3
0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-25 08:02:38 +01:00
Commit Graph

2975 Commits

Author SHA1 Message Date
Andrew Zaborowski
c51e187462 ap: Use frame-xchg when sending frames
Convert ap_send_mgmt_frame() to use frame_xchg_start for sending frames,
this fixes among other things the ACK-received checks.

One side effect is that we're no longer sending Probe Responses with the
don't-wait-for-ack flag because frame-xchg doesn't support it, but other
AP implementations don't use that flag either.

Another side-effect is that we do use the no-cck-rate flag
unconditionally, something we may want to fix but would need to add
another parameter to frame-xchg.
2020-09-21 22:13:38 -05:00
Andrew Zaborowski
311e91b944 p2p: Free response frame payloads 2020-09-21 22:13:32 -05:00
Andrew Zaborowski
c58b91dfd4 p2p: Free parsed frame data in p2p_go_negotiation_confirm_cb 2020-09-21 22:13:24 -05:00
Andrew Zaborowski
47596c67d3 p2p: Free peer->wfd in p2p_peer_free 2020-09-21 22:13:21 -05:00
Andrew Zaborowski
ee4e1368d2 p2p: Try IP allocation during 4-Way handshake on client 2020-09-16 17:25:44 -05:00
Andrew Zaborowski
68cb9d38bf p2p: Start a basic P2P Group after GO Negotiation
Use the ap.c API to start an AP on a P2P_GO interface after we've been
selected as the GO in the GO Negotiation.
2020-09-16 17:25:44 -05:00
Andrew Zaborowski
185b676f31 ap: Rename wpa2_psk to wpa2_passphrase on DBus
Use the passphrase naming instead of PSK.
2020-09-16 17:25:44 -05:00
Andrew Zaborowski
fbe7e0bd36 ap: Support working without passphrase
Add a "psk" setting to allow the user to pass the binary PSK directly
instead of generating it from the passphrase and the SSID.  In that case
we'll only send the PSK to WSC enrollees.
2020-09-16 17:25:44 -05:00
Andrew Zaborowski
1f68696578 ap: Pass "ops" struct to ap_start()
Pass the event callback function pointer in a "struct ap_ops" instead of
as individual ap_start() argument to make adding new callbacks easier.
2020-09-16 17:25:34 -05:00
Andrew Zaborowski
8e9a2fe05d treewide: Use l_settings_{set,get}_bytes 2020-09-16 16:46:02 -05:00
James Prestwood
18531a524f plugin: remove plugin source 2020-09-16 14:31:21 -05:00
James Prestwood
83a9de58c2 ofono: convert to module 2020-09-16 14:31:07 -05:00
James Prestwood
bbcfde8743 plugins: remove dependency on ELL plugins
There has been a desire to remove the ELL plugin dependency from
IWD which is the only consumer of the plugin API. This removes
the dependency and prepares the tree for converting the existing
ofono plugin into a regular module.

sim_hardcoded was removed completely. This was originall implemented
before full ofono support purely to test the IWD side of EAP-SIM/AKA.
Since the ofono plugin (module-to-be) is now fully implemented there
really isn't a need for sim_hardcoded.
2020-09-16 14:30:14 -05:00
James Prestwood
2a8d7d4835 adhoc: delay setting Started
The Started property was being set in the Join IBSS callback which
isn't really when the IBSS has been started. The kernel automatically
scans for IBSS networks which takes some time. Its better to wait
on setting Started until we get the Join IBSS event.
2020-09-14 16:44:53 -05:00
James Prestwood
e8888fab2e adhoc: print handshake failure reason 2020-09-14 16:26:41 -05:00
James Prestwood
cd90097ce1 adhoc: start both eapol SM's
Commit 1f910f84b4 ("eapol: Use eapol_start in authenticator mode too")
introduced the requirement that authentication eapol_sm objects also had
to be started via eapol_start.  Adhoc was never updated to do that.
2020-09-14 16:25:03 -05:00
James Prestwood
ffe9ce8034 station: print which BSS is being connected to
For multi-bss networks its nice to know which BSS is being connected
to. The ranking can hint at it, but blacklisting or network capabilities
could effect which network is actually chosen. An explicit debug print
makes debugging much easier.
2020-09-14 16:03:04 -05:00
Andrew Zaborowski
e1393501e7 netconfig: Don't bswap IP netmasks for __builtin_popcountl
The __builtin_popcountl() value shouldn't change with the endianness.
2020-09-14 11:45:18 -05:00
Andrew Zaborowski
159afd7f18 eapol: IP Allocation KDE support authenticator side
Again the hs->support_ip_allocation flag is used for two purposes here,
first the user signals whether to support this mechanism through this
flag, then it reads the flag to find out if an IP was allocated.
2020-09-14 11:45:15 -05:00
Andrew Zaborowski
ddf111d2c4 eapol: IP Allocation KDE support
Support IP allocation during the 4-Way Handshake as defined in the P2P
spec.  This is the supplicant side implementation.

The API requires the user to set hs->support_ip_allocation true before
eapol_start().  On HANDSHAKE_EVENT_COMPLETE, if this same flag is still
set, we've received the IP lease, the netmask and the authenticator's
IP from the authenticator and there's no need to start DHCP.  If the
flag is cleared, the user needs to use DHCP.
2020-09-14 11:45:12 -05:00
Andrew Zaborowski
4fa4cc5867 p2p: Add GO-side of GO Negotiation (responder)
Allow the possibility of becoming the Group-owner when we parse the GO
Negotiation Request, build GO Negotiation Response and parse the GO
Negotiation Confirmation, i.e. if we're responding to a negotiation
initiated by the peer after it needed to request user action.

Until now the code assumed we can't become the GO or we'd report error.
2020-09-14 11:39:25 -05:00
Andrew Zaborowski
52810ba445 p2p: Add GO-side of GO Negotiation (initiator)
Allow the possibility of becoming the Group-owner when we build the GO
Negotiation Request, parse GO Negotiation Response and build the GO
Negotiation Confirmation, i.e. if we're the initiator of the
negotiation.

Until now the code assumed we can't become the GO or we'd report error.
2020-09-14 11:39:25 -05:00
Andrew Zaborowski
116b36e943 p2putil: Add p2p_get_random_string
Add a utility to select random characters from the set defined in P2P
v1.7 Section 3.2.1.  In this version the assumption is that we're only
actually using this for the two SSID characters.
2020-09-14 11:39:25 -05:00
Andrew Zaborowski
fbb0776716 ap: Fix setting the basic rate in Supported Rates IE 2020-09-14 11:39:25 -05:00
Andrew Zaborowski
1eb2735239 ap: Fix NULL ap->rates
Make sure ap->rates is non-NULL both with and without no_cck_rates.
2020-09-14 11:39:20 -05:00
Fabrice Fontaine
0a6de7932a ap: fix build with uclibc
explicit_bzero is used in src/ap.c since commit
d55e00b31d but src/missing.h is not
included, as a result build with uclibc fails on:

/srv/storage/autobuild/run/instance-1/output-1/host/lib/gcc/xtensa-buildroot-linux-uclibc/9.3.0/../../../../xtensa-buildroot-linux-uclibc/bin/ld: src/ap.o: in function `ap_probe_req_cb':
ap.c:(.text+0x23d8): undefined reference to `explicit_bzero'

