May 2022 - iwd - Ml01.01.Org

by 1148d778-20a8-4ab0-96b7-24572ddab965＠simplelogin.co

Hi, A few times I've already seen a strange behaviour right after rebooting. All of the sudden the wifi card is no longer available. To me it looks like iwd fails to detect and rename the device. Hopefully it happens very seldom. $ journalctl -b -1 | grep -i wifi may 27 12:02:52 kernel: Intel(R) Wireless WiFi driver for Linux may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: enabling device (0000 -> 0002) may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: Direct firmware load for iwlwifi-cc-a0-69.ucode failed with error -2 may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: api flags index 2 larger than supported by driver may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: TLV_FW_FSEQ_VERSION: FSEQ Version: 89.3.35.37 may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: loaded firmware version 68.01d30b0c.0 cc-a0-68.ucode op_mode iwlmvm may 27 12:02:52 kernel: iwlwifi 0000:03:00.0: Detected Intel(R) Wi-Fi 6 AX200 160MHz, REV=0x340 may 27 12:02:53 kernel: iwlwifi 0000:03:00.0: Detected RF HR B3, rfid=0x10a100 may 27 12:02:53 kernel: iwlwifi 0000:03:00.0: base HW address: xx:xx:xx:xx:xx:xx $ journalctl -b -1 | grep -i iwd may 27 12:02:53 iwd[863]: Wireless daemon version 1.27 may 27 12:02:53 iwd[863]: Loaded configuration from /etc/iwd/main.conf may 27 12:02:53 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=iwd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' may 27 12:02:53 iwd[863]: Wiphy: 0, Name: phy0 may 27 12:02:53 iwd[863]: Permanent Address: xx:xx:xx:xx:xx:xx may 27 12:02:53 iwd[863]: 2.4Ghz Band: may 27 12:02:53 iwd[863]: Bitrates (non-HT): may 27 12:02:53 iwd[863]: 1.0 Mbps may 27 12:02:53 iwd[863]: 2.0 Mbps may 27 12:02:53 iwd[863]: 5.5 Mbps may 27 12:02:53 iwd[863]: 11.0 Mbps may 27 12:02:53 iwd[863]: 6.0 Mbps may 27 12:02:53 iwd[863]: 9.0 Mbps may 27 12:02:53 iwd[863]: 12.0 Mbps may 27 12:02:53 iwd[863]: 18.0 Mbps may 27 12:02:53 iwd[863]: 24.0 Mbps may 27 12:02:53 iwd[863]: 36.0 Mbps may 27 12:02:53 iwd[863]: 48.0 Mbps may 27 12:02:53 iwd[863]: 54.0 Mbps may 27 12:02:53 iwd[863]: HT Capabilities: may 27 12:02:53 iwd[863]: HT40 may 27 12:02:53 iwd[863]: Short GI for 20Mhz may 27 12:02:53 iwd[863]: Short GI for 40Mhz may 27 12:02:53 iwd[863]: HT RX MCS indexes: may 27 12:02:53 iwd[863]: 0-15 may 27 12:02:53 iwd[863]: 5Ghz Band: may 27 12:02:53 iwd[863]: Bitrates (non-HT): may 27 12:02:53 iwd[863]: 6.0 Mbps may 27 12:02:53 iwd[863]: 9.0 Mbps may 27 12:02:53 iwd[863]: 12.0 Mbps may 27 12:02:53 iwd[863]: 18.0 Mbps may 27 12:02:53 iwd[863]: 24.0 Mbps may 27 12:02:53 iwd[863]: 36.0 Mbps may 27 12:02:53 iwd[863]: 48.0 Mbps may 27 12:02:53 iwd[863]: 54.0 Mbps may 27 12:02:53 iwd[863]: HT Capabilities: may 27 12:02:53 iwd[863]: HT40 may 27 12:02:53 iwd[863]: Short GI for 20Mhz may 27 12:02:53 iwd[863]: Short GI for 40Mhz may 27 12:02:53 iwd[863]: HT RX MCS indexes: may 27 12:02:53 iwd[863]: 0-15 may 27 12:02:53 iwd[863]: VHT Capabilities: may 27 12:02:53 iwd[863]: 160 Mhz operation may 27 12:02:53 iwd[863]: Short GI for 80Mhz may 27 12:02:53 iwd[863]: Short GI for 160 and 80 + 80 Mhz may 27 12:02:53 iwd[863]: Max RX MCS: 0-9 for NSS: 2 may 27 12:02:53 iwd[863]: Max TX MCS: 