3:01 a.m.
---
src/wiphy.c | 5 +++++
src/wiphy.h | 1 +
2 files changed, 6 insertions(+)
diff --git a/src/wiphy.c b/src/wiphy.c
index 82e3ca87..e230b273 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -404,6 +404,11 @@ bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss)
return true;
}
+bool wiphy_supports_cmds_auth_assoc(struct wiphy *wiphy)
+{
+ return wiphy->support_cmds_auth_assoc;
+}
+
bool wiphy_has_feature(struct wiphy *wiphy, uint32_t feature)
{
return wiphy->feature_flags & feature;
diff --git a/src/wiphy.h b/src/wiphy.h
index 1fd71f0d..6c91220c 100644
--- a/src/wiphy.h
+++ b/src/wiphy.h
@@ -79,6 +79,7 @@ uint32_t wiphy_get_supported_bands(struct wiphy *wiphy);
const struct scan_freq_set *wiphy_get_supported_freqs(
const struct wiphy *wiphy);
bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss);
+bool wiphy_supports_cmds_auth_assoc(struct wiphy *wiphy);
bool wiphy_can_randomize_mac_addr(struct wiphy *wiphy);
bool wiphy_rrm_capable(struct wiphy *wiphy);
bool wiphy_has_feature(struct wiphy *wiphy, uint32_t feature);
--
2.26.2
3:01 a.m.
New subject: [PATCH v2 2/6] wiphy: check SAE offload in wiphy_select_akm
This allows an SAE AKM to be selected if the hardware does not
support SAE in userspace, but does support SAE offload.
---
src/wiphy.c | 59 ++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 47 insertions(+), 12 deletions(-)
v2:
* Added large comments explaing all the possible scenarios
diff --git a/src/wiphy.c b/src/wiphy.c
index e230b273..89186ce3 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -126,6 +126,52 @@ enum ie_rsn_cipher_suite wiphy_select_cipher(struct wiphy *wiphy,
uint16_t mask)
return 0;
}
+static bool wiphy_can_connect_sae(struct wiphy *wiphy)
+{
+ /*
+ * SAE support in the kernel is a complete mess in that there are 3
+ * different ways the hardware can support SAE:
+ *
+ * 1. Cards which allow SAE in userspace, meaning they support both
+ * CMD_AUTHENTICATE and CMD_ASSOCIATE as well as advertise support
+ * for FEATURE_SAE (SoftMAC).
+ *
+ * 2. Cards which allow SAE to be offloaded to hardware. These cards
+ * do not support AUTH/ASSOC commands, do not advertise FEATURE_SAE,
+ * but advertise support for EXT_FEATURE_SAE_OFFLOAD. With these
+ * cards the entire SAE protocol as well as the subsequent 4-way
+ * handshake are all done in the driver/firmware (fullMAC).
+ *
+ * 3. TODO: Cards which allow SAE in userspace via CMD_EXTERNAL_AUTH.
+ * These cards do not support AUTH/ASSOC commands but do implement
+ * CMD_EXTERNAL_AUTH which is supposed to allow userspace to
+ * generate Authenticate frames as it would for case (1). As it
+ * stands today only one driver actually uses CMD_EXTERNAL_AUTH and
+ * for now IWD will not allow connections to SAE networks using this
+ * mechanism.
+ */
+
+ if (wiphy_has_feature(wiphy, NL80211_FEATURE_SAE)) {
+ /* Case (1) */
+ if (wiphy->support_cmds_auth_assoc)
+ return true;
+
+ /*
+ * Case (3)
+ *
+ * TODO: No support for CMD_EXTERNAL_AUTH yet.
+ */
+ return false;
+ } else {
+ /* Case (2) */
+ if (wiphy_has_ext_feature(wiphy,
+ NL80211_EXT_FEATURE_SAE_OFFLOAD))
+ return true;
+
+ return false;
+ }
+}
+
enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
struct scan_bss *bss,
bool fils_capable_hint)
@@ -188,19 +234,8 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
goto wpa2_personal;
}
- /*
- * TODO: Only SoftMAC (mac80211) drivers are currently
- * capable of SAE since it requires ability to send
- * Authenticate and Associate frames (which is given by
- * support_cmds_auth_assoc). FullMAC drivers require
- * SAE offload which we do not support nor supported
- * in any upstream driver as of this time.
- */
- if (!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) ||
- !wiphy->support_cmds_auth_assoc) {
- l_debug("No HW WPA3 support, trying WPA2");
+ if (!wiphy_can_connect_sae(wiphy))
goto wpa2_personal;
- }
if (info.akm_suites &
IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256)
--
2.26.2
3:01 a.m.
New subject: [PATCH v2 3/6] wiphy: check SAE offload in wiphy_can_connect
This allows this wiphy_can_connect to pass for an SAE BSS
if the hardware does not support user space SAE, but does
support SAE offload.
---
src/wiphy.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/src/wiphy.c b/src/wiphy.c
index 89186ce3..676f236c 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -411,15 +411,7 @@ bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss)
switch (rsn_info.akm_suites) {
case IE_RSN_AKM_SUITE_SAE_SHA256:
case IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256:
- /*
- * if the AP ONLY supports SAE/WPA3, then we can only
- * connect if the wiphy feature is supported. Otherwise
- * the AP may list SAE as one of the AKM's but also
- * support PSK (hybrid). In this case we still want to
- * allow a connection even if SAE is not supported.
- */
- if (!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) ||
- !wiphy->support_cmds_auth_assoc)
+ if (!wiphy_can_connect_sae(wiphy))
return false;
break;
--
2.26.2
3:01 a.m.
New subject: [PATCH v2 4/6] handshake: add offload flag
If true, this flag indicates the handshake is being offloaded to
the kernel/hardware.