Fixes:
 - http://autobuild.buildroot.org/results/c7a0096a269bfc52bd8e23d453d36d5bfb61441d
2020-09-11 13:42:58 -05:00
Andrew Zaborowski
c7b072ff21 ap: Accept P2P wildcard SSIDs in probe requests
Add the special case "DIRECT-" SSID, called the P2P Wildcard SSID, in
ap_probe_req_cb so as not to reject those Probe Requests on the basis of
ssid mismatch.  I'd have preferred to keep all the P2P-specific bits in
p2p.c but in this case there's little point in adding a generic
config setting for SSID-matching quirks.
2020-09-09 14:52:44 -05:00
Andrew Zaborowski
0d2d34c353 p2p: Consistently use the conn_ prefix for variables
Prefix all the struct p2p_device members that are part of the connection
state with the "conn_" string for consistency.  If we needed to support
multiple client connections, these members are the ones that would
probably land in a separate structure, without that prefix.
2020-09-09 13:05:36 -05:00
Andrew Zaborowski
d511b4b782 p2p: Free parsed frame data in p2p_go_negotiation_resp_cb 2020-09-09 13:05:07 -05:00
Andrew Zaborowski
6bba989913 p2p: Use WSC_RF_BAND_2_4_GHZ constant instead of 0x01 2020-09-09 13:05:01 -05:00
Andrew Zaborowski
0fc97d2674 p2p: Move p2p_device_discovery_stop calls to connect_failed
Move a few the calls to p2p_device_discovery_stop() done right after
p2p_connect_failed() directly to that function to reduce duplication.
2020-09-09 13:04:22 -05:00
Andrew Zaborowski
0fad5fef71 p2p: Do provisioning scan from the Interface Address
For WSC we should have been sending our probe requests from the same
address we're going to be doing EAP-WSC with the GO.  Somehow I was able
to connect to most devices without that but other implementations seem
to use the Interface Address (the P2P-Client's MAC), not the Device
Address (P2P-Device's MAC).  We could switch the order to first create
the new interface and scan from it is simpler to use the scan_context we
already have created on the device interface and set a different mac.
2020-09-09 13:04:18 -05:00
Andrew Zaborowski
9335680cd8 scan: Add optional source_mac scan parameter
This is similar to randomize_mac_addr_hint but it sets a specific source
MAC address for our probe frames.
2020-09-09 13:02:02 -05:00
Andrew Zaborowski
4bc20a0979 ap: Start EAP-WSC authentication with WSC enrollees
After association and sending the SET_STATION commands, set up the
handshake_state and eapol_sm for EAP-WSC and start the handshake.
2020-08-28 10:50:59 -05:00
Andrew Zaborowski
7a7c580ffc ap: Parse WSC PBC association request and build response
Check the conditions for PBC enrollee registration when we receive the
Association Request with WSC IE and indicate to the enrollee whether we
accept the association using a WSC IE in the Association Response.
After this, a NULL sta->assoc_rsne indicates that the station is not
establishing the RSNA and is a WSC enrollee.
2020-08-28 10:49:16 -05:00
Andrew Zaborowski
99112c9317 ap: WSC Probe Request processing logic
Implement the caching of WSC probe requests -- when an Enrollee later
associates to start registration we need to have its Probe Request on
file.  Also use this cache for PBC "Session Overlap" detection.
2020-08-28 10:35:58 -05:00
Andrew Zaborowski
43c101ab14 ap: Push Button mode API and beacon changes
This adds the API for putting the AP in Push Button mode, which we'll
need to P2P GO side but may be useful on its own too.  A WSC IE is added
to our beacons and probe responses indicating whether the PBC mode is
active.
2020-08-28 10:32:58 -05:00
Andrew Zaborowski
1f89311798 ap: Stop ongoing handshake on reassociation
On a new association or re-association, in addition to forgetting a
complete RSN Association, also stop the EAPoL SM to stop any ongoing
handshake.

Do this in a new function ap_stop_handshake that is now used in a few
places that had copies of the same few lines.  I'll be adding some more
lines to this function for WSC support.
2020-08-28 10:32:01 -05:00
Andrew Zaborowski
2231179b97 eapol: Handle the use_eapol_start flag on authenticator
Reuse this flag on the authenticator side with a slightly different
meaning: when it's true we're forced to wait for the EAPoL-Start before
sending the first EAPoL-EAP frame to the supplicant, such as is required
in a WSC enrollee registration when the Association Request didn't have
a v2.0 WSC IE.
2020-08-28 10:29:36 -05:00
Andrew Zaborowski
66e9d4fca9 wscutil: Add wsc_build_beacon
For consistency also update wsc_build_probe_response to use the same
__builtin_popcount based rf_bands check.
2020-08-28 10:29:06 -05:00
Andrew Zaborowski
8c1bf5385e wscutil: Use a utility for building authorized_macs
Add the wfa_build_authorized_macs function (wfa_ prefix following the
wfa_extract_ naming) and use it in wsc_build_probe_response.  The logic
is changed slightly to treat the first 6-zeros address in the array as
the end of the array.
2020-08-28 10:28:15 -05:00
Andrew Zaborowski
1449b8fbc4 ap: Fix incoming Probe Request BSSID check
Setting 'match' false wouldn't do anything because it was already false.
If the frame is addressed to some other non-broadcast address ignore it
directly and exit ap_probe_req_cb.
2020-08-27 14:04:02 -05:00
Andrew Zaborowski
137309c998 ap: Drop unused variable 2020-08-27 14:02:03 -05:00
Andrew Zaborowski
d55e00b31d ap: Move AP parameters to a struct
To limit the number of ap_start parameters, group basic AP config
parameters in the ap_config struct that is passed as a pointer and owned
by the ap_state.
2020-08-27 14:00:28 -05:00
Andrew Zaborowski
7713e00992 eap-wsc: In WSC-R read UUID-E from settings
The intent was to read the UUID-E from the settings rather than generate
it from the enrollee's MAC because it needs to match the UUID-E from
enrolee's Probe Requests, fix this.  The UUID-E supplied in the unit
test was being ignored but the test still passed because the supplied
UUID-E was generated the same way we generated it in eap-wsc.c.
2020-08-27 13:53:46 -05:00
Andrew Zaborowski
e4b1d4202f eap: Re-send Identity Request on EAPoL-Start
It looks like clients sometimes miss our unsolicited Identity Request
and need a resend.
2020-08-27 13:53:12 -05:00
Andrew Zaborowski
a4fa91a695 p2p: Build our Probe Response using connection data
When we're sending our probe response to the same peer that we're
currently connected or connecting to, use current WSC Configuration
Methods, UUID-E and WFD IE selected for this connection attempt, not the
ones we'd use when discovering peers or being discovered by peers.
In the case of the WFD IE, the "Available for WFD Session" flag is going
to differ between the two cases -- we may be unavailable for other peers
but we're still available for the peer we're trying to start the WFD
session with.
2020-08-25 16:52:41 -05:00
Andrew Zaborowski
619a5ed43b p2p: Fix the WSC Config Methods in GO Negotiation Response
When we send our GO Negotiation Response, send the Configuration Method
selected for the current connection rather than the accepted methods mask
that we hold in dev->device_info.
2020-08-25 16:52:29 -05:00
Andrew Zaborowski
19ab25f1d6 p2p: Send the right UUID-E in probe request WSC IEs
When building the scan IEs for our provisioning scans, use the UUID-E
based on the Interface Address, not the Device Address, as that is what
wsc.c will be using to in the registration protocol.

Eventually we may have to base the UUID-E on the Device Address or
something else that is persistent, and pass the actual UUID-E to wsc.c,
as the Interface Address is randomly generated on every connect attempt.
IIRC the UUID-E is supposed to be persistent.
2020-08-25 16:51:51 -05:00
Andrew Zaborowski
8173ded0eb wscutil: Allow 0-length attributes in wsc_attr_builder
wsc_attr_builder_start_attr and wsc_attr_builder_free look at
builder->curlen to see whether the TLV's length needs to be updated to
include the previous attribute.  If builder->curlen is 0
wsc_attr_builder_start_attr assumes there's no previous attribute and
starts writing at current builder->offset.  If the previous attribute
length was 0 curlen would stay at 0 and that attribute would get
overwritten with the new one.  To solve this add the 4 bytes of the T
and L to curlen as soon as a new attribute is started, and subtract
them when writing the L value.  The alternative would be to set a flag
to say whether an attribute was started.

The spec explicitly allows 0-length attributes in section 12:
"The variable length string attributes, e.g., Device Name, are encoded
without null-termination, i.e., no 0x00 octets added to the end of the
value. If the string is empty, the attribute length is set to zero."
2020-08-25 16:47:34 -05:00
Denis Kenzior
8840d4623d resolve: Support .add_domain_name for resolvconf
Add ability to populate search domains for resolvconf based systems.
Search domains are added using the 'search' directive and added using
the <ifname>.domain key into resolvconf.
2020-08-21 22:41:49 -05:00
Denis Kenzior
65fdc8f2fe resolve: Refactor resolvconf implementation
Introduce a new resolvconf_invoke function that takes care of all the
details of invoking resolvconf and simplify the code a bit.

Introduce have_dns that tracks whether DNS servers were actually
provided.  If no DNS info was provided, do not invoke resolvconf to
remove it.

Instead of interface index, resolvconf is now invoked with the printable
name of the interface and the dns entries are placed in the "dns"
protocol.  This makes it a bit simpler to add additional info to
resolvconf instead of trying to generate a monolithic entry.
2020-08-21 22:41:49 -05:00
Denis Kenzior
e58a818ce9 resolve: Refactor resolve module
Resolve module does not currently track any state that has been set on
a per ifindex basis.  This was okay while the set of information we
supported was quite small.  However, with dhcpv6 support being prepared,
a more flexible framework is needed.

