1:19 a.m.
The 'in_ft' flag is going to be renamed/repurposed to be used
with reassociations as well as FT. Because of this the check
here is being re-worked to use the AKMs rather than this flag.
---
src/netdev.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index deb780dc..ff9110ea 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2510,11 +2510,10 @@ static void netdev_associate_event(struct l_genl_msg *msg,
ret = auth_proto_rx_associate(netdev->ap, frame, frame_len);
if (ret == 0) {
- bool fils = !!(netdev->handshake->akm_suite &
- (IE_RSN_AKM_SUITE_FILS_SHA256 |
- IE_RSN_AKM_SUITE_FILS_SHA384 |
- IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384 |
- IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA256));
+ bool require_handshake = IE_AKM_IS_FILS(
+ netdev->handshake->akm_suite) ||
+ IE_AKM_IS_FT(
+ netdev->handshake->akm_suite);
auth_proto_free(netdev->ap);
netdev->ap = NULL;
@@ -2530,7 +2529,7 @@ static void netdev_associate_event(struct l_genl_msg *msg,
* handshake and instead just keep the EAPoL state
* machine for the rekeys.
*/
- if (netdev->in_ft || fils)
+ if (require_handshake)
eapol_sm_set_require_handshake(netdev->sm,
false);
--
2.31.1
1:19 a.m.
New subject: [PATCH 2/6] netdev: rename in_ft flag to in_roam
The 'in_ft' flag's only purpose now is to ignore disconnect events.
Since disconnect events also occur with reassociations this flag
was renamed to make it more general purpose rather than only
significant for FT roams.
---
src/netdev.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index ff9110ea..eebced05 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -174,7 +174,7 @@ struct netdev {
bool operational : 1;
bool rekey_offload_support : 1;
bool pae_over_nl80211 : 1;
- bool in_ft : 1;
+ bool in_roam : 1;
bool cur_rssi_low : 1;
bool use_4addr : 1;
bool ignore_connect_event : 1;
@@ -755,7 +755,7 @@ static void netdev_connect_free(struct netdev *netdev)
netdev->user_data = NULL;
netdev->result = NETDEV_RESULT_OK;
netdev->last_code = 0;
- netdev->in_ft = false;
+ netdev->in_roam = false;
netdev->ignore_connect_event = false;
netdev->expect_connect_failure = false;
netdev->cur_rssi_low = false;
@@ -1098,7 +1098,7 @@ static void netdev_disconnect_event(struct l_genl_msg *msg,
l_debug("");
if (!netdev->connected || netdev->disconnect_cmd_id > 0 ||
- netdev->in_ft)
+ netdev->in_roam)
return;
if (!l_genl_attr_init(&attr, msg)) {
@@ -2533,7 +2533,7 @@ static void netdev_associate_event(struct l_genl_msg *msg,
eapol_sm_set_require_handshake(netdev->sm,
false);
- netdev->in_ft = false;
+ netdev->in_roam = false;
netdev->associated = true;
return;
} else if (ret == -EAGAIN) {
@@ -3865,7 +3865,7 @@ static void prepare_ft(struct netdev *netdev, struct scan_bss
*target_bss)
netdev->associated = false;
netdev->operational = false;
- netdev->in_ft = true;
+ netdev->in_roam = true;
/*
* Cancel commands that could be running because of EAPoL activity
--
2.31.1
1:19 a.m.
New subject: [PATCH 3/6] netdev: allow SAE reassociation
This adds support in netdev_reassociate for SAE. An SAE auth
protocol is created rather than the connect command and from
here there is virtually no difference to a normal connection
attempt. The only differences are 'in_roam' is set as to
ignore the inevitable disconnect event and PREV_BSSID is
appended to CMD_ASSOCIATE only for this new reassociation case.