---
src/handshake.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/handshake.h b/src/handshake.h
index b738efd9..e667fccd 100644
--- a/src/handshake.h
+++ b/src/handshake.h
@@ -116,6 +116,7 @@ struct handshake_state {
bool wait_for_gtk : 1;
bool no_rekey : 1;
bool support_fils : 1;
+ bool offload : 1;
uint8_t ssid[32];
size_t ssid_len;
char *passphrase;
--
2.26.2
3:01 a.m.
New subject: [PATCH v2 5/6] netdev: add SAE offload support
SAE offload support requires some minor tweaks to CMD_CONNECT
as well as special checks once the connect event comes in. Since
at this point we are fully connected.
---
src/netdev.c | 34 +++++++++++++++++++++++++++++++---
1 file changed, 31 insertions(+), 3 deletions(-)
v2:
* More comments explaining things.
diff --git a/src/netdev.c b/src/netdev.c
index 66a781bc..0cd139c2 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -1212,6 +1212,11 @@ static void netdev_connect_ok(struct netdev *netdev)
netdev->fw_roam_bss = NULL;
}
+ /* Allow station to sync the PSK to disk */
+ if (netdev->handshake->offload)
+ handshake_event(netdev->handshake,
+ HANDSHAKE_EVENT_SETTING_KEYS);
+
if (netdev->connect_cb) {
netdev->connect_cb(netdev, NETDEV_RESULT_OK, NULL,
netdev->user_data);
@@ -1979,6 +1984,14 @@ process_resp_ies:
netdev_send_qos_map_set(netdev, qos_set, qos_len);
}
+ /*
+ * TODO: Only SAE/WPA3-personal offload is supported. In this case IWD
+ * is 'done'. In the case of 8021x offload EAP still needs to take
+ * place, so this must be updated accordingly when that is implemented.
+ */
+ if (netdev->handshake->offload)
+ goto done;
+
if (netdev->sm) {
/*
* Let station know about the roam so a state change can occur.
@@ -2002,6 +2015,7 @@ process_resp_ies:
return;
}
+done:
netdev_connect_ok(netdev);
return;
@@ -2601,7 +2615,9 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev
*netdev,
const struct iovec *vendor_ies,
size_t num_vendor_ies)
{
- uint32_t auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
+ uint32_t auth_type = IE_AKM_IS_SAE(hs->akm_suite) ?
+ NL80211_AUTHTYPE_SAE :
+ NL80211_AUTHTYPE_OPEN_SYSTEM;
struct l_genl_msg *msg;
struct iovec iov[4 + num_vendor_ies];
int iov_elems = 0;
@@ -2618,6 +2634,12 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev
*netdev,
bss->ssid_len, bss->ssid);
l_genl_msg_append_attr(msg, NL80211_ATTR_AUTH_TYPE, 4, &auth_type);
+ if (hs->offload) {
+ if (IE_AKM_IS_SAE(hs->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_SAE_PASSWORD,
+ strlen(hs->passphrase), hs->passphrase);
+ }
+
if (prev_bssid)
l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
prev_bssid);
@@ -2659,7 +2681,9 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev
*netdev,
l_genl_msg_append_attr(msg, NL80211_ATTR_AKM_SUITES,
4, &nl_akm);
- if (hs->wpa_ie)
+ if (IE_AKM_IS_SAE(hs->akm_suite))
+ wpa_version = NL80211_WPA_VERSION_3;
+ else if (hs->wpa_ie)
wpa_version = NL80211_WPA_VERSION_1;
else
wpa_version = NL80211_WPA_VERSION_2;
@@ -3020,6 +3044,9 @@ int netdev_connect(struct netdev *netdev, struct scan_bss *bss,
switch (hs->akm_suite) {
case IE_RSN_AKM_SUITE_SAE_SHA256:
case IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256:
+ if (hs->offload)
+ goto build_cmd_connect;
+
netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
netdev_sae_tx_associate,
netdev);
@@ -3038,13 +3065,14 @@ int netdev_connect(struct netdev *netdev, struct scan_bss *bss,
netdev);
break;
default:
+build_cmd_connect:
cmd_connect = netdev_build_cmd_connect(netdev, bss, hs,
NULL, vendor_ies, num_vendor_ies);
if (!cmd_connect)
return -EINVAL;
- if (is_rsn || hs->settings_8021x)
+ if (!hs->offload && (is_rsn || hs->settings_8021x))
sm = eapol_sm_new(hs);
}
--
2.26.2
3:01 a.m.
New subject: [PATCH v2 6/6] station: set handshake offload if required
If IWD is connecting to a SAE/WPA3 BSS and Auth/Assoc commands
are not supported the only option is SAE offload. At this point
network_connect should have verified that the extended feature
for SAE offload exists so we can simply enable offload if these
commands are not supported.
---
src/station.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/station.c b/src/station.c
index 2e577290..385dc7da 100644
--- a/src/station.c
+++ b/src/station.c
@@ -979,6 +979,16 @@ static struct handshake_state *station_handshake_setup(struct station
*station,
goto no_psk;
handshake_state_set_passphrase(hs, passphrase);
+
+ /*
+ * TODO: This check isn't strictly correct since
+ * some drivers may support EXTERNAL_AUTH but since
+ * wiphy_can_connect takes this into account IWD should
+ * have already rejected the connection if this was the
+ * case.
+ */
+ if (!wiphy_supports_cmds_auth_assoc(wiphy))
+ hs->offload = true;
} else {
const uint8_t *psk = network_get_psk(network);
--
2.26.2
545
days inactive
545
days old
6 comments
2 participants
participants (2)
-
Denis Kenzior -
James Prestwood