0-9 for NSS: 2 may 27 12:02:53 iwd[863]: Ciphers: CCMP TKIP BIP may 27 12:02:53 iwd[863]: Supported iftypes: ad-hoc station ap p2p-client p2p-go p2p-device may 27 12:02:53 iwd[863]: Unable to add the net.connman.iwd.Adapter interface to /net/connman/iwd/0 may 27 12:02:53 iwd[863]: Unable to add the org.freedesktop.DBus.Properties interface to /net/connman/iwd/0 may 27 12:02:53 iwd[863]: Wiphy: 0, Name: phy0 may 27 12:02:53 iwd[863]: Permanent Address: xx:xx:xx:xx:xx:xx may 27 12:02:53 iwd[863]: 2.4Ghz Band: may 27 12:02:53 iwd[863]: Bitrates (non-HT): may 27 12:02:53 iwd[863]: 1.0 Mbps may 27 12:02:53 iwd[863]: 2.0 Mbps may 27 12:02:53 iwd[863]: 5.5 Mbps may 27 12:02:53 iwd[863]: 11.0 Mbps may 27 12:02:53 iwd[863]: 6.0 Mbps may 27 12:02:53 iwd[863]: 9.0 Mbps may 27 12:02:53 iwd[863]: 12.0 Mbps may 27 12:02:53 iwd[863]: 18.0 Mbps may 27 12:02:53 iwd[863]: 24.0 Mbps may 27 12:02:53 iwd[863]: 36.0 Mbps may 27 12:02:53 iwd[863]: 48.0 Mbps may 27 12:02:53 iwd[863]: 54.0 Mbps may 27 12:02:53 iwd[863]: HT Capabilities: may 27 12:02:53 iwd[863]: HT40 may 27 12:02:53 iwd[863]: Short GI for 20Mhz may 27 12:02:53 iwd[863]: Short GI for 40Mhz may 27 12:02:53 iwd[863]: HT RX MCS indexes: may 27 12:02:53 iwd[863]: 0-15 may 27 12:02:53 iwd[863]: 5Ghz Band: may 27 12:02:53 iwd[863]: Bitrates (non-HT): may 27 12:02:53 iwd[863]: 6.0 Mbps may 27 12:02:53 iwd[863]: 9.0 Mbps may 27 12:02:53 iwd[863]: 12.0 Mbps may 27 12:02:53 iwd[863]: 18.0 Mbps may 27 12:02:53 iwd[863]: 24.0 Mbps may 27 12:02:53 iwd[863]: 36.0 Mbps may 27 12:02:53 iwd[863]: 48.0 Mbps may 27 12:02:53 iwd[863]: 54.0 Mbps may 27 12:02:53 iwd[863]: HT Capabilities: may 27 12:02:53 iwd[863]: HT40 may 27 12:02:53 iwd[863]: Short GI for 20Mhz may 27 12:02:53 iwd[863]: Short GI for 40Mhz may 27 12:02:53 iwd[863]: HT RX MCS indexes: may 27 12:02:53 iwd[863]: 0-15 may 27 12:02:53 iwd[863]: VHT Capabilities: may 27 12:02:53 iwd[863]: 160 Mhz operation may 27 12:02:53 iwd[863]: Short GI for 80Mhz may 27 12:02:53 iwd[863]: Short GI for 160 and 80 + 80 Mhz may 27 12:02:53 iwd[863]: Max RX MCS: 0-9 for NSS: 2 may 27 12:02:53 iwd[863]: Max TX MCS: 0-9 for NSS: 2 may 27 12:02:53 iwd[863]: Ciphers: CCMP TKIP BIP may 27 12:02:53 iwd[863]: Supported iftypes: ad-hoc station ap p2p-client p2p-go p2p-device may 27 12:02:53 iwd[863]: DEL_INTERFACE failed: No such device may 27 12:02:53 iwd[863]: Could not register frame watch type 00d0: -19 may 27 12:02:53 iwd[863]: RTM_GETLINK error -19: No such device may 27 12:02:53 iwd[863]: Could not register frame watch type 00d0: -19 may 27 12:02:53 iwd[863]: Could not register frame watch type 00d0: -19 may 27 12:02:53 iwd[863]: Could not register frame watch type 00d0: -19 may 27 12:02:53 iwd[863]: Could not register frame watch type 00d0: -19 may 27 12:03:31 iwd[863]: D-Bus disconnected, quitting... may 27 12:03:32 iwd[863]: Terminate may 27 12:03:32 iwd[863]: Removing scan context for wdev 2 may 27 12:03:33 systemd[1]: iwd.service: Deactivated successfully. Arch Linux wiki on iwd troubleshooting mentions two issues that look possible causes to me: - Low entropy pool - Wireless device not renamed by udev You can check it here: https://wiki.archlinux.org/title/Iwd#Troubleshooting Any help to fix this issue would be appreciated. Thanks!