---
src/netdev.c | 27 ++++++++++++++++++++-------
1 file changed, 20 insertions(+), 7 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index eebced05..e9c19faf 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2715,6 +2715,11 @@ static void netdev_sae_tx_associate(void *user_data)
l_genl_msg_append_attrv(msg, NL80211_ATTR_IE, iov, n_used);
+ /* If doing a non-FT Reassociation */
+ if (netdev->in_roam && !IE_AKM_IS_FT(netdev->handshake->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, 6,
+ netdev->prev_bssid);
+
if (!l_genl_family_send(nl80211, msg, netdev_assoc_cb, netdev, NULL)) {
l_genl_msg_unref(msg);
netdev_connect_failed(netdev, NETDEV_RESULT_ASSOCIATION_FAILED,
@@ -3583,7 +3588,7 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
netdev_event_func_t event_filter,
netdev_connect_cb_t cb, void *user_data)
{
- struct l_genl_msg *cmd_connect;
+ struct l_genl_msg *cmd_connect = NULL;
struct netdev_handshake_state;
struct handshake_state *old_hs;
struct eapol_sm *sm = NULL, *old_sm;
@@ -3593,16 +3598,21 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (netdev_handshake_state_setup_connection_type(hs) < 0)
return -ENOTSUP;
- /* TODO: SoftMac SAE/FILS Re-Associations are not suppored yet */
- if (L_WARN_ON(IE_AKM_IS_SAE(hs->akm_suite) ||
- IE_AKM_IS_FILS(hs->akm_suite)))
+ /* TODO: SoftMac FILS Re-Associations are not suppored yet */
+ if (L_WARN_ON(IE_AKM_IS_FILS(hs->akm_suite)))
return -ENOTSUP;
- cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
+ if (IE_AKM_IS_SAE(hs->akm_suite))
+ netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
+ netdev_sae_tx_associate,
+ netdev);
+ else {
+ cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
orig_bss->addr, NULL, 0);
- if (is_rsn)
- sm = eapol_sm_new(hs);
+ if (is_rsn)
+ sm = eapol_sm_new(hs);
+ }
old_sm = netdev->sm;
old_hs = netdev->handshake;
@@ -3612,11 +3622,14 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (err < 0)
return err;
+ l_debug("reassociate to "MAC, MAC_STR(target_bss->addr));
+
memcpy(netdev->prev_bssid, orig_bss->addr, ETH_ALEN);
netdev->associated = false;
netdev->operational = false;
netdev->connected = false;
+ netdev->in_roam = true;
netdev_rssi_polling_update(netdev);
--
2.31.1
1:19 a.m.
New subject: [PATCH 4/6] auto-t: add reassociate test to FT-SAE-roam
This refactors to test both FT and reassociation.
---
autotests/testFT-SAE-roam/connection_test.py | 91 +++++++++++++-------
1 file changed, 61 insertions(+), 30 deletions(-)
diff --git a/autotests/testFT-SAE-roam/connection_test.py
b/autotests/testFT-SAE-roam/connection_test.py
index bea42856..16316123 100644
--- a/autotests/testFT-SAE-roam/connection_test.py
+++ b/autotests/testFT-SAE-roam/connection_test.py
@@ -14,32 +14,17 @@ import testutil
from config import ctx
class Test(unittest.TestCase):
- def test_roam_success(self):
- hwsim = Hwsim()
-
- rule0 = hwsim.rules.create()
- rule0.source = self.bss_radio[0].addresses[0]
- rule0.bidirectional = True
-
- rule1 = hwsim.rules.create()
- rule1.source = self.bss_radio[1].addresses[0]
- rule1.bidirectional = True
-
- rule2 = hwsim.rules.create()
- rule2.source = self.bss_radio[2].addresses[0]
- rule2.bidirectional = True
-
+ def validate_connection(self, wd, ft=True):
# Check that iwd selects BSS 0 first
- rule0.signal = -2000
- rule1.signal = -6900
- rule2.signal = -7200
-
- wd = IWD(True)
+ self.rule[0].signal = -2000
+ self.rule[1].signal = -6900
+ self.rule[2].signal = -7200
psk_agent = PSKAgent("EasilyGuessedPassword")
wd.register_psk_agent(psk_agent)
device = wd.list_devices(1)[0]
+ device.disconnect()
condition = 'not obj.scanning'
wd.wait_for_object_condition(device, condition)
@@ -84,7 +69,7 @@ class Test(unittest.TestCase):
