2:59 a.m.
This adds support in netdev_reassociate for SAE. An SAE auth
protocol is created rather than the connect command and from
here there is virtually no difference to a normal connection
attempt. The only differences are 'in_roam' is set as to
ignore the inevitable disconnect event and PREV_BSSID is
appended to CMD_ASSOCIATE only for this new reassociation case.
---
src/netdev.c | 32 ++++++++++++++++++++++++--------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index deb780dc..f42e7881 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -182,6 +182,7 @@ struct netdev {
bool aborting : 1;
bool events_ready : 1;
bool retry_auth : 1;
+ bool in_reassoc : 1;
};
struct netdev_preauth_state {
@@ -756,6 +757,7 @@ static void netdev_connect_free(struct netdev *netdev)
netdev->result = NETDEV_RESULT_OK;
netdev->last_code = 0;
netdev->in_ft = false;
+ netdev->in_reassoc = false;
netdev->ignore_connect_event = false;
netdev->expect_connect_failure = false;
netdev->cur_rssi_low = false;
@@ -1098,7 +1100,7 @@ static void netdev_disconnect_event(struct l_genl_msg *msg,
l_debug("");
if (!netdev->connected || netdev->disconnect_cmd_id > 0 ||
- netdev->in_ft)
+ netdev->in_ft || netdev->in_reassoc)
return;
if (!l_genl_attr_init(&attr, msg)) {
@@ -2535,6 +2537,7 @@ static void netdev_associate_event(struct l_genl_msg *msg,
false);
netdev->in_ft = false;
+ netdev->in_reassoc = false;
netdev->associated = true;
return;
} else if (ret == -EAGAIN) {
@@ -2716,6 +2719,11 @@ static void netdev_sae_tx_associate(void *user_data)
l_genl_msg_append_attrv(msg, NL80211_ATTR_IE, iov, n_used);
+ /* If doing a non-FT Reassociation */
+ if (netdev->in_reassoc && !IE_AKM_IS_FT(netdev->handshake->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, 6,
+ netdev->prev_bssid);
+
if (!l_genl_family_send(nl80211, msg, netdev_assoc_cb, netdev, NULL)) {
l_genl_msg_unref(msg);
netdev_connect_failed(netdev, NETDEV_RESULT_ASSOCIATION_FAILED,
@@ -3584,7 +3592,7 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
netdev_event_func_t event_filter,
netdev_connect_cb_t cb, void *user_data)
{
- struct l_genl_msg *cmd_connect;
+ struct l_genl_msg *cmd_connect = NULL;
struct netdev_handshake_state;
struct handshake_state *old_hs;
struct eapol_sm *sm = NULL, *old_sm;
@@ -3594,16 +3602,21 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (netdev_handshake_state_setup_connection_type(hs) < 0)
return -ENOTSUP;
- /* TODO: SoftMac SAE/FILS Re-Associations are not suppored yet */
- if (L_WARN_ON(IE_AKM_IS_SAE(hs->akm_suite) ||
- IE_AKM_IS_FILS(hs->akm_suite)))
+ /* TODO: SoftMac FILS Re-Associations are not suppored yet */
+ if (L_WARN_ON(IE_AKM_IS_FILS(hs->akm_suite)))
return -ENOTSUP;
- cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
+ if (IE_AKM_IS_SAE(hs->akm_suite))
+ netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
+ netdev_sae_tx_associate,
+ netdev);
+ else {
+ cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
orig_bss->addr, NULL, 0);
- if (is_rsn)
- sm = eapol_sm_new(hs);
+ if (is_rsn)
+ sm = eapol_sm_new(hs);
+ }
old_sm = netdev->sm;
old_hs = netdev->handshake;
@@ -3613,11 +3626,14 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (err < 0)
return err;
+ l_debug("reassociate to "MAC, MAC_STR(target_bss->addr));
+
memcpy(netdev->prev_bssid, orig_bss->addr, ETH_ALEN);
netdev->associated = false;
netdev->operational = false;
netdev->connected = false;
+ netdev->in_reassoc = true;
netdev_rssi_polling_update(netdev);
--
2.31.1
2:59 a.m.