3 weeks, 4 days

2
3
0 / 0

[PATCH 1/2] auto-t: fix eapol_reauth utility

by James Prestwood

This was passing IFNAME= along with EAPOL_REAUTH which does not work in the context of a hostapd socket where the iface is already implied. This fixes that issue as well as resets the events array and actually waits for the required events afterwards. --- autotests/testEAP-PEAPv0-CryptoBinding/NoISK_test.py | 3 --- autotests/util/hostapd.py | 5 ++++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/autotests/testEAP-PEAPv0-CryptoBinding/NoISK_test.py b/autotests/testEAP-PEAPv0-CryptoBinding/NoISK_test.py index 9a1fa52c..0323fdc1 100644 --- a/autotests/testEAP-PEAPv0-CryptoBinding/NoISK_test.py +++ b/autotests/testEAP-PEAPv0-CryptoBinding/NoISK_test.py @@ -37,9 +37,6 @@ class Test(unittest.TestCase): hostapd.eapol_reauth(device.address) - hostapd.wait_for_event('CTRL-EVENT-EAP-STARTED') - hostapd.wait_for_event('CTRL-EVENT-EAP-SUCCESS') - condition = 'obj.state == DeviceState.connected' wd.wait_for_object_condition(device, condition) diff --git a/autotests/util/hostapd.py b/autotests/util/hostapd.py index 6a9f37c7..ff5a97c1 100644 --- a/autotests/util/hostapd.py +++ b/autotests/util/hostapd.py @@ -163,8 +163,11 @@ class HostapdCLI(object): ctx.start_process(cmd).wait() def eapol_reauth(self, client_address): - cmd = 'IFNAME=' + self.ifname + ' EAPOL_REAUTH ' + client_address + self.events = [] + cmd = 'EAPOL_REAUTH ' + client_address self.ctrl_sock.sendall(cmd.encode('utf-8')) + self.wait_for_event('CTRL-EVENT-EAP-STARTED') + self.wait_for_event('CTRL-EVENT-EAP-SUCCESS') def reload(self): # Seemingly all three commands needed for the instance to notice -- 2.34.1

