--- src/ft.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/ft.c b/src/ft.c index cff1d759..6897f6d7 100644 --- a/src/ft.c +++ b/src/ft.c @@ -32,6 +32,7 @@ #include "src/ft.h" #include "src/mpdu.h" #include "src/auth-proto.h" +#include "src/band.h" struct ft_sm { struct auth_proto ap; @@ -273,6 +274,22 @@ static int ft_tx_reassociate(struct ft_sm *ft) memcpy(ft_info.anonce, hs->anonce, 32); memcpy(ft_info.snonce, hs->snonce, 32); + /* + * IEEE 802.11-2020 Section 13.7.1 FT reassociation in an RSN + * + * "If dot11RSNAOperatingChannelValidationActivated is true and + * the FTO indicates OCVC capability, the target AP shall + * ensure that OCI subelement of the FTE matches by ensuring + * that all of the following are true: + * - OCI subelement is present + * - Channel information in the OCI matches current + * operating channel parameters (see 12.2.9)" + */ + if (hs->supplicant_ocvc && hs->chandef) { + oci_from_chandef(hs->chandef, ft_info.oci); + ft_info.oci_present = true; + } + fte = alloca(256); ie_build_fast_bss_transition(&ft_info, kck_len, fte); -- 2.31.1

This modifies the FT logic to fist call get_oci() before reassociation. This allows the OCI to be included in reassociation and in the 4-way handshake later on. --- src/ft.c | 13 ++++++++++++- src/ft.h | 2 ++ src/netdev.c | 20 +++++++++++++++++++- 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/src/ft.c b/src/ft.c index 6897f6d7..40e29341 100644 --- a/src/ft.c +++ b/src/ft.c @@ -40,6 +40,7 @@ struct ft_sm { ft_tx_authenticate_func_t tx_auth; ft_tx_associate_func_t tx_assoc; + ft_get_oci get_oci; void *user_data; }; @@ -640,7 +641,7 @@ static int ft_rx_authenticate(struct auth_proto *ap, const uint8_t *frame, if (ret < 0) goto auth_error; - return ft_tx_reassociate(ft); + return ft->get_oci(ft->user_data); auth_error: return (int)status_code; @@ -783,6 +784,13 @@ static int ft_rx_associate(struct auth_proto *ap, const uint8_t *frame, return 0; } +static int ft_rx_oci(struct auth_proto *ap) +{ + struct ft_sm *ft = l_container_of(ap, struct ft_sm, ap); + + return ft_tx_reassociate(ft); +} + static void ft_sm_free(struct auth_proto *ap) { struct ft_sm *ft = l_container_of(ap, struct ft_sm, ap); @@ -890,12 +898,14 @@ static bool ft_start(struct auth_proto *ap) struct auth_proto *ft_over_air_sm_new(struct handshake_state *hs, ft_tx_authenticate_func_t tx_auth, ft_tx_associate_func_t tx_assoc, + ft_get_oci get_oci, void *user_data) { struct ft_sm *ft = l_new(struct ft_sm, 1); ft->tx_auth = tx_auth; ft->tx_assoc = tx_assoc; + ft->get_oci = get_oci; ft->hs = hs; ft->user_data = user_data; @@ -903,6 +913,7 @@ struct auth_proto *ft_over_air_sm_new(struct handshake_state *hs, ft->ap.rx_associate = ft_rx_associate; ft->ap.start = ft_start; ft->ap.free = ft_sm_free; + ft->ap.rx_oci = ft_rx_oci; return &ft->ap; } diff --git a/src/ft.h b/src/ft.h index 6167e0d7..cc25463f 100644 --- a/src/ft.h +++ b/src/ft.h @@ -26,6 +26,7 @@ typedef void (*ft_tx_authenticate_func_t)(struct iovec *iov, size_t iov_len, void *user_data); typedef int (*ft_tx_associate_func_t)(struct iovec *ie_iov, size_t iov_len, void *user_data); +typedef int (*ft_get_oci)(void *user_data); typedef void (*ft_ds_free_func_t)(void *user_data); @@ -60,6 +61,7 @@ bool ft_over_ds_parse_action_ies(struct ft_ds_info *info, struct auth_proto *ft_over_air_sm_new(struct handshake_state *hs, ft_tx_authenticate_func_t tx_auth, ft_tx_associate_func_t tx_assoc, + ft_get_oci get_oci, void *user_data); struct auth_proto *ft_over_ds_sm_new(struct handshake_state *hs, diff --git a/src/netdev.c b/src/netdev.c index 5a44895d..91d1316c 100644 --- a/src/netdev.c +++ b/src/netdev.c @@ -2074,6 +2074,21 @@ static void netdev_get_oci_cb(struct l_genl_msg *msg, void *user_data) handshake_state_set_chandef(netdev->handshake, l_steal_ptr(chandef)); done: + if (netdev->ap) { + /* + * Cant do much here. IWD assumes every kernel/driver supports + * this. There is no way of detecting support either. + */ + if (L_WARN_ON(err < 0)) + netdev_connect_failed(netdev, + NETDEV_RESULT_AUTHENTICATION_FAILED, + MMPDU_STATUS_CODE_UNSPECIFIED); + else + auth_proto_rx_oci(netdev->ap); + + return; + } + L_WARN_ON(!eapol_start(netdev->sm)); } @@ -4099,6 +4114,8 @@ static void prepare_ft(struct netdev *netdev, const struct scan_bss *target_bss) netdev->operational = false; netdev->in_ft = true; + handshake_state_set_chandef(netdev->handshake, NULL); + /* * Cancel commands that could be running because of EAPoL activity * like re-keying, this way the callbacks for those commands don't @@ -4274,7 +4291,8 @@ int netdev_fast_transition(struct netdev *netdev, netdev->ap = ft_over_air_sm_new(netdev->handshake, netdev_ft_tx_authenticate, - netdev_ft_tx_associate, netdev); + netdev_ft_tx_associate, + netdev_get_oci, netdev); memcpy(netdev->ap->prev_bssid, orig_bss->addr, ETH_ALEN); wiphy_radio_work_insert(netdev->wiphy, &netdev->work, 1, -- 2.31.1

Hi, On Mon, 2021-09-27 at 12:55 -0500, Denis Kenzior wrote: I'll make sure. Also, I realized we will be getting the OCI again after FT succeeds so I need to change up some logic a bit so we only get OCI when its not already updated. I also have FILS changes locally which suffer the same problem.

Hi James, On 9/27/21 12:04 PM, James Prestwood wrote: You can't really do it this way since this builds the handshake for an initial association. Only FT-over-DS is affected, and so you want to reset ocvc elsewhere. Maybe prior to calling netdev_fast_transition_over_ds or somewhere inside that function. Also, can we add a way to disable OCV in case we get into compatibility issues? Regards, -Denis

If the AP advertises FT-over-DS support it likely wants us to use it. Additionally signal_low is probably going to be true since IWD has started a roam attempt. --- src/station.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/station.c b/src/station.c index 96794998..9da5c595 100644 --- a/src/station.c +++ b/src/station.c @@ -2022,8 +2022,7 @@ static void station_transition_start(struct station *station, vendor_ies = network_info_get_extra_ies(info, bss, &iov_elems); handshake_state_set_vendor_ies(hs, vendor_ies, iov_elems); - /* FT-over-DS can be better suited for these situations */ - if ((hs->mde[4] & 1) && station->signal_low) { + if ((hs->mde[4] & 1)) { ret = netdev_fast_transition_over_ds(station->netdev, bss, station->connected_bss, station_fast_transition_cb); -- 2.31.1