Change the resolve API to allocate and return an instance for a given
ifindex that has the ability to track information that was provided.
2020-08-21 22:41:32 -05:00
Denis Kenzior
ac5ddda56f treewide: Add missing netdev module dependencies 2020-08-20 11:49:01 -05:00
Denis Kenzior
b0fe62af5a scan: free wfd member
Found using lsan:

==29896==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 9 byte(s) in 1 object(s) allocated from:
    #0 0x7fcd41e0c710 in __interceptor_malloc /var/tmp/portage/sys-devel/gcc-8.2.0-r6/work/gcc-8.2.0/libsanitizer/asan/asan_malloc_linux.cc:86
    #1 0x606abd in l_malloc ell/util.c:62
    #2 0x460230 in ie_tlv_vendor_ie_concat src/ie.c:140
    #3 0x4605d1 in ie_tlv_extract_wfd_payload src/ie.c:216
    #4 0x4a8773 in scan_parse_bss_information_elements src/scan.c:1105
    #5 0x4a94a8 in scan_parse_attr_bss src/scan.c:1181
    #6 0x4a99f8 in scan_parse_result src/scan.c:1238
    #7 0x4abe4e in get_scan_callback src/scan.c:1451
    #8 0x6442d9 in process_unicast ell/genl.c:979
    #9 0x6453ff in received_data ell/genl.c:1087
    #10 0x62e1a4 in io_callback ell/io.c:126
    #11 0x628fca in l_main_iterate ell/main.c:473
    #12 0x6294e8 in l_main_run ell/main.c:520
    #13 0x629d8b in l_main_run_with_signal ell/main.c:642
    #14 0x40681b in main src/main.c:505
    #15 0x7fcd40a55bdd in __libc_start_main (/lib64/libc.so.6+0x21bdd)
2020-08-20 11:11:44 -05:00
Andrew Zaborowski
df60f0ace6 eap-wsc: Handle the M{1,3,5,7} messages
Parse, validate and respond to the M1, M3, M5 and M7 messages and send
the M2, M4, M6 and M8.
2020-08-17 09:42:40 -05:00
Andrew Zaborowski
e768f034a3 eap-wsc: Registrar mode message processing
This commit has all the changes to extend and generalise the current
eap-wsc.c code to handle both the Enrollee and Registrar side of the
protocol, reusing existing functions and structures.
2020-08-17 09:40:25 -05:00
Andrew Zaborowski
50f2b3d0ca eap-wsc: Registrar mode settings loading
Alongside the current EAP-WSC enrollee side support, add the initial
part of registrar side.  In the same file, register a new method with
the name string of "WSC-R".  In this patch only the load_settings
method is added.  validate_identity and handle_response are added in
later patches.
2020-08-17 09:38:16 -05:00
Andrew Zaborowski
4c64e0d560 eapol: Basic EAP support in authenticator mode
Handle EAPoL-EAP frames using our eap.c methods in authenticator mode
same as we do on the supplicant side.  The user (ap.c) will only need to
set a valid 8021x_settings in the handshake object, same as on the
supplicant side.
2020-08-17 09:33:51 -05:00
Andrew Zaborowski
17c569ba4c eap: Add authenticator method logic and API
The goal is to add specifically EAP-WSC registrar side and it looks like
extending our EAP and EAPoL code to support both supplicant and
authenticator-side methods is simpler than adding just EAP-WSC as a
special case.

Since EAP-WSC always ends in an EAP failure, I haven't actually tested
the success path.
2020-08-17 09:28:49 -05:00
Andrew Zaborowski
1f910f84b4 eapol: Use eapol_start in authenticator mode too
On the supplicant side eapol_register would only register the eapol_sm
on a given netdev to start receiving frames and an eapol_start call is
required for the state machine to start executing.  On the authenticator
side we shouldn't have the "early frame" problem but there's no reason
for the semantics of the two methods to be different.  Somehow we were
doing everything in eapol_register and not using eapol_start if
hs->authenticator was true, so bring this in line with the supplicant
side and require eapol_start to be called also from ap.c.
2020-08-17 09:25:50 -05:00
Andrew Zaborowski
49f38b0d2e station: Don't call network_rank_update with NULL network
Move the update of station->networks_sorted order to before we set
station->connected_network NULL to avoid a crash when we attempt to
use the NULL pointer.
2020-08-17 09:25:33 -05:00
Alvin Šipraga
bfd8cead95 treewide: guard compare functions against signed integer overflow
Besides being undefined behaviour, signed integer overflow can cause
unexpected comparison results. In the case of network_rank_compare(),
a connected network with rank INT_MAX would cause newly inserted
networks with negative rank to be inserted earlier in the ordered
network list. This is reflected in the GetOrderedMethods() DBus method
as can be seen in the following iwctl output:

  [iwd]# station wlan0 get-networks
    Network name                    Security  Signal
  ----------------------------------------------------
    BEOLAN                          8021x     **** }
    BeoBlue                         psk       ***  } all unknown,
    UI_Test_Network                 psk       ***  } hence assigned
    deneb_2G                        psk       ***  } negative rank
    BEOGUEST                        open      **** }
  > titan                           psk       ****
    Linksys05274_5GHz_dmt           psk       ****
    Lyngby-4G-4 5GHz                psk       ****
2020-08-14 10:55:30 -05:00
Alvin Šipraga
94d4b341e3 station: refresh ordered network list on (dis)connect
Doing so ensures that the currently connected network is always at the
beginning of the list. Previously, the list would only get updated after
a scan.

This fixes the documented behaviour of GetOrderedNetworks() DBus method,
which states that the currently connected network is always at the
beginning of the returned array.
2020-08-14 10:55:22 -05:00
Denis Kenzior
4fbfa76fc5 wiphy: Fix not attempting WPA3 connections for APs in transition mode
Fix a logic error which prevented iwd from using SAE/WPA3 when
attempting to connect to APs that are in transition mode.  The SAE/WPA3
check incorrectly required mfpr bit to be set, which is true for
APs in WPA3-Personal only mode, but is set to 0 for APs in
WPA3-Personal transition mode.

This patch also adds a bit more diagnostic output to help diagnose
causes for connections where WPA3 is not attempted even when advertised
by the AP.
2020-08-13 14:27:14 -05:00
Denis Kenzior
9e98a74efd common: Remove duplicate AKM 2020-08-13 13:43:31 -05:00
Andrew Zaborowski
0480989a73 eap-wsc: Zero a temporary buffer before freeing 2020-08-13 10:39:48 -05:00
Andrew Zaborowski
45d74ac1ed eap-wsc: Validate enrollee_nonce (N1) in M{2,4,6,8} 2020-08-13 10:39:17 -05:00
Andrew Zaborowski
c826dd0052 eap: Simplify sending EAP method responses
Replace the usage of eap_send_response() in the method implementations
with a new eap_method_respond that skips the redundant "type" parameter.
The new eap_send_packet is used inside eap_method_respond and will be
reused for sending request packets in authenticator side EAP methods.
2020-08-13 10:36:43 -05:00
Andrew Zaborowski
8a5861d3f5 eapol: Use eapol_sm_write in authenticator mode
Throughout the supplicant mode we'd use the eapol_sm_write wrapper but
in the authenticator mode we'd call __eapol_tx_packet directly.  Adapt
eapol_sm_write to use the right destination address and use it
consistently.
2020-08-13 10:14:21 -05:00
Andrew Zaborowski
225a28f364 eapol: Don't try setting protocol_version in eapol_rx_auth_packet
In authenticator mode we'll always have protocol_version set from the
start so the condition is always going to be false.
2020-08-13 10:14:05 -05:00
Andrew Zaborowski
b40d7460b3 eapol: Don't re-build the AP RSNE in authenticator mode
sm->handshake already contains our RSN/WPA IE so there's no need to
rebuild it for msg 3/4, especially since we hardcode the fact that we
only support one pairwise cipher.  If we start declaring more supported
ciphers and need to include a second RSNE we can first parse
sm->hs->authenticator_ie into a struct ir_rsn_info, overwrite the cipher
and rebuild it from that struct.

This way we duplicate less code and we hardcode fewer facts about the AP
in eapol.c which also helps in adding EAP-WSC.
2020-08-13 10:12:07 -05:00
Andrew Zaborowski
69259b3a3f eapol: Use the require_handshake flag for FILS
In both FT or FILS EAPoL isn't used for the initial handshake and only
for the later re-keys.  For FT we added the
eapol_sm_set_require_handshake mechanism to tell EAPoL to not require
the initial handshake and we can re-use it for FILS.
2020-08-13 10:10:54 -05:00
Andrew Zaborowski
a95cd4f0fa wscutil: Handle a deprecated network key format
Implement a note from the spec saying that implementations should handle
NUL-terminated Network Keys inside credentials structures.
2020-08-13 10:10:51 -05:00
Mathy Vanhoef
f22ba5aebb eapol: prevent key reinstallation on retransmitted Msg4/4
Currently an adversary can retransmit EAPOL Msg4/4 to make the AP
reinstall the PTK. Against older Linux kernels this can subsequently
be used to decrypt, replay, and possibly decrypt frames. See the
KRACK attacks research at krackattacks.com for attack scenarios.
In this case no machine-in-the-middle position is needed to trigger
the key reinstallation.