1 month

2
2
0 / 0

[PATCH] eap-tls: Keep l_tls instance for reauthentication

by Andrew Zaborowski

After one of the eap-tls-common-based methods succeeds keep the TLS tunnel instance until the method is freed, rather than free it the moment the method succeeds. This fixes repeated method runs where until now each next run would attempt to create a new TLS tunnel instance but would have no authentication data (CA certificate, client certificate, private key and private key passphrase) since those are were by the old l_tls object from the moment of the l_tls_set_auth_data() call. Use l_tls_reset() to reset the TLS state after method success, followed by a new l_tls_start() when the reauthentication starts. --- Depends on the ell l_tls_reset patch. src/eap-tls-common.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/src/eap-tls-common.c b/src/eap-tls-common.c index 75d3aa33..acc5b387 100644 --- a/src/eap-tls-common.c +++ b/src/eap-tls-common.c @@ -131,10 +131,13 @@ static void __eap_tls_common_state_reset(struct eap_tls_state *eap_tls) eap_tls->expecting_frag_ack = false; eap_tls->tunnel_ready = false; - if (eap_tls->tunnel) { - l_tls_free(eap_tls->tunnel); - eap_tls->tunnel = NULL; - } + /* + * Keep the tunnel instance to avoid losing the authentication + * settings that we may have loaded with l_tls_set_auth_data() + * since .reset_state is not supposed to clear settings. + */ + if (eap_tls->tunnel) + l_tls_reset(eap_tls->tunnel); eap_tls->tx_frag_offset = 0; eap_tls->tx_frag_last_len = 0; @@ -167,6 +170,10 @@ static void __eap_tls_common_state_free(struct eap_tls_state *eap_tls) l_key_free(eap_tls->client_key); l_strv_free(eap_tls->domain_mask); + + if (eap_tls->tunnel) + l_tls_free(eap_tls->tunnel); + l_free(eap_tls); } @@ -569,7 +576,7 @@ static bool eap_tls_tunnel_init(struct eap_state *eap) struct eap_tls_state *eap_tls = eap_get_data(eap); if (eap_tls->tunnel) - return false; + goto start; eap_tls->tunnel = l_tls_new(false, eap_tls_tunnel_data_received, eap_tls_tunnel_data_send, @@ -626,6 +633,7 @@ static bool eap_tls_tunnel_init(struct eap_state *eap) if (eap_tls->domain_mask) l_tls_set_domain_mask(eap_tls->tunnel, eap_tls->domain_mask); +start: if (!l_tls_start(eap_tls->tunnel)) { l_error("%s: Failed to start the TLS client", eap_get_method_name(eap)); -- 2.32.0

1 month

2
1
0 / 0

[PATCH v2 1/6] test-runner: remove root user requirement from log/monitor/result

by James Prestwood

Certain aspects of QEMU like mounting host directories may still require root access but for UML this is not the case. To handle both cases first check if SUDO_UID/GID are set and use those to obtain the actual users ID's. Otherwise if running as non-root use the UID/GID of the user directly. --- tools/runner.py | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/tools/runner.py b/tools/runner.py index 1739b786..7c177f1f 100644 --- a/tools/runner.py +++ b/tools/runner.py @@ -305,18 +305,12 @@ class RunnerAbstract: # For QEMU/UML --log, --monitor, --result def _prepare_outfiles(self): - gid = None append_gid_uid = False - if os.environ.get('SUDO_GID', None): - uid = int(os.environ['SUDO_UID']) - gid = int(os.environ['SUDO_GID']) + uid = int(os.environ.get('SUDO_UID', os.getuid())) + gid = int(os.environ.get('SUDO_GID', os.getgid())) if self.args.log: - if os.getuid() != 0: - print("--log can only be used as root user") - quit() - append_gid_uid = True if not os.path.exists(self.args.log): @@ -326,20 +320,12 @@ class RunnerAbstract: os.chown(self.args.log, uid, gid) if self.args.monitor: - if os.getuid() != 0: - print("--monitor can only be used as root user") - quit() - append_gid_uid = True self.args.monitor_parent = os.path.abspath( os.path.join(self.args.monitor, os.pardir)) if self.args.result: - if os.getuid() != 0: - print("--result can only be used as root user") - quit() - append_gid_uid = True self.args.result_parent = os.path.abspath( -- 2.34.1