# by mac80211_hwsim will not finish. If this times out then, but
# device_roam_trigger_cb has happened, it probably means that
# Neighbor Reports are broken.
- rule0.signal = -8000
+ self.rule[0].signal = -8000
condition = 'obj.state == DeviceState.roaming'
wd.wait_for_object_condition(device, condition)
@@ -95,7 +80,7 @@ class Test(unittest.TestCase):
to_condition = 'obj.state == DeviceState.connected'
wd.wait_for_object_change(device, from_condition, to_condition)
- rule1.signal = -2000
+ self.rule[1].signal = -2000
# wait for IWD's signal levels to recover
wd.wait(5)
@@ -107,10 +92,13 @@ class Test(unittest.TestCase):
self.assertRaises(Exception, testutil.test_ifaces_connected,
(self.bss_hostapd[0].ifname, device.name))
- # test FT-PSK after FT-SAE
- rule1.signal = -8000
- rule0.signal = -8000
- rule2.signal = -1000
+ if not ft:
+ return
+
+ # test FT-PSK after FT-SAE
+ self.rule[1].signal = -8000
+ self.rule[0].signal = -8000
+ self.rule[2].signal = -1000
condition = 'obj.state == DeviceState.roaming'
wd.wait_for_object_condition(device, condition)
@@ -125,6 +113,35 @@ class Test(unittest.TestCase):
testutil.test_ifaces_connected(self.bss_hostapd[2].ifname, device.name)
self.assertRaises(Exception, testutil.test_ifaces_connected,
(self.bss_hostapd[1].ifname, device.name))
+ def test_ft_roam_success(self):
+ wd = IWD(True)
+
+ self.bss_hostapd[0].set_value('wpa_key_mgmt', 'FT-SAE SAE')
+ self.bss_hostapd[0].reload()
+ self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[1].set_value('wpa_key_mgmt', 'FT-SAE SAE')
+ self.bss_hostapd[1].reload()
+ self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[2].set_value('wpa_key_mgmt', 'FT-PSK')
+ self.bss_hostapd[2].reload()
+ self.bss_hostapd[2].wait_for_event("AP-ENABLED")
+
+ self.validate_connection(wd, True)
+
+ def test_reassociate_roam_success(self):
+ wd = IWD(True)
+
+ self.bss_hostapd[0].set_value('wpa_key_mgmt', 'SAE')
+ self.bss_hostapd[0].reload()
+ self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[1].set_value('wpa_key_mgmt', 'SAE')
+ self.bss_hostapd[1].reload()
+ self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[2].set_value('wpa_key_mgmt', 'WPA-PSK')
+ self.bss_hostapd[2].reload()
+ self.bss_hostapd[2].wait_for_event("AP-ENABLED")
+
+ self.validate_connection(wd, False)
def tearDown(self):
os.system('ifconfig "' + self.bss_hostapd[0].ifname + '"
down')
@@ -134,10 +151,6 @@ class Test(unittest.TestCase):
os.system('ifconfig "' + self.bss_hostapd[1].ifname + '"
up')
os.system('ifconfig "' + self.bss_hostapd[2].ifname + '"
up')
- hwsim = Hwsim()
- for rule in list(hwsim.rules.keys()):
- del hwsim.rules[rule]
-
@classmethod
def setUpClass(cls):
hwsim = Hwsim()
@@ -149,6 +162,19 @@ class Test(unittest.TestCase):
hwsim.get_radio('rad1'),
hwsim.get_radio('rad2') ]
+ cls.rule = [ hwsim.rules.create(),
+ hwsim.rules.create(),
+ hwsim.rules.create() ]
+
+ cls.rule[0].source = cls.bss_radio[0].addresses[0]
+ cls.rule[0].bidirectional = True
+
+ cls.rule[1].source = cls.bss_radio[1].addresses[0]
+ cls.rule[1].bidirectional = True
+
+ cls.rule[2].source = cls.bss_radio[2].addresses[0]
+ cls.rule[2].bidirectional = True
+
ctx.start_process(['ifconfig', cls.bss_hostapd[0].ifname, 'down',
'hw', \
'ether', '12:00:00:00:00:01',
'up'], wait=True)
ctx.start_process(['ifconfig', cls.bss_hostapd[1].ifname, 'down',
'hw', \
@@ -187,6 +213,11 @@ class Test(unittest.TestCase):
@classmethod
def tearDownClass(cls):
IWD.clear_storage()
+
+ hwsim = Hwsim()
+ for rule in list(hwsim.rules.keys()):
+ del hwsim.rules[rule]
+
cls.bss_hostapd = None
cls.bss_radio = None
--
2.31.1
1:19 a.m.