Fix this by using the ptk_complete boolean to track when the 4-way
handshake has completed (similar to its usage for clients). When
receiving a retransmitted Msg4/4 accept this frame but do not reinstall
the PTK.

Credits to Chris M. Stone, Sam Thomas, and Tom Chothia of Birmingham
University to help discover this issue.
2020-08-12 09:51:20 -05:00
Andrew Zaborowski
59ce53ceb2 ap: Add authorized_macs parameter 2020-08-04 10:41:45 -05:00
Andrew Zaborowski
887f679023 ap: Add a no_cck_rates flag 2020-08-04 10:41:45 -05:00
Andrew Zaborowski
30933423fd ap: Put a public api between AP logic and DBus code
Separate AP logic from DBus code, add a public API to make the AP
logic reusable from other files.
2020-08-04 10:41:42 -05:00
Andrew Zaborowski
1d852e10ad scan: Always allocate results->bss_list
Instead of creating the results->bss_list l_queue lazily, always create
one before sending the GET_SCAN command.  This is to make sure that an
empty list is passed to the scan callback (e.g. in station.c) instead of
a NULL.  Passing NULL has been causing difficult to debug crashes in
station.c, in fact I think I've been seeing them for over a year now
but can't be sure.  station_set_scan_results has been taking ownership
of the new BSS list and, if station->connected_bss was not on the list,
it would try to add it not realizing that l_queue_push_tail() was doing
nothing.  Always passing a valid list may help us prevent similar
problems in the future.

The crash might start with:
==120489== Invalid read of size 8
==120489==    at 0x425D38: network_bss_select (network.c:709)
==120489==    by 0x415BD1: station_try_next_bss (station.c:2263)
==120489==    by 0x415E31: station_retry_with_status (station.c:2323)
==120489==    by 0x415E31: station_connect_cb (station.c:2367)
==120489==    by 0x407E66: netdev_connect_failed (netdev.c:569)
==120489==    by 0x40B93D: netdev_connect_event (netdev.c:1801)
==120489==    by 0x40B93D: netdev_mlme_notify (netdev.c:3678)
2020-08-04 10:30:07 -05:00
Ard Biesheuvel
1db8a85a60 crypto: incorporate C implementation of ARC4
Incorporate the LGPL v2.1 licensed implementation of ARC4, taken from
the Nettle project (https://git.lysator.liu.se/nettle/nettle.git,
commit 3e7a480a1e351884), and tweak it a bit so we don't have to
operate on a skip buffer to fast forward the stream cipher, but can
simply invoke it with NULL dst or src arguments to achieve the same.

This removes the dependency [via libell] on the OS's implementation of
ecb(arc4), which may be going away, and which is not usually accelerated
in the first place.
2020-08-03 16:28:24 -05:00
Daniel DE ALMEIDA BRAGA
211f7dde6e sae: Fix a side channel leak on the password
Use a constant control flow in the derivation loop, avoiding leakage
in the iteration succesfuly converting the password.
Increase number of iterations (20 to 30) to avoid issues with
passwords needing more iterations.
2020-08-03 16:12:50 -05:00
Andrew Zaborowski
3910b9d9c3 p2p: Use a longer DHCP timeout
With some devices the 10 seconds are not enough for the P2P Group Owner
to give us an address but I think we still want to use a timeout as
short as possible so that the user doesn't wait too long if the
connection isn't working.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
2dea8bcc69 p2p: Set p2p_own_wfd->available by default
We need to set this flag true when the WFD service is first registered
as there's no WFD session and we're available for a new session.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
c42de40a3b p2p: Add a null-check before use
p2p_connection_reset may be called as a result of a WFD service
unregistering and p2p_own_wfd is going to be NULL, don't update
p2p_own_wfd->available in this case.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
650e7715b1 p2p: Retry connect on "Previous authentication not valid"
With some WFD devices we occasionally get a Disconnect before or during
the DHCP setup on the first connection attempt to a newly formeg group,
with the reason code MMPDU_REASON_CODE_PREV_AUTH_NOT_VALID.  Retrying a
a few times makes the connections consistently successful.  Some
conditions are simplified/update in this patch because
conn_dhcp_timeout now implies conn_wsc_bss, and both imply
conn_retry_count.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
914a03c4bf station: Comment/whitespace fix 2020-07-31 10:38:59 -05:00
Andrew Zaborowski
8faa0c1f0d frame-xchg: Re-add frame_xchg_stop
In 98cf2bf3ec frame_xchg_stop was removed
and its use in p2p.c was changed to frame_xchg_cancel with the slight
complication that the ID returned by frame_xchg_start had do be stored.
Re-add frame_xchg_stop, (renamed as frame_xchg_stop_wdev) to simplify
this bit in p2p.c.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
28d3eed32e frame-xchg: Improve search for current frame in MLME notify
Since there may now be multiple frames-xchg record for each wdev, when
we receive the TX Status event, make sure we find the record who's radio
work has started, as indicated by fx->retry_cnt > 0.  Otherwise we're
relying on the ordering of the frames in the "frame_xchgs" queue and
constant priority.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
736aadc75f frame-xchg: Fix potential use after free
Check if the frame callback has cancelled the frame_xchg before
attempting to free it.
2020-07-31 10:38:59 -05:00
Andrew Zaborowski
40c091ac7f frame-xchg: Drop the BSSID check for incoming frames
The BSSID (address_3) in response frames was being checked to be the
same as in the request frame, or all-zeros for faulty drivers.  At least
one Wi-Fi Display device sends a GO Negotiation Response with the BSSID
different from its Device Address (by 1 bit) and I didn't see an easy
way to obtain that address beforhand so we can "whitelist" it for this
check, so just drop that check for now.

ANQP didn't have this check before it started using frame-xchg so it
shouldn't be critical.
2020-07-21 09:00:44 -05:00
Andrew Zaborowski
5600c736b8 frame-xchg: Fix group removal inside frame callback
When a frame registered in a given group Id triggers a callback and that
callback ends up calling frame_watch_group_remove for that group Id,
that call will happen inside WATCHLIST_NOTIFY_MATCHES and will free the
memory used by the watchlist.  watchlist.h has protection against the
watchlist being "destroyed" inside WATCHLIST_NOTIFY_MATCHES, but not
against its memory being freed -- the memory where it stores the in_notify
and destroy_pending flags.  Free the group immediately after
WATCHLIST_NOTIFY_MATCHES to avoid reads/writes to those flags triggering
valgrind warnings.
2020-07-21 08:59:39 -05:00
Andrew Zaborowski
1f4b32ff53 p2p: Update call after frame-xchg changes 2020-07-21 08:59:24 -05:00
Andrew Zaborowski
b4d85942e6 frame-xchg: Don't call frame_xchg_destroy directly
frame_xchg_destroy is passed as the wiphy radio work's destroy callback
to wiphy.c.  If it's also called directly in frame_xchg_exit, there's
going to be a use-after-free when it's called again from wiphy_exit, so
instead use wiphy_radio_work_done which will call frame_xchg_destroy and
forget the frame_xchg record.
2020-07-21 08:58:16 -05:00
Andrew Zaborowski
07915485ed p2p: Add WFD IEs in GO Negotiation and association
This patch lets us establish WFD connections by parsing, validating and
acting on WFD IEs in received frames, and adding our own WFD IEs in the
GO Negotiation and Association frames.  Applications should assume that
any connection to a WFD-capable peer when we ourselves have a WFD
service registered, are WFD connections and should handle RTSP and
other IP-based protocols on those connections.

When connecting to a WFD-capable peer and when we have a WFD service
registered, the connection will fail if there are any conflicting or
invalid WFD parameters during GO Negotiation.
2020-07-16 10:48:43 -05:00
Andrew Zaborowski
edf6b1b644 p2p: Add the p2p.Display interface on WFD-capable peers
If anyone's registered as implementing the WFD service, add the
net.connman.iwd.p2p.Display DBus interface on peer objects that are
WFD-capable and are available for a WFD Session.
2020-07-16 10:47:03 -05:00
Andrew Zaborowski
fc96b35cdc agent: Don't remove object at IWD_AGENT_MANAGER_PATH
This same object is used for the P2P service manager, let each module
remove the interfaces it added only.

Reported-by: Denis Kenzior
2020-07-16 10:44:40 -05:00
Andrew Zaborowski
4cf5f5c4b6 p2p: Implement the p2p.ServiceManager interface
The net.connman.iwd.p2p.ServiceManager interface on the /net/connman/iwd
object lets user applications register/unregister the Wi-Fi Display
service.  In this commit all it does is it adds local WFD information
as given by the app, to the frames we send out during discovery.