New subject: [PATCH v2 2/4] auto-t: add reassociate test to FT-SAE-roam
This refactors to test both FT and reassociation.
---
autotests/testFT-SAE-roam/TestFT.psk | 5 +
autotests/testFT-SAE-roam/connection_test.py | 98 +++++++++++++-------
2 files changed, 68 insertions(+), 35 deletions(-)
create mode 100644 autotests/testFT-SAE-roam/TestFT.psk
diff --git a/autotests/testFT-SAE-roam/TestFT.psk b/autotests/testFT-SAE-roam/TestFT.psk
new file mode 100644
index 00000000..acadaab9
--- /dev/null
+++ b/autotests/testFT-SAE-roam/TestFT.psk
@@ -0,0 +1,5 @@
+[Security]
+Passphrase=EasilyGuessedPassword
+
+[Settings]
+AutoConnect=False
diff --git a/autotests/testFT-SAE-roam/connection_test.py
b/autotests/testFT-SAE-roam/connection_test.py
index bea42856..ca64b6e4 100644
--- a/autotests/testFT-SAE-roam/connection_test.py
+++ b/autotests/testFT-SAE-roam/connection_test.py
@@ -14,32 +14,14 @@ import testutil
from config import ctx
class Test(unittest.TestCase):
- def test_roam_success(self):
- hwsim = Hwsim()
-
- rule0 = hwsim.rules.create()
- rule0.source = self.bss_radio[0].addresses[0]
- rule0.bidirectional = True
-
- rule1 = hwsim.rules.create()
- rule1.source = self.bss_radio[1].addresses[0]
- rule1.bidirectional = True
-
- rule2 = hwsim.rules.create()
- rule2.source = self.bss_radio[2].addresses[0]
- rule2.bidirectional = True
-
+ def validate_connection(self, wd, ft=True):
# Check that iwd selects BSS 0 first
- rule0.signal = -2000
- rule1.signal = -6900
- rule2.signal = -7200
-
- wd = IWD(True)
-
- psk_agent = PSKAgent("EasilyGuessedPassword")
- wd.register_psk_agent(psk_agent)
+ self.rule[0].signal = -2000
+ self.rule[1].signal = -6900
+ self.rule[2].signal = -7200
device = wd.list_devices(1)[0]
+ device.disconnect()
condition = 'not obj.scanning'
wd.wait_for_object_condition(device, condition)
@@ -71,8 +53,6 @@ class Test(unittest.TestCase):
self.assertTrue(self.bss_hostapd[0].list_sta())
self.assertFalse(self.bss_hostapd[1].list_sta())
- wd.unregister_psk_agent(psk_agent)
-
testutil.test_iface_operstate(device.name)
testutil.test_ifaces_connected(self.bss_hostapd[0].ifname, device.name)
self.assertRaises(Exception, testutil.test_ifaces_connected,
@@ -84,7 +64,7 @@ class Test(unittest.TestCase):