1 month

2
6
0 / 0

[PATCH 1/5] test-runner: mount testhome rather than assume location

by James Prestwood

Usually the test home directory is a git repo somewhere e.g. under /home. But if the home directory is located under /tmp this poses a problem since UML remounts /tmp. To handle both cases mount the home directory explicity. --- tools/runner.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/runner.py b/tools/runner.py index 7c177f1f..5f837097 100644 --- a/tools/runner.py +++ b/tools/runner.py @@ -451,6 +451,9 @@ class QemuRunner(RunnerAbstract): def prepare_environment(self): mounts = [ MountInfo('debugfs', 'debugfs', '/sys/kernel/debug', '', 0) ] + mounts.append(MountInfo('hostfs', 'hostfs', self.args.testhome, + self.args.testhome, 0)) + if self.args.log: mounts.append(MountInfo('9p', 'logdir', self.args.log, 'trans=virtio,version=9p2000.L,msize=10240', 0)) @@ -513,6 +516,9 @@ class UmlRunner(RunnerAbstract): mounts.append(MountInfo('hostfs', 'hostfs', self.args.result_parent, self.args.result_parent, 0)) + mounts.append(MountInfo('hostfs', 'hostfs', self.args.testhome, + self.args.testhome, 0)) + self._prepare_mounts(extra=mounts) super().prepare_environment() -- 2.34.1

1 month

1
4
0 / 0

[PATCH] eap-tls: Keep l_tls instance for reauthentication

by Andrew Zaborowski

After one of the eap-tls-common-based methods succeeds keep the TLS tunnel instance until the method is freed, rather than free it the moment the method succeeds. This fixes repeated method runs where until now each next run would attempt to create a new TLS tunnel instance but would have no authentication data (CA certificate, client certificate, private key and private key passphrase) since those are owned by the l_tls object from the moment of the l_tls_set_auth_data() call. Use l_tls_close() to reset the TLS state after method success, followed by a new l_tls_start() when the reauthentication starts. In the tunnel's tx handler and disconnect handler do nothing if the method isn't currently running (because it already succeeded.) --- src/eap-tls-common.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/src/eap-tls-common.c b/src/eap-tls-common.c index 75d3aa33..92f5c07b 100644 --- a/src/eap-tls-common.c +++ b/src/eap-tls-common.c @@ -131,10 +131,13 @@ static void __eap_tls_common_state_reset(struct eap_tls_state *eap_tls) eap_tls->expecting_frag_ack = false; eap_tls->tunnel_ready = false; - if (eap_tls->tunnel) { - l_tls_free(eap_tls->tunnel); - eap_tls->tunnel = NULL; - } + /* + * Keep the tunnel instance to avoid losing the authentication + * settings that we may have loaded with l_tls_set_auth_data() + * since .reset_state is not supposed to clear settings. + */ + if (eap_tls->tunnel) + l_tls_close(eap_tls->tunnel); eap_tls->tx_frag_offset = 0; eap_tls->tx_frag_last_len = 0; @@ -167,6 +170,10 @@ static void __eap_tls_common_state_free(struct eap_tls_state *eap_tls) l_key_free(eap_tls->client_key); l_strv_free(eap_tls->domain_mask); + + if (eap_tls->tunnel) + l_tls_free(eap_tls->tunnel); + l_free(eap_tls); } @@ -209,6 +216,9 @@ static void eap_tls_tunnel_data_send(const uint8_t *data, size_t data_len, struct eap_state *eap = user_data; struct eap_tls_state *eap_tls = eap_get_data(eap); + if (eap_tls->version_negotiated == EAP_TLS_VERSION_NOT_NEGOTIATED) + return; + if (!eap_tls->tx_pdu_buf) eap_tls->tx_pdu_buf = databuf_new(data_len); @@ -268,6 +278,9 @@ static void eap_tls_tunnel_disconnected(enum l_tls_alert_desc reason, struct eap_state *eap = user_data; struct eap_tls_state *eap_tls = eap_get_data(eap); + if (eap_tls->version_negotiated == EAP_TLS_VERSION_NOT_NEGOTIATED) + return; + l_info("%s: Tunnel has disconnected with alert: %s", eap_get_method_name(eap), l_tls_alert_to_str(reason)); @@ -569,7 +582,7 @@ static bool eap_tls_tunnel_init(struct eap_state *eap) struct eap_tls_state *eap_tls = eap_get_data(eap); if (eap_tls->tunnel) - return false; + goto start; eap_tls->tunnel = l_tls_new(false, eap_tls_tunnel_data_received, eap_tls_tunnel_data_send, @@ -626,6 +639,7 @@ static bool eap_tls_tunnel_init(struct eap_state *eap) if (eap_tls->domain_mask) l_tls_set_domain_mask(eap_tls->tunnel, eap_tls->domain_mask); +start: if (!l_tls_start(eap_tls->tunnel)) { l_error("%s: Failed to start the TLS client", eap_get_method_name(eap)); -- 2.32.0