Instead of accepting raw WFD IE contents from the app and exposing
peers' raw WFD IEs to the app, we build the WFD IEs in our code based on
the few meaningful DBus properties that we support and using default
values for the rest.  If an app ever needs any of the other WFD
capabilities more properties can be added.
2020-07-16 10:42:38 -05:00
James Prestwood
4165d9414f netdev: use wiphy radio work queue for connections
This adds connection/FT attempts to the radio work queue. This
will ensure that connections aren't delayed or done concurrently
with scanning.
2020-07-15 17:10:36 -05:00
Andrew Zaborowski
344fb528ab p2p: Add ConnectedInterface and ConnectedIP Peer properties
The are useful for P2P service implementations to know unambiguously
which network interface a new P2P connection is on and the peer's IPv4
address if they need to initiate an IP connection or validate an
incoming connection's address from the peer.
2020-07-13 14:53:38 -05:00
Andrew Zaborowski
bafd604834 netconfig: Implement netconfig_get_dhcp_server_ipv4
This uses l_dhcp_lease_get_server_id to get the IP of the server that
offered us our current lease.  l_dhcp_lease_get_server_id returns the
vaue of the L_DHCP_OPTION_SERVER_IDENTIFIER option, which is the address
that any unicast DHCP frames are supposed to be sent to so it seems to
be the best way to get the P2P group owner's IP address as a P2P-client.
2020-07-13 14:52:02 -05:00
Andrew Zaborowski
8b64fa97f0 p2putil: Add WFD IEs when building P2P Action frames 2020-07-13 14:18:09 -05:00
Andrew Zaborowski
b924b1da61 p2putil: Extract WFD IE payloads from P2P Action frames 2020-07-13 14:16:09 -05:00
Andrew Zaborowski
75e014f72b scan: Extract WFD IE payload into struct bss 2020-07-13 14:15:42 -05:00
Andrew Zaborowski
ee933c6b58 man iwd.debug: Document IWD_GENL_DEBUG 2020-07-13 14:14:41 -05:00
Andrew Zaborowski
c8f4b9d98f p2p: Implement the Peer.Device property
Add the net.connman.iwd.p2p.Peer.Device property as listed in
doc/p2p-peer-api.txt
2020-07-13 14:12:44 -05:00
Andrew Zaborowski
a09d7628dd p2p: Use nl80211_parse_attrs
Simplify p2p_device_update_from_genl by making use of nl80211_parse_attrs.
2020-07-13 14:11:07 -05:00
Andrew Zaborowski
09c9482045 p2p: Initialize dev->discovery_users in p2p_device_request_discovery
Make sure dev->discovery_users points at a queue before we try adding
user records to it.
2020-07-13 14:10:44 -05:00
Andrew Zaborowski
7d3092e1ca p2p: Update peer->device_addr when updating peer->bss
peer->device_addr is a pointer to the Device Address contained in
one of two possible places in peer->bss.  If during discovery we've
received a new beacon/probe response for an existing peer and we're
going to replace peer->bss, we also have to update peer->device_addr.
2020-07-13 14:09:42 -05:00
Andrew Zaborowski
122ea7a8aa p2p: Stop discovery after GO Negotiation Req error
If we were in discovery only to be able to receive the target peer's
GO Negotiation Request (i.e. we have no users requesting discovery)
and we've received the frame and decided that the connection has
failed, exit discovery.
2020-07-13 14:08:51 -05:00
James Prestwood
5f7b28d501 scan: refactor to use wiphy radio work queue
To use the wiphy radio work queue, scanning mostly remained the same.
start_next_scan_request was modified to be used as the work callback,
as well as not start the next scan if the current one was done
(since this is taken care of by wiphy work queue now). All
calls to start_next_scan_request were removed, and more or less
replaced with wiphy_radio_work_done.

scan_{suspend,resume} were both removed since radio management
priorities solve this for us. ANQP requests can be inserted ahead of
scan requests, which accomplishes the same thing.
2020-07-10 13:23:58 -05:00
James Prestwood
a3d0eebe74 station: cancel hidden network scan when connecting
Before connecting to a hidden network we must scan. During this scan
if another connection attempt comes in the expected behavior is to
abort the original connection. Rather than waiting for the scan to
complete, then canceling the original hidden connection we can just
cancel the hidden scan immediately, reply to dbus, and continue with
the new connection attempt.
2020-07-09 10:00:55 -05:00
James Prestwood
7e0084e6ae anqp: refactor to use frame-xchg
The new frame-xchg module now handles a lot of what ANQP used to do. ANQP
now does not need to depend on nl80211/netdev for building and sending
frames. It also no longer needs any of the request lookups, frame watches
or to maintain a queue of requests because frame-xchg filters this for us.

From an API perspective:
 - anqp_request() was changed to take the wdev_id rather than ifindex.
 - anqp_cancel() was added so that station can properly clean up ANQP
   requests if the device disappears.

During testing a bug was also fixed in station on the timeout path
where the request queue would get popped twice.
2020-07-09 09:58:21 -05:00
James Prestwood
98cf2bf3ec frame-xchg: refactor to use wiphy work queue
In order to first integrate frame-xchg some refactoring needed to
be done. First it is useful to allow queueing frames up rather than
requiring the module (p2p, anqp etc) to wait for the last frame to
finish. This can be aided by radio management but frame-xchg needed
some refactoring as well.

First was getting rid of this fx pointer re-use. It looks like this
was done to save a bit of memory but things get pretty complex
needed to check if the pointer is stale or has been reset. Instead
of this we now just allocate a new pointer each frame-xchg. This
allows for the module to queue multiple requests as well as removes
the complexity of needed to check if the fx pointer is stale.

Next was adding the ability to track frame-xchgs by ID. If a module
can queue up multiple requests it also needs to be able to cancel
them individually vs per-wdev. This comes free with the wiphy work
queue since it returns an ID which can be given directly to the
caller.

Then radio management was simply piped in by adding the
insert/done APIs.
2020-07-09 09:58:16 -05:00
James Prestwood
771f292939 wiphy: introduce new radio management APIs
These APIs will handle fairness and order in any operations which
radios can only do sequentially (offchannel, scanning, connection etc.).

Both scan and frame-xchg are complex modules (especially scanning)
which is why the radio management APIs were implemented generic enough
where the changes to both modules will be minimal. Any module that
requires this kind of work can push a work item into the radio
management work queue (wiphy_radio_work_insert) and when the work
is ready to be started radio management will call back into the module.
Once the work is completed (and this may be some time later e.g. in
scan results or a frame watch) the module can signal back that the
work is finished (wiphy_radio_work_done). Wiphy will then pop the
queue and continue with the next work item.

A concept of priority was added in order to allow important offchannel
operations (e.g. ANQP) to take priority over other work items. The
priority is an integer, where lower values are of a higher priority.
The concept of priority cleanly solves a lot of the complexity that
was added in order to support ANQP queries (suspending scanning and
waiting for ANQP to finish before connecting).

Instead ANQP queries can be queued at a higher priority than scanning
which removes the need for suspending scans. In addition we can treat
connections as radio management work and insert them at a lower
priority than ANQP, but higher than scanning. This forces the
connection to wait for ANQP without having to track any state.
2020-07-09 09:57:13 -05:00
James Prestwood
70824d7b5a wiphy: add convenience API wiphy_find_by_wdev 2020-07-02 17:07:21 -05:00
Denis Kenzior
a1b41f786e station: Re-attempt roam with a full scan
When roaming, iwd tries to scan a limited number of frequencies to keep
the roaming latency down.  Ideally the frequency list would come in from
a neighbor report, but if neighbor reports are not supported, we fall
back to our internal database for known frequencies of this network.

iwd tries to keep the number of scans down to a bare minimum, which
means that we might miss APs that are in range.  This could happen
because the user might have moved physically and our frequency list is
no longer up to date, or if the AP frequencies have been reconfigured.

