20:59 -06:00
Denis Kenzior
712a92cc4c network: Simplify is_rsn logic
In the current version SECURITY_PSK was handled inside the is_rsn block
while the SECURITY_8021X was off in its own block.  This was weird and a
bit misleading.  Simplify the code flow through the use of a goto and
decrease the nesting level.

Also optimize out unnecessary use of scan_bss_get_rsn_info
2018-11-15 11:37:20 -06:00
Denis Kenzior
5bfbdd5a01 network: Check Autoconnectable as the first condition 2018-11-15 11:31:39 -06:00
Denis Kenzior
c146490567 network: Introduce __bss_is_sae
This takes an rsn_info pointer directly so that some calls to
scan_bss_get_rsn_info can be optimized
2018-11-15 11:29:13 -06:00
Denis Kenzior
3d549e457d scan: make scan_bss_get_rsn_info const correct 2018-11-15 11:28:46 -06:00
James Prestwood
ad242a796a network: fix 8021x autoconnect
In network_autoconnect, when the network was SECURITY_8021X there was no
check (for SECURITY_PSK) before calling network_load_psk. Since the
provisioning file was for an 8021x network neither PreSharedKey or
Passphrase existed so this would always fail. This fixes the 8021x failure
in testConnectAutoconnect.
2018-11-15 11:20:06 -06:00
James Prestwood
07c870df55 station: only set 8021x config on 8021x networks
During the handshake setup, if security != SECURITY_PSK then 8021x settings
would get set in the handshake object. This didn't appear to break anything
(e.g. Open/WEP) but its better to explicitly check that we are setting up
an 8021x network.
2018-11-14 20:47:42 -06:00
Peter Seiderer
7d6e11ddd5 main: Fix __iwd_backtrace_init() availability detection
Check for HAVE_EXECINFO_H for all __iwd_backtrace_init usages.

Fixes:

  src/main.o: In function `main':
  main.c:(.text.startup+0x798): undefined reference to `__iwd_backtrace_init'
  collect2: error: ld returned 1 exit status
2018-11-10 19:09:14 +01:00
Denis Kenzior
6df62ab68e station: Update to the new GetHiddenAccessPoints API 2018-11-09 14:06:20 -06:00
Denis Kenzior
5f8c20f455 netdev: Enable ControlPortOverNL80211 by default 2018-11-09 11:52:09 -06:00
Denis Kenzior
8732a9f38a main: Add checks for asymmetric key support
Tell the user that Kernel 4.20 with asymmetric key support enabled is
required to support TLS based (EAP/PEAP/TTLS) WPA-Enterprise methods.
2018-11-09 11:50:29 -06:00
Tim Kourt
8c1992feb2 station: Introduce GetHiddenStations API call 2018-11-09 11:34:43 -06:00
Tim Kourt
f803b0439b station: Introduce an ordered list of hidden stations
A sorted list of hidden network BSSs observed in the recent scan
is kept for the informational purposes of the clients. In addition,
it has deprecated the usage of seen_hidden_networks variable.
2018-11-09 11:34:43 -06:00
Andrew Zaborowski
0b5dceab27 network: Don't require PSK if Passphrase present
Refactor the network->psk and network->passphrase loading and saving
logic to not require the PreSharedKey entry in the psk config file and
to generate network->psk lazily on request.  Still cache the computed
PSK in memory and in the .psk file to avoid recomputing it which uses
many syscalls.  While there update the ask_psk variable to
ask_passphrase because we're specifically asking for the passphrase.
2018-11-05 12:43:16 -06:00
Patrik Flykt
0b1e6cc3e5 scan: Log BSSID in messages
If there is an error with the BSSID information, log the BSSID
station address to catch the offending Access Point.
2018-11-05 12:29:41 -06:00
Patrik Flykt
7ec8fd6776 ie: Fix up broken Access Point with too many rates added
According to the specification, Supported rates IE is supposed
to have a maximum length of eight rate bytes. In the wild an
Access Point is found to add 12 bytes of data instead of placing
excess rate bytes in an Extended Rates IE.

BSS: len 480
    BSSID 44:39:C4:XX:XX:XX
    Probe Response: true
    TSF: 0 (0x0000000000000000)
    IEs: len 188
...
        Supported rates:
            1.0(B) 2.0(B) 5.5(B) 6.0(B) 9.0 11.0(B) 12.0(B) 18.0 Mbit/s
            24.0(B) 36.0 48.0 54.0 Mbit/s
            82 84 8b 8c 12 96 98 24 b0 48 60 6c              .......$.H`l
        DSSS parameter set: channel 3
            03
...

Any following IEs decode nicely, thus it seems that we can relax
Supported Rates IE length handling to support this thermostat.
2018-11-05 12:07:22 -06:00
Patrik Flykt
c68ae2f00b main: Log optimized implementations only when they exist
Log optimized implementations strings only when the hashmap contains
items in order to avoid an unnecessary line of text with no members
printed out.
2018-11-05 11:52:48 -06:00
Denis Kenzior
c4153941af netdev: Use l_genl_family_unicast_handler 2018-11-02 15:53:07 -05:00
James Prestwood
1d62f4ec0e eapol: remove unused public eapol functions from header
After moving AP EAPoL code into eapol.c there were a few functions that
no longer needed to be public API's. These were changed to static's and
the header definition was removed.
2018-11-02 14:05:44 -05:00
Marcel Holtmann
554e4f55db build: Fix includes for using with -std=c99 compiler option 2018-11-01 22:37:11 +01:00
Marcel Holtmann
72a64fa7fb build: Adjust to the latest ELL signal API changes 2018-11-01 22:09:19 +01:00
Andrew Zaborowski
e4222d0ebe eap-tls: Set upper limit on request size
Set an upper limit on a fragmented EAP-TLS request size similar to how
we do it in EAP-TTLS.  While there make the code more similar to the
EAP-TTLS flag processing to keep them closer in sync.  Note that the
spec suggests a 64KB limit but it's not clear if that is for the TLS
record or EAP request although it takes into account the whole TLS
negotiation so it might be good for both.
2018-11-01 15:04:56 -05:00
Andrew Zaborowski
0b71b034c1 eap-tls/ttls/peap: Conditionally enable TLS debugging
Print the TLS debug messages if IWD_TLS_DEBUG is set.
2018-11-01 15:04:56 -05:00
Marcel Holtmann
a011909556 main: Use l_main_run_with_signal instead of open coding it 2018-11-01 19:56:16 +01:00
Marcel Holtmann
38e831afa0 main: Make genl and nl80211 global variables static 2018-11-01 19:55:54 +01:00
Marcel Holtmann
013bae6d3d eapol: Make eapol_frame_watch_{add,remove} functions static 2018-11-01 10:27:22 +01:00
Marcel Holtmann
9335602ba0 network: Removed unneeded include for src/watchlist.h 2018-11-01 10:19:26 +01:00
Marcel Holtmann
e1c391a76b wsc: Removed unneeded include for src/watchlist.h 2018-11-01 10:17:54 +01:00
Denis Kenzior
7699c8ab1e eap-ttls: Handle redundant L flags
Some of the TTLS server implementations set the L flag in the fragment
packets other than the first one. To stay interoperable with such devices,
iwd is relaxing the L bit check.
2018-10-30 15:47:57 -05:00
Denis Kenzior
5cc60d18cc eap-md5: Add warning about deprecated settings key 2018-10-29 18:49:19 -05:00
Tim Kourt
99c685940a eap-md5: Standardize setting keys
Switch EAP-MD5 to use the common password setting key nomenclature.
The key name has been changed from PREFIX-MD5-Secret to PREFIX-Password.
Note: The old key name is supported.
In addition, this patch adds an ability to request Identity and/or
Password from user.
2018-10-29 18:46:07 -05:00
James Prestwood
b9029aaf65 adhoc: wait for both handshakes before adding peer
Adhoc was not waiting for BOTH handshakes to complete before adding the
new peer to the ConnectedPeers property. Actually waiting for the gtk/igtk
(in a previous commit) helps with this, but adhoc also needed to keep track
of which handshakes had completed, and only add the peer once BOTH were done.
This required a small change in netdev, where we memcmp the addresses from
both handshakes and only set the PTK on one.
2018-10-26 15:29:48 -05:00
James Prestwood
e678d6655f netdev: signal handshake complete after setting all keys
Currently, netdev triggers the HANDSHAKE_COMPLETE event after completing
the SET_STATION (after setting the pairwise key). Depending on the timing
this may happen before the GTK/IGTK are set which will result in group
traffic not working initially (the GTK/IGTK would still get set, but group
traffic would not work immediately after DBus said you were connected, this
mainly poses a problem with autotests).

In order to fix this, several flags were added in netdev_handshake_state:
ptk_installed, gtk_installed, igtk_installed, and completed. Each of these
flags are set true when their respective keys are set, and in each key
callback we try to trigger the handshake complete event (assuming all the
flags are true). Initially the gtk/igtk flags are set to true, for reasons
explained below.

In the WPA2 case, all the key setter functions are called sequentially from
eapol. With this change, the PTK is now set AFTER the gtk/igtk. This is
because the gtk/igtk are optional and only set if group traffic is allowed.
If the gtk/igtk are not used, we set the PTK and can immediately trigger the
handshake complete event (since gtk_installed/igtk_installed are initialized
as true). When the gtk/igtk are being set, we immediately set their flags to
false and wait for their callbacks in addition to the PTK callback. Doing it
this way handles both group traffic and non group traffic paths.

WPA1 throws a wrench into this since the group keys are obtained in a
separate handshake. For this case a new flag was added to the handshake_state,
'wait_for_gtk'. This allows netdev to set the PTK after the initial 4-way,
but still wait for the gtk/igtk setters to get called before triggering the
handshake complete event. As a precaution, netdev sets a timeout that will
trigger if the gtk/igtk setters are never called. In this case we can still
complete the connection, but print a warning that group traffic will not be
allowed.
2018-10-26 15:26:49 -05:00
Marcel Holtmann
9b2bb2723f crypto: Use full include path local includes 2018-10-26 21:35:27 +02:00
Marcel Holtmann
77710f9765 simauth: Use full include path local includes 2018-10-26 21:34:58 +02:00
Marcel Holtmann
515c130549 storage: Use full include path local includes 2018-10-26 21:34:00 +02:00
Marcel Holtmann
0b93fde3b4 wscutil: Use full include path local includes 2018-10-26 21:33:38 +02:00
Marcel Holtmann
162e6a19f6 watchlist: Use full include path local includes 2018-10-26 21:33:01 +02:00
Marcel Holtmann
1eaca1f8e1 mscaputil: Use full include path local includes 2018-10-26 21:32:20 +02:00
Marcel Holtmann
3fa63ede50 eapol: Use full include path local includes 2018-10-26 21:31:52 +02:00
Marcel Holtmann
c2d0517228 knownnetworks: Use full include path local includes 2018-10-26 21:30:44 +02:00
Marcel Holtmann
e92b976663 ecc: Use full include path local includes 2018-10-26 21:29:45 +02:00
Marcel Holtmann
42cfaeb265 sae: Use full include path local includes 2018-10-26 21:29:08 +02:00
Marcel Holtmann
785be02ee5 mpdu: Use full include path local includes 2018-10-26 21:28:10 +02:00
Marcel Holtmann
52f7f1dea2 handshake: Use full include path local includes 2018-10-26 21:27:01 +02:00
Marcel Holtmann
23a7fafec6 ie: Use full include path for local includes 2018-10-26 21:26:17 +02:00
Marcel Holtmann
be5bf7ee15 util: Only include <ell/ell.h> and use full include path 2018-10-26 21:24:20 +02:00
Denis Kenzior
a2efe2d2de eap-pwd: Warn if deprecated setting is used 2018-10-25 14:52:30 -05:00
Tim Kourt
df59d57f96 eap-pwd: Standardize setting keys
Switch EAP-PWD to use the common password setting key nomenclature.
2018-10-25 14:29:56 -05:00
Denis Kenzior
c256dbfbd8 eap-gtc: Warn if deprecated setting is used 2018-10-25 14:25:28 -05:00
Tim Kourt
c92f8231b2 eap-gtc: Standardize property keys
Switch EAP-GTC to use the common password setting key nomenclature.
2018-10-25 14:14:16 -05:00
Tim Kourt
e8de229223 ttls: add support for tunneled MS-CHAP 2018-10-24 16:33:06 -05:00
Tim Kourt
b46376980a mschaputil: Add MS CHAP utilities 2018-10-24 16:28:46 -05:00
Denis Kenzior
ae538eae7d netdev: Cancel ongoing rekey offload
We need to cancel an ongoing rekey offload in a few additional places
besides the netdev destructor.
2018-10-20 10:38:56 -05:00
Denis Kenzior
8501b2edb1 netdev: Add a TODO about Rekey Offload errors 2018-10-20 10:36:42 -05:00
Denis Kenzior
658362a349 netdev: Put command cancelation into a common function 2018-10-20 10:35:28 -05:00
Tim Kourt
e979bf97f1 netdev: add an ability to cancel hw rekey cmd
==1628== Invalid read of size 1
==1628==    at 0x405E71: hardware_rekey_cb (netdev.c:1381)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Address 0x5475208 is 312 bytes inside a block of size 320 free'd
==1628==    at 0x4C2ED18: free (vg_replace_malloc.c:530)
==1628==    by 0x43D94D: l_queue_clear (queue.c:107)
==1628==    by 0x43D998: l_queue_destroy (queue.c:82)
==1628==    by 0x40B431: netdev_shutdown (netdev.c:4765)
==1628==    by 0x403B17: iwd_shutdown (main.c:81)
==1628==    by 0x4419D2: signal_callback (signal.c:82)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
==1628==  Block was alloc'd at
==1628==    at 0x4C2DB6B: malloc (vg_replace_malloc.c:299)
==1628==    by 0x43CA4D: l_malloc (util.c:62)
==1628==    by 0x40A853: netdev_create_from_genl (netdev.c:4517)
==1628==    by 0x444E5B: process_unicast (genl.c:415)
==1628==    by 0x444E5B: received_data (genl.c:534)
==1628==    by 0x442032: io_callback (io.c:126)
==1628==    by 0x4414CD: l_main_iterate (main.c:387)
==1628==    by 0x44158B: l_main_run (main.c:434)
==1628==    by 0x403775: main (main.c:489)
2018-10-20 10:29:52 -05:00
Marcel Holtmann
a59e162446 knownnetworks: Use l_dir_watch instead of l_fswatch 2018-10-19 19:14:05 +02:00
Marcel Holtmann
8f8a214fbd build: Use new l_tls_prf_get_bytes and remove ell/tls-private.h usage 2018-10-19 09:30:59 +02:00
Marcel Holtmann
467d3958b4 build: Use l_tls_prf_get_bytes instead of tls_prf_get_bytes 2018-10-19 08:46:57 +02:00
Marcel Holtmann
b27edce298 build: Use include "" instead of include <> for ell/tls-private.h 2018-10-19 08:24:57 +02:00
Denis Kenzior
d22e57c994 treewide: Remove use of key-private.h 2018-10-19 00:31:41 -05:00
Denis Kenzior
6e8f10f695 eap-ttls: Use iwd's version of align_len
No need to include ell's private bits unnecessarily
2018-10-19 00:20:47 -05:00
Denis Kenzior
770f3c6049 dbus: Remove unneeded include 2018-10-19 00:20:35 -05:00
Marcel Holtmann
1ee7de15c8 ttls: Fix truncated before the last format character 2018-10-14 11:35:48 +02:00
Marcel Holtmann
a3c1fa28da build: Rename nl80211_util.[ch] into nl80211util.[ch] 2018-10-14 05:41:06 +02:00
James Prestwood
70d6c9c692 adhoc: implement setting TX GTK
Adhoc requires 2 GTK's to be set, a single TX GTK and a per-mac RX GTK.
The per-mac RX GTK already gets set via netdev_set_gtk. The single TX GTK
is created the same as AP, where, upon the first station connecting a GTK
is generated and set in the kernel. Then any subsequent stations use
GET_KEY to retrieve the GTK and set it in the handshake.
2018-10-08 21:38:30 -05:00
James Prestwood
2123d613fc nl80211: support per-mac GTK on _new_key_group
AdHoc will require a per-mac GTK to be set. For this reason
nl80211_build_new_key_group has been updated to optionally take
a MAC address.
2018-10-08 21:35:33 -05:00
James Prestwood
5e5caedb90 nl80211: added verifier/parser for GET_KEY
AdHoc will also need the same functionality to verify and parse the
key sequence from GET_KEY. This block of code was moved from AP's
GET_KEY callback into nl80211_parse_get_key_seq.
2018-10-08 21:35:24 -05:00
James Prestwood
60aba7114e nl80211: make SET_KEY/GET_KEY common
Moved AP helpers for building SET_KEY/GET_KEY commands into
nl80211_util.c
2018-10-08 21:35:12 -05:00
James Prestwood
04a9315a3c nl80211: introduce nl80211 utility API's
Netdev/AP share several NL80211 commands and each has their own
builder API's. These were moved into a common file nl80211_util.[ch].

A helper was added to AP for building NEW_STATION to make the associate
callback look cleaner (rather than manually building NEW_STATION).
2018-10-08 21:34:58 -05:00
Andrew Zaborowski
dc39c52525 station: Cancel ongoing scans in station_free
Make scan.c forget station's scan callbacks to prevent crash when
switching interface types with a scan running.
2018-10-08 11:33:53 -05:00
James Prestwood
395acc8203 netdev: simplify netdev_choose_key_address
The key address can be chosen regardless of iftype. The deciding
factor is the authenticator bit in the handshake.
2018-10-08 11:29:47 -05:00
Andrew Zaborowski
fb85b1d1a7 netdev: Check that netdev->device is not NULL
Check that netdev->device is not NULL before doing device_remove()
(which would crash) and emitting NETDEV_WATCH_EVENT_DEL.  It may be
NULL if the initial RTM_SETLINK has failed to bring device UP.
2018-10-04 20:57:33 -05:00
Andrew Zaborowski
6e70c84f8e station: Ignore ad-hoc networks in scan results
If there are Ad-hoc BSSes they should be present in the scan results
together with regular APs as far as scan.c is concerned.  But in
station mode we can't connect to them -- the Connect method will fail and
autoconnect would fail.  Since we have no property to indicate a
network is an IBSS just filter these results out for now.  There are
perhaps better solutions but the benefit is very low.
2018-10-03 16:56:19 -05:00
Tim Kourt
0682ddad37 ttls: change signature of the inner reset funcs 2018-10-01 17:30:29 -05:00
Tim Kourt
f0a86519e9 ttls: add support for tunneled CHAP 2018-10-01 17:14:19 -05:00
Tim Kourt
ba5cf86716 ttls: add support for tunneled PAP 2018-10-01 17:12:17 -05:00
Tim Kourt
aedf89ca37 ttls: remove load_settings from phase2_method 2018-10-01 17:11:39 -05:00
Tim Kourt
726ff5d2b1 ttls: exclude avp_builder_put_bytes 2018-10-01 17:11:10 -05:00
Tim Kourt
2aefd8badf ttls: improve avp build approach 2018-10-01 17:10:03 -05:00
Tim Kourt
e6bf22f8c9 ttls: add support for non eap auth settings 2018-09-26 17:55:44 -05:00
Tim Kourt
8f0c4a769a ttls: clear the obtained memory to prevent info leaks 2018-09-26 17:19:46 -05:00
Tim Kourt
3d77748bca ttls: change signature of the inner destroy funcs. 2018-09-26 17:19:05 -05:00
Tim Kourt
b2ec0c350a ttls: fix check on avp start 2018-09-25 16:23:40 -05:00
James Prestwood
50acc11f07 wiphy: added wiphy_select_akm
This is a replacement for station's static select_akm_suite. This was
done because wiphy can make a much more intellegent decision about the
akm suite by checking the wiphy supported features e.g. SAE support.