New subject: [PATCH 5/6] auto-t: rename testFT-SAE-roam to testSAE-roam
Since reassociation is now tested this name fits better
---
autotests/{testFT-SAE-roam => testSAE-roam}/connection_test.py | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-psk-3.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-1.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-2.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/hw.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/main.conf | 0
6 files changed, 0 insertions(+), 0 deletions(-)
rename autotests/{testFT-SAE-roam => testSAE-roam}/connection_test.py (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-psk-3.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-1.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-2.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/hw.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/main.conf (100%)
diff --git a/autotests/testFT-SAE-roam/connection_test.py
b/autotests/testSAE-roam/connection_test.py
similarity index 100%
rename from autotests/testFT-SAE-roam/connection_test.py
rename to autotests/testSAE-roam/connection_test.py
diff --git a/autotests/testFT-SAE-roam/ft-psk-3.conf
b/autotests/testSAE-roam/ft-psk-3.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-psk-3.conf
rename to autotests/testSAE-roam/ft-psk-3.conf
diff --git a/autotests/testFT-SAE-roam/ft-sae-1.conf
b/autotests/testSAE-roam/ft-sae-1.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-sae-1.conf
rename to autotests/testSAE-roam/ft-sae-1.conf
diff --git a/autotests/testFT-SAE-roam/ft-sae-2.conf
b/autotests/testSAE-roam/ft-sae-2.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-sae-2.conf
rename to autotests/testSAE-roam/ft-sae-2.conf
diff --git a/autotests/testFT-SAE-roam/hw.conf b/autotests/testSAE-roam/hw.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/hw.conf
rename to autotests/testSAE-roam/hw.conf
diff --git a/autotests/testFT-SAE-roam/main.conf b/autotests/testSAE-roam/main.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/main.conf
rename to autotests/testSAE-roam/main.conf
--
2.31.1
1:19 a.m.
New subject: [PATCH 6/6] netdev: enable FILS reassociation
In the same vein of SAE reassociation create a FILS auth
proto just as we would for a normal connection. Then append
the PREV_BSSID for reassociation.
---
src/netdev.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index e9c19faf..0800f334 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2803,6 +2803,11 @@ static void netdev_fils_tx_associate(struct iovec *iov, size_t
iov_len,
l_genl_msg_append_attr(msg, NL80211_ATTR_FILS_KEK, kek_len, kek);
l_genl_msg_append_attr(msg, NL80211_ATTR_FILS_NONCES, nonces_len, nonces);
+ /* If doing a non-FT Reassociation */
+ if (netdev->in_roam && !IE_AKM_IS_FT(netdev->handshake->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, 6,
+ netdev->prev_bssid);
+
if (!l_genl_family_send(nl80211, msg, netdev_assoc_cb,
netdev, NULL)) {
l_genl_msg_unref(msg);
@@ -3598,14 +3603,14 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (netdev_handshake_state_setup_connection_type(hs) < 0)
return -ENOTSUP;
- /* TODO: SoftMac FILS Re-Associations are not suppored yet */
- if (L_WARN_ON(IE_AKM_IS_FILS(hs->akm_suite)))
- return -ENOTSUP;
-
if (IE_AKM_IS_SAE(hs->akm_suite))
netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
netdev_sae_tx_associate,
netdev);
+ else if (IE_AKM_IS_FILS(hs->akm_suite))
+ netdev->ap = fils_sm_new(hs, netdev_fils_tx_authenticate,
+ netdev_fils_tx_associate,
+ netdev);
else {
cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
orig_bss->addr, NULL, 0);
--
2.31.1
409
days inactive
409
days old
5 comments
1 participants
participants (1)
-
James Prestwood