# by mac80211_hwsim will not finish. If this times out then, but
# device_roam_trigger_cb has happened, it probably means that
# Neighbor Reports are broken.
- rule0.signal = -8000
+ self.rule[0].signal = -8000
condition = 'obj.state == DeviceState.roaming'
wd.wait_for_object_condition(device, condition)
@@ -95,7 +75,7 @@ class Test(unittest.TestCase):
to_condition = 'obj.state == DeviceState.connected'
wd.wait_for_object_change(device, from_condition, to_condition)
- rule1.signal = -2000
+ self.rule[1].signal = -2000
# wait for IWD's signal levels to recover
wd.wait(5)
@@ -107,10 +87,13 @@ class Test(unittest.TestCase):
self.assertRaises(Exception, testutil.test_ifaces_connected,
(self.bss_hostapd[0].ifname, device.name))
- # test FT-PSK after FT-SAE
- rule1.signal = -8000
- rule0.signal = -8000
- rule2.signal = -1000
+ if not ft:
+ return
+
+ # test FT-PSK after FT-SAE
+ self.rule[1].signal = -8000
+ self.rule[0].signal = -8000
+ self.rule[2].signal = -1000
condition = 'obj.state == DeviceState.roaming'
wd.wait_for_object_condition(device, condition)
@@ -125,6 +108,35 @@ class Test(unittest.TestCase):
testutil.test_ifaces_connected(self.bss_hostapd[2].ifname, device.name)
self.assertRaises(Exception, testutil.test_ifaces_connected,
(self.bss_hostapd[1].ifname, device.name))
+ def test_ft_roam_success(self):
+ wd = IWD(True)
+
+ self.bss_hostapd[0].set_value('wpa_key_mgmt', 'FT-SAE SAE')
+ self.bss_hostapd[0].reload()
+ self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[1].set_value('wpa_key_mgmt', 'FT-SAE SAE')
+ self.bss_hostapd[1].reload()
+ self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[2].set_value('wpa_key_mgmt', 'FT-PSK')
+ self.bss_hostapd[2].reload()
+ self.bss_hostapd[2].wait_for_event("AP-ENABLED")
+
+ self.validate_connection(wd, True)
+
+ def test_reassociate_roam_success(self):
+ wd = IWD(True)
+
+ self.bss_hostapd[0].set_value('wpa_key_mgmt', 'SAE')
+ self.bss_hostapd[0].reload()
+ self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[1].set_value('wpa_key_mgmt', 'SAE')
+ self.bss_hostapd[1].reload()
+ self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+ self.bss_hostapd[2].set_value('wpa_key_mgmt', 'WPA-PSK')
+ self.bss_hostapd[2].reload()
+ self.bss_hostapd[2].wait_for_event("AP-ENABLED")
+
+ self.validate_connection(wd, False)
def tearDown(self):
os.system('ifconfig "' + self.bss_hostapd[0].ifname + '"
down')
@@ -134,10 +146,6 @@ class Test(unittest.TestCase):
os.system('ifconfig "' + self.bss_hostapd[1].ifname + '"
up')
os.system('ifconfig "' + self.bss_hostapd[2].ifname + '"
up')
- hwsim = Hwsim()
- for rule in list(hwsim.rules.keys()):
- del hwsim.rules[rule]
-
@classmethod
def setUpClass(cls):
hwsim = Hwsim()
@@ -149,6 +157,19 @@ class Test(unittest.TestCase):
hwsim.get_radio('rad1'),
hwsim.get_radio('rad2') ]
+ cls.rule = [ hwsim.rules.create(),
+ hwsim.rules.create(),
+ hwsim.rules.create() ]
+
+ cls.rule[0].source = cls.bss_radio[0].addresses[0]
+ cls.rule[0].bidirectional = True
+
+ cls.rule[1].source = cls.bss_radio[1].addresses[0]
+ cls.rule[1].bidirectional = True
+
+ cls.rule[2].source = cls.bss_radio[2].addresses[0]
+ cls.rule[2].bidirectional = True
+
ctx.start_process(['ifconfig', cls.bss_hostapd[0].ifname, 'down',
'hw', \
'ether', '12:00:00:00:00:01',
'up'], wait=True)
ctx.start_process(['ifconfig', cls.bss_hostapd[1].ifname, 'down',
'hw', \
@@ -184,9 +205,16 @@ class Test(unittest.TestCase):
cls.bss_hostapd[2].set_neighbor('12:00:00:00:00:02', 'TestFT',
'1200000000028f0000005101060603000000')
+ IWD.copy_to_storage('TestFT.psk')
+
@classmethod
def tearDownClass(cls):
IWD.clear_storage()
+
+ hwsim = Hwsim()
+ for rule in list(hwsim.rules.keys()):
+ del hwsim.rules[rule]
+
cls.bss_hostapd = None
cls.bss_radio = None
--
2.31.1
2:59 a.m.