This allows a connection to hybrid WPA2/WPA3 AP's if SAE is not
supported in the kernel.
2018-09-25 10:58:04 -05:00
James Prestwood
272cb441cd wiphy: only connect to SAE if feature is supported 2018-09-25 10:56:06 -05:00
Andrew Zaborowski
36c441c945 ap: Set up the GTK and pass to handshake
Set a default GTK cipher type same as our current PTK type, generate a
random GTK when the first STA connects and set it up in the kernel, then
pass the values that EAPoL is going to need to the handshake_state.
2018-09-25 10:53:40 -05:00
Andrew Zaborowski
01edef9001 netdev: Reject setting powered while setting iftype
In netdev_set_powered also check that no NL80211_CMD_SET_INTERFACE is in
progress because once it returned we would overwrite
netdev->set_powered_cmd_id (could also add a check there but it seems
more logical to just disallow Powered property changes while Mode is
being changed, since we also disallow Mode changes while Powered is
being changed.)
2018-09-25 10:51:48 -05:00
Denis Kenzior
ebda2ce60f device: Remove unneeded includes 2018-09-24 19:29:40 -05:00
Denis Kenzior
87118959e6 device: Obtain station using station_find
Since device object no longer creates / destroys station objects, use
station_find inside ap directed roam events to direct these to the
station interface.
2018-09-24 19:27:04 -05:00
Andrew Zaborowski
8632b81397 eapol: Add GTK data to msg 3/4 of the handshake 2018-09-24 14:53:41 -05:00
Andrew Zaborowski
e4873dea5a handshake: Use enum handshake_kde in find_kde()
Since we have all the KDE types defined in enum handshake_kde use that
instead of uint8_t buffers containing the same values.
2018-09-24 14:24:41 -05:00
Andrew Zaborowski
7c779956ac handshake: Add handshake_util_build_gtk_kde utility 2018-09-24 14:24:41 -05:00
Andrew Zaborowski
68e612573e handshake: Add GTK data to handshake_state
Add places to store the GTK data, index and RSC in struct
handshake_state and add a setter function for these fields.  We may want
to also convert install_gtk to use these fields similar to install_ptk.
2018-09-24 14:24:41 -05:00
Denis Kenzior
7eb59602df netdev: Drop redundant netdev_get_device checks
As a consequence of the previous commit, netdev watches are always
called when the device object is valid.  As a result, we can drop the
netdev_get_device calls and checks from individual AP/AdHoc/Station/WSC
netdev watches
2018-09-24 14:12:43 -05:00
Andrew Zaborowski
916bde3a02 netdev: Don't emit events before NETDEV_WATCH_EVENT_NEW 2018-09-24 14:09:36 -05:00
Andrew Zaborowski
c96f44b2e6 station: Make station_create/station_free static
These two functions don't need to be used from outside of station.c
anymore so make them static and simplify the station_create arguments
slightly.
2018-09-24 14:07:03 -05:00
Andrew Zaborowski
567baed2c4 station: Create interface simliarly to AP, AdHoc interfaces
Instead of creating the Station interface in device.c create it directly
on the netdev watch event the same way that the AP and AdHoc interfaces
are created and freed.  This fixes some minor incosistencies, for
example station_free was previously called twice, once from device.c and
once from the netdev watch.

device.c would previously keep the pointer returned by station_create()
but that pointer was not actually useful so remove it.  Autotests still
seem to pass.
2018-09-24 14:05:03 -05:00
Andrew Zaborowski
daf248e1ba station: Disconnect netdev in station_free()
Call netdev_disconnect() to make netdev forget any of station.c's
callbacks for connections or transitions in progress or established.
Otherwise station.c will crash as soon as we're connected and try to
change interface mode:
==17601== Invalid read of size 8
==17601==    at 0x11DFA0: station_disconnect_event (station.c:775)
==17601==    by 0x11DFA0: station_netdev_event (station.c:1570)
==17601==    by 0x115D18: netdev_disconnect_event (netdev.c:868)
==17601==    by 0x115D18: netdev_mlme_notify (netdev.c:3403)
==17601==    by 0x14E287: l_queue_foreach (queue.c:441)
==17601==    by 0x1558B4: process_multicast (genl.c:469)
==17601==    by 0x1558B4: received_data (genl.c:532)
==17601==    by 0x152888: io_callback (io.c:123)
==17601==    by 0x151BCD: l_main_iterate (main.c:376)
==17601==    by 0x151C9B: l_main_run (main.c:423)
==17601==    by 0x10FE20: main (main.c:489)
2018-09-24 13:57:36 -05:00
Andrew Zaborowski
f9faeed7bb ap, adhoc: On NETDEV_WATCH_EVENT_NEW check device is UP
Since the interfaces are not supposed to exist when the device is DOWN
(we destroy the interfaces on NETDEV_WATCH_EVENT_DOWN too), don't
create the interfaces if the device hasn't been brought up yet.
2018-09-24 13:56:02 -05:00
Andrew Zaborowski
99e7e0d977 netdev: Update ifi_flags in rntl_set_powered callbacks
When we detect a new device we either bring it down and then up or only
up.  The IFF_UP flag in netdev->ifi_flags is updated before that, then
we send the two rtnl commands and then fire the NETDEV_WATCH_EVENT_NEW
event if either the bring up succeeded or -ERFKILL was returned, so the
device may either be UP or DOWN at that point.

It seems that a RTNL NEWLINK notification is usually received before
the RTNL command callback but I don't think this is guaranteed so update
the IFF_UP flag in the callbacks so that the NETDEV_WATCH_EVENT_NEW
handlers can reliably use netdev_get_is_up()
2018-09-24 13:54:24 -05:00
Andrew Zaborowski
ab6160b017 netdev: Drop DEFAULT_TYPES nl80211 attr of CMD_NEW_KEY
The NL80211_ATTR_KEY_DEFAULT_TYPES attribute is only parsed by the
kernel if either NL80211_ATTR_KEY_DEFAULT or
NL80211_ATTR_KEY_DEFAULT_MGMT are also present, however these are only
used with NL80211_CMD_SET_KEY and ignored for NEW_KEY.  As far as I
understand the default key concept only makes sense for a Tx key because
on Rx all keys can be tried, so we don't need this for client mode.  The
kernel decides whether the NEW_KEY is for unicast or multicast based on
whether NL80211_ATTR_KEY_MAC was supplied.
2018-09-24 13:14:27 -05:00
Denis Kenzior
b60e79b8dd eap-wsc: Do not leak device_password
device password was read from settings using l_settings_get_string which
returns a newly-allocated string due to un-escape semantics.  However,
when assigning wsc->device_password, we strdup-ed the password again
unnecessarily.

==1069== 14 bytes in 2 blocks are definitely lost in loss record 1 of 1
==1069==    at 0x4C2AF0F: malloc (vg_replace_malloc.c:299)
==1069==    by 0x16696A: l_malloc (util.c:62)
==1069==    by 0x16B14B: unescape_value (settings.c:108)
==1069==    by 0x16D12C: l_settings_get_string (settings.c:971)
==1069==    by 0x149680: eap_wsc_load_settings (eap-wsc.c:1270)
==1069==    by 0x146113: eap_load_settings (eap.c:556)
==1069==    by 0x12E079: eapol_start (eapol.c:2022)
==1069==    by 0x1143A5: netdev_connect_event (netdev.c:1728)
==1069==    by 0x118751: netdev_mlme_notify (netdev.c:3406)
==1069==    by 0x1734F1: notify_handler (genl.c:454)
==1069==    by 0x168987: l_queue_foreach (queue.c:441)
==1069==    by 0x173561: process_multicast (genl.c:469)
2018-09-24 12:19:27 -05:00
Denis Kenzior
3ca1aeb917 wsc: Don't use wsc_pin_is_checksum_valid on 4 digit PINs
wsc_pin_is_valid allows two types of PINs through:
  1. 4 digit numeric PIN
  2. 8 digit numeric PIN

The current code always calls wsc_pin_is_checksum_valid to determine
whether a DEFAULT or USER_SPECIFIED PIN is used.  However, this function
is not safe to call on 4 digit PINs and causes a buffer overflow.

Add simple checks to treat 4 digit PINs as DEFAULT PINs and do not call
wsc_pin_is_checksum_valid on these.

Reported-By: Matthias Gerstner <matthias.gerstner@suse.de>
2018-09-24 12:19:27 -05:00
Denis Kenzior
cc37018426 eap-wsc: Drop 8 digit PIN check
EAP-WSC handles 4 digit, 8 digit and out-of-band Device passwords.  The
latter in particular can be anything, so drop the mandatory minimum
password length check here.

This also has the effect of enabling 4-digit PINs to actually work as
they are intended.
2018-09-24 12:19:27 -05:00
Tim Kourt
a3cc68e61e ttls: add radius AVP builder and build response 2018-09-21 18:07:58 -05:00
Tim Kourt
4d8791dd3a ttls: replace old AVP processing with new 2018-09-21 15:20:18 -05:00
Tim Kourt
5d1d1ad893 ttls: add radius AVP parser 2018-09-21 15:19:13 -05:00
Tim Kourt
71ba8ac765 ttls: introduce phase2_method structure
The struct allows to support multiple types of the tunneled methods.
Previously, EAP-TTLS was supporting only the eap based ones.
This patch is also starts to move some of the phase 2 EAP
functionality into the new structure.
2018-09-21 15:19:13 -05:00
Tim Kourt
a7f5d1da21 ttls: remove unused state var 2018-09-21 12:15:28 -05:00
Tim Kourt
410ee2f6b9 eap-tls-common: introduce utility functions for eap-tls 2018-09-21 12:15:25 -05:00
James Prestwood
a553771ffe netdev: station: support FT over SAE
Boiled down, FT over SAE is no different than FT over PSK, apart from
the different AKM suite. The bulk of this change fixes the current
netdev/station logic related to SAE by rebuilding the RSNE and adding
the MDE if present in the handshake to match what the PSK logic does.

A common function was introduced into station which will rebuild the
handshake rsne's for a target network. This is used for both new
network connections as well as fast transitions.
2018-09-21 11:26:05 -05:00
James Prestwood
8064cb599a ie: introduce IE_AKM_IS_SAE macro
To prepare for FT over SAE, several case/if statements needed to include
IE_RSN_AKM_SUITE_FT_OVER_SAE. Also a new macro was introduced to remove
duplicate if statement code checking for both FT_OVER_SAE and SAE AKM's.
2018-09-21 11:26:05 -05:00
James Prestwood
996a18e934 network: free EAP_CACHE_NEVER secret types
When freeing a network secrets any secrets labeled with CACHE_NEVER
would get removed from the secret queue but never actually freed.
2018-09-19 14:33:23 -05:00
James Prestwood
74b8b6d65c watchlist: fix stale watchlist item processing
All the watchlist notify macros were broken in that they did not check
that the watchlist item was still valid before calling it. This only
came into play when a watchlist was being notified and one of the notify
functions removed an item from the same watchlist. It appears this was
already thought of since watchlist_remove checks 'in_notify' and will
mark the item's id as stale (0), but that id never got checked in the
notify macros.

This fixes testAdHoc valgrind warning:

==3347== Invalid read of size 4
==3347==    at 0x416612: eapol_rx_auth_packet (eapol.c:1871)
==3347==    by 0x416DD4: __eapol_rx_packet (eapol.c:2334)
==3347==    by 0x40725B: netdev_pae_read (netdev.c:3515)
==3347==    by 0x440958: io_callback (io.c:123)
==3347==    by 0x43FDED: l_main_iterate (main.c:376)
==3347==    by 0x43FEAB: l_main_run (main.c:423)
==3347==    by 0x40377A: main (main.c:489)
...
2018-09-19 14:17:26 -05:00
Denis Kenzior
ba248e028e station: Make station_rssi_level_changed static 2018-09-19 13:47:51 -05:00
Denis Kenzior
f06c3b645d station: Make station_state_to_string static 2018-09-19 13:45:49 -05:00
Tim Kourt
59c4c8ac6b scan: change scan triggered notification behavior
Do not notify the caller after the first scan_triggered event in
multi-segmented scans.
2018-09-19 11:53:36 -05:00
Tim Kourt
b5aefede95 network: add check for the existing settings
In the case of the open networks with hidden SSIDs
the settings object is already created.

Valgrind:
==4084==    at 0x4C2EB6B: malloc (vg_replace_malloc.c:299)
==4084==    by 0x43B44D: l_malloc (util.c:62)
==4084==    by 0x43E3FA: l_settings_new (settings.c:83)
==4084==    by 0x41D101: network_connect_new_hidden_network (network.c:1053)
==4084==    by 0x4105B7: station_hidden_network_scan_results (station.c:1733)
==4084==    by 0x419817: scan_finished (scan.c:1165)
==4084==    by 0x419CAA: get_scan_done (scan.c:1191)
==4084==    by 0x443562: destroy_request (genl.c:139)
==4084==    by 0x4437F7: process_unicast (genl.c:424)
==4084==    by 0x4437F7: received_data (genl.c:534)
==4084==    by 0x440958: io_callback (io.c:123)
==4084==    by 0x43FDED: l_main_iterate (main.c:376)
==4084==    by 0x43FEAB: l_main_run (main.c:423)
2018-09-19 11:52:33 -05:00
Denis Kenzior
88b2aefeed wiphy: Add missing blank 2018-09-18 17:06:07 -05:00
Denis Kenzior
e52204f46f station: Fix scan_pending assignment
In case an error occurs starting a scan, the scan_pending variable is
never cleared and message is never unrefed.
2018-09-18 13:58:52 -05:00
Denis Kenzior
d347100ac2 device: Remove the rest of the legacy Device properties 2018-09-14 21:53:01 -05:00
Denis Kenzior
42e5dbf6f8 device: Remove legacy GetOrderedNetworks 2018-09-14 21:49:13 -05:00
Denis Kenzior
b2e0a82225 device: Remove Scan method 2018-09-14 21:21:47 -05:00
Denis Kenzior
c47db2635f device: Remove Disconnect method 2018-09-14 21:20:33 -05:00
Marcel Holtmann
804ce5944b dbus: Make the g_dbus global variable static 2018-09-14 23:01:32 +02:00
Marcel Holtmann
2606bc73ad build: Add DAEMON_ prefix to CONFIGDIR and STORAGEDIR 2018-09-14 17:58:44 +02:00
Marcel Holtmann
1e37ef31fe eapol: Move eapol_key_validate() into eapolutil helper 2018-09-14 17:31:42 +02:00
Marcel Holtmann
c40be7a7d5 monitor: Add EAP dummy method to keep linker happy 2018-09-14 17:12:47 +02:00
Marcel Holtmann
502aac073f tools: Add configure option and D-Bus policy file for hwsim utility 2018-09-14 15:24:15 +02:00
Marcel Holtmann
5126459ecc main: Fix the order of --help and -h option handling 2018-09-14 15:19:06 +02:00
Marcel Holtmann
0c5b6e4da3 dbus: Fix policy entries and add access for group wheel 2018-09-14 15:04:15 +02:00
Denis Kenzior
b181604c18 main: Don't init nl80211 until dbus name is owned 2018-09-11 20:06:00 -05:00
Denis Kenzior
95896c10ff device: Fix crashes when outside of Station mode 2018-09-10 20:01:35 -05:00
Denis Kenzior
0a42f63d42 station: Update GetOrderedNetworks API implementation
The Station interface GetOrderedNetworks signature now matches the API
documentation.  Device.GetOrderedNetworks still uses the legacy
signature.
2018-09-08 10:34:52 -05:00
Andrew Zaborowski
854ce2b062 station: Emit PropertiesChanged on the Station interface too 2018-09-07 21:23:41 -05:00
Tim Kourt
18aa744099 eap: clarify warning message 2018-09-07 12:31:03 -05:00
Tim Kourt
bb5997c4ea peap: fix typo and add labels 2018-09-07 12:30:05 -05:00
Tim Kourt
2735e32b10 peap: handle redundant usage of the L flag
Some of the PEAP server implementations set the L flag along with
redundant TLS Message Length field for the un-fragmented packets.
This patch allows to identify and handle such occasions.
2018-09-07 12:26:23 -05:00
Tim Kourt
958bd12624 peap: accept EAP type 33 as termination mechanism for PEAPv1
EAP Extensions type 33 is used in PEAPv0 as a termination
mechanism for the tunneled EAP methods. In PEAPv1
the regular EAP-Success/Failure packets must be used to terminate
the method. Some of the server implementations of PEAPv1
rely on EAP Extensions method to terminate the conversation
instead of the required Success/Failure packets. This patch
makes iwd interoperable with such devices.
2018-09-06 18:23:24 -05:00
James Prestwood
397bf9c0bd crypto: pwd: sae: Made H function common
The "H" function used by SAE and EAP-PWD was effectively the same
function, EAP-PWD just used a zero key for its calls. This removes
the duplicate implementations and merges them into crypto.c as
"hkdf_256".

Since EAP-PWD always uses a zero'ed key, passing in a NULL key to
hkdf_256 will actually use a 32 byte zero'ed array as the key. This
avoids the need for EAP-PWD to store or create a zero'ed key for
every call.