If a limited scan fails to find any good roaming candidates, re-attempt
a full scan right away.
2020-06-30 12:34:41 -05:00
Denis Kenzior
b026e6740b station: Return errno from station_roam_scan 2020-06-30 12:29:22 -05:00
Denis Kenzior
10e83aa347 station: Return errno from station_roam_scan_known_freqs 2020-06-30 12:05:51 -05:00
Denis Kenzior
05b803cb76 station: reflow station_roam_failed
If the roam failed and we are no longer connected, station_disassociated
is called which ends up calling station_roam_state_clear.  Thus
resetting the variables is not needed.  Reflow the logic to make this a
bit more explicit.
2020-06-30 10:58:05 -05:00
Denis Kenzior
faa31802c5 station: Don't reset roam_no_orig_ap on roam failure
If the roam attempt fails, do not reset this to false.  Generally this
is set by the fact that we lost beacon and to not attempt neighbor
reports, etc.  This hint should be preserved across roam attempts.
2020-06-30 10:23:40 -05:00
Denis Kenzior
ec7044d615 main: Do not always return -ENOTSUP
Fixes: 19b0d0f2e2 ("main: Rework kernel option detection logic")
2020-06-23 12:25:18 -05:00
James Prestwood
05ad0120a8 frame-xchg: add destroy function to start() APIs
This makes things more consistent with other IWD APIs as well as
prepares for unifying frame-xchg and scanning.
2020-06-23 10:45:31 -05:00
James Prestwood
6c9c65a5de frame-xchg: fix incorrect length check
frame_xchg_startv was using sizeof(mmpdu) to check the minimum length
for a frame. Instead mmpdu_header_len should be used since this checks
fc.order and returns either 24 or 28 bytes, not 28 bytes always.

This change adds the requirement that the first iovec in the array
must contain at least the first 2 bytes (mmpdu_fc) of the header.
This really shouldn't be a problem since all current users of
frame-xchg put the entire header (or entire frame) into the first
iovec in the array.
2020-06-22 10:27:59 -05:00
Fabrice Fontaine
6bf5c3ddbd p2p: fix build with uclibc
explicit_bzero is used in src/p2p.c since commit
1675c765a3 but src/missing.h is not
included, as a result build with uclibc fails on:

/home/naourr/work/instance-0/output-1/per-package/iwd/host/opt/ext-toolchain/bin/../lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/../../../../mips64el-buildroot-linux-uclibc/bin/ld: src/p2p.o: in function `p2p_connection_reset':
p2p.c:(.text+0x2cf4): undefined reference to `explicit_bzero'
/home/naourr/work/instance-0/output-1/per-package/iwd/host/opt/ext-toolchain/bin/../lib/gcc/mips64el-buildroot-linux-uclibc/5.5.0/../../../../mips64el-buildroot-linux-uclibc/bin/ld: p2p.c:(.text+0x2cfc): undefined reference to `explicit_bzero'
2020-06-22 10:27:19 -05:00
Denis Kenzior
19b0d0f2e2 main: Rework kernel option detection logic
This logic was using l_hashmap_insert, which supports duplicates.  Since
some entries were inserted multiple times, they ended up being printed
multiple times.  Fix that by introducing a macro that uses
l_hashmap_replace instead.
2020-06-22 10:12:34 -05:00
Denis Kenzior
254cefcc96 station: Give network a connection failed hint
Right now, if the connection fails, then network always thinks that the
password should be re-asked.  Loosen this to only do so if the
connection failed at least in the handshake phase.  If the connection
failed due to Association / Authentication timeout, it is likely that
something is wrong with the AP and it can't respond.
2020-06-12 15:21:39 -05:00
James Prestwood
248190b0ed network: delay connect if ANQP has not completed
Using the new station ANQP watch network can delay the connection
request until after ANQP has finished. Since station may be
autoconnecting we must also add a check in network_autoconnect
which prevents it from autoconnecting if we have a pending Connect
request.
2020-06-12 15:04:31 -05:00
James Prestwood
60e2c4647c station: add ANQP state watch API
This is to allow network to watch for ANQP activity in order to
fix the race condition between scanning finishing and ANQP finishing.
Without this it is possible for a DBus Connect() to come in before
ANQP has completed and causing the network to return NotConfigured,
when its actually in the process of obtaining all the network info.

The watch was made globally in station due to network not having
a station object until each individual network is created. Adding a
watch during network creation would result in many watchers as well
as a lot of removal/addition as networks are found and lost.
2020-06-12 14:58:56 -05:00
Tim Kourt
ecd39dcf0d network: Don't crash when network_connect_new_hidden_network fails
Change signature of network_connect_new_hidden_network to take
reference to the caller's l_dbus_message struct. This allows to
set the caller's l_dbus_message struct to NULL after replying in
the case of a failure.

==201==    at 0x467C15: l_dbus_message_unref (dbus-message.c:412)
==201==    by 0x412A51: station_hidden_network_scan_results (station.c:2504)
==201==    by 0x41EAEA: scan_finished (scan.c:1505)
==201==    by 0x41EC10: get_scan_done (scan.c:1535)
==201==    by 0x462592: destroy_request (genl.c:673)
==201==    by 0x462987: process_unicast (genl.c:988)
==201==    by 0x462987: received_data (genl.c:1087)
==201==    by 0x45F5A2: io_callback (io.c:126)
==201==    by 0x45E8FD: l_main_iterate (main.c:474)
==201==    by 0x45E9BB: l_main_run (main.c:521)
==201==    by 0x45EBCA: l_main_run_with_signal (main.c:643)
==201==    by 0x403B15: main (main.c:512)
2020-06-09 21:59:36 -05:00
Tim Kourt
61ee99f632 station: Use separate msg holder for hidden connections
Introduce hidden_pending to keep reference to the dbus message object
while we wait for the scan results to be returned while trying to
connect to a hidden network. This simplifies the logic by separating it
into two independent logical units: scanning, connecting and eliminates
a possibility of a memory leak in the case when Network.Connect being
initiated while Station.ConnectHiddenNetwork is in progress.
2020-06-09 21:58:52 -05:00
Denis Kenzior
532f6b154e station: Do not enter autoconnect_full erroneously
If a connection is initiated (via dbus) while a quick scan is in
progress, the quick scan will be aborted.  In this case,
station_quick_scan_results will always transition to the
AUTOCONNECT_FULL state regardless of whether it should or not.

Fix this by making sure that we only enter AUTOCONNECT_FULL if we're
still in the AUTOCONNECT_QUICK state.

Reported-by: Alvin Šipraga <alsi@bang-olufsen.dk>
2020-06-09 10:03:33 -05:00
Alvin Šipraga
8db4d9272a scan: refactor start_next_scan_request to not send duplicate requests
If start_scan_next_request() is called while a scan request
(NL80211_CMD_TRIGGER_SCAN) is still running, the same scan request will
be sent again. Add a check in the function to avoid sending a request if
one is already in progress. For consistency, check also that scan
results are not being requested (NL80211_CMD_GET_SCAN), before trying to
send the next scan request. Finally, remove similar checks at
start_next_scan_request() callsites to simplify the code.

This also fixes a crash that occurs if the following conditions are met:
  - the duplicated request is the only request in the scan request
    queue, and
  - both scan requests fail with an error not EBUSY.

In this case, the first callback to scan_request_triggered() will delete
the request from the scan request queue. The second callback will find
an empty queue and consequently pass a NULL scan_request pointer to
scan_request_failed(), causing a segmentation fault.
2020-06-08 15:10:30 -05:00
Alvin Šipraga
cae6949ce1 scan: Do not start new requests while suspended
If scanning is suspended, have scan_common() queue its scan request
rather than issuing it immediately. This respects the assumption that
scans are not requested while sc->suspended is true.
2020-06-04 13:17:42 -05:00
James Prestwood
8b1161ec8e frame-xchg: fix bug when starting new xchg from callback
This bug is caused by the following behavior:

 1. Start a frame-xchg, wait for callback
 2. From callback start a new frame-xchg, same prefix.

The new frame-xchg request will detect that there is a duplicate watch,
which is correct behavior. It will then remove this duplicate from the
watchlist. The issue here is that we are in the watchlist notify loop
from the original xchg. This causes that loop to read from the now
freed watchlist item, causing an invalid read.

Instead of freeing the item immediately, check if the notify loop is in
progress and only set 'id' to zero and 'stale_items' to true. This will
allow the notify loop to finish, then the watchlist code will prune out
any stale items. If not in the notify loop the item can be freed as it
was before.
2020-06-04 09:36:42 -05:00
Andrew Zaborowski
1e10d13645 frame-xchg: Use frame_watch_group_match in frame_watch_group_get 2020-06-04 09:14:21 -05:00
Andrew Zaborowski
d012a7f2ac frame-xchg: Fix frame_watch_remove_by_handler for group 0
Don't match the default group's (group_id 0) wdev_id against the
provided wdev_id because the default group can be used on all wdevs and
its wdev_id is 0.  Also match individual item's wdev_id in the group to
make up for this although it normally wouldn't matter.
2020-06-04 09:13:47 -05:00
James Prestwood
d38bd513c9 fils: include RSNE in authenticate
802.11ai mandates that the RSN element is included during authentication
for FILS. This previously was happening by chance since supplicant_ie
was being included with CMD_AUTHENTICATE. This included more than just
the RSNE so that was removed in an earlier commit. Now FILS builds the
RSNE itself and includes this with CMD_AUTHENTICATE.
2020-05-02 20:56:13 -05:00
James Prestwood
c7a17e5987 netdev: unify ft/auth_proto authenticate builders
build_cmd_ft_authenticate and build_cmd_authenticate were virtually
identical. These have been unified into a single builder.