New subject: [PATCH v2 3/4] auto-t: rename testFT-SAE-roam to testSAE-roam
Since reassociation is now tested this name fits better
---
autotests/{testFT-SAE-roam => testSAE-roam}/TestFT.psk | 0
autotests/{testFT-SAE-roam => testSAE-roam}/connection_test.py | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-psk-3.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-1.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-2.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/hw.conf | 0
autotests/{testFT-SAE-roam => testSAE-roam}/main.conf | 0
7 files changed, 0 insertions(+), 0 deletions(-)
rename autotests/{testFT-SAE-roam => testSAE-roam}/TestFT.psk (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/connection_test.py (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-psk-3.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-1.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/ft-sae-2.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/hw.conf (100%)
rename autotests/{testFT-SAE-roam => testSAE-roam}/main.conf (100%)
diff --git a/autotests/testFT-SAE-roam/TestFT.psk b/autotests/testSAE-roam/TestFT.psk
similarity index 100%
rename from autotests/testFT-SAE-roam/TestFT.psk
rename to autotests/testSAE-roam/TestFT.psk
diff --git a/autotests/testFT-SAE-roam/connection_test.py
b/autotests/testSAE-roam/connection_test.py
similarity index 100%
rename from autotests/testFT-SAE-roam/connection_test.py
rename to autotests/testSAE-roam/connection_test.py
diff --git a/autotests/testFT-SAE-roam/ft-psk-3.conf
b/autotests/testSAE-roam/ft-psk-3.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-psk-3.conf
rename to autotests/testSAE-roam/ft-psk-3.conf
diff --git a/autotests/testFT-SAE-roam/ft-sae-1.conf
b/autotests/testSAE-roam/ft-sae-1.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-sae-1.conf
rename to autotests/testSAE-roam/ft-sae-1.conf
diff --git a/autotests/testFT-SAE-roam/ft-sae-2.conf
b/autotests/testSAE-roam/ft-sae-2.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/ft-sae-2.conf
rename to autotests/testSAE-roam/ft-sae-2.conf
diff --git a/autotests/testFT-SAE-roam/hw.conf b/autotests/testSAE-roam/hw.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/hw.conf
rename to autotests/testSAE-roam/hw.conf
diff --git a/autotests/testFT-SAE-roam/main.conf b/autotests/testSAE-roam/main.conf
similarity index 100%
rename from autotests/testFT-SAE-roam/main.conf
rename to autotests/testSAE-roam/main.conf
--
2.31.1
2:59 a.m.
New subject: [PATCH v2 4/4] netdev: enable FILS reassociation
In the same vein of SAE reassociation create a FILS auth
proto just as we would for a normal connection. Then append
the PREV_BSSID for reassociation.
---
src/netdev.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/src/netdev.c b/src/netdev.c
index f42e7881..3beb767c 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2807,6 +2807,11 @@ static void netdev_fils_tx_associate(struct iovec *iov, size_t
iov_len,
l_genl_msg_append_attr(msg, NL80211_ATTR_FILS_KEK, kek_len, kek);
l_genl_msg_append_attr(msg, NL80211_ATTR_FILS_NONCES, nonces_len, nonces);
+ /* If doing a non-FT Reassociation */
+ if (netdev->in_reassoc && !IE_AKM_IS_FT(netdev->handshake->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, 6,
+ netdev->prev_bssid);
+
if (!l_genl_family_send(nl80211, msg, netdev_assoc_cb,
netdev, NULL)) {
l_genl_msg_unref(msg);
@@ -3602,14 +3607,14 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (netdev_handshake_state_setup_connection_type(hs) < 0)
return -ENOTSUP;
- /* TODO: SoftMac FILS Re-Associations are not suppored yet */
- if (L_WARN_ON(IE_AKM_IS_FILS(hs->akm_suite)))
- return -ENOTSUP;
-
if (IE_AKM_IS_SAE(hs->akm_suite))
netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
netdev_sae_tx_associate,
netdev);
+ else if (IE_AKM_IS_FILS(hs->akm_suite))
+ netdev->ap = fils_sm_new(hs, netdev_fils_tx_authenticate,
+ netdev_fils_tx_associate,
+ netdev);
else {
cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
orig_bss->addr, NULL, 0);
--
2.31.1
3:23 a.m.