1 month

1
0
0 / 0

eap-tls connects, after 1 hour fails and then connects again

by Josef Vybíhal

Hi, I am facing quite strange (to me) issue with iwd 1.27. I have an eap-tls profile. I am able to connect with is just fine. But exactly after one hour, there is reauthentication (guessing the right term here) for some reason, and it fails, and then immediately after it there is second one which is successfull. After exactly one hour the cycle repeats. Here is log. What stands out to me is "TLS: tls_tx_handshake:890 Sending a TLS_CERTIFICATE of 3 bytes". That's super strange, only 3 bytes? May 24 11:04:33 jv iwd[781]: resolve: /usr/bin/resolvconf exited with status (256). May 24 11:04:34 jv iwd[781]: netconfig: Failed to start DHCPv6 client for interface 5 May 24 12:04:34 jv iwd[781]: EAP server tried method 25 while client was configured for method 13 May 24 12:04:34 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CLIENT_HELLO of 117 bytes May 24 12:04:34 jv iwd[781]: TLS: l_tls_start:2849 New state TLS_HANDSHAKE_WAIT_HELLO May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_HELLO of 38 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_handle_server_hello:1830 Negotiated TLS 1.2 May 24 12:04:34 jv iwd[781]: TLS: tls_handle_server_hello:1866 Negotiated TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA May 24 12:04:34 jv iwd[781]: TLS: tls_handle_server_hello:1877 Negotiated CompressionMethod.null May 24 12:04:34 jv iwd[781]: TLS: tls_handle_server_hello:1880 New state TLS_HANDSHAKE_WAIT_CERTIFICATE May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_CERTIFICATE of 1371 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_handle_certificate:1950 Peer certchain written to /tmp/iwd-tls-debug-server-cert.pem May 24 12:04:34 jv iwd[781]: TLS: tls_handle_certificate:2044 New state TLS_HANDSHAKE_WAIT_KEY_EXCHANGE May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_KEY_EXCHANGE of 329 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2443 New state TLS_HANDSHAKE_WAIT_HELLO_DONE May 24 12:04:34 jv iwd[781]: TLS: tls_handle_ecdhe_server_key_xchg:506 Negotiated secp256r1 May 24 12:04:34 jv iwd[781]: TLS: tls_rsa_verify:213 Peer signature verified May 24 12:04:34 jv iwd[781]: TLS: tls_handle_ecdhe_server_key_xchg:560 New state TLS_HANDSHAKE_WAIT_HELLO_DONE May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_CERTIFICATE_REQUEST of 112 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_HELLO_DONE of 0 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CERTIFICATE of 3 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CLIENT_KEY_EXCHANGE of 66 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_FINISHED of 12 bytes May 24 12:04:34 jv iwd[781]: TLS: tls_handle_server_hello_done:2155 New state TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC May 24 12:04:35 jv iwd[781]: EAP completed with eapFail May 24 12:04:35 jv iwd[781]: TLS: tls_reset_handshake:204 New state TLS_HANDSHAKE_WAIT_START May 24 12:04:35 jv iwd[781]: 4-Way handshake failed for ifindex: 5, reason: 23 May 24 12:04:36 jv iwd[781]: EAP server tried method 25 while client was configured for method 13 May 24 12:04:36 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CLIENT_HELLO of 117 bytes May 24 12:04:36 jv iwd[781]: TLS: l_tls_start:2849 New state TLS_HANDSHAKE_WAIT_HELLO