We were also incorrectly including ATTR_IE to every authenticate
command, which violates the spec for certain protocols, This was
removed and any auth protocols will now add any IEs that they require.
2020-05-02 20:55:42 -05:00
James Prestwood
3f2c84c2a2 netdev: fix segfault due to roaming before connected
In this situation the kernel is sending a low RSSI event which netdev
picks up, but since we set netdev->connected so early the event is
forwarded to station before IWD has fully connected. Station then
tries to get a neighbor report, which may fail and cause a known
frequency scan. If this is a new network the frequency scan tries to
get any known frequencies in network_info which will be unset and
cause a segfault.

This can be avoided by only sending RSSI events when netdev->operational
is set rather than netdev->connected.
2020-05-01 20:42:58 -05:00
James Prestwood
dfb6f7f025 wiphy: restrict FT AKMs when not supported
Some full mac cards don't like being given a FT AKM when connecting.
From an API perspective this should be supported, but in practice
these cards behave differently and some do no accept FT AKMs. Until
this becomes more stable any cards not supporting Auth/Assoc commands
(full mac) will not connect using FT AKMs.
2020-05-01 19:55:18 -05:00
James Prestwood
1c75f636ed wiphy: remove useless debug prints
Several parsing functions printed the function name, which isn't
very useful to anyone.
2020-05-01 19:55:15 -05:00
James Prestwood
d12fad5eed scan: remove useless debug print
Further on in the function we still print that the scan was triggered.
2020-05-01 19:54:46 -05:00
James Prestwood
d6a3798078 manager: move debug print in dump callback
This callback gets called way to many times to have a debug print
in the location that it was. Instead only print if a NEW wiphy is
found, and also print the name/id.
2020-05-01 19:54:37 -05:00
Andrew Zaborowski
57b02108af netdev: Handle P2P-client iftype in netdev_setting_keys_failed 2020-05-01 11:40:11 -05:00
Andrew Zaborowski
7711b06b6b watchlist: Save the watchlist pointer in WATCHLIST_NOTIFY_*
Save the value of the watchlist pointer at the beginning of the
WATCHLIST_NOTIFY_* macros as if it was a function.  This will fix a
frame-xchg.c scenario in which one of the watch callback removes the
frame watch group and the memory where the watchlist pointer was
becomes unallocated but the macro still needs to access it ones or
twice while it destroys the watchlist.  Another option would be for
the pointer to be copied in frame-xchg.c itself.
2020-05-01 11:38:57 -05:00
Andrew Zaborowski
c49b724a2e p2p: Do DHCP as part of connection setup
Use netconfig.c functions to unconditionally run DHCP negotiation,
fail the connection setup if DHCP fails.  Only report connection success
after netconfig returns.
2020-05-01 11:38:43 -05:00
Andrew Zaborowski
c8edd36234 netconfig: Move EnableNetworkConfiguration check to station
Allow p2p to use netconfig even if not enabled for Infrastructure mode
connections.
2020-05-01 11:30:42 -05:00
Andrew Zaborowski
7a38085bf8 p2p: WSC client provisioning and connection
Add the final two steps of the connection setup, and corresponding
disconnect logic:

* the WSC connection to the GO to do the client provisioning,
* the netdev_connect call to use the provisioned credentials for the
  final WPA2 connection.
2020-04-27 13:53:15 -05:00
Andrew Zaborowski
85f09d9318 p2p: Create the P2P-Client interface
Once we've found the provisioning BSS create the P2P-Client interface
that we're going to use for the actual provisioning and the final P2P
connection.
2020-04-27 13:51:08 -05:00
Andrew Zaborowski
d77fdd087b p2p: Scan for the provision BSS
Add the next step after Provision Discovery or GO Negotiation that is
scanning for the WSC BSS that the GO has set up for client provisioning.
2020-04-27 13:49:35 -05:00
Andrew Zaborowski
ce4b1e1fcb p2p: Add the Provision Discovery frame sequence
When connecting to an existing group, use the Provision Discovery
Request/Response frame exchange before calling
p2p_start_client_provision().
2020-04-27 13:49:03 -05:00
Andrew Zaborowski
fdf2b8a94c p2p: Respond to Probe Reqs when waiting for GO negotiation
Some devices (a Wi-Fi Display dongle in my case) will send us Probe
Requests and wait for a response before they send us the GO
Negotiation Request that we're waiting for after the peer initially
replied with "Fail: Information Not Available" to our GO Negotiation
attempt.  Curiously this specific device I tested would even accept
a Probe Response with a mangled body such that the IE sequence couldn't
be parsed.
2020-04-27 13:47:42 -05:00
Andrew Zaborowski
bb4a3e8f84 p2p: Handle the Information Not Available response code
Handle the scenario where the peer's P2P state machine doesn't know
whether a connection has been authorized by the user and needs some time
to ask the user or a higher software layer whether to accept a
connection.  In that case their GO Negotiation Response to our GO
Negotiation Request will have the status code "Fail: Information Not
Available" and we need to give the peer 120s to start a new GO
Negotiation with us.  In this patch we handle the GO Negotiation
responder side where we parse the Request frame, build and send the
Response and finally parse the Confirmation.  The existing code so far
only did the initiator side.
2020-04-27 13:44:40 -05:00
Andrew Zaborowski
bff4147d52 p2p: Handle GO Negotiation Response, send Confirmation
Parse the GO Negotiation Response frame and if no errors found send the
GO Negotiation Confirmation.  If that gets ACKed wait for the GO to set
up the group.
2020-04-27 13:43:21 -05:00
Andrew Zaborowski
3ef8688df5 p2p: Build and send the GO Negotiation Request 2020-04-27 13:43:12 -05:00
Andrew Zaborowski
1675c765a3 p2p: Add the WSC interface on peer DBus objects
Add net.connman.iwd.SimpleConfiguration interfaces to peer objects on
DBus and handle method calls.  Building and transmitting the actual
action frames to start the connection sequence is done in the following
commits.
2020-04-24 22:18:52 -05:00
Andrew Zaborowski
3d4725870d p2p: Add the Listen State
Start a remain-on-channel cmd implementing the Listen State, after each
the Scan Phase implemented as an active scan.
2020-04-24 22:16:43 -05:00
Andrew Zaborowski
6e98d8a888 p2p: Add the Scan Phase
Add some of the Device Discovery logic and the DBus API.  Device
Discovery is documented as having three states: the Scan Phase, the Find
Phase and the Listen State.

This patch adds the Scan Phase and the next patch adds the Listen State,
which will happen sequentially in a loop until discovery is stopped.

The Find Phase, which is documented as happening at the beginning of the
Discovery Phase, is incorporated into the Scan Phases.  The difference
between the two is that Find Phase scans all of the supported channels
while the Scan Phase only scans the three "social" channels.  In
practical terms the Find Phase would discover existing groups, which may
operate on any channel, while the Scan Phase will only discover P2P
Devices -- peers that are not in a group yet.  To cover existing groups,
we add a few "non-social" channels to each of our active scans
implementing the Scan Phases.
2020-04-24 11:42:46 -05:00
Andrew Zaborowski
b43e915b98 wiphy: Track regulatory domain changes
When a new wiphy is added query its regulatory domain and listen for
nl80211 regulatory notifications to be able to provide current
regulatory country code through the new wiphy_get_reg_domain_country().
2020-04-24 11:39:00 -05:00
Andrew Zaborowski
0f3f0086ae nl80211util: Parse NL80211_ATTR_REG_ALPHA2 attrs 2020-04-24 11:38:44 -05:00
Andrew Zaborowski
59cc1e27c2 p2p: Add device enable/disable logic
Implement the Enabled property on device interface.  The P2P device is
currently disabled on startup but automatically enabling the P2P device
can be considered.
2020-04-24 11:36:54 -05:00
Andrew Zaborowski
ff65e1fd9a p2p: Add main device settings
Read WSC configuration methods and the Primary Device Type from the
config file and expose device name as a property.
2020-04-24 11:35:30 -05:00
Denis Kenzior
1277a01426 wscutil: Fix dbus string using spaces 2020-04-23 14:50:33 -05:00
Andrew Zaborowski
945abadc8a p2p: Add peer WSC device type properties 2020-04-23 14:49:24 -05:00
Andrew Zaborowski
ed81fe1f4f wscutil: Add device type category/subcategory string api
FTR ie.h is included for @microsoft_oui
2020-04-23 14:41:17 -05:00
Fabrice Fontaine
c352714e61 frame-xchg.c: fix build with glibc < 2.24
SOL_NETLINK is used since commit
87a198111a resulting in the following
build failure with glibc < 2.24:

src/frame-xchg.c: In function 'frame_watch_group_io_read':
src/frame-xchg.c:328:27: error: 'SOL_NETLINK' undeclared (first use in this function)
   if (cmsg->cmsg_level != SOL_NETLINK)
                           ^