Hi James,
On 8/5/21 11:59 AM, James Prestwood wrote:
This adds support in netdev_reassociate for SAE. An SAE auth
protocol is created rather than the connect command and from
here there is virtually no difference to a normal connection
attempt. The only differences are 'in_roam' is set as to
Did you mean 'in_reassoc' here?
ignore the inevitable disconnect event and PREV_BSSID is
appended to CMD_ASSOCIATE only for this new reassociation case.
---
src/netdev.c | 32 ++++++++++++++++++++++++--------
1 file changed, 24 insertions(+), 8 deletions(-)
Please rebase on top of git HEAD.
@@ -2716,6 +2719,11 @@ static void netdev_sae_tx_associate(void
*user_data)
l_genl_msg_append_attrv(msg, NL80211_ATTR_IE, iov, n_used);
+ /* If doing a non-FT Reassociation */
+ if (netdev->in_reassoc &&
!IE_AKM_IS_FT(netdev->handshake->akm_suite))
+ l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, 6,
+ netdev->prev_bssid);
+
Actually I added auth_proto::prev_bssid just recently with exactly this in mind.
if (!l_genl_family_send(nl80211, msg, netdev_assoc_cb, netdev,
NULL)) {
l_genl_msg_unref(msg);
netdev_connect_failed(netdev, NETDEV_RESULT_ASSOCIATION_FAILED,
@@ -3584,7 +3592,7 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
netdev_event_func_t event_filter,
netdev_connect_cb_t cb, void *user_data)
{
- struct l_genl_msg *cmd_connect;
+ struct l_genl_msg *cmd_connect = NULL;
struct netdev_handshake_state;
struct handshake_state *old_hs;
struct eapol_sm *sm = NULL, *old_sm;
@@ -3594,16 +3602,21 @@ int netdev_reassociate(struct netdev *netdev, struct scan_bss
*target_bss,
if (netdev_handshake_state_setup_connection_type(hs) < 0)
return -ENOTSUP;
- /* TODO: SoftMac SAE/FILS Re-Associations are not suppored yet */
- if (L_WARN_ON(IE_AKM_IS_SAE(hs->akm_suite) ||
- IE_AKM_IS_FILS(hs->akm_suite)))
+ /* TODO: SoftMac FILS Re-Associations are not suppored yet */
+ if (L_WARN_ON(IE_AKM_IS_FILS(hs->akm_suite)))
return -ENOTSUP;
- cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
+ if (IE_AKM_IS_SAE(hs->akm_suite))
+ netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
+ netdev_sae_tx_associate,
+ netdev);
+ else {
+ cmd_connect = netdev_build_cmd_connect(netdev, target_bss, hs,
orig_bss->addr, NULL, 0);
This should be taking SAE offload into account, similar to netdev_connect path...
- if (is_rsn)
- sm = eapol_sm_new(hs);
+ if (is_rsn)
+ sm = eapol_sm_new(hs);
+ }
old_sm = netdev->sm;
old_hs = netdev->handshake;
Regards,
-Denis
409
days inactive
409
days old
4 comments
2 participants
participants (2)
-
Denis Kenzior -
James Prestwood