Both the original "H" functions never called va_end, so that was
added to hkdf_256.
2018-09-05 11:12:54 -05:00
Denis Kenzior
5db022041c station: Fix up some printf type inconsistencies
The ifindex as reported by netdev is unsigned, so make sure that it is
printed as such.  It is astronomically unlikely that this causes any
actual issues, but lets be paranoid.
2018-09-05 11:09:35 -05:00
Denis Kenzior
0f34e1a0c1 station: Expose ConnectedNetwork, Scanning and State
These properties will temporarily be exposed on both interfaces
until tools such as test runner, iwctl and NetworkManager/ConnMan
are ported over.
2018-09-05 11:09:35 -05:00
Denis Kenzior
2f2ec71a6c station: Expose Scan, Disconnect, GetOrderedNetworks
These methods will temporarily be exposed on both interfaces until tools
such as test runner, iwctl and NetworkManager/ConnMan are ported over.
2018-09-05 11:09:35 -05:00
Denis Kenzior
b650a5d492 station: Move ConnectHiddenNetwork to station 2018-09-05 11:09:35 -05:00
Denis Kenzior
f61747f011 device: Allow switching mode even if station is busy
Since device will no longer be aware of what is happening on the station
interface, we should allow switching modes in any situation
2018-09-04 23:57:14 -05:00
Denis Kenzior
25f36f5644 station: Move remaining connect/re-connect/roam logic 2018-09-04 23:57:14 -05:00
Denis Kenzior
cdfcb902e4 station: move signal level agent logic from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
ac83a35b97 station: Register skeleton dbus interface 2018-09-04 23:57:14 -05:00
Denis Kenzior
f3d326b0fd adhoc: Fix comment 2018-09-04 23:57:14 -05:00
Denis Kenzior
4c8b39da3b station: Move device_disconnect_event to station 2018-09-04 23:57:14 -05:00
Denis Kenzior
d8617a5000 station: Move device_disassociate to station 2018-09-04 23:57:14 -05:00
Denis Kenzior
520d3ad6b2 station: move GetSortedNetworks implementation 2018-09-04 23:57:14 -05:00
Denis Kenzior
77b006b4e9 station: Move dbus disconnection logic from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
12ce9debec station: Move device_disconnect to station 2018-09-04 23:57:14 -05:00
Denis Kenzior
ee91cfcb7e station: Move hidden network code from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
e65c3e63be station: Move state reset code from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
f8b724d3ba wsc/device: Use station_set_autoconnect 2018-09-04 23:57:14 -05:00
Denis Kenzior
b49ec9461b station: move the remaining scanning code from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
58c8243114 device: Get rid of device_list queue 2018-09-04 23:57:14 -05:00
Denis Kenzior
553a8c1bae device/wsc: Use station_set_scan_results 2018-09-04 23:57:14 -05:00
Denis Kenzior
187ea7f5d1 device/network: Use station_is_busy 2018-09-04 23:57:14 -05:00
Denis Kenzior
f996bea880 station: Add station_is_busy 2018-09-04 23:57:14 -05:00
Denis Kenzior
5e2cce2e0b device: Remove unused device_get_connected_network 2018-09-04 23:57:14 -05:00
Denis Kenzior
1962549152 device: Remove device_network_find
Switch to using station_network_find instead
2018-09-04 23:57:14 -05:00
Denis Kenzior
dcfdd0ccde network: Use station_foreach
Instead of __iwd_device_foreach api, use the newly introduced
station_foreach API
2018-09-04 23:57:14 -05:00
Denis Kenzior
d576c28d9f device: Remove device_get_path
Use netdev_get_path instead
2018-09-04 23:57:14 -05:00
Denis Kenzior
993a69cef8 network: Make network station centric 2018-09-04 23:57:14 -05:00
Denis Kenzior
0650707eea station: Add station_get_connected_network 2018-09-04 23:57:14 -05:00
Denis Kenzior
d0ec5fcf77 station: Add station_get_netdev 2018-09-04 23:57:14 -05:00
Denis Kenzior
5837e65c40 station: Add station_get_wiphy 2018-09-04 23:57:14 -05:00
Denis Kenzior
738faa7657 network: Pass connected state to network_rank_update 2018-09-04 23:57:14 -05:00
Denis Kenzior
b69f938879 device: Get rid of connected_bss member 2018-09-04 23:57:14 -05:00
Denis Kenzior
e6c6e4f0ae device: Get rid of connected_network member 2018-09-04 23:57:14 -05:00
Denis Kenzior
575d0fa554 station: Move roam triggering & scanning code
Move the roam initiation (signal loss, ap directed roaming) and scanning
details into station from device.  Certain device functions have been
exposed temporarily to make this possible.
2018-09-04 23:57:14 -05:00
Denis Kenzior
966cad3696 network: Remove unused function 2018-09-04 23:57:14 -05:00
Denis Kenzior
e028b7019c station: Move state tracking from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
69f1c3321a station: Add station_find 2018-09-04 23:57:14 -05:00
Denis Kenzior
1378a3c945 station: Move scanning code from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
1b22af2052 scan: Add scan_bss_addr_cmp/eq 2018-09-04 23:57:14 -05:00
Denis Kenzior
9b574b5931 station: Move autoconnect logic from device 2018-09-04 23:57:14 -05:00
Denis Kenzior
977b817f3c device: Modify signature of device_set_scan_results
WSC was using this to set the scan results.  However it never needed the
autoconnect paths, so modify the signature to make this explicit.
2018-09-04 23:57:14 -05:00
Denis Kenzior
345485c506 device: Split process_bss
process_bss performs two main operations.  It adds a seen BSS to a
network object (existing or new) and if the device is in the autoconnect
state, it adds an autoconnect entry as needed.  Split this operation
into two separate & independent steps.
2018-09-04 23:57:14 -05:00
Denis Kenzior
e6060c1026 station: Move handshake setup code from device
For now we temporarily create the station object from within device so
that the code can be moved over in a more manageable manner.
2018-08-31 20:25:23 -05:00
Denis Kenzior
641e71a02f station: Add skeleton 2018-08-31 20:24:15 -05:00
Denis Kenzior
839053c952 device: Get rid of timestamp parameter in process_bss
This is no longer being used
2018-08-31 14:53:56 -05:00
James Prestwood
35231a1b2c adhoc: removed unneeded check for !sta->addr
sta->addr is is guarenteed to be valid (assuming sta is valid).
2018-08-29 12:49:06 -05:00
Andrew Zaborowski
5f3cdc2093 handshake: Rename own_ie/ap_ie and related setters
To avoid confusion in case of an authenticator side handshake_state
structure and eapol_sm structure, rename own_ie to supplicant_ie and
ap_ie to authenticator_ie.  Also rename
handshake_state_set_{own,ap}_{rsn,wpa} and fix when we call
handshake_state_setup_own_ciphers.  As a result
handshake_state_set_authenticator, if needed, should be called before
handshake_state_set_{own,ap}_{rsn,wpa}.
2018-08-27 11:42:45 -05:00
Andrew Zaborowski
ddbc49538e ap: Drop a RSNE check
After EAPOL logic was moved to eapol.c a check was added to
ap_associate_sta_cb to bitwise compare the AP's RSNE to the RSNE
received in the (Re)Association frame.  There is as far as I know no
reason for them to be the same (although they are in our autotest) and
if there was a reason we'd rather validate the (Re)Association RSNE
immediately when received.  We also must set different RSNEs as the
"own" (supplicant) and "ap" RSNEs in the handshake_state for validation
of step 2/4 in eapol.c (fixes wpa_supplicant's and MS Windows
connections being rejected)
2018-08-23 22:03:38 -05:00
Andrew Zaborowski
cb04fb6314 ap: Stop EAPOL negotiation on Disassociation
Make sure we interrupt eapol traffic (4-way handshake) if we receive a
Disassociation from station.  Actually do this in ap_del_station because
it's called from both ap_disassoc_cb and ap_success_assoc_resp_cb and
seems to make sense in both cases.
2018-08-23 21:49:53 -05:00
Andrew Zaborowski
f460a7e12c ap: eapol_sm lifecycle fixes
On one hand when we're called with HANDSHAKE_EVENT_FAILED or
HANDSHAKE_EVENT_SETTING_KEYS_FAILED the eapol_sm will be freed in
eapol.c, fix a double-free by setting it to NULL before ap_free_sta
is called.
On the other hand make sure we call eapol_sm_free before setting
sta->sm to NULL in ap_drop_rsna to avoid potential leak and avoid
the eapol_sm continuing to use the handshake_state we freed.
2018-08-23 21:45:41 -05:00
Andrew Zaborowski
c0a70cc9b7 device: Drop now unused start/stop_ap_pending fields 2018-08-23 21:43:33 -05:00
Andrew Zaborowski
58f91a741b knownnetworks: Fix timestamps comparison
timespec_compare wanted to receive network_info structures as arguments
to compare connected_time timestamps but in one instance we were passing
actual timespec structures.  Add a new function to compare plain timespec
values and switch the names for readability.
2018-08-23 21:43:30 -05:00
James Prestwood
9c71d56444 sae: fix endianness issues
Replaced all calls of l_get_u16 with l_get_le16. This fixes
failures on big-endian hardware.
2018-08-23 12:23:59 -05:00
Denis Kenzior
99253a8689 sae: Fix Wformat warning
src/sae.c:714:3: warning: format ‘%ld’ expects argument of type ‘long
int’, but argument 6 has type ‘size_t’ [-Wformat=]
2018-08-21 10:19:39 -05:00
Andrew Zaborowski
da96b5c51c network: Use is_known to save queue lookups
Now that the is_known field is back use it instead of searching the
"networks" queue where possible.
2018-08-20 11:37:07 -05:00
Denis Kenzior
7e7bf126d3 device: Remove device_get_netdev 2018-08-19 23:37:29 -05:00
Denis Kenzior
8d6f3021e3 adhoc: Do not use device
Ad-Hoc only uses information from the netdev object and doesn't really
depend on the device object.
2018-08-19 23:36:24 -05:00
Denis Kenzior
92e7e63af5 device: Remove device_get_ifindex 2018-08-19 23:30:06 -05:00
Denis Kenzior
1ad22021d2 device: Remove device_get_address 2018-08-19 23:28:58 -05:00
Denis Kenzior
e068c97409 wsc: Make WSC netdev centric 2018-08-19 23:28:07 -05:00
Denis Kenzior
2e0638d51b ap: Make AP use netdev instead of device
The information is always on the netdev object anyway, so this just
makes it explicit.
2018-08-19 23:12:29 -05:00
Denis Kenzior
0ad8f7e0d6 netdev: Add netdev_get_path 2018-08-19 23:12:14 -05:00
Denis Kenzior
a277a424f3 device: Remove unneeded typedefs/enums 2018-08-19 23:10:27 -05:00
Denis Kenzior
9ca72b9527 netdev: Issue initial SET_CQM when in STATION mode 2018-08-19 22:52:52 -05:00
Denis Kenzior
99b5c67c88 device: Update State when Mode is changed 2018-08-19 22:41:07 -05:00
Denis Kenzior
5a6c19988c device/netdev: Properly implement mode switching 2018-08-19 22:07:15 -05:00
Denis Kenzior
3628003296 wsc: Do not check device mode
There's no longer a need to do that since WSC is only created in station
mode.
2018-08-19 22:06:02 -05:00
Denis Kenzior
cc9fc8de67 knownnetworks: Fix leak of fswatch
==7330== 112 bytes in 1 blocks are still reachable in loss record 1 of 1
==7330==    at 0x4C2CF8F: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7330==    by 0x14CF7D: l_malloc (util.c:62)
==7330==    by 0x152A25: l_io_new (io.c:172)
==7330==    by 0x16B217: l_fswatch_init (fswatch.c:171)
==7330==    by 0x16B217: l_fswatch_new (fswatch.c:198)
==7330==    by 0x13B9D9: known_networks_init (knownnetworks.c:401)
==7330==    by 0x110020: main (main.c:439)
2018-08-19 22:05:31 -05:00
Denis Kenzior
93985103bb device: Use netdev->iftype instead of device_mode 2018-08-19 20:39:37 -05:00
Denis Kenzior
ae223fe06c netdev: Don't bother switching iftype on shutdown 2018-08-19 20:16:16 -05:00
Denis Kenzior
52e0a7ce83 netdev: Remove redundant typedefs
Unify command specific typedefs which had the same signature into a
single netdev_command_cb_t
2018-08-19 18:25:23 -05:00
Denis Kenzior
f6eb571b67 device: Set autoconnect only if triggered via D-Bus 2018-08-18 00:41:25 -05:00
Denis Kenzior
b7fd5023f0 device: Honor autoconnect setting on power up
If the device Powered state is toggled, honor the autoconnect setting
instead of always going into AUTOCONNECT mode
2018-08-18 00:40:45 -05:00
Denis Kenzior
996a6d2546 netdev/device: Combine watches
There was somewhat overlapping functionality in the device_watch
infrastructure as well as the netdev_event_watch.  This commit combines
the two into a single watch based on the netdev object and cleans up the
various interface additions / removals.

With this commit the interfaces are created when the netdev/device is
switched to Powered=True state AND when the netdev iftype is also in the
correct state for that interface.  If the device is brought down, then
all interfaces except the .Device interface are removed.

This will make it easy to implement Device.Mode property properly since
most nl80211 devices need to be brought into Powered=False state prior
to switching the iftype.
2018-08-18 00:38:56 -05:00
Denis Kenzior
da52bcd109 netdev: Rework netdev_init/exit 2018-08-17 23:47:20 -05:00
Denis Kenzior
b3e937e11a main: Rework initialization order
Group together all the configuration settings / reading code together
for more readability.

Initialize eap, eapol and rfkill before device
2018-08-17 23:35:09 -05:00
Denis Kenzior
c5b19dc747 main: Don't call wsc_exit twice 2018-08-17 16:45:05 -05:00
Denis Kenzior
28916dc5ca netdev: Add netdev_get_device 2018-08-17 14:59:01 -05:00
Denis Kenzior
3788156f39 netdev: Don't use device_get_ifindex in join_adhoc
This is pointless as the ifindex is already available on the netdev
object.
2018-08-17 14:42:07 -05:00
Denis Kenzior
3c28c5c24c netdev: Don't crash on operstate callbacks
The way that netdev_set_linkmode_and_operstate was used resulted in
potential crashes when the netdev was destroyed.  This is because netdev
was given as data to l_netlink_send and could be destroyed between the
time of the call and the callback.  Since the result of calls to
netdev_set_linkmode_and_operstate is inconsequential, it isn't really
worthwhile tracking these calls in order to cancel them.

This patch simplies the handling of these rtnl calls, makes sure that
netdev isn't passed as user data and rewrites the
netdev_set_linkmode_and_operstate signature to be more consistent with
rtnl_set_powered.
2018-08-17 14:10:13 -05:00
Denis Kenzior
ec437661b8 netdev: Don't set userdata for getlink 2018-08-17 14:10:13 -05:00
Denis Kenzior
015e8625bf netdev: Make sure set_powered calls are cancelable
Since all netdevs share the rtnl l_netlink object, it was possible for
netdevs to be destroyed with outstanding commands still executing on the
rtnl object.  This can lead to crashes and other nasty situations.

This patch makes sure that Powered requests are always tracked via
set_powered_cmd_id and the request is canceled when netdev is destroyed.
This also implies that netdev_set_powered can now return an -EBUSY error
in case a request is already outstanding.
2018-08-17 14:10:13 -05:00
Denis Kenzior
c530667ed1 device: Send .Aborted error if property set fails
If a property setting is canceled before the callback is generated, then
generate an .Aborted error the the method return
2018-08-17 14:10:13 -05:00
Denis Kenzior
3a9b1f2e38 device: Return an error if netdev_set_powered fails
netdev_set_powered could in theory return an error.  So handle this
case by returning an error from the property set call.
2018-08-17 14:10:13 -05:00
James Prestwood
b9fac0fd14 sae: fix sae to not hard code peer address
SAE is meant to work in a peer-to-peer fashion where neither side acts
as a dedicated authenticator or supplicant. This was not the case with
the current code. The handshake state authenticator address was hard
coded as the destination address for all packets, which will not work
when mesh comes into play. This also made unit testing the full SAE
procedure with two sae_sm's impossible.

This patch adds a peer address element to sae_sm which is filled with
either aa/spa based on the value of handshake->authenticator
2018-08-15 13:26:45 -05:00
James Prestwood
986f66a3c6 eapol: removed authenticator bit and auth register
This removes the authenticator bit in eapol_sm as well as unifies
eapol_register_authenticator and eapol_register. Taking advantage
of the handshake state authenticator bit we no longer have a need
for 2 separate register functions.

ap, and adhoc were also updated to set the authenticator bit in
the handshake and only use eapol_register to register their sm's.

netdev was updated to use the authenticator bit when choosing the
correct key address for adhoc.
2018-08-15 12:40:38 -05:00
James Prestwood
2036d36313 handshake: introduce authenticator bit
Both SAE and adhoc can benefit from knowing whether the handshake state
is an authenticator or a supplicant. It will allow both to easily
obtain the remote address rather than sorting out if aa/spa match the
devices own address.
2018-08-15 12:40:35 -05:00
Denis Kenzior
1f512ff85c device: Move device_init/device_exit to iwd.h 2018-08-14 14:57:19 -05:00
Denis Kenzior
47beec30f9 network: Implement Network.KnownNetwork property 2018-08-14 14:57:16 -05:00
Denis Kenzior
1c27aa5f1d knownnetworks: move known_networks_init/exit to iwd.h 2018-08-14 13:36:48 -05:00
Denis Kenzior
e6b3691c9e knownnetworks: Expose known_network_get_path
So that it can be used to implement Network.KnownNetwork property
2018-08-14 13:35:23 -05:00
James Prestwood
dd1885de11 sae: remove double sc increment
The send confirm counter is incremented before calling sae_send_confirm
in all cases, but the function itself was also incrementing sc after
sending the packet. This isn't critical to the successful execution of
SAE as the AP just uses the sc value in the packet but it did violate
the 802.11 spec.
2018-08-14 13:13:50 -05:00
James Prestwood
fd8671e9c5 netdev: added sae functionality to netdev
In order to plug SAE into the existing connect mechanism the actual
CMD_CONNECT message is never sent, rather sae_register takes care
of sending out CMD_AUTHENTICATE. This required some shuffling of
code in order to handle both eapol and sae. In the case of non-SAE
authentication everything behaves as it did before. When using SAE
an sae_sm is created when a connection is attempted but the eapol_sm
is not. After SAE succeeds it will start association and then create
the eapol_sm and start the 4-way handshake.

This change also adds the handshake SAE events to device and
initializes SAE in main.
2018-08-14 10:37:52 -05:00
James Prestwood
220fb61128 sae: implementation
SAE (Simultaneous Authentication of Equals) takes place during
authentication, and followed by EAPoL/4-way handshake. This
module handles the entire SAE commit/confirm exchange. This was
done similar to eapol.

SAE begins when sae_register is called. At this point a commit
message will be created and sent out which kicks off the SAE
authentication procedure.

The commit/confirm exchange is very similar to EAP-PWD, so all
the ecc utility functions could be re-used as-is. A few new ecc
utility functions were added to conform to the 80211 'blinding'
technique for computing the password element.
2018-08-13 20:40:59 -05:00
James Prestwood
920b307431 network: require Passphrase on psk files
For an SAE network, the raw passphrase is required. For this reason,
known network psk files should now always contain a 'Passphrase' entry.

If a psk file is found without a Passphrase entry the agent will be asked
for the Passphrase before connecting. This will update the legacy psk
file with the Passphrase entry.
2018-08-13 20:40:59 -05:00
Denis Kenzior
70acf2dcb4 device: rename SignalLevelChanged to Changed 2018-08-13 20:40:59 -05:00
Denis Kenzior
51c6d2d391 storage: use rename instead of unlink, link, unlink 2018-08-10 14:42:33 -05:00
Denis Kenzior
cbc149c7ed knownnetworks: Avoid unnecessary known object removal
Due to the quirk in how storage_network_sync implements file writing,
iwd was generating unnecessary KnownNetwork removal events (and
preventing certain test cases from passing successfully)

storage_network_sync tries to perform atomic writes by writing to a
temporary storage location first, unlinking the existing file and
renaming the tmp file as the original.

This generates a set of inotify events which confuses the current
implementation.
2018-08-10 12:17:40 -05:00
Denis Kenzior
c38b77d0c0 network: Fix syncing the PSK on 1st connection
The previous change did not consider the case of the PSK being written
for the very first time.  In this case storage_network_open would return
NULL and an empty file would be written.

Change this so that if storage_network_open fails, then the current
network settings are written to disk and not a temporary.
2018-08-10 12:13:44 -05:00
Andrew Zaborowski
abeed797c0 network: Reload settings in network_sync_psk
Reload the network settings from disk before calling
storage_network_sync in network_sync_psk to avoid potentially
overwriting changes made to the storage by user since the connection
attempt started.  This won't account for all situations but it
covers some of them and doesn't cost us much.
2018-08-10 09:44:16 -05:00
Andrew Zaborowski
3065e0768c knownnetworks: Add KnownNetwork.Hidden boolean property 2018-08-10 09:43:31 -05:00
Denis Kenzior
14693065d7 netdev: Use EAPoL over nl80211 if CONTROL_PORT set
Our logic would set CONTROL_PORT_OVER_NL80211 even in cases where
CONTROL_PORT wasn't used (e.g. for open networks).  While the kernel
ignored this attribute in this case, it is nicer to set this only if
CONTROL_PORT is intended to be used.
2018-08-09 15:20:27 -05:00
James Prestwood
d2d2b59f25 netdev: break out FT associate into common function
SAE will require some of the same CMD_ASSOCIATE building code that
FT currently uses. This breaks out the common code from FT into
netdev_build_cmd_associate_common.
2018-08-09 15:20:10 -05:00
James Prestwood
43b70b37d9 eapol: added key description type 0
This also required passing in the akm suite in case the key description
version was zero. In the zero case the akm must be checked. For now this
only supports the SAE akm.
2018-08-09 15:05:56 -05:00
James Prestwood
d256e97b32 device: added SUITE_SAE_SHA256 to _select_akm_suite 2018-08-09 14:57:41 -05:00
Jordan Glover
87d74db156 net.connman.iwd.service: Change SystemdService name to iwd.service
This allows to activate iwd service through dbus even when service
isn't enabled.
2018-08-09 10:45:16 -05:00
Andrew Zaborowski
4b4875e6cf knownnetworks: Watch filesystem events in STORAGEDIR
Update the known networks list and network properties on file creations,
removals and modifications.  We watch for these filesystem events using
ell's fswatch and react accordingly.
2018-08-09 10:35:37 -05:00
Andrew Zaborowski
ca270e9de2 network: Drop actions to be handled by filesystem watch 2018-08-09 10:27:28 -05:00
Andrew Zaborowski
5f79acfd8d storage: Expose get_network_file_path in the header 2018-08-09 10:25:56 -05:00
Andrew Zaborowski
549021b5dd eap-gtc: Fix reading secret from settings
This makes testEAP-PEAP-GTC pass for me by re-adding the check for the
GTC-Secret setting which was replaced with the check for the secrets
list in 3d2285ec7e.
2018-08-08 19:43:08 -05:00
Andrew Zaborowski
4ffb97faa1 eap: Add secret cache policy types
eap_append_secret now takes a new cache_policy parameter which can be
used by the EAP method to signal that the value received from the agent
is to never be cached, i.e. each value can only be used once.  The
parameter value should be EAP_CACHE_NEVER for this and we use this in
value EAP-GTC where the secret tokens are one time use.  The
EAP_CACHE_TEMPORARY value is used in other methods, it preserves the
default behaviour where a secret can be cached for as long as the
network stays in range (this is the current implementation more than a
design choice I believe, I didn't go for a more specific enum name as
this may still change I suppose).
2018-08-08 19:43:05 -05:00
James Prestwood
f68cca43da handshake: add setter for PMKID
SAE generates the PMKID during the authentication process, rather than
generating it on-the-fly using the PMK. For this reason SAE needs to be
able to set the PMKID once its generated. A new flag was also added
(has_pmkid) which signifies if the PMKID was set or if it should be
generated.
2018-08-08 16:03:17 -05:00
James Prestwood
0b452b9200 ecc: added Y^2 and legendre API's
SAE requires checking a values legendre symbol. Also added a helper
for computing Y^2, or, calculating the sum for the X side of the
equation.
2018-08-07 17:40:55 -05:00
James Prestwood
35278ae108 network: save passphrase in network
SAE needs access to the raw passphrase, not the PSK which network
saves. This changes saves the passphrase in network and handshake
objects, as well as adds getters to both objects so SAE can retrieve
the passphrase.
2018-08-07 17:39:16 -05:00
Denis Kenzior
7da345a9a5 mpdu: Also update comment to reflect 2016 spec 2018-08-07 17:23:26 -05:00
James Prestwood
4f8a722580 mpdu: added reason codes from more recent (2016) spec 2018-08-07 17:20:14 -05:00
James Prestwood
ff197edfc4 main: reordered plugin init/exit
This fixes improper cleanup when ofono leaves the bus after a simauth
instance has been cleaned up. The problem was that the plugin
exit was being called after the simauth module, causing there to
be stale simauth instances that were no longer valid. Now plugins
cleanup before simauth.