This failure is due to glibc that doesn't support SOL_NETLINK before
version 2.24 and
f9b437d5ef

Fixes:
 - http://autobuild.buildroot.org/results/3485088b84111c271bbcfaf025aa4103c6452072
2020-04-22 10:38:51 -05:00
Tim Kourt
001b9035e0 station: Fix init return type 2020-04-17 12:22:48 -05:00
Tim Kourt
749d45f58f device: Fix init return type 2020-04-17 12:22:47 -05:00
Andrew Zaborowski
358d0ca201 manager: Create/destroy P2P devices
Create a P2P device interface along with the station interface when
setting up a wiphy and handle the interface being removed.
2020-04-10 06:39:48 -05:00
Andrew Zaborowski
326a8cd6ee Add minimal p2p.c and p2p.h
Add the functions to be called by manager.c and a minimal DBus API.
2020-04-10 06:31:19 -05:00
Andrew Zaborowski
042f88e3e9 dbus: Add P2P interface name defines 2020-04-10 06:31:19 -05:00
Tim Kourt
104e6898ca main: Fix freeing invalid pointer 2020-04-08 21:47:46 -05:00
Rosen Penev
1dfc28d21a module: add void to empty argument functions
Found with clang's -Wstrict-prototypes
2020-04-08 21:03:13 -05:00
Rosen Penev
a47609acbe iwd: remove unnecessary semicolons
Found with clang's -Wextra-semi-stmt
2020-04-08 21:02:15 -05:00
Tim Kourt
a074f30edc main: Simplify config file search logic 2020-04-08 16:19:52 -05:00
Denis Kenzior
98e4f84348 main: pretty up formatting 2020-04-08 16:19:37 -05:00
Tim Kourt
19a5250b34 main: Fix failure cleanup sequence 2020-04-08 16:18:05 -05:00
Tim Kourt
f92ce9441e storage: Refactor dirs creation logic to cleanup on failure 2020-04-08 16:18:04 -05:00
Denis Kenzior
848897ec17 adhoc: Set linkmode & operstate for open networks
For PSK networks we have netdev.c taking care of setting the linkmode &
operstate.  For open adhoc networks, netdev.c was never involved which
resulted in linkmode & operstate never being set.  Fix this by invoking
the necessary magic when a connection is established.
2020-04-08 12:35:04 -05:00
Denis Kenzior
6c95933663 netdev: Use the global rtnl object 2020-04-08 12:35:04 -05:00
Denis Kenzior
520f851564 netconfig: Use the global rtnl object 2020-04-08 12:35:02 -05:00
Denis Kenzior
5ea86c98fc main: Add iwd_get_rtnl 2020-04-08 12:27:57 -05:00
Diego Santa Cruz
f5a7510a22 adhoc: segfault when exiting iwd after adhoc stop
adhoc_reset() destroys ssid and sta_states but leaves the pointers
around, athough the adhoc_state structure is not always freed.

This causes a segfault when exiting iwd after a client has done
adhoc start and adhoc stop on a device since adhoc_reset() is called
from adhoc_sta_free although it was previously called from
adhoc_leave_cb().
2020-04-06 17:17:19 -05:00
Diego Santa Cruz
d66dcc9412 adhoc: fix bogus Failed error and segfault on stop
The netdev_leave_adhoc() returns a negative errno on errors and zero
on success, but adhoc_dbus_stop() assumed the inverse when checking for
an error.

Also, the DBus message was not being referenced in adhoc->pending and
then adhoc_leave_cb() segfaulted attempting to dereference it.
2020-04-06 17:17:19 -05:00
Andrew Zaborowski
508d71e3c1 eap-wsc: Convert memsets to explicit_bzero 2020-04-06 16:21:35 -05:00
Andrew Zaborowski
0ffb96056a wsc: Clear the pin copy in wsc_generate_pin 2020-04-06 16:21:31 -05:00
Denis Kenzior
aba3da32ac netdev: work around APs that send igtk in big endian
It seems some APs send the IGTK key in big endian format (it is a
uin16).  The kernel rightly reports an -EINVAL error when iwd issues a
NEW_KEY with such a value, resulting in the connection being aborted.

Work around this by trying to detect big-endian key indexes and 'fixing'
them up.
2020-04-06 15:56:46 -05:00
Denis Kenzior
5576722d29 eapol: Make sure igtk key index is uint16_t
Fixes: 1cc7346d6a ("handshake: Change signature of (i)gtk setters")
2020-04-02 18:16:56 -05:00
Denis Kenzior
1cc7346d6a handshake: Change signature of (i)gtk setters 2020-04-02 00:41:02 -05:00
Denis Kenzior
426681aeb2 netdev: Add support for extended errors 2020-04-02 00:30:59 -05:00
James Prestwood
972762b116 handshake: fix OWE PTK derivation
This bug has been in here since OWE was written, but a similar bug also
existed in hostapd which allowed the PTK derivation to be identical.
In January 2020 hostapd fixed this bug, which now makes IWD incompatible
when using group 20 or 21.

This patch fixes the bug for IWD, so now OWE should be compatible with
recent hostapd version. This will break compatibility with old hostapd
versions which still have this bug.
2020-03-20 23:50:55 -05:00
James Prestwood
6e8b765278 wiphy: add check for CMD_AUTH/CMD_ASSOC support
If the AP only supports an AKM which requires an auth protocol
CMD_AUTHENTICATE/CMD_ASSOCIATE must be supported or else the
auth protocol cannot be run. All the auth protocols are started
assuming that the card supports these commands, but the support
was never checked when parsing supported commands.

This patch will prevent any fullMAC cards from using
SAE/FILS/OWE. This was the same behavior as before, just an
earlier failure path.
2020-03-20 18:58:55 -05:00
Andrew Zaborowski
59a7f2e681 frame-xchg: Drop l_io read destroy handler
This function was intended to catch socket errors and destroy the group
but it would leak the l_io object if that happened, and if called on
ordinary shutdown it could cause a crash.  Since we're now assuming
that the netlink socket operations never fail just remove it.
2020-03-20 10:47:53 -05:00
Andrew Zaborowski
97051da883 eap-tls: Print a hint about IWD_TLS_DEBUG on TLS errors 2020-03-20 10:23:30 -05:00
Andrew Zaborowski
264ab685ba ie: Add ie_tlv_extract_wfd_payload 2020-03-20 10:21:04 -05:00
Andrew Zaborowski
430ccf8714 p2putil: Add WFD IE parsing utilities
Only add constants for parsing the Device Information subelement as that
is the main thing we care about in P2P code.  And since our own WFD IEs
will likely only need to contain the Device Information subelement, we
don't need builder utilities.  We do need iterator utilities because we
may receive WFD IEs with more subelements.
2020-03-20 10:18:56 -05:00
Andrew Zaborowski
4abafd8eea wsc: Don't start connections until Cancel finishes
Return busy from StartPin and PushButton if the Cancel method is still
running.
2020-03-20 10:17:04 -05:00
Andrew Zaborowski
485cb4d375 wscutil: Implement wsc_build_probe_response 2020-03-20 10:16:44 -05:00
Andrew Zaborowski
e7e597c876 frame-xchg: Add frame_xchg_start 2020-03-20 10:15:50 -05:00
Andrew Zaborowski
e6de4b10ad frame-xchg: Add facility to keep retransmitting after ACK
In some cases a P2P peer will ACK our frame but not reply on the first
attempt, and other implementations seem to handle this by going back to
retransmitting the frame at a high rate until it gets ACKed again, at
which point they will again give the peer a longer time to tx the
response frame.  Implement the same logic here by adding a
retries_on_ack parameter that takes the number of additional times we
want to restart the normal retransmit counter after we received no
response frame on the first attempt.  So passing 0 maintains the
current behaviour, 1 for 1 extra attempt, etc.

In effect we may retransmit a frame about 15 * (retry_on_ack + 1) *
<in-kernel retransmit limit> times.  The kernel/driver retransmits a
frame a number of times if there's no ACK (I've seen about 20 normally)
at a high frequency, if that fails we retry the whole process 15 times
inside frame-xchg.c and if we still get no ACK at any point, we give up.
If we do get an ACK, we wait for a response frame and if we don't get
that we will optionally reset the retry counter and restart the whole
thing retry_on_ack times.
2020-03-20 10:13:42 -05:00