May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_HELLO of 38 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_handle_server_hello:1830 Negotiated TLS 1.2 May 24 12:04:36 jv iwd[781]: TLS: tls_handle_server_hello:1866 Negotiated TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA May 24 12:04:36 jv iwd[781]: TLS: tls_handle_server_hello:1877 Negotiated CompressionMethod.null May 24 12:04:36 jv iwd[781]: TLS: tls_handle_server_hello:1880 New state TLS_HANDSHAKE_WAIT_CERTIFICATE May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_CERTIFICATE of 1371 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_handle_certificate:1950 Peer certchain written to /tmp/iwd-tls-debug-server-cert.pem May 24 12:04:36 jv iwd[781]: TLS: tls_handle_certificate:2044 New state TLS_HANDSHAKE_WAIT_KEY_EXCHANGE May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_KEY_EXCHANGE of 329 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2443 New state TLS_HANDSHAKE_WAIT_HELLO_DONE May 24 12:04:36 jv iwd[781]: TLS: tls_handle_ecdhe_server_key_xchg:506 Negotiated secp256r1 May 24 12:04:36 jv iwd[781]: TLS: tls_rsa_verify:213 Peer signature verified May 24 12:04:36 jv iwd[781]: TLS: tls_handle_ecdhe_server_key_xchg:560 New state TLS_HANDSHAKE_WAIT_HELLO_DONE May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_CERTIFICATE_REQUEST of 112 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_SERVER_HELLO_DONE of 0 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CERTIFICATE of 1173 bytes May 24 12:04:36 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CLIENT_KEY_EXCHANGE of 66 bytes May 24 12:04:37 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_CERTIFICATE_VERIFY of 260 bytes May 24 12:04:37 jv iwd[781]: TLS: tls_tx_handshake:890 Sending a TLS_FINISHED of 12 bytes May 24 12:04:37 jv iwd[781]: TLS: tls_handle_server_hello_done:2155 New state TLS_HANDSHAKE_WAIT_CHANGE_CIPHER_SPEC May 24 12:04:37 jv iwd[781]: TLS: tls_handle_message:2709 New state TLS_HANDSHAKE_WAIT_FINISHED May 24 12:04:37 jv iwd[781]: TLS: tls_handle_handshake:2354 Handling a TLS_FINISHED of 12 bytes May 24 12:04:37 jv iwd[781]: TLS: tls_reset_handshake:204 New state TLS_HANDSHAKE_WAIT_START May 24 12:04:37 jv iwd[781]: TLS: tls_finished:2340 New state TLS_HANDSHAKE_DONE May 24 12:04:37 jv iwd[781]: EAP completed with eapSuccess May 24 12:04:37 jv iwd[781]: TLS: tls_reset_handshake:204 New state TLS_HANDSHAKE_WAIT_START May 24 12:04:38 jv iwd[781]: netconfig: Failed to start DHCPv6 client for interface 5 Here follows my profile config JV.8021x: [Security] EAP-Method=TLS EAP-Identity=jv EAP-TLS-CACert=/etc/ca-certificates/trust-source/anchors/VYBIHAL-CA.crt EAP-TLS-ServerDomainMask=*.vybihal.cz;*.jvi.cz EAP-TLS-ClientCert=embed:pepa-VYBIHAL-CA_client_cert EAP-TLS-ClientKey=embed:pepa-VYBIHAL-CA_client_key [Settings] AutoConnect=true [@pem@pepa-VYBIHAL-CA_client_cert] -----BEGIN CERTIFICATE----- MIIEizCCAnOgAwIBAgIIdF0KMgHJlTIwDQYJKoZIhvcNAQELBQAwNjETMBEGA1UE AxMKVllCSUhBTCBDQTEfMB0GCSqGSIb3DQEJARYQam9zZWZAdnliaWhhbC5jejAe Fw0yMjAzMjcxMjQ1MDBaFw0yNzAzMjcxMjQ1MDBaMDAxDTALBgNVBAMTBHBlcGEx HzAdBgkqhkiG9w0BCQEWEGpvc2VmQHZ5YmloYWwuY3owggEiMA0GCSqGSIb3DQEB AQUAA4IBDwAwggEKAoIBAQDAn+iMsh5HbrrnmJ8kzrghccos69jRPI8aI/RLlJBm TFyjakaVPq3GbuKrKDZBc/vT0xfGVbXQrDniB5mouyi/u+q2nOkmKnxDcr64XXXP RhEL6gPKzdg8QXiEeVMl61osG2JoOc3inEbGE+uAs/r/XfhrpQ8yT1qjuu9mlH5F m