This fix fixes the print seen when iwd exits:

"Auth provider queue was not empty on exit!"
2018-08-07 17:18:23 -05:00
Denis Kenzior
8102b33634 wiphy: Support Adapter.SupportedModes property 2018-08-07 17:10:26 -05:00
Denis Kenzior
33e83b8c7c wiphy: Parse & report supported interface types 2018-08-07 16:45:17 -05:00
Denis Kenzior
6e6797cbde dbus: Add dbus_iftype_to_string 2018-08-07 16:19:39 -05:00
Denis Kenzior
9c6f3ef5c0 netdev: synchronize iftypes with nl80211
Make sure the netdev iftype enumeration is the same as nl80211
2018-08-07 16:12:12 -05:00
Denis Kenzior
6f2fbe32f9 wiphy: Add wiphy_supports_adhoc_rsn 2018-08-07 15:38:15 -05:00
Denis Kenzior
59697ead34 dbus: Remove unused functions 2018-08-07 15:38:15 -05:00
Jordan Glover
ed59c1af7f iwd.service: Order iwd before network.target
This ensures the unit will be stopped after network.target on shutdown
and any network filesystems will be unmounted before iwd is killed.
2018-08-06 15:46:19 -05:00
Marcel Holtmann
28573c90d1 build: Add support for systemd D-Bus activation 2018-08-06 22:37:22 +02:00
Andreas Henriksson
0573c6b5fb src: Fix spelling errors spotted by lintian
The debian package checking tool lintian spotted a bunch
of spelling errors in the built binaries.
2018-08-06 12:29:06 -05:00
Andrew Zaborowski
17c35dd1bc knownnetworks: Add back removing network files
This step apparently got lost during the refactoring in
97913c6f9a.
2018-08-01 10:32:32 -05:00
Andrew Zaborowski
e1634baae4 storage: Take enum security instead of string as parameter
Make the network_storage_* functions uniformly accept an enum value
instead of a string so that he conversion to string doesn't need to
happen in all callers.
2018-08-01 09:38:52 -05:00
Andrew Zaborowski
ac527d88c6 network: Actually remove the seen_time field 2018-08-01 09:32:41 -05:00
James Prestwood
3d2285ec7e eap-gtc: added support for agent in gtc
Now, EAP-GTC behaves similar to MSCHAPv2 where check_settings allows
for missing EAP-Identity and GTC-Secret fields. Either or both can be
missing and the agent will request the missing fields.
2018-07-31 14:35:36 -05:00
Andrew Zaborowski
00a643f093 knownnetworks: Drop the old KnownNetworks DBus interface 2018-07-31 11:52:38 -05:00
Andrew Zaborowski
e7e6cc3064 knownnetworks: Move ForgetNetwork() to KnownNetwork object
Remove the KnownNetworks.ForgetNetwork(ssid, security) method and add a
KnownNetwork.Forget() method on Known Network's DBus objects.
2018-07-31 11:52:35 -05:00
Andrew Zaborowski
c651bed28f knownnetworks: DBus objects for KnownNetworks
Add ObjectManager objects with properties for each Known Network so that
signals are emitted for creation or removal of a Known Network and a
Property Changed is emitted on LastConnectedTime change.  Remove the
ListKnownNetworks method from the old KnownNetworks interface.

Note this breaks clients that used the known networks interface.
2018-07-31 10:58:03 -05:00
Andrew Zaborowski
319b6416de network: Stop tracking network last seen times
Drop the corresponding network_info field, function and D-Bus property.
The last seen times didn't seem useful but if a client needs them it can
probably implement the same logic with the information already available
through DBus.
2018-07-31 10:55:32 -05:00
Denis Kenzior
6be0f55d85 ap/adhoc: Don't crash on eapol_sm_free
If the sm object (or the handshake object) is NULL, don't call the
corresponding function.

0  0x7fb6cd37da80 in /lib64/libc.so.6
1  0x414764 in eapol_sm_destroy() at eapol.c:673
2  0x42e402 in ap_sta_free() at ap.c:97
3  0x439dbe in l_queue_clear() at /home/parallels/wrk/iwd/ell/queue.c:109
4  0x439e09 in l_queue_destroy() at /home/parallels/wrk/iwd/ell/queue.c:83
5  0x42e4bf in ap_reset() at ap.c:132
6  0x42e519 in ap_free() at ap.c:147
7  0x447456 in interface_instance_free() at /home/parallels/wrk/iwd/ell/dbus-service.c:513
8  0x449be0 in _dbus_object_tree_remove_interface() at /home/parallels/wrk/iwd/ell/dbus-service.c:1595
9  0x449ced in _dbus_object_tree_object_destroy() at /home/parallels/wrk/iwd/ell/dbus-service.c:787
10 0x40fb8c in device_free() at device.c:2717
11 0x405cdb in netdev_free() at netdev.c:605
12 0x439dbe in l_queue_clear() at /home/parallels/wrk/iwd/ell/queue.c:109
13 0x439e09 in l_queue_destroy() at /home/parallels/wrk/iwd/ell/queue.c:83
14 0x40aac2 in netdev_shutdown() at netdev.c:4483
15 0x403b75 in iwd_shutdown() at main.c:80
16 0x43d9f3 in signal_callback() at /home/parallels/wrk/iwd/ell/signal.c:83
17 0x43d4ee in l_main_iterate() at /home/parallels/wrk/iwd/ell/main.c:376
18 0x43d5ac in l_main_run() at /home/parallels/wrk/iwd/ell/main.c:419
19 0x40379b in main() at main.c:454
20 0x7fb6cd36788a in /lib64/libc.so.6
2018-07-30 09:07:58 -05:00
Tim Kourt
ece63270e7 adhoc: expose property 'Started' property on the Dbus 2018-07-30 09:00:57 -05:00
Tim Kourt
dda350a93d ap: expose property 'Started' property on the Dbus 2018-07-30 09:00:57 -05:00
Andrew Zaborowski
215162a49e network: Don't free known networks in network_info_put
Fix a double free resulting from network.c freeing a known network when
it goes out of range due to a missing check.
2018-07-30 08:55:27 -05:00
Andrew Zaborowski
97913c6f9a network: Refactor and move Known Networks management
Until now network.c managed the list of network_info structs including
for known networks and networks that are seen in at least one device's
scan results, with the is_known flag to distinguish known networks.
Each time the list was processed though the code was either interested
in one subset of networks or the other.  Split the list into a Known
Networks list and the list of other networks seen in scans.  Move all
code related to Known Networks to knownnetworks.c, this simplifies
network.h.  It also gets rid of network_info_get_known which actually
returned the list of all network_infos (not just for known networks),
which logically should have been private to network.c.  Update device.c
and scan.c to use functions specific to Known Networks instead of
filtering the lists by the is_known flag.

This will also allow knownnetworks.c to export DBus objects and/or
properties for the Known Networks information because it now knows when
Known Networks are added, removed or modified by IWD.
2018-07-25 09:40:14 -05:00
Andrew Zaborowski
c2abc212ad network: Make networks_connected return void
The return value from network_connected is not checked and even if one
of the storage operations fails the function should probably continue
so only print a message on error.
2018-07-23 11:46:49 -05:00
Andrew Zaborowski
ea2b83e5a7 ap: Remove unused psk field 2018-07-23 11:46:15 -05:00
James Prestwood
a68e958f29 ap: fixed crash in AP
If the device mode it toggled from 'ap' back to 'station' without actually
starting the access point ap_free attempts to zero out the psk, which
causes a crash because it had never been allocated (Start() never was
called). Since ap->psk is actually never used this was removed. Also added
a memset to zero out the pmk on cleanup.

This is the crash observed:

++++++++ backtrace ++++++++
0  0x7f6ffe978a80 in /lib64/libc.so.6
1  0x7f6ffe9d6766 in /lib64/libc.so.6
2  0x42dd51 in memset() at /usr/include/bits/string3.h:90
3  0x42ddd9 in ap_free() at src/ap.c:144
4  0x445ec6 in interface_instance_free() at ell/dbus-service.c:513
5  0x448650 in _dbus_object_tree_remove_interface() at ell/dbus-service.c:1595
6  0x40d980 in device_set_mode_sta() at src/device.c:2113
7  0x447d4c in properties_set() at ell/dbus-service.c:1861
8  0x448a33 in _dbus_object_tree_dispatch() at ell/dbus-service.c:1691
9  0x442587 in message_read_handler() at ell/dbus.c:285
10 0x43cac9 in io_callback() at ell/io.c:123
11 0x43bf5e in l_main_iterate() at ell/main.c:376
12 0x43c01c in l_main_run() at ell/main.c:419
13 0x40379d in main() at src/main.c:460
14 0x7f6ffe96288a in /lib64/libc.so.6
+++++++++++++++++++++++++++
2018-07-19 11:21:43 -05:00
Denis Kenzior
46a797043a ie: Add AKMs from 802.11-2016 2018-07-19 11:09:08 -05:00
Denis Kenzior
c4a2654703 ie: Split RSN & WPA akm suite builders 2018-07-19 10:56:46 -05:00
Denis Kenzior
438af4aebc ie: Don't fail RSNE parsing with unknown AKMs 2018-07-19 10:36:18 -05:00
Denis Kenzior
c37146d403 wsc: Rework wsc_init & wsc_exit
- wsc module does not need nl80211 any longer, so remove it.
- Move wsc_init & wsc_exit declarations to iwd.h and remove wsc.h
- re-arrange how wsc_init & wsc_exit is called inside main.c.
2018-07-17 19:19:09 -05:00
Denis Kenzior
17bfbbd397 main: Re-arrange _exit order
The plugin_exit was in the wrong place, it should be triggered in case
genl creation fails.  Also adhoc_exit was in the wrong sequence compared
to _init()
2018-07-17 19:15:08 -05:00
Denis Kenzior
6b58ab1a08 main: Simplify sim_auth_init
There's no real reason why sim_auth_init should fail, so simplify the
procedure and move declarations to iwd.h
2018-07-17 19:12:48 -05:00
James Prestwood
8cf44499d1 device: added DEVICE_EVENT_MODE_CHANGED
Rather than have device.c manage the creation/removal of
AP/AdHoc interfaces this new event was introduced. Now
anyone can listen for device events and if the mode changes
handle accordingly. This fixes potential memory leaks
in WSC when switching modes as well.
2018-07-17 18:52:59 -05:00
James Prestwood
bf3a171e3a device: added ad-hoc mode
As with station/ap, a new mode was added for ad-hoc
2018-07-17 16:55:59 -05:00
James Prestwood
682c844239 main: added adhoc init to main 2018-07-17 16:46:21 -05:00
James Prestwood
55cb9aa2e9 adhoc: adhoc implementation 2018-07-17 16:46:18 -05:00
James Prestwood
88bd69269e netdev: add join_adhoc/leave_adhoc API's
These will issue a JOIN/LEAVE_IBSS to the kernel. There is
a TODO regarding network configuration. For now, only the
SSID is configurable. This configuration is also required
for AP, but needs to be thought out. Since the current
AP Dbus API has nothing related to configuration items
such as freq/channel or RSN elements they are hard coded,
and will be for Ad-Hoc as well (for now).
2018-07-17 16:25:33 -05:00
James Prestwood
e10d79b53f netdev: ensure proper iftype on connect/disconnect
Now that the device mode can be changed, netdev must check that
the iftype is correct before starting a connection or disconnecting.
netdev_connect, netdev_connect_wsc, and netdev_disconnect now check
that the iftype is station before continuing.
2018-07-17 16:16:17 -05:00
James Prestwood
515985afed netdev: choose correct address on NEW_KEY/SET_STATION
With the introduction of Ad-Hoc, its not as simple as choosing
aa/spa addresses when setting the keys. Since Ad-Hoc acts as
both the authenticator and supplicant we must check how the netdev
address relates to the particular handshake object as well as
choose the correct key depending on the value of the AA/SPA address.
802.11 states that the higher of the two addresses is to be used
to set the key for the Ad-Hoc connection.

A simple helper was added to choose the correct addressed based on
netdev type and handshake state. netdev_set_tk also checks that
aa > spa in the handshake object when in Ad-Hoc mode. If this is
true then the keys from that handshake are used, otherwise return
and the other handshake key will be used (aa will be > spa).

The station/ap mode behaves exactly the same as before.
2018-07-17 11:13:53 -05:00
James Prestwood
27430287ab dbus: added Ad-Hoc dbus interface 2018-07-17 10:53:08 -05:00
James Prestwood
42fe517d4e netdev: added station watch
For Ad-Hoc networks, the kernel takes care of auth/assoc
and issues a NEW_STATION event when that is complete. This
provides a way to notify when NEW_STATION events occur as
well as forward the MAC of the station to Ad-Hoc.

The two new API's added:
 - netdev_station_watch_add()
 - netdev_station_watch_remove()
2018-07-17 10:50:34 -05:00
James Prestwood
54cd428c94 netdev: Add IFTYPE_ADHOC interface type
netdev_set_iftype and get_iftype were also changed to
account for all three interface types.
2018-07-17 10:49:10 -05:00
Denis Kenzior
efecce772f eapol: Fix memory allocation issues
When the EAPOL-Key data field is encrypted using AES Wrap, check
that the data field is large enough before calculating the expected
plaintext length.

Previously, if the encrypted data field was smaller than 8 bytes, an
integer underflow would occur when calculating the expected plaintext
data length. This would cause iwd to try to allocate a huge amount of
memory, which causes it to abort and terminate. If the data field was
equal to 8 bytes, iwd would try to allocate 0 bytes of memory, making
l_new return NULL, which subsequently causes iwd to crash on a NULL
pointer deference.

Reported-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-07-16 10:51:13 -05:00
Denis Kenzior
57c3aa2589 scan: Fix triggered flag setting
triggered flag was being reset to false in all cases.  However, due to
how scan_finished logic works, it should have remained true if no more
commands were left to be sent (e.g. the scan was finished).
2018-07-13 12:34:59 -05:00
Tim Kourt
d83dda410d device: fix incomplete variable replacement 2018-07-13 11:41:49 -05:00
Christian Hesse
22e5ba2133 device: make the output less verbose
Having hidden SSIDs or SSIDs with non-UTF8 characters around make iwd
flood the logs with messages. Make iwd less verbose and show these
messages with enabled debug output only.
2018-07-13 10:39:02 -05:00
Tim Kourt
9ff2e59e40 scan: add hidden networks into periodic scan
In addition, the periodic scan can now alternate between the
active or passive modes. The active mode is enabled by existence of
the known hidden networks and observation of them in the
previous scan result.
2018-07-11 17:29:47 -05:00
Tim Kourt
ec8afb0af1 scan: add todo comment for randomization flag 2018-07-11 17:24:17 -05:00
Denis Kenzior
48e9f2aee0 scan: Break up logic into utility functions
Some fairly common logic was duplicated across functions.  Split it up
into common utilities
2018-07-11 17:20:06 -05:00
Denis Kenzior
dfe74ea8ff scan: Use a cast instead of an extra function 2018-07-11 16:30:45 -05:00
Tim Kourt
c33deb7a0a scan: add hidden networks into the scan requests
To support an auto-connect for the hidden networks and having
a limited number of SSIDs that can be appended into a probe
request, introduced a concept of a command batch. Now, scan request
may consist of a series of commands. The commands in the batch
are triggered sequentially. Once we are notified about the
results from a previous command, a consequent command in the
batch is triggered. The collective results are reported once
the batch is complete. On a command failure, the batch
processing is canceled and scan request is removed
2018-07-11 16:30:41 -05:00
Denis Kenzior
87108984bc network: set Hidden=true for new hidden networks 2018-07-11 16:09:42 -05:00
Denis Kenzior
d744915534 device: Rework device_hidden_network_scan_results
Rework the logic slightly to simplify the need for error labels.  Also
the connect_pending variable might not have been properly reset to NULL
in case of error, so make sure we reset it prior to calling into
network_connect_new_hidden_network
2018-07-11 15:59:51 -05:00
Tim Kourt
d8c8ebdf3a device: enable connection to the hidden networks
1) Change signature of process_bss to return a confirmation
   that bss has been added to a network otherwise we can
   discard it.

2) Implements logic for the discovery and connection to
   a hidden network.
2018-07-11 15:36:14 -05:00
Tim Kourt
72c6862255 network: add network info accessors
This adds the accessors for the hidden field in network
info. In addition, it provides a lookup of the network infos
by ssid and security type.
2018-07-11 15:20:55 -05:00
Tim Kourt
d2feb535a5 network: implement a counter for the hidden networks 2018-07-11 10:36:40 -05:00
Tim Kourt
f7a30106bf scan: initial support for the direct probe request
This enables the discovery of the hidden networks
2018-07-11 10:25:24 -05:00
Tim Kourt
d1a8e191e9 network: introduce connect API for the hidden nets 2018-07-11 10:19:43 -05:00
James Prestwood
bbad6b4ec9 ap: use netdev_del_station API
Removes del station code from AP in favor of netdev_del_station.
2018-07-03 16:45:29 -05:00
James Prestwood
4a2b80ee97 netdev: expose netdev_del_station
This removes the need for duplicate code in AP/netdev for issuing
a DEL_STATION command. Now AP can issue a DEL_STATION with
netdev_del_station, and specify to either disassociate or deauth
depending on state.
2018-07-03 16:45:29 -05:00
James Prestwood
b2f27f3abe netdev: fixed key setting failure
If netdev fails to set the keys, there was no way for device/ap to
know. A new handshake event was added for this. The key setting
failure function was also fixed to support both AP/station iftypes.
It will now automatically send either a disconnect or del_station
depending on the interface type.

In similar manner, netdev_handshake_failed was also modified to
support both AP/station iftypes. Now, any handshake event listeners
should call netdev_handshake_failed upon a handshake failure
event, including AP.
2018-07-03 16:45:25 -05:00
James Prestwood
d4e521027b device: add debug prints for mode switching
Its useful to know when the device has switched modes
2018-07-03 16:15:54 -05:00
Denis Kenzior
5b8f052524 device: Don't return an error on no state change
If device is already disconnected or in autoconnect mode, don't return
an error if .Disconnect is called.  Instead simply silently return
success after disabling autoconnect.
2018-07-03 16:13:39 -05:00
Denis Kenzior
73e0394d7f device: Use dbus_error_from_errno in .Disconnect 2018-07-03 16:12:04 -05:00
Denis Kenzior
8bbe85787c device: Fix memory leak when aborting a connection
==1058== 231 (32 direct, 199 indirect) bytes in 1 blocks are definitely lost in loss record 10 of 10
==1058==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1058==    by 0x452472: l_malloc (util.c:62)
==1058==    by 0x456324: l_settings_new (settings.c:83)
==1058==    by 0x427D45: storage_network_open (storage.c:262)
==1058==    by 0x42806C: network_settings_load (network.c:75)
==1058==    by 0x428C2F: network_autoconnect (network.c:490)
==1058==    by 0x4104E9: device_autoconnect_next (device.c:194)
==1058==    by 0x410E38: device_set_scan_results (device.c:393)
==1058==    by 0x410EFA: new_scan_results (device.c:414)
==1058==    by 0x424A6D: scan_finished (scan.c:1012)
==1058==    by 0x424B88: get_scan_done (scan.c:1038)
==1058==    by 0x45DC67: destroy_request (genl.c:134)
2018-07-03 15:45:29 -05:00
Tim Kourt
5f69aba32b eap-peap: add warning for the missing M flag 2018-07-02 20:28:08 -05:00
James Prestwood
9e32ea5e80 ap: removed unused ap_event enum 2018-07-02 15:34:26 -05:00
Denis Kenzior
fb1296e9c0 network: Add network_info_get_known 2018-07-02 13:03:03 -05:00
James Prestwood
8ed043533a wsc: register for handshake events
This is a fixup for the AP code merge. wsc.c never registered
for handshake events, so in case of failure it was never calling
netdev_handshake_failed, which caused a double free.
2018-07-02 12:29:08 -05:00
Denis Kenzior
057b019550 network: Use __device_connect_network
In network_autoconnect, use the low-level version of
device_connect_network
2018-07-02 12:28:10 -05:00
Denis Kenzior
a1a6c2d7d6 device: Introduce __device_connect_network
The version with '__' prefix is the raw version that returns errnos.
The version without '__' prefix deals with D-Bus error conversion.
2018-07-02 12:25:47 -05:00
Denis Kenzior
31081f98e7 dbus: Add dbus_error_from_errno 2018-07-02 12:24:33 -05:00
Denis Kenzior
7f844a2520 eapol: Relax key_iv checks
Many APs don't send properly zerod key_iv elements in EAPoL-Key frames.
In the past iwd has complained, but this broken behavior is so
prevalent, that it is likely a lost cause.

This patch takes out these warnings
2018-07-01 20:57:38 -05:00
Denis Kenzior
1c9a1ea46d eapol: Handle all zero PMKID 2018-07-01 20:48:11 -05:00
Denis Kenzior
7676aa2107 netdev: Allow iwd.conf to specify PAE over NL80211
Right now iwd uses Control Port over NL80211 feature if the kernel /
driver supports it.  On some kernels this feature is still buggy, so add
an iwd.conf entry to allow the user to override id.

For now the default is to disable this feature until it is more stable.
2018-07-01 20:41:34 -05:00
James Prestwood
fd79297553 device/ap: Moved AP dbus interface into ap.c
Now, a user can setup an AP as follows:

- Set device "Mode" to ap (ap interface will appear on bus)
- call "Start()" on AP interface

Issuing "Stop()" on the AP interface will stop and cleanup
the internal AP structures, but the AP interface will remain
up. To shutdown completely the device Mode must be switched
back to station. If the AP interface is running, the Mode can
directly be switched to station without calling Stop; this
has the same effect and will take down the AP interface.
2018-06-29 18:28:28 -05:00
Tim Kourt
9976007dd8 eap-peap: Relax the M bit requirement
Some of the PEAP server implementation brake the protocol
and don’t set the M flag for the first packet during the
fragmented transmission. To stay compatible with such
devices, we relax this requirement in iwd.
2018-06-29 17:39:50 -05:00
James Prestwood
d5dd1a4e90 wsc: fixed comment typo 2018-06-29 16:41:13 -05:00
James Prestwood
1d8869fbb7 dbus: define AccessPoint interface
net.connman.iwd.AccessPoint interface was added
2018-06-29 14:26:07 -05:00
Tim Kourt
1fff705160 device: use direct probe request in roam scans
This takes care of the roaming for the hidden networks.
In addition, it limits the noise responses from the
other networks.
2018-06-29 13:53:39 -05:00
Tim Kourt
5ded4890a6 network: introduce the concept of hidden networks 2018-06-29 13:51:12 -05:00
Tim Kourt
1ffc99c343 scan: add ssid parameter
ssid – is used for the direct probe requests
2018-06-29 13:48:09 -05:00
Tim Kourt
d91b81bc11 dbus: add AlreadyProvisioned and NotHidden errors 2018-06-29 13:46:33 -05:00
Tim Kourt
28c6a37db0 scan: rename scan triggered callback 2018-06-28 15:56:46 -05:00
Tim Kourt
27e305c9d2 device: change scan command logic
This patch allows alternating between the passive and active
scans taking into consideration an existence of the known
hidden networks and previous observation of them in the scan
results, as well as an ability to randomize the MAC address.
2018-06-28 15:44:57 -05:00
Denis Kenzior
5828073cd5 scan: Add randomize_mac_addr_hint
This will be used by the scanning code to enable mac address
randomization if supported by the hardware / kernel.
2018-06-28 15:41:29 -05:00
Tim Kourt
ef5110869b network: Add stub for network_info_has_hidden 2018-06-28 15:06:11 -05:00
Denis Kenzior
961c3e849d eap-peap: Print alert number 2018-06-28 13:23:13 -05:00
Tim Kourt
8ea4f82166 device: introduce seen_hidden_networks flag
This flag indicates whether the hidden networks were
observed in the scan results. We drop the hidden network BSSs
after the flag is set.
2018-06-28 11:37:10 -05:00
Tim Kourt
3781c157db util: Add util_ssid_is_hidden 2018-06-28 11:37:06 -05:00
Tim Kourt
a681e845a6 scan: change signature of scan_build_cmd
This allows scan_build_cmd to take advantage of a full
scan context. For example to check the feature availability
of wiphy, etc.
2018-06-28 11:25:30 -05:00
Tim Kourt
bece39619b scan: fix scan state check
The state of scan is split between the two variables sc->state
and sc->start_cmd_id. Not checking start_cmd_id used to cause
sending a scan request while periodic scan was just triggered
resulting in EBUSY.
2018-06-28 11:13:45 -05:00
James Prestwood
93a113f551 ap: remove ap_error_deauth_sta
Instead of manually sending a deauth/disassociate to a station
during an error or removal, the kernel can do it automatically
with DEL_STATION by including the MGMT_SUBTYPE attribute. This
removes the need for ap_error_deauth_sta and introduces
ap_deauthenticate_sta. Now AP can be explicit when it chooses
to deauth or disassociate.
2018-06-28 11:12:11 -05:00
Tim Kourt
48b7ed1e47 dbus: Add error msg for the service set overlap
The intended usage of this error is to notify a client
application about the presence of the multiple overlapping
network sessions.
2018-06-27 19:37:30 -05:00
James Prestwood
92f1ceb3ce netdev/eapol: removed eapol deauthenticate
This removes the need for the eapol/netdev deauthenticate function.
netdev_handshake_failed was exposed so device.c could issue the
disconnect.
2018-06-27 16:17:14 -05:00
James Prestwood
4ed30ff661 ap: removed code that was moved to eapol
All handshake packet handling has been removed from ap and
moved to eapol. After association, the AP registers a new
authenticator state machine which handles the AP side of
the handshake. AP will receive a handshake event once the
4-way handshake is complete.
2018-06-27 14:21:16 -05:00
James Prestwood
9d4f1b4ca6 eapol: moved AP authenticator into eapol
Includes:
 - support for handling ptk 2/4 and 4/4. Also sending 1/4 and 3/4.
 - new API to register an authenticator SM. This automatically
   sends 1/4 to kick off authentication with an sta.
2018-06-22 14:40:20 -05:00
James Prestwood
b81a9482b4 netdev: added checks for station/ap iftype
These checks allow both a station and authenticator to use
the same netdev key install functions. For NEW_KEY and
SET_STATION, the iftype is checked and either handshake->aa
or ->spa is used as the station address for the KEY/STATION
commands. Also, in the failure cases, a disconnect command
is issued only if the iftype is station as this doesn't
apply to AP.
2018-06-22 14:33:32 -05:00
James Prestwood
aac00bf33a handshake: remove handshake related netdev events
Handshake related netdev events were removed in favor of
handshake events. Now events will be emitted on the handshake
object related to the 4-way handshake and key settings. Events
are:

HANDSHAKE_EVENT_STARTED
HANDSHAKE_EVENT_SETTING_KEYS
HANDSHAKE_EVENT_COMPLETE
HANDSHAKE_EVENT_FAILED

Right now, since netdev only operates in station mode, nothing
listens for COMPLETE/FAILED, as device/wsc gets notified by the
connect_cb when the connection was successful. The COMPLETE/
FAILED were added in preperation for AP moving into eapol/netdev.
2018-06-22 14:21:50 -05:00
Denis Kenzior
c5893f7da8 network: Fix memory leak in network_set_psk
==1057== 32 bytes in 1 blocks are definitely lost in loss record 1 of 1
==1057==    at 0x4C2AF0F: malloc (vg_replace_malloc.c:299)
==1057==    by 0x15E9A2: l_malloc (util.c:62)
==1057==    by 0x15EA9D: l_memdup (util.c:121)
==1057==    by 0x133D9A: network_set_psk (network.c:350)
==1057==    by 0x13BD29: wsc_try_credentials (wsc.c:136)
==1057==    by 0x13C121: wsc_connect_cb (wsc.c:220)
==1057==    by 0x110FAF: netdev_connect_failed (netdev.c:525)
==1057==    by 0x16AAF4: process_unicast (genl.c:390)
==1057==    by 0x16AF03: received_data (genl.c:509)
==1057==    by 0x166CB6: io_callback (io.c:123)
==1057==    by 0x16580D: l_main_iterate (main.c:376)
==1057==    by 0x16594B: l_main_run (main.c:423)
2018-06-21 20:14:00 -05:00
Denis Kenzior
3df790e3c5 handshake: Switch to superclass api 2018-06-21 20:10:07 -05:00
Denis Kenzior
b5e01226cb netdev: Remove un-needed pairwise set_key call
This seems to be no longer needed as the kernel looks up the key by the
sta specific key index.
2018-06-21 20:10:07 -05:00
James Prestwood
2177b22caa handshake: Add utility to generate a new anonce
AP EAPoL state machine will need to generate the anonce, so as
with snonce, an API was added to do that.
2018-06-20 14:04:54 -05:00
James Prestwood
b059a699ab netdev: refactored code to prep for AP code
Added several helpers for code that will be reused by AP
2018-06-20 14:02:07 -05:00
Denis Kenzior
d76cf840ed eap-ttls: Rename eap to phase2_eap for clarity 2018-06-20 13:55:15 -05:00
Denis Kenzior
a217b4f8b9 eap-ttls: Remove eap_new calls after load_settings
load_settings ensures that ttls->eap is correctly initialized.  So this
code should be treated as an error condition.

We also do not support EAP chaining, so remove that logic as well
2018-06-20 13:55:15 -05:00
Denis Kenzior
2fe2ed61e1 netdev: Set netdev->type to NL80211 enum 2018-06-20 08:23:22 -05:00
James Prestwood
0b5a3da2ef netdev: fixed netdev_set_iftype
While this would issue a SET_INTERFACE to the kernel it would
not actually set netdev->type, so netdev_get_iftype would
return incorrectly.
2018-06-19 16:13:39 -05:00
Antonio Quartulli
1de8d18883 main: don't crash if DBus is not running
dbus_init() currently does not check for the g_dbus object being
properly initialized and this leads to crashes when dbus is not yet
running.

Ensure g_dbus is properly initialized and return false otherwise.
In this case the caller can understand that something went wrong and
stop the initialization procedure.

Program received signal SIGSEGV, Segmentation fault.
0x00005555555bc089 in l_dbus_add_service_watch (dbus=0x0,
name=0x5555555e5b0a "org.ofono",
    connect_func=0x5555555aa81e <ofono_found>,
disconnect_func=0x5555555aa8e6 <ofono_disappeared>,
    user_data=0x0, destroy=0x0) at ell/dbus.c:1621
1621		if (!dbus->name_cache)
(gdb) bt
name=0x5555555e5b0a "org.ofono",
    connect_func=0x5555555aa81e <ofono_found>,
disconnect_func=0x5555555aa8e6 <ofono_disappeared>,
    user_data=0x0, destroy=0x0) at ell/dbus.c:1621
user_data=0x0) at ell/plugin.c:115
function=0x5555555b40fd <plugin_start>,
    user_data=0x0) at ell/queue.c:441
version=0x0) at ell/plugin.c:201
src/plugin.c:82
src/main.c:417
2018-06-15 10:59:07 -05:00
Denis Kenzior
8112806aca eap-mschapv2: Fix uninitialized use of memory
When the response structure is generated, not all of the memory was
initialized to 0.

==1045== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==1045==    at 0x5134D52: send (in /lib64/libc-2.25.so)
==1045==    by 0x168AB5: l_checksum_update (checksum.c:338)
==1045==    by 0x186777: tls_write_mac (tls-record.c:58)
==1045==    by 0x1869D1: tls_tx_record_plaintext (tls-record.c:120)
==1045==    by 0x186DEA: tls_tx_record (tls-record.c:201)
==1045==    by 0x185A3B: l_tls_write (tls.c:2064)
==1045==    by 0x14584F: eap_ttls_eap_tx_packet (eap-ttls.c:321)
==1045==    by 0x14236C: eap_send_response (eap.c:165)
==1045==    by 0x147904: eap_mschapv2_send_response (eap-mschapv2.c:468)
==1045==    by 0x147A10: eap_mschapv2_handle_challenge (eap-mschapv2.c:492)
==1045==    by 0x147E9A: eap_mschapv2_handle_request (eap-mschapv2.c:615)
==1045==    by 0x142693: __eap_handle_request (eap.c:240)
==1045==  Address 0x1ffeffe7f9 is on thread 1's stack
==1045==  in frame #4, created by tls_tx_record (tls-record.c:177)
==1045==  Uninitialised value was created by a stack allocation
==1045==    at 0x1477AE: eap_mschapv2_send_response (eap-mschapv2.c:443)
==1045==
==1045== Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s)
==1045==    at 0x5134E3B: sendmsg (in /lib64/libc-2.25.so)
==1045==    by 0x17F691: operate_cipher (cipher.c:356)
==1045==    by 0x17F9D8: l_cipher_encrypt (cipher.c:446)
==1045==    by 0x186BAA: tls_tx_record_plaintext (tls-record.c:152)
==1045==    by 0x186DEA: tls_tx_record (tls-record.c:201)
==1045==    by 0x185A3B: l_tls_write (tls.c:2064)
==1045==    by 0x14584F: eap_ttls_eap_tx_packet (eap-ttls.c:321)
==1045==    by 0x14236C: eap_send_response (eap.c:165)
==1045==    by 0x147904: eap_mschapv2_send_response (eap-mschapv2.c:468)
==1045==    by 0x147A10: eap_mschapv2_handle_challenge (eap-mschapv2.c:492)
==1045==    by 0x147E9A: eap_mschapv2_handle_request (eap-mschapv2.c:615)
==1045==    by 0x142693: __eap_handle_request (eap.c:240)
==1045==  Address 0x1ffeffe7f9 is on thread 1's stack
==1045==  in frame #4, created by tls_tx_record (tls-record.c:177)
==1045==  Uninitialised value was created by a stack allocation
==1045==    at 0x1477AE: eap_mschapv2_send_response (eap-mschapv2.c:443)
==1045==
2018-06-15 07:55:41 -05:00
Denis Kenzior
38952813dd storage: Simplify storage_network_open 2018-06-14 20:53:39 -05:00
Denis Kenzior
a2d8054218 eap: Separate private bits into eap-private.h 2018-06-14 20:01:19 -05:00
Denis Kenzior
f04869c3cf network: Use network_load_psk in network_connect_psk 2018-06-14 19:22:29 -05:00
Denis Kenzior
c25499a118 network: Rework autoconnect logic 2018-06-14 19:21:44 -05:00
Denis Kenzior
786365e2c7 eap: Add __eap_check_settings
Since PEAP & TTLS expect to use eap_check_settings recursively, make
them use a private version of that API that does not perform cleanup and
can contain side-effects.

eap_check_settings itself will guarantee that no side effects happen on
error.  It is meant to be used by code outside of the eap subsystem.
2018-06-14 19:21:44 -05:00
Denis Kenzior
e24d6b54d2 eap: Ensure that we don't return an empty queue 2018-06-14 17:02:09 -05:00
Denis Kenzior
250568025c network: Fix a bunch of double-frees
Missing secrets are freed by eap_send_agent_req() even in case of
failure, so it was erroneous to try to free them on error.

==1048== Invalid read of size 8
==1048==    at 0x1603EC: l_queue_clear (queue.c:101)
==1048==    by 0x1603B8: l_queue_destroy (queue.c:82)
==1048==    by 0x135328: network_connect_8021x (network.c:943)
==1048==    by 0x1354C4: network_connect (network.c:987)
==1048==    by 0x178DD2: _dbus_object_tree_dispatch (dbus-service.c:1690)
==1048==    by 0x16D32A: message_read_handler (dbus.c:285)
==1048==    by 0x166EC3: io_callback (io.c:123)
==1048==    by 0x165A1A: l_main_iterate (main.c:376)
==1048==    by 0x165B58: l_main_run (main.c:423)
==1048==    by 0x1102DA: main (main.c:458)
==1048==  Address 0x5461850 is 0 bytes inside a block of size 24 free'd
==1048==    at 0x4C2C13B: free (vg_replace_malloc.c:530)
==1048==    by 0x15ED03: l_free (util.c:136)
==1048==    by 0x1603C4: l_queue_destroy (queue.c:83)
==1048==    by 0x134BD5: eap_secret_request_free (network.c:719)
==1048==    by 0x134EF9: eap_send_agent_req (network.c:817)
==1048==    by 0x1352F7: network_connect_8021x (network.c:936)
==1048==    by 0x1354C4: network_connect (network.c:987)
==1048==    by 0x178DD2: _dbus_object_tree_dispatch (dbus-service.c:1690)
==1048==    by 0x16D32A: message_read_handler (dbus.c:285)
==1048==    by 0x166EC3: io_callback (io.c:123)
==1048==    by 0x165A1A: l_main_iterate (main.c:376)
==1048==    by 0x165B58: l_main_run (main.c:423)
2018-06-14 17:00:52 -05:00
Denis Kenzior
75b492eacc eap-peap: Fix double free 2018-06-14 16:01:50 -05:00
Denis Kenzior
eb1a183277 eap-ttls: Fix double free 2018-06-14 15:58:43 -05:00
Denis Kenzior
86fef093c0 eap-mschapv2: Optimize away some allocs/frees 2018-06-14 15:19:50 -05:00
Andrew Zaborowski
1a465aed4a eap: Allow methods to request the Identity from agent
In eap_check_settings move the check for the EAP-Identity setting so
that the method's check_setting call back has a chance to request it
from the agent.  Note the check can be also moved to the EAP methods
so that they are free to skip it if not NULL identity is ok.
2018-06-13 21:49:24 -05:00
Andrew Zaborowski
b9aaab9c63 eap-mschapv2: Drop unneeded UTF-8 validation
As report by Denis those strings have already gone through validation.
2018-06-13 21:49:07 -05:00
Andrew Zaborowski
66e332fd4a eap: Use l_settings_get_string where needed
Replace usages of l_settings_get_value with l_settings_get_string, which
will make sure the returned strings are unescaped but also allocates
memeory and forces us to use l_free on most of the strings.  Some of
these strings we explicitly set with l_settings_set_string() in our code
so when we retrieved them with l_settings_get_value() we would receive a
different string if there were any escapable characters in the string.
I didn't replace any of the l_settings_get_value() uses where we're just
checking whether a setting is present, or those which are hexstrings or
EAP method names assuming that they can't have any special characters,
although this isn't future proof.  I did use l_settings_get_string() for
file paths though.
2018-06-13 21:41:43 -05:00
Andrew Zaborowski
b8fde0c166 eap: Accept a second id parameter in eap_append_secret
Accept two setting IDs in eap_append_secret, first for the username and
second for the password in case of the EAP_SECRET_REMOTE_USER_PASSWORD
EAP secret type.  In all other cases only the first setting is used.
Until now for EAP_SECRET_REMOTE_USER_PASSWORD secrets we'd generate the
two setting names by adding different suffixes to the ID parameter.

Using the two different setting names automatically fixes the issues
with using the EAP Identity returned by the agent in EAP-MSCHAPv2 and
EAP-PWD.
2018-06-13 21:34:25 -05:00
Denis Kenzior
7877be328b netdev: Fix unneeded error negation
device.c expects errors to be negative for both set_powered and
set_4addr.
2018-06-13 21:25:01 -05:00
Antonio Quartulli
b415858698 device: add dbus interface for WDS property
The WDS dbus property of a Device directly maps to the 4ADDR property
of a real netdevice. It can be activated or deactivated at any point
in time.

The name WDS comes from the fact that this feature allows a STA
interface to be bridged and thus create a Wireless Distribution
System (the same name is used in OpenWRT and hostapd).

To implement this feature, the 'powered callback' data structure has
been renamed and re-used.
2018-06-13 21:16:22 -05:00
Antonio Quartulli
9476f78e2d netdev: add helper to set/unset 4ADDR property 2018-06-13 21:12:53 -05:00
Andrew Zaborowski
17ad048c8c device: On lost beacon always set roam_no_orig_ap
Even if we're already roaming or preparing to roam, setting this flag
may still affect some step of the roam sequence so set it anyway.
2018-06-13 12:13:45 -05:00
Andrew Zaborowski
660f321c3d eap-mschapv2: Fix password hash validation 2018-06-13 11:59:49 -05:00
Antonio Quartulli
896aa41082 netdev: handle netlink events on bridge ports
When a wifi interface is added/removed to/from a bridge, a
RTM_NEW/DELLINK event is issued. This is the same event used to signal
when an interface is created/deleted.

For this reason the event generated by the bridge code has to be
properly distinguished and handled accordingly. Failing to do so will
result in inconsistencies in iwd which will think an interface has been
deleted when it was actually not.

Detect incoming NEW/DELLINK bridge events and reacts accordingly. For
now, this simply means printing a simple message, as there is no
special logic in iwd for this yet.
2018-06-13 08:31:46 -05:00
James Prestwood
96374f47e5 eap-aka: added EAP reset_state 2018-06-12 11:09:10 -05:00
James Prestwood
789eb08bc9 eap-sim: added EAP reset_state 2018-06-12 11:09:10 -05:00
Denis Kenzior
e4bc7149c3 eap-tls: Implement reset_state method 2018-06-07 19:58:56 -05:00
Denis Kenzior
092ccb4372 eap-ttls: Add reset_state method 2018-06-07 19:53:42 -05:00
Denis Kenzior
1f3b120467 eap-peap: Add reset_state method 2018-06-07 19:43:25 -05:00
Denis Kenzior
6e242acddb eap-mschapv2: Implement reset_state 2018-06-07 17:10:59 -05:00
Denis Kenzior
ff7a581d36 eap: Don't destroy method on completion
Let the upper layers decide what to do when a method completes
2018-05-30 22:36:41 -05:00
Denis Kenzior
9bcb2b75ac eapol: On success, reset EAP state
Instead of destroying the EAP object, just reset its state in case the
EAP process completed successfully.  This allows EAP Reauthentication to
work.
2018-05-30 15:09:42 -05:00
Denis Kenzior
2722990e61 eap-pwd: Add .reset_state method 2018-05-30 15:04:20 -05:00
Denis Kenzior
5894051d6c eap: Introduce state reset
This is meant to reset the EAP state back to its original state without
affecting any state variables obtained through load_settings.  This can
be useful for EAP Reauthentication triggered by the AP.
2018-05-30 14:52:22 -05:00
Denis Kenzior
4c59569f0c scan: Move scan_get_security to common.c 2018-05-24 19:22:16 -05:00
Denis Kenzior
7c18e3cdfe iwd: Move network_init & network_exit to iwd.h 2018-05-24 19:22:12 -05:00
Denis Kenzior
e4ddf4cf19 ie: Add missing #include and forward declaration 2018-05-24 15:54:32 -05:00
Tim Kourt
c0daec7e8d scan: add wiphy into scan context
The added wiphy will later be used by the scan command
builder to identify the available features and get properties
2018-05-24 15:24:33 -05:00
Tim Kourt
8f17186666 scan: rename callback for the triggered scan 2018-05-24 15:24:33 -05:00
Denis Kenzior
3b4cc1bfe2 wiphy: Rename get_ext_feature API
to has_ext_feature
2018-05-24 15:24:16 -05:00
Tim Kourt
933eabb6ef wiphy: added accessor for the feature flags 2018-05-24 13:10:56 -05:00
Tim Kourt
367522fe8f netdev: added accessor for wiphy
Added an accessor to get wiphy associated with a network device
2018-05-24 13:07:00 -05:00
Denis Kenzior
e6adb36621 iwd.service: Use multi-user target 2018-05-22 11:28:02 -05:00
Denis Kenzior
2aba2f3ba9 main: Disable debug output by default
Instead use '-d' command line option.  This option uses an optional
argument.  Without an argument, '*' is assumed.  Otherwise you can
specify a glob string to match.  Any debug output that matches the glob
string will be printed.  e.g.:

src/iwd -d '*eap*'
2018-05-19 18:29:28 -05:00
James Prestwood
d54a8e56d3 netdev: print error if frame watch fails
The frame watch API had no callback, so if there was a failure
it would silently continue.
2018-05-18 12:54:40 -05:00
Denis Kenzior
6db257b937 eap: Dump unhandled EAP packets 2018-05-18 10:29:58 -05:00
Denis Kenzior
450ed03e21 eap: Fix crash
Some EAP servers might try to send us packets after the EAP connection
has been established.  When EAP succeeds we destroy the EAP object.  If
a new EAP request arrives we create a temporary EAP object to handle the
request (most likely to NAK it).  However, if the packet is not destined
to a particular method (e.g. it is a notification) the current logic can
result in a crash.

src/netdev.c:netdev_set_gtk() 3
==4300== Invalid read of size 8
==4300==    at 0x14204B: __eap_handle_request (eap.c:203)
==4300==    by 0x142339: eap_rx_packet (eap.c:287)
==4300==    by 0x12AEF9: eapol_rx_packet (eapol.c:1622)
==4300==    by 0x12BBBC: __eapol_rx_packet (eapol.c:2018)
==4300==    by 0x116D1E: netdev_pae_read (netdev.c:3121)
==4300==    by 0x16672B: io_callback (io.c:123)
==4300==    by 0x165239: l_main_iterate (main.c:376)
==4300==    by 0x16537D: l_main_run (main.c:423)
==4300==    by 0x10F95C: main (main.c:447)
==4300==  Address 0x30 is not stack'd, malloc'd or (recently) free'd
==4300==
2018-05-18 10:27:42 -05:00
Denis Kenzior
56eeaf7b7a eap: Fix invalid access
When the server sends an identity prompt or a notification, we were
trying to print from our local buffer, not from the actual packet.  The
relevant valgrind trace is:

src/netdev.c:netdev_mlme_notify() MLME notification 64
==4300== Conditional jump or move depends on uninitialised value(s)
==4300==    at 0x4C3006E: strnlen (vg_replace_strmem.c:425)
==4300==    by 0x508C513: vfprintf (vfprintf.c:1643)
==4300==    by 0x508EB75: buffered_vfprintf (vfprintf.c:2329)
==4300==    by 0x508C1A1: vfprintf (vfprintf.c:1301)
==4300==    by 0x167051: log_stderr (log.c:145)
==4300==    by 0x16756E: l_log_with_location (log.c:293)
==4300==    by 0x142173: __eap_handle_request (eap.c:235)
==4300==    by 0x142339: eap_rx_packet (eap.c:287)
==4300==    by 0x12AEF9: eapol_rx_packet (eapol.c:1622)
==4300==    by 0x12BBBC: __eapol_rx_packet (eapol.c:2018)
==4300==    by 0x116D1E: netdev_pae_read (netdev.c:3121)
==4300==    by 0x16672B: io_callback (io.c:123)
==4300==
EAP identity prompt: ""
2018-05-18 09:46:12 -05:00
John Zimmermann
3b4c1dd4d3 build: check for existence of execinfo.h
GLIBC is not necessarily the only library that provides execinfo.
With libexecinfo execinfo can be used also in other Libraries.
The patch lets the configure check the existence of the header
and the libexecinfo Library and uses them if avaible.

(also fixes compilation if execinfo is not avaible)
2018-05-17 17:42:28 -05:00
Tim Kourt
42c5d96219 network: load settings for the open networks
iwd was auto-connecting to the open networks despite having
Autoconnect=false flag set in the network configuration file.
This patch enables iwd to load the configuration files for the
open networks during the auto-connect attempt to take advantage
of the Autoconnect flag.
2018-05-10 12:47:40 -05:00
Tim Kourt
46abfc7813 wiphy: add support for MAX_NUM_SCAN_SSIDS 2018-05-08 19:17:40 -05:00
James Prestwood
2f0c37dae6 eap-pwd: use ecc byte conversion API's 2018-05-04 19:33:55 -05:00
James Prestwood
db690ebe73 ecc: added byte conversion functions
EAP-PWD was hard coded to only work on LE architectures. This
adds 2 conversion functions to go from network byte order (BE)
to any native architecture, and vise versa.
2018-05-04 19:33:55 -05:00
James Prestwood
71902e2291 eap-pwd: fix 32 bit build warnings from debug prints
Printing size_t as %lu works on 64 bit architectures but shows a
compile warning on 32 bit. The %zu modifier fixes this.
2018-05-04 12:48:02 -05:00
James Prestwood
322f32295d eap-pwd: fixup some minor bounds checking issues 2018-05-03 14:46:29 -05:00
Denis Kenzior
6a28cd5527 main: Check and print missing kernel options 2018-05-03 14:45:26 -05:00
Denis Kenzior
bfe4fcffd3 eap-mschapv2: Check for MD4 support 2018-05-03 14:45:00 -05:00
Denis Kenzior
a65e5e0800 eap-pwd: Don't leak on failure 2018-05-03 12:57:23 -05:00
Denis Kenzior
5cf358cd4f eap-pwd: Fixup minor style issues 2018-05-03 12:55:45 -05:00
James Prestwood
d10369cf60 eap-pwd: core EAP-PWD code 2018-05-03 10:50:30 -05:00
James Prestwood
fdee72dffc ecc: added ecc implementation for EAP-PWD
The file, src/ecc.c was taken from the bluez project:
https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/src/shared/ecc.c

There were minor changes made, e.g. changing some functions to globals
for access in EAP-PWD as well as removing some unneeded code. There was
also some code appended which allows for point addition, modulus inverse
as well as a function to compute a Y value given an X.
2018-05-03 10:27:53 -05:00
Denis Kenzior
b8c80060d3 wiphy: Update ext_features size 2018-05-01 20:46:06 -05:00
Denis Kenzior
92cf0446a1 netdev: Print handshake failure reason code 2018-05-01 20:46:06 -05:00
Denis Kenzior
9e8850c423 ap: Use EAPoL over NL80211 if available 2018-05-01 20:46:06 -05:00
Denis Kenzior
5d0f1bbb31 netdev: Handle Control Port TX path 2018-05-01 20:46:06 -05:00
Denis Kenzior
b5d48da4c7 netdev: Open PAE transport if needed
If Control Port over NL80211 is not supported, open up a PAE socket and
stuff it into an l_io on the netdev object.  Install a read handler on
the l_io and call __eapol_rx_packet as needed.
2018-05-01 20:46:03 -05:00
Denis Kenzior
ebc4e2cdf0 netdev: React to CONTROL_PORT unicast 2018-05-01 20:46:01 -05:00
Denis Kenzior
c31cf5d383 eapol: Fully separate eapol transport details
With the introduction of Control Port Over NL80211 feature, the
transport details need to be moved out of eapol and into netdev.c.
Whether a given WiFi hardware supports transfer of Control Port packets
over NL80211 is Wiphy and kernel version related, so the transport
decisions need to be made elsewhere.
2018-05-01 11:14:04 -05:00
Andrew Zaborowski
008965882d eap-mschapv2: Fix string start calculation 2018-04-30 10:47:31 -05:00
Andrew Zaborowski
b1d4db7cc8 eap: Return specific error when check_settings fails
Change the check_settings eap functions to return a negative errno and
return more granular Dbus error from the Connect method.
2018-04-30 10:45:28 -05:00
James Prestwood
071ef356db eap: add EAP-PWD method type 2018-04-27 11:14:30 -05:00
Andrew Zaborowski
56d3d40f30 eap: Wipe passphrase memory in TLS, TTLS, EAP
Wipe the passphrase memory in more places before freeing.
2018-04-26 11:27:22 -05:00
Andrew Zaborowski
6dc5d2c3ec eap-mschapv2: Load credentials obtained from agent
If needed load the username and password obtained from the agent and
received in the settings object.
2018-04-26 11:23:29 -05:00
Andrew Zaborowski
cb775819b8 network: Pass secrets to EAP methods
On connect add any secrets we've received through the agent to the
l_settings objects which the EAP methods will process in load_settings.
The settings object is modified but is never written to storage.  If
this was to change because some settings need to be saved to storage,
a new l_settings object might be needed with the union of the settings
from the file and the secrets so as to avoid saving the sensitive data.
2018-04-26 11:23:29 -05:00
James Prestwood
d1a13036d2 eap: fix EAP-SIM/AKA/AKA' after settings change
These EAP methods do not store the identity inside the settings file
since it is obtained from the SIM card, then provided to IWD via
get_identity method. If the get_identity method is implemented, do
not fail the settings check when EAP-Identity is missing.
2018-04-20 14:36:52 -05:00
Andrew Zaborowski
2382dc7ffa network: Validate 8021x settings and request passwords
Use eap_check_settings directly from network.c before we start the
connection attempt at netdev.c level, to obtain all of the required
passwords/passphrases through the agent.  This is in network.c because
here we can decide the policies for whether to call the agent in
autoconnect or only if we had a request from the user, also whether we
want to save any of that for later re-use (either password data or
kernel-side key serial), etc.

In this patch we save the credentials for the lifetime of the network
object in memory, and we skip the network if it requires any passphrases
we don't have while in autoconnect, same as with PSK networks where the
PSK isn't given in the settings.  Note that NetworkManager does pop up
the password window for PSK or EAP passwords even in autoconnect.

If EAP needs multiple passwords we will call the agent sequentially for
each.
2018-04-19 14:05:20 -05:00
Andrew Zaborowski
7541b595f9 eap-peap: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.  Then also call eap_check_settings to validate the inner
method's settings.
2018-04-19 13:23:03 -05:00
Andrew Zaborowski
86aa4e8af1 eap-gtc: Implement .check_settings
Only do the same validation that .load_settings would do for GTC.
2018-04-19 13:14:37 -05:00
Andrew Zaborowski
8650bddcfe eap-aka: Implement .check_settings
Also it seems aka->identity could not have been set at the time
it was used in the error message so I changed that error message
slightly.
2018-04-19 13:14:25 -05:00
Andrew Zaborowski
200312c4e5 eap-sim: Implement .check_settings 2018-04-19 13:13:58 -05:00
Andrew Zaborowski
d27b0d5b1e eap-ttls: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.  Then also call eap_check_settings to validate the inner
method's settings.
2018-04-19 13:13:07 -05:00
Andrew Zaborowski
8eea2c39d1 eap-tls: Implement .check_settings
Confirm that the PEM file paths that we'll be passing to the l_tls
object are loading Ok and request/validate the private key passphrase
if needed.
2018-04-19 13:11:39 -05:00
Andrew Zaborowski
3b2b194170 eap-mschapv2: Implement .check_settings
Move the settings validation from .load_settings plus allow the
username/password to be supplied in the secrets l_queue instead of
in the l_settings.
2018-04-19 13:01:58 -05:00
Andrew Zaborowski
9134743a97 eap-md5: Implement .check_settings
Only do the same validation that .load_settings would do for MD5.
2018-04-19 13:00:44 -05:00
Andrew Zaborowski
246e76c7b0 eap: Validate settings, report passwords needed
With the goal of requesting the required passwords/passphrases, such as
the TLS private key passphrase, from the agent, add a static method
eap_check_settings to validate the settings and calculate what passwords
are needed for those settings, if any.  This is separate from
eap_load_settings because that can only be called later, once we've
got an eap state machine object.  We need to get all the needed EAP
credentials from the user before we even start connecting.

While we do this, we also validate the settings and output any error
messages through l_error (this could be changed so the messages go
somewhere else in the future), so I removed the error messages from
eap_load_settings and that method now assumes that eap_check_settings
has been called before.

eap_check_settings calls the appropriate method's .check_settings method
if the settings are complete enough to contain the method name.  The
policy is that any data can be provided inside the l_settings object
(from the network provisioning/config file), but some of the more
sensitive fields, like private key passwords, can be optionally omitted
and then the UI will ask for them and iwd will be careful with
caching them.

Within struct eap_secret_info, "id" is mainly for the EAP method to
locate the info in the list.  "value" is the actual value returned
by agent.  "parameter" is an optional string to be passed to the agent.
For a private key passphrase it may be the path to the key file, for a
password it may be the username for which the password is requested.
2018-04-19 13:00:12 -05:00
Andrew Zaborowski
15a037f633 agent: Add new request types
Add new agent.h methods and corresponding DBus methods to request
the 3 different EAP credential types from user.
2018-04-19 11:49:41 -05:00
Andrew Zaborowski
b862fd8fe1 agent: Check if callback has sent a new request
In agent_receive_reply we first call the callback for the pending
request (agent_finalize_pending) then try to send the next request
in the queue.  Check that the next request has not been sent already
which could happen if it has been just queued by the callback.
2018-04-19 11:45:03 -05:00
Andrew Zaborowski
c6e3140b38 device: Handle disconnect by AP and by SME events same way
The difference in the handlers was that in the
NETDEV_EVENT_DISCONNECT_BY_AP case we would make sure to reply
to a pending dbus Connect call.  We also need to do that for
NETDEV_EVENT_DISCONNECT_BY_SME.  This happens if another process
sends an nl80211 disconnect command while we're connecting.
2018-04-19 10:36:18 -05:00
Andrew Zaborowski
32d846470b device: Use active scans when connected
When we're connected we're advertising our hardware address anyway so
there's no benefit from using passive scanning.
2018-04-10 00:19:33 -05:00
Andrew Zaborowski
d9ae78b780 device: Drop unsupported bands from roam scan frequency set
The kernel will reject the TRIGGER_SCAN commands that include
frequencies not supported by the wiphy.
2018-04-10 00:19:30 -05:00
James Prestwood
c0739c1965 eap-gtc: add EAP-GTC method implementation 2018-04-04 09:42:28 -05:00
James Prestwood
d1c7f360d2 eap: add EAP_TYPE_GTC (6) type 2018-04-04 09:40:05 -05:00
James Prestwood
88a1520dbd main: set eapol config 2018-04-02 13:54:25 -05:00
James Prestwood
50eae9bf87 eapol: process config setting for handshake timeout
The eapol handshake timeout can now be configured in main.conf
(/etc/iwd/main.conf) using the key eapol_handshake_timeout. This
allows the user to configure a long timeout if debugging.
2018-04-02 13:54:25 -05:00
Andrew Zaborowski
5a17c2275f eapol: Make sure rsn_info is initialized in eapol_handle_ptk_1_of_4
After an EAP exchange rsn_info would be uninitialized and in the FT case
we'd use it to generate the step 2 IEs which would cause an RSNE
mismatch during FT handshake.
2018-03-15 11:40:17 -05:00
Andrew Zaborowski
8b534ba067 eapol: In FT-EAP use all 64 bytes of the MSK
Until now we'd save the second 32 bytes of the MSK as the PMK and use
that for the PMK-R0 as well as the PMKID calculation.  The PMKID
actually uses the first 32 bytes of the PMK while the PMK-R0's XXKey
input maps to the second 32 bytes.  Add a pmk_len parameter to
handshake_state_set_pmk to handle that.  Update the eapol_eap_results_cb
802.11 quotes to the 2016 version.
2018-03-15 11:40:17 -05:00
Tim Kourt
436e95d599 peap: Postpone cleanup on phase two failure 2018-03-01 09:13:17 -06:00
Andrew Zaborowski
d2247c3a3f netdev: Avoid calling netdev_connect_ok twice in FT
handshake_state_install_ptk triggers a call to
netdev_set_pairwise_key_cb which calls netdev_connect_ok, so don't call
netdev_connect_ok after handshake_state_install_ptk.  This doesn't fix
any specific problem though.
2018-02-26 09:59:58 -06:00
Tim Kourt
9783e236a1 peap: handle completion of phase two 2018-02-23 15:19:52 -06:00
Tim Kourt
97980c0315 eap: allow to discard EAP-Success/EAP-Failure pkts 2018-02-23 12:48:40 -06:00
Tim Kourt
ad94752170 eap: add accessor for method success 2018-02-21 20:14:50 -06:00
Andrew Zaborowski
7fd6803c7a agent: Fix cancelling running request
If the request being cancelled by agent_request_cancel has already been
sent over dbus we need to reset pending_id, the timeout, call l_dbus_cancel
to avoid the agent_receive_reply callback (and crash) and perhaps start
the next request.  Alternatively we could only reset the callback and not
free the request, then wait until the agent method to return before starting
the next request.
2018-02-20 11:07:00 -06:00
Tim Kourt
55e8d7fdcc peap: add retransmission support 2018-02-15 13:00:22 -06:00
Tim Kourt
78270bc39e eap: interoperability support for Success/Failure pkts 2018-02-15 12:59:45 -06:00
Tim Kourt
91ec5cff8c peap: add phase two eap tx/rx handlers 2018-02-14 21:34:21 -06:00
Tim Kourt
1ece3b13e4 peap: introduce and configure phase two eap method 2018-02-14 21:31:24 -06:00
Tim Kourt
50b7a01f87 peap: handle send for phase two data 2018-02-14 21:30:33 -06:00
Tim Kourt
8ae6e7c3de peap: switch tx_pdu_buf to use databuf struct 2018-02-14 21:28:03 -06:00
Tim Kourt
93d0dac77b peap: handle receive for phase two data 2018-02-14 21:26:54 -06:00
Tim Kourt
487c5cbafc peap: send ack on established tunnel 2018-02-14 17:37:19 -06:00
Tim Kourt
43c650a2b4 peap: add specification reference by the version 2018-02-14 17:36:08 -06:00
Tim Kourt
5b19d0454a eap: make eap_handle_request public 2018-02-14 15:09:27 -06:00
Andrew Zaborowski
7e8e8b2ac2 eapol: Stop eapol timeout after step 3/4
Move the cancelling of the eapol timeout from the end of step 1 to
step 3 to guard the whole handshake.  At the end of step 1 stop the
EAPOL-Start timeout for the case of 802.1X authentication + a cached
PMKSA (not used yet.)
2018-02-13 12:46:27 -06:00
Andrew Zaborowski
0abab92cac scan: Add new Operating Classes from 802.11-2016 2018-02-13 11:59:42 -06:00
Andrew Zaborowski
d42e848567 device: Workaround for 0 oper class in Neighbor Report
Some APs respond to Neighbor Report Requests with neighbor reports that
have a zero operating class value and a non-zero channel number.  This
does not mean that the channel is in the same band that the reporting
AP operates in.  Try to guess the band that the channel refers to out of
2.4 and 5GHz -- the bands supported by those APs.

wpa_supplicant also has this workaround in place.
2018-02-13 11:58:38 -06:00
Marcel Holtmann
c31244ddec build: Add support for installing systemd service unit 2018-02-10 18:42:43 +01:00
James Prestwood
41936468ed netdev: basic support for receiving SA Query requests 2018-02-08 10:34:53 -06:00
Tim Kourt
8c1b175b8b peap: derive and install eap key material 2018-02-02 14:27:05 -06:00
Tim Kourt
c5ec12e0e4 peap: response fragmentation support 2018-02-02 12:58:28 -06:00
Tim Kourt
71ebb7c1d5 peap: send response pkts 2018-02-01 22:09:12 -06:00
Tim Kourt
84be0eb8d3 peap: handle fragmented request 2018-02-01 22:08:13 -06:00
James Prestwood
f3cc96499c netdev: added support for SA Query
SA Query procedure is used when an unprotected disassociate frame
is received (with frame protection enabled). There are two code
paths that can occur when this disassociate frame is received:

1. Send out SA Query and receive a response from the AP within a
   timeout. This means that the disassociate frame was not sent
   from the AP and can be ignored.

2. Send out SA Query and receive no response. In this case it is
   assumed that the AP went down ungracefully and is now back up.
   Since frame protection is enabled, you must re-associate with
   the AP.
2018-02-01 11:33:47 -06:00
Tim Kourt
362771577b peap: introduce basic request-response flow 2018-02-01 10:47:26 -06:00
Tim Kourt
40898deb8b peap: handle Start flag 2018-02-01 10:43:16 -06:00
James Prestwood
ce0d5858da util: added macros to print mac addresses 2018-02-01 10:12:09 -06:00
Marcel Holtmann
64dcf11042 main: Rephrase warning when optional configuration file is missing 2018-01-29 02:25:28 -08:00
Marcel Holtmann
0cf589e13d build: Don't provide iwd/main.conf during make install 2018-01-29 02:20:52 -08:00
Marcel Holtmann
980f6f3645 main: Rename iwd/iwd.conf into iwd/main.conf 2018-01-29 02:13:41 -08:00
Tim Kourt
1d1bbb83eb eap-peap: add version validation 2018-01-24 11:23:50 -06:00
Tim Kourt
ba8857d2f4 eap-peap: configure Protected EAP 2018-01-24 11:22:16 -06:00
Tim Kourt
20e74e8679 eap-peap: Introduce Protected EAP support 2018-01-24 11:19:56 -06:00
Tim Kourt
b33486a7c7 eap: add eap type 25 - peap 2018-01-24 11:19:12 -06:00
Tim Kourt
3230cee2a1 network: add check for autoconnect flag in settings 2018-01-23 14:13:00 -06:00
Tim Kourt
91b6efaf66 eap: add NULL checks
1. Enforce implementation of handle_request function

2. In case of unimplemented handle_retransmit try to use
   handle_request instead and rely on method specific
   mechanism to restart the conversation if necessary

3. Make method->free implementation unrequired
2018-01-23 14:12:24 -06:00
Tim Kourt
4ed442b8b8 eap: add eap type 33 - extensions 2018-01-22 17:12:16 -06:00
Andrew Zaborowski
0ac0c6b129 device: Update Scanning on periodic scan stop
When we call scan_periodic_stop and a periodic scan is in progress (i.e.
the trigger callback has been called already) we get no new callback
from scan.c and the device Scanning property remains True forever so set
it to False.

The change from scan_periodic_stop to periodic_scan_stop looks silly but
it's consistent with our naming :)
2018-01-22 10:35:33 -06:00
Denis Kenzior
0930814aba device: Change #define names to be more descriptive 2018-01-22 10:27:14 -06:00
James Prestwood
38e9a67da8 device: Add support for AP directed roaming
This patch adds a watcher/parser for the frame event associated with
an AP directed BSS transition (AP roaming). When the AP sends a BSS
transition request, this will parse out the BSS candidate list
(neighbor report) and initiate a roam scan. After this point the
existing roaming code path is reused.
2018-01-18 15:32:42 -06:00
Andrew Zaborowski
fb8063f37f netdev: Make sure we send SET_STATION after FT
Make sure that we set the AUTHORIZED sta flag after an FT in
netdev_set_pairwise_key_cb, I broke this in
a03839f8ef.
2018-01-16 11:13:54 -06:00
Andrew Zaborowski
69b852126d device: Remove unnecessary assignment 2018-01-16 11:12:10 -06:00
James Prestwood
f82c2253ce eap-aka/sim: Automatically prefix identities
The identity retrieved from simauth was required to include the
prefix for SIM/AKA/AKA', but in reality a real SIM would not
include that prefix in the IMSI. Now the correct prefix is
prepended onto the identity depending on the EAP method.
2017-12-14 16:23:40 -06:00
James Prestwood
f7a9caef2b simauth: remove unregister API
The unregister simauth API was unused and not required, this
also fixes a double free when freeing the NAI.
2017-12-14 16:22:09 -06:00
James Prestwood
5f3bf1dbac eap-aka: support for synchronization error
If the SQN in AUTN is incorrect the simauth module will return
the AUTS parameter, which is sent back to the server and the
servers SQN number is updated.
2017-12-13 17:13:29 -06:00
James Prestwood
3de239ed9e simutil: removed milenage algorithm from simutil
The simauth module now checks the milenage values
2017-12-13 17:13:29 -06:00
James Prestwood
1fa218fc8d eap-aka: Updated EAP-AKA to use simauth module 2017-12-13 16:16:32 -06:00
James Prestwood
80aa03edd8 eap-sim: Updated EAP-SIM to use simauth module 2017-12-13 16:14:59 -06:00
James Prestwood
a1ceb34bec simauth: fixup to add proper return values
The GSM and Milenage API's should return an integer which
can be used to cancel the request, they were returning bool.
2017-12-13 16:12:24 -06:00
James Prestwood
36804b1b5c simauth: add register/unregister API's
Forcing a plugin to create and register simauth at once is sometimes
inconvenient. This patch separates the creation and registration
into two API's, and also adds several others to add the required simauth
data incrementally (identity, driver data, sim/aka support). This also
allows for the driver to unregister the auth provider without freeing
up the simauth object itself e.g. if the driver temporarily becomes
unavailable, but will come back sometime in the future.

The simauth watch API's were also renamed. Watchers will now get a
callback when the provider has been unregistered, so they have been
renamed to sim_auth_unregistered_watch_[add|remove].
2017-12-11 23:36:43 -06:00
James Prestwood
1a975a1168 simauth: fixup, destroy watchlist was not being removed 2017-11-30 12:44:06 -06:00
Denis Kenzior
777c7c3dae simauth: Fix compiler warning
src/simauth.c:163:6: error: no previous declaration for ‘sim_auth_cancel_request’ [-Werror=missing-declarations]
 void sim_auth_cancel_request(struct iwd_sim_auth *auth, int id)
      ^~~~~~~~~~~~~~~~~~~~~~~
2017-11-30 08:56:10 -06:00
James Prestwood
a595587b65 main: start simauth module 2017-11-30 08:49:49 -06:00
James Prestwood
e030151f7d main: start up plugin module
iwd now supports plugin loading, whitelisting and blacklisting.  Both
the whitelist and the blacklist support multiple patterns separated by a
',' character.
2017-11-28 13:32:36 -06:00
James Prestwood
09de4433ad plugins: module to load ell plugins 2017-11-28 13:30:06 -06:00
James Prestwood
517df48101 make: plugin system for build
Preperation for ell plugins. New plugins can be added to
builtin_sources/builtin_modules, which will be added
to src/builtin.h when it is generated.
2017-11-28 13:20:33 -06:00
Andrew Zaborowski
016dcd52d8 device: Fix an autoconnect corner case
Make sure device->autoconnect is set when entering the autoconnect state
after netdev UP event.  Otherwise the next time
device_set_autoconnect(device, false) is called it will exit early seeing
that device->autoconnect is false and not switch the device state.
2017-11-27 09:56:04 -06:00
James Prestwood
46c1e8fa60 simauth: new module to handle EAP-SIM/AKA auth
This is the core module that takes care of registering
authentication drivers. EAP-SIM/AKA will be able to acquire
a driver that supports the required algorithms. The driver
implementation (hardcoded/ofono etc.) is isolated into
separate plugin modules.
2017-11-22 11:59:13 -06:00
James Prestwood
1d119d58c1 watchlist: added macro for notifying with no args
The macros currently did not support notifying a watchlist with
no extra arguments.
2017-11-16 14:10:47 -06:00
James Prestwood
c0fe2b78c4 eap: new method API for getting EAP-Identity
EAP-SIM/AKA/AKA' retrieve the EAP-Identity off the SIM card
not from the settings file. This adds a new EAP method API
which can optionally be implemented to retrieve the identity.
If get_identity is implemented, the EAP layer will use it to
retrieve the identity rather than looking in the settings file.
2017-11-13 11:09:37 -06:00
Tim Kourt
f4f1450880 network: Start checking outcomes of setting loads 2017-10-31 17:46:28 -05:00
Tim Kourt
e7d1b779e7 storage: provide proper feedback on failures
network_settings_load expects NULL value to be returned
on failed attempts to read the settings files inside of
storage_network_open. At the same time storage_network_open
used to always return an initialized l_settings
structure despite the outcome of the read operations,
indicating a success.
2017-10-31 17:45:47 -05:00
Tim Kourt
adc203184b netdev: fail early on unsuccessful eapol_start 2017-10-30 08:51:59 -05:00
Tim Kourt
3f4b5a98f5 eapol: provide feedback from eapol_start, refactor 2017-10-30 08:51:28 -05:00
Tim Kourt
3b6d7e94f8 dbus: Add NotConfigured dbus exception 2017-10-26 16:00:21 -05:00
Andrew Zaborowski
4dba9e37dd netdev: Track the id of the SET_STATION netlink command
This way we make sure it gets cancelled any sort of connect abort of
netdev removal and don't leak the message on error.
2017-10-23 11:17:11 -05:00
Andrew Zaborowski
a03839f8ef netdev: Send SET STATION in pairwise key callback
When the 4-Way Handshake is done eapol.c calls netdev_set_tk, then
optionally netdev_set_gtk and netdev_set_igtk.  To support the no group
key option send the final SET STATION enabling the controlled port
inside the callback for the netdev_set_tk operation which always means
the end of a 4-Way Handshake rather than in the netdev_set_gtk callback.
The spec says exactly that the controlled port is enabled at the end of
the 4-Way Handshake.

The netlink operations will still be queued in the same order because
the netdev_set_tk/netdev_set_gtk/netdev_set_igtk calls happen in one
main loop iteration but even if the order changed it wouldn't matter.
On failure of any of the three operations netdev_setting_keys_failed
gets called and the remaining operations are cancelled.
2017-10-23 11:17:08 -05:00
Andrew Zaborowski
ffcda135d2 eapol: Check for "No Group Traffic" group cipher suite 2017-10-23 11:14:40 -05:00
Denis Kenzior
2c565019c7 eapol: Silence uninitialized var warnings 2017-10-20 07:41:56 -05:00
Denis Kenzior
7f8f45220e eapol: Do not install the same GTK/IGTK
Track the contents and size of the GTK and IGTK and if the Authenticator
(or an adversary) tries to set the same GTK/IGTK, process the packet
normally but do not resubmit the GTK/IGTK to the kernel.
2017-10-19 16:47:35 -05:00
Denis Kenzior
cd7af67aac eapol: Tighten up GTK/IGTK KDE validation
GTK KDE was being checked for being a minimum of 6 bytes.  Not quite
sure why since the minimum GTK key length is 16 bytes for CCMP.
Similarly make sure that the maximum length is not more than 32, which
is currently the largest key size (TKIP)
2017-10-19 16:47:35 -05:00
Denis Kenzior
c93a52c066 eapol: Handle retransmissions 2017-10-19 16:47:29 -05:00
Denis Kenzior
f07164b2ef eapol: Remove unneeded {} 2017-10-18 20:40:10 -05:00
Denis Kenzior
ac5d8c2b34 eapol: Reword comment 2017-10-18 20:39:31 -05:00
Denis Kenzior
bee04b179e eapol: Fail handshake if MIC calculation fails
This is a bizarre case since MIC calculation succeeded for the incoming
packet.  But just in case MIC calculation fails for the outgoing packet,
kill the handshake.
2017-10-18 20:38:54 -05:00
Denis Kenzior
c1a0e844b0 eapol: Tighten up replay counter handling 2017-10-18 20:31:49 -05:00
Denis Kenzior
5b6c18fadd watchlist: Fix memory leak 2017-10-18 19:29:24 -05:00
James Prestwood
8ce787557f simutil: fixup adding const to data pointer
eap_sim_add_attribute() was not taking a const uint8_t * as
it should.
2017-10-18 11:18:26 -05:00
Denis Kenzior
ffbf10fa31 eapol: Remove erroneous comments
The comments quoted sections of the specification that indicated STA
behavior for verifying Message 3 of 4 or GTK 1 of 2.  But in reality the
code directly below simply calculated the MIC for Message 4 of 4 or GTK
2 of 2.
2017-10-16 14:41:57 -05:00
Andrew Zaborowski
dae0abbac8 eapol: Use frame watches for preauth_sm 2017-10-12 11:14:59 -05:00
Andrew Zaborowski
cc4da26f69 eapol: Use frame watches for eapol_sm, refactor
Use eapol_frame_watch_add/eapol_frame_watch_remove in eapol_sm, while
there simplify the early_frame logic and confirm sender address for
received frames.
2017-10-12 11:13:51 -05:00
Andrew Zaborowski
47ae8571c1 ap: Drop unneeded ap_deauth_cb cleanup step
ap_free_sta() later in ap_deauth_cb already cancels the command.
2017-10-12 10:55:02 -05:00
Andrew Zaborowski
69687bedd1 ap: Implement Deauthentication on error 2017-10-12 10:54:45 -05:00
Andrew Zaborowski
375e2262f2 ap: Implement Reassociation
Add some form of the Reassociation procedure with comment on the
interpretation choice.
2017-10-12 10:54:24 -05:00
Andrew Zaborowski
a26ca0fb66 ap: Simplify ap_common_rates
If we've checked that the STA has included our Basic Rate we've already
found one common rate, no need for further checks.
2017-10-12 10:53:07 -05:00
Andrew Zaborowski
f011b81b19 ap: Implement EAPOL frame retries 2017-10-12 10:52:48 -05:00
Andrew Zaborowski
9d05a6ddb7 ap: Reorder ap_assoc_req_cb, fix comment
Set all the new field values into struct sta_state only after all the
error checks for better readabilty and fixing a possible issue if we
did "sta->rates = rates" and then detected en error and freed "rates".
Also update a comment which I think used the wording from 802.11-2012
instead of 802.11-2016.
2017-10-12 10:47:12 -05:00
Andrew Zaborowski
3d9cbdb6f6 ap: Drop two unneeded DEL_KEY commands
DEL_KEY is not needed and will return errors right after NEW_STATION or
right after DEL_STATION.  In both cases the kernel makes sure there are
no old keys for the station already.
2017-10-12 10:46:17 -05:00
Andrew Zaborowski
3c64d21e34 ap: Use ie_tlv_builder in ap_build_beacon_pr_head 2017-10-12 10:46:14 -05:00
Andrew Zaborowski
ba78950c83 crypto: Use l_pkcs5_pbkdf2 in place of local pbkdf2_sha1 2017-10-09 14:34:31 -05:00
Andrew Zaborowski
31631e1935 device: Add temporary Start / StopAccessPoint Dbus methods
As a temporary DBus API to switch between Station and Access Point
modes, add two methods on the Device interface.  Add a new state
DEVICE_STATE_ACCESS_POINT which is in effect from the moment
StartAccessPoint is received (even before it returns) until
StopAccessPoint returns, there are no intermediate states when the
methods run for simplicity.  Add checks across device.c to make sure
Station related functionality is disabled when in Access Point mode.
2017-09-22 12:50:12 -05:00
Andrew Zaborowski
aca698573f ap: Handle netdev DOWN event 2017-09-22 12:44:41 -05:00
Andrew Zaborowski
251edd2557 ap: Handle PTK handshake frame 4/4
Handle the 4-Way Handshake last frame, install keys, enable data frames
on the controlled port.
2017-09-22 12:44:17 -05:00
Andrew Zaborowski
a3361c5077 ap: Handle PTK handshake frame 2/4, send frame 3/4 2017-09-22 12:43:09 -05:00
Andrew Zaborowski
c505de3582 ap: Send PTK handshake frame 1 of 4 2017-09-22 12:41:41 -05:00
Andrew Zaborowski
89c2f14683 eapol: Add eapol_append_key_data utility
Add a utility to append a KDE to the key_data field in an EAPoL frame.
The KDE types enum is actually added to handshake.h because we've got
the utilities for finding those KDEs in a buffer there.  The new
function is specific to EAPoL-Key frames though and perhaps to simple to
be split across handshake.c and eapol.c.  Also it didn't seem useful to
use the ie_tlv_builder here.
2017-09-22 12:38:42 -05:00
Andrew Zaborowski
29ee350ec3 ap: Handle Association / Disassociation
Parse Association Request frames and send Association Responses, handle
Disassociation.  With this we should be able to receive uncontrolled
port data frames since we register the STAs with the kernel.

In this version I don't register for Reassociation frames.
2017-09-22 12:32:19 -05:00
Andrew Zaborowski
1842fe542b ap: Handle Authentication and Deauthentication frames
Parse authentication frames and send responses, manage a list of STAs.
2017-09-22 12:29:33 -05:00
Andrew Zaborowski
d8378c5a0f ap: Handle Probe Request frames
Parse probe requests and send probe responses to show up in active
scans.
2017-09-22 12:26:06 -05:00
Andrew Zaborowski
45c4e0589b netdev: Use mpdu_validate on received registered frames
This way the individual frame handlers have less validation to do.
2017-09-22 12:19:28 -05:00
Andrew Zaborowski
8db7725e0b netdev: Use util_is_broadcast_address 2017-09-22 12:19:23 -05:00
Andrew Zaborowski
6418a23fd5 mpdu: Refactor Authentication frame validation
Validate the IE order for some of the cases.  For other cases, as with
the Disassociation, Deauthentication and Action frame types in section
9.3 it's not even clear from the spec the fields are expected to be IEs
(in fact for Action frame we know they aren't).  For the Shared Key
authentication type drop the union with the contents as they can be
easier parsed as an IE sequence.  For SAE we are not expecting an IE
sequence apparently so this is where the union could come useful but
let's leave that until we want to support SAE.
2017-09-22 12:18:06 -05:00
Andrew Zaborowski
3f61a88ed5 mpdu: Declare missing Auth Algorithm values 2017-09-22 12:18:03 -05:00
Andrew Zaborowski
736f611974 mpdu: Validate IE order for most frame subtypes
Check the IE order for each frame type where we'd just do the body
minimum length check until now (and not always correctly).  We do not
try to validate the contents of any IEs (may be doable for some) or the
minimum mandatory IEs presence.  This is because which IEs are required
depend on the contents of other fields in the frame, on the
authentication state and STA config and even contents of a request frame
which we're validating the response to.  Frame handlers have to do this
work anyway.
2017-09-22 12:12:06 -05:00
Andrew Zaborowski
58a7032ed9 mpdu: Don't report Action frames as invalid
Declare the two missing frame subtype enum values for Action frames,
assume Action frames are valid.  Once we have specific validation code
for any Action frames elsewhere, we can move it to mpdu_validate, but
right don't try to validate the frame body as there are many subtypes
and we don't use any of them except Neighbor Reports which are actually
really simple.
2017-09-22 12:06:02 -05:00
Andrew Zaborowski
025d8dad44 ie: Allow building an empty IE sequence in ie_tlv_builder_finalize
Since we use the special 0xffff value in the builder code, check that
the tag is not 0xffff in ie_tlv_builder_finalize before writing the
header.  This is for consistency, not for a specific use case.
2017-09-22 11:59:06 -05:00
Andrew Zaborowski
5d8cb6260f ie: Handle Extended Element IDs
Make parsing TLVs using Extended Element IDs easier by returning the
extended tag value as listed in enum ie_type instead of just the 255
value, and not returning the pointer to the extended tag as the IE data
and instead the pointer to the next byte after the extended ID.
2017-09-22 11:55:47 -05:00
Andrew Zaborowski
bc30c94044 ie: Add IE tags new in 802.11-2016
Add new IEs including the Extended Element IDs, for which I make a
convention of using 256 + the actual value to differentiate from old
Element IDs.
2017-09-22 10:10:37 -05:00
Andrew Zaborowski
9ef5f68d4b util: Add address type utils 2017-09-22 10:08:04 -05:00
Andrew Zaborowski
2ebc64db55 ap: Build and send NL80211_CMD_START_AP and STOP_AP
This should be enough for the AP to start sending beacons and appear in
a passive scan.
2017-09-12 14:33:03 -05:00
Andrew Zaborowski
212bc08104 ap: Add AP mode api
Very basic WPA2-PSK only access point mode API with stubs of the start and
stop functions.
2017-09-12 14:29:34 -05:00
Andrew Zaborowski
275cc2789d eapol: Make eapol_find_rsne non-static
EAPoL server can reuse this function.
2017-09-12 14:29:25 -05:00
Andrew Zaborowski
6be08a3604 eapol: Add eapol_tx_frame
Allow other files to send EAPoL frames.
2017-09-07 16:16:45 -05:00
Andrew Zaborowski
f05c3c30d1 eapol: Add eapol_frame_watch_add / remove
Allow other files to receive EAPoL frames on specified interfaces.
2017-09-07 16:16:42 -05:00
Andrew Zaborowski
509324666c netdev: Reorder the registered check in netdev_frame_watch_add
The l_queue_find() to find other watches matching the new prefix
needs to be before the watchlist_link(), otherwise the prefix will
match itself and "registered" is always true.
2017-09-07 16:16:39 -05:00
Andrew Zaborowski
f2c4969fc9 watchlist: Pass item pointer to match function
In WATCHLIST_NOTIFY_MATCHES pass pointer to the item instead of
item->notify_data to free item->notify_data to be the final watch user's
user_data.  This is also what netdev expects.
2017-09-07 16:14:31 -05:00
Andrew Zaborowski
70518fad5f eap: Drop method's .probe, rename .remove
The EAP-method's .probe methods only checked the method name so do that
in eap.c instead and allocate method state in .load_settings.  Rename
method's .remove method to .free to improve the naming.
2017-09-06 14:43:11 -05:00
Denis Kenzior
af124da544 netdev: Simplify frame_watch using watchlist 2017-09-06 14:33:39 -05:00
Denis Kenzior
fa7fab196e watchlist: Add WATCHLIST_NOTIFY_MATCHES
This can be used to selectively notify watchlist items.  The match
function is called for each watchlist_item and match_data is passed
along.  If the match function returns true, then the watch_item is
notified.  The match function signature and semantics are identical
to l_queue_match_func_t.
2017-09-06 14:33:39 -05:00
Andrew Zaborowski
70079912ad netdev: Refactor netdev_register_frame
Rename netdev_register_frame to netdev_frame_watch_add and expose to be
usable outside of netdev.c, add netdev_frame_watch_remove also.  Update
the Neighbor Report handling which was the only user of
netdev_register_frame.

The handler is now simpler because we use a lookup list with all the
prefixes and individual frame handlers only see the frames matching the
right prefix.  This is also useful for the future Access-Point mode.
2017-09-06 14:29:46 -05:00
Denis Kenzior
04506c9afa netdev: Update to the new watchlist API 2017-09-06 14:29:33 -05:00
Denis Kenzior
0fa0d49adc device: Update to the new watchlist API 2017-09-06 14:29:01 -05:00
Denis Kenzior
2071fb7836 watchlist: Support polymorphic watchlist_items 2017-09-06 11:54:45 -05:00
Denis Kenzior
4a9d8278b4 util: Add container_of macro 2017-09-06 11:50:15 -05:00
Denis Kenzior
023ba1ea32 mpdu: Fix error
src/mpdu.c: In function ‘mpdu_validate’:
src/mpdu.c:180:9: error: ‘mmpdu’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
   mmpdu = (const struct mmpdu_header *) mmpdu;
         ^
2017-08-31 18:23:47 -05:00
Denis Kenzior
ba54fded0b netdev: Simplify event watches using watchlist 2017-08-31 18:18:41 -05:00
Andrew Zaborowski
303683c89f mpdu: Refactor mpdu structs
Refactor management frame structures to take into account optional
presence of some parts of the header:
 * drop the single structure for management header and body since
   the body offset is variable.
 * add mmpdu_get_body to locate the start of frame body.
 * drop the union of different management frame type bodies.
 * prefix names specific to management frames with "mmpdu" instead
   of "mpdu" including any enums based on 802.11-2012 section 8.4.
 * move the FC field to the mmpdu_header structure.
2017-08-31 15:11:30 -05:00
Andrew Zaborowski
66325e8c9b eapol: Implement eapol_encrypt_key_data
Add a function to do the inverse of eapol_decrypt_key_data to be used in
eapol server.  Only AES-based versions supported.
2017-08-31 13:21:05 -05:00
Denis Kenzior
6d6fa57550 crypto: Make aes_unwrap look similar to aes_wrap
Running basic performance testing on x86 shows new and old code within a
few percent of each other.  The main penalty is the AES AF_ALG
invocation.
2017-08-31 13:00:46 -05:00
Andrew Zaborowski
4f865ba9f8 crypto: Implement aes_wrap
Add the inverse of aes_unwrap for eapol server usage.
2017-08-31 12:53:53 -05:00
Andrew Zaborowski
f66ae1e481 crypto: remove unneeded assignments in aes_unwrap
A is present in the specification but in practice B always contains A so
drop A.
2017-08-30 22:47:08 -05:00
Andrew Zaborowski
f659265000 netdev: Clarify the PTK->TK to MIC key mapping
Cite 802.11 in the comments and use nl80211.h constants to map the tx
and rx keys correctly.
2017-08-30 22:45:28 -05:00
Andrew Zaborowski
092ede1147 eapol: Stricter length check in eapol_decrypt_key_data
The plaintext key_data + padding must be at least 16 bytes so the
AES-encrypted key_data must be at least 24 bytes.
2017-08-30 22:42:20 -05:00
James Prestwood
1c34452a7b eap-aka: RAND and AUTN were not being checked
When processing the challenge, the AT_RAND and AT_AUTN attributes
were never being checked if they were present.
2017-08-30 21:01:35 -05:00
James Prestwood
5d98c7adcf aka-prime: EAP-AKA' implementation
This EAP method uses nearly all the logic from EAP-AKA. The major
difference is it uses the new key derivation functions for AKA' as
well as the SHA256 MAC calculation.
2017-08-30 21:01:22 -05:00
James Prestwood
e29d0dd69c simutil: updated EAP-SIM/AKA MAC API's to take type
EAP-AKA' uses SHA256 rather than SHA1 to generate the packet MAC's.
This updates the derive MAC API to take the EAP method type and
correctly use the right SHA variant to derive the MAC.
2017-08-30 17:31:39 -05:00
Denis Kenzior
44463389f1 wscutil: Fix invalid type conversion
We should be assigning to an enum type instead of a uint8.  This showed
up on PowerPC where the endianness affected the result.
2017-08-30 16:58:14 -05:00
James Prestwood
af0e432e0f eap: added EAP-AKA' method type 2017-08-30 16:43:38 -05:00
James Prestwood
c6bb0eb32d simutil: Added new key/prf functions for EAP-AKA'
This is the core key generation code for the AKA' method which
follows RFC 5448. Two new functions are implemented, one for
deriving CK'/IK' and the other for deriving the encryption keys
using CK'/IK'.
2017-08-30 16:39:10 -05:00
Andrew Zaborowski
eda160de12 eapol: Set a timeout for preauthentication
Wait 1 second for the first EAP frame to be received, after that wait up
to 3 seconds for all of EAP to complete.
2017-08-25 11:26:26 -05:00
Andrew Zaborowski
07b04e180f agent: Add a destroy function parameter for agent requests 2017-08-22 23:28:36 -05:00
Andrew Zaborowski
452e174802 netdev: RSSI polling support for less capable drivers
If the kernel device driver or the kernel nl80211 version doesn't
support the new RSSI threshold list CQM monitoring, implement similar
logic in iwd with periodic polling.  This is only active when an RSSI
agent is registered to receive the events.  I tested this with the same
testRSSIAgent autotests that tests the driver-side rssi monitoring
except with all timeouts multiplied by ~20.
2017-08-22 22:51:34 -05:00
James Prestwood
417367e272 eap-sim: Fix EAP-SIM version list length checks
The AT_VERSION_LIST attribute length was not being properly
checked. The actual length check did not include possible padding
bytes, so align_len() was added to ensure it was padded properly.
The comment about the padding being included in the Master Key
generation was not correct (padding is NOT included), and was removed.
2017-08-22 12:40:22 -05:00
Andrew Zaborowski
23af935e7b eapol: Add eapol_sm_set_require_handshake
Function to allow netdev.c to explicitly tell eapol.c whether to expect
EAP / 4-Way handshake.  This is to potentially make the code more
descriptive, until now we'd look at sm->handshake->ptk_complete to see
if a new PTK was needed.

A 4-Way handshake is required on  association to an AP except after FT.
2017-08-21 18:35:00 -05:00
James Prestwood
6aaa917dde aka: EAP-AKA protocol implementation 2017-08-21 18:20:10 -05:00
James Prestwood
283717b22f sim: EAP-SIM protocol implementation 2017-08-21 17:43:55 -05:00
Andrew Zaborowski
a9cbb95260 netdev: Add interface type setter and getter
Modify netdev_get_iftype, which was until now unused, and add
netdev_set_iftype.  Don't skip interfaces with types other than STATION
on startup, instead reset the type to STATION in device.c.

netdev_get_iftype is modified to use our own interface type enum to
avoid forcing users to include "nl80211.h".

Note that setting an interface UP and DOWN wouldn't generally reset the
iftype to STATION.  Another process may still change the type while iwd
is running and iwd would not detect this as it would detect another
interface setting interface DOWN, not sure how far we want to go in
monitoring all of the properties this way.
2017-08-15 15:01:33 -05:00
Andrew Zaborowski
b344d27c56 ie: Fix Supported Rates length check
Supported Rates IEs can be 1-8 bytes, not only 8 byte long, according to
802.11-2012 8.4.2.3.
2017-08-15 13:57:27 -05:00
Andrew Zaborowski
0cd18a0214 device: Set current BSS rank to 0 if not in scan results
If we're adding the BSS to the list only because it is the current BSS,
set the rank to 0 (lowest possible value) in case the list gets used in
the next Connect call.
2017-08-15 12:41:46 -05:00
Andrew Zaborowski
6e03933e62 netdev: Allow reassociation if not currently connected
Allow attempts to connect to a new AP using the Reassociation frame even
if netdev->operational is false.  This is needed if we want to continue
an ongoing roam attempt after the original connection broke and will be
needed when we start using cached PMKSAs in the future.
2017-08-15 12:39:35 -05:00
Andrew Zaborowski
a4edbbd429 device: Trigger roaming on beacon loss
Use beacon loss event to trigger a roam attempt in addition to the RSSI
monitoring.  Due to the how well beacons are normally received compared
to data packets, a beacon loss indicates a serious problem with the
connection so act as soon as a first beacon loss event is seen.

Avoid roaming methods that involve the current AP: preauthentication,
neighbor report request and FT-over-the-DS (not supported)
2017-08-15 11:53:15 -05:00
Andrew Zaborowski
cb9c6e8ade netdev: Handle CMD_DISCONNECT without "by AP" flag
There are situations including after beacon loss and during FT where the
cfg80211 will detect we're now disconnected (in some cases will send a
Deauthenticate frame too) and generate this event, or the driver may do
this.  For example in ieee80211_report_disconnect in net/mac80211/mlme.c
will (through cfg80211) generate a CMD_DEAUTHENTICATE followed by a
CMD_DISCONNECT.
2017-08-14 16:32:35 -05:00
Andrew Zaborowski
5c4313bcc2 netdev: Don't assume disconnect on beacon loss
The kernel doesn't reset the netdev's state to disconnected when it
sends us a beacon loss event so we can't either unless we automatically
send a disconnect command to the kernel.

It seems the handling of beacon loss depends on the driver.  For example
in mac80211 only after N beacon loss events (default 7) a probe request is
sent to the AP and a deauthenticate packet is sent if no probe reply is
receiver within T (default 500ms).
2017-08-14 16:32:35 -05:00
Marcel Holtmann
df911c0cf6 agent: Simplify loop exit handling 2017-07-18 08:37:21 +02:00
Tim Kourt
653019c263 agent: Fix uninitialized member usage 2017-07-18 08:36:06 +02:00
Tim Kourt
31d60b5cf2 agent: Fix formatting 2017-06-09 14:05:30 -05:00
Tim Kourt
7bd22770ed agent: Enable multi-agent support
If an application initiates the Connect() operation and
that application has an agent registered, then that
application's agent will be called. Otherwise, the default
agent is called.
2017-06-09 14:05:30 -05:00
Denis Kenzior
ff319b8234 crypto: Fix valgrind warning
==40686== Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s)
==40686==    at 0x5147037: sendmsg (in /usr/lib64/libc-2.24.so)
==40686==    by 0x43957C: operate_cipher (cipher.c:354)
==40686==    by 0x439C18: l_cipher_decrypt (cipher.c:415)
==40686==    by 0x40FAB8: arc4_skip (crypto.c:181)

Initialize the skip buffer to 0s.  This isn't strictly necessary, but
hides the above valgrind warning.

The aim of arc4 skip is simply to seed some data into the RC4 cipher so
it makes it harder for the attacker to decrypt.  This 'initialization'
doesn't really care what data is fed.
2017-06-06 13:33:08 -05:00
Denis Kenzior
7e2e965eb7 crypto: Optimize arc4_skip 2017-06-06 13:32:14 -05:00
Denis Kenzior
21fffe2629 netdev: Use CMD_DISCONNECT for non-FT cases
CMD_DEAUTHENTICATE is not available for FullMAC based cards.  We already
use CMD_CONNECT in the non-FT cases, which works on all cards.  However,
for some reason we kept using CMD_DEAUTHENTICATE instead of CMD_DISCONNECT.

For FT (error) cases, keep using CMD_DEAUTHENTICATE.
2017-05-31 11:08:40 -05:00
Andrew Zaborowski
0416749710 eap: Move eap->method NULL check before first dereference
Move the eap->method NULL check to fix possible crash.
2017-05-30 17:10:31 -05:00
Andrew Zaborowski
e3c6d2e169 netdev: Use NL80211_ATTR_SOCKET_OWNER flag
Use the new NL80211_ATTR_SOCKET_OWNER with CMD_CONNECT and
CMD_ASSOCIATE to make sure an iwd crash results in deauthentication.
2017-05-30 17:09:09 -05:00
Denis Kenzior
f5decb274d netdev: Ignore CMD_SET_STATION errors
Certain WiFi drivers do not support using CMD_SET_STATION (e.g.
mwifiex).  It is not completely clear how such drivers handle the
AUTHORIZED state, but they don't seem to take it into account.  So for
such drivers, ignore the -ENOTSUPP error return from CMD_SET_STATION.
2017-05-30 17:04:26 -05:00
Andrew Zaborowski
55ecda31f3 netdev: On connect success don't wait for netdev_operstate_cb
Send the link_mode and operstate RTNL command in parallel with the
connect Ok event, don't wait for the RTNL callback as it's non-critical.
2017-05-30 17:04:19 -05:00
Andrew Zaborowski
4d20db05d7 netdev: Rework link_mode and operstate setting
These flags are documented in RFC2863 and kernel's
Documentation/networking/operstates.txt.  Operstate doesn't have any
siginificant effect on normal connectivity or on our autotests because
it is not used by the kernel except in some rare cases but it is
supposed to affect some userspace daemons that watch for RTM_NEWLINK
events, so I believe we *should* set them according to this
documentation.  Changes:

* There's no point setting link_mode or operstate of the netdev when
  we're bringing the admin state DOWN as that overrides operstate.

* Instead of numerical values for link_mode use the if.h defines.

* Set IF_OPER_UP when association succeeds also in the Fast Transition
  case.  The driver will have set carrier off and then on so the
  operstate should be IF_OPER_DORMANT at this point and needs to be
  reset to UP.
2017-05-30 17:04:13 -05:00
Denis Kenzior
c68200b5a1 device: Add extra sanity check to UnregisterAgent
We have to make sure that the path the application passes to
UnregisterAgent is the same as the one passed to RegisterAgent
2017-05-30 11:40:09 -05:00
Denis Kenzior
f38287f457 device: Don't check count upper limit twice
We already check it once in the for loop above
2017-05-30 11:40:09 -05:00
Andrew Zaborowski
570b483264 device: Add a SignalLevelAgent D-bus API
Allow registering and unregistering agent object to receive RSSI level
notifications.  The methods are similar to the ones related to the
password agent, including a Release method for the agent.
2017-05-30 11:32:51 -05:00
Denis Kenzior
3741c5aa6e netdev: Fix off-by-one error
rssi_levels_num should be able to hold a value of
L_ARRAY_SIZE(rssi_levels) (which is 16).  However, the maximum value is
15.
2017-05-30 11:32:51 -05:00
Andrew Zaborowski
faa8dce6da netdev: Implement RSSI level notifications API
Add an methods and an event using the new
NL80211_EXT_FEATURE_CQM_RSSI_LIST kernel feature to request RSSI
monitoring with notifications only when RSSI moves from one of the N
intervals requested to another.

device.c will call netdev_set_rssi_report_levels to request
NETDEV_EVENT_RSSI_LEVEL_NOTIFY events every time the RSSI level changes,
level meaning one of the intervals delimited by the threshold values
passed as argument.  Inside the event handler it can call
netdev_get_rssi_level to read the new level.

There's no fallback to periodic polling implemented in this patch for
the case of older kernels and/or the driver not supporting
NL80211_EXT_FEATURE_CQM_RSSI_LIST.
2017-05-30 11:28:33 -05:00
Andrew Zaborowski
fd4ab5d3df wiphy: Add wiphy_get_ext_feature
Save the extended features reported by the wiphy in the NEW_WIPHY event
or GET_WIPHY dump and allow netdev to query it with
wiphy_get_ext_feature()
2017-05-19 10:01:53 -05:00
Denis Kenzior
b59977262b handshake: Fix valgrind warning
==27901== Conditional jump or move depends on uninitialised value(s)
==27901==    at 0x41157A: handshake_util_find_pmkid_kde
(handshake.c:537)
==27901==    by 0x40E03A: eapol_handle_ptk_1_of_4 (eapol.c:852)
==27901==    by 0x40F3CD: eapol_key_handle (eapol.c:1417)
==27901==    by 0x40F955: eapol_rx_packet (eapol.c:1607)
==27901==    by 0x410321: __eapol_rx_packet (eapol.c:1915)
2017-05-15 15:23:03 -05:00
Denis Kenzior
b36dd5203e network: Sort out reference counting
Agent implementation inside agent.c takes a reference of the trigger
message associated with the request.  When the callback is called, the
message is passed as an argument.  The callback is responsible for
taking the message reference if necessary.  Once the callback returns,
agent releases its reference.

For error paths, our code was using dbus_pending_reply which in turn
uses dbus_message_unref.  This caused the agent to try an unref
operation on an already freed object.
2017-05-11 19:50:05 -05:00
Andrew Zaborowski
fb4ba71952 main: Don't init nl80211 if we're terminating
Don't enter nl80211_appeared if we're already terminating and inside the
1 second timeout.  This fixes a potential crash in device_free() caused
by a netdev_init() and a netdev_exit() happening without netdev_shutdown
in between.  netdev_shutdown has already run if terminating is true.

src/main.c:main() Opening nl80211 interface
src/eap.c:__eap_method_enable()
src/eap-wsc.c:eap_wsc_init()
src/eap-md5.c:eap_md5_init()
src/eap-tls.c:eap_tls_init()
src/eap-ttls.c:eap_ttls_init()
src/eap-mschapv2.c:eap_mschapv2_init()
Terminate
src/main.c:nl80211_appeared() Found nl80211 interface
src/netdev.c:netdev_init() Opening route netlink socket
src/wiphy.c:protocol_features_callback() Found split wiphy dump support
src/wiphy.c:regulatory_info_callback() Regulatory alpha2 is 00
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:parse_supported_bands()
src/wiphy.c:parse_supported_frequencies()
src/wiphy.c:parse_supported_frequencies()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad1
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
src/wiphy.c:wiphy_dump_callback()
src/wiphy.c:wiphy_is_managed() whitelist filtered phy: rad0
Wiphy: 2, Name: rad2
Bands: 2.4 GHz 5 GHz
Ciphers: CCMP TKIP BIP
src/netdev.c:netdev_create_from_genl() Created interface wln2[6]
src/netdev.c:netdev_initial_up_cb() Interface 6 initialized
src/device.c:device_enter_state() Old State: off, new state:
autoconnect
src/scan.c:scan_periodic_start() Starting periodic scan for
ifindex: 6
src/scan.c:scan_notify() Scan notification 33
src/netdev.c:netdev_operstate_dormant_cb() netdev: 6, success: 1
src/scan.c:scan_periodic_done()
src/scan.c:scan_periodic_done() Periodic scan triggered for
ifindex: 6
src/eap.c:__eap_method_disable()
src/eap-wsc.c:eap_wsc_exit()
src/eap-md5.c:eap_md5_exit()
src/eap-tls.c:eap_tls_exit()
src/eap-ttls.c:eap_ttls_exit()
src/eap-mschapv2.c:eap_mschapv2_exit()
src/main.c:nl80211_vanished() Lost nl80211 interface
src/wsc.c:wsc_exit()
src/scan.c:scan_exit()
src/scan.c:scan_context_free() sc: 0x5434ab0
src/netdev.c:netdev_exit() Closing route netlink socket
src/wiphy.c:wiphy_free() Freeing wiphy rad2[2]
device_list isn't empty!
src/device.c:device_free()
(crash here)
2017-05-04 10:50:33 -05:00
Andrew Zaborowski
33f8b1f53d dbus: Use the shutdown procedure instead of l_main_quit
Move the calling of the *_shutdown functions from the signal handler to
a new public function, and use that function inside the DBus disconnect
handler to make sure resources are cleanly released.
2017-05-04 10:50:29 -05:00
Andrew Zaborowski
faba9d509a eapol: After EAP skip the RSNE PMKID check in step 1/4
Skip the matching of the PMKID KDE to the PMKID list in the RSNE if
we've seen a new EAP authentication before the step 1/4 was received.
That would mean that the server had not accepted the PMKIDs we submitted
and we performed a new 8021X authentication, producing a new PMKSA which
won't be on the list in the RSNE.
2017-05-04 10:50:29 -05:00
Andrew Zaborowski
a620a02d35 device: In roam, preauthenticate to target BSS if supported
If FT is not possible and we're using 8021x try to preauthenticate to
target BSS before reassociation to it.
2017-05-01 11:24:04 -05:00
Andrew Zaborowski
08e863cb7e netdev: Add netdev_preauthenticate
Add preauthentication logic.  The callback receives the new PMK only.
2017-05-01 11:19:06 -05:00
Andrew Zaborowski
b910784e83 eapol: Add preauth_sm class, drop eapol_sm.preauth
Remove the preauthentication support code from the normal eapol_sm
methods and add a separate simplified class that only handles EAP
packets.
2017-05-01 11:13:32 -05:00
Andrew Zaborowski
48966f57e8 eapol: Only send EAPOL-Start on step 1/4 if really needed
Currently we'd send EAPOL-Start whenever EAP was configured and we
received an EAPOL-Key before EAP negotiation.  Instead only do that if
we know we can't respond to the 4-Way handshake because we don't have
a PMK yet or the PMKID doesn't match.  Require a PMKID in step 1/4 if
we'd sent a list of PMKIDs in our RSNE.
2017-04-21 14:16:25 -05:00
Tim Kourt
19e7ce2f30 eap: Fix whitespace 2017-04-18 17:44:25 -05:00
Andrew Zaborowski
c0ae9e3577 eapol: Receive frames with the Preauthentication ethertype
Modify the packet filter to also accept frames with ethertype of 0x88c7
and pass the ethertype value to __eapol_rx_packet so it can filter out
the frames where this value doesn't match the sm->preauth flag.
2017-04-18 11:42:45 -05:00
Andrew Zaborowski
0a4bd616c2 eapol: Use the Preauthentication ethertype in eapol_write
Select the right ether type for the eapol frame in eapol_write and pass
it to pae_write.
2017-04-18 11:41:24 -05:00
Andrew Zaborowski
4e9ed2d686 eapol: Add eapol_start_preauthentication
Add a wrapper for eapol_start that sets the sm->preauth flag and sends
the EAPOL-Start frame immediately to skip the timeout since we know
that the supplicant has to initiate the authentication.
2017-04-18 11:09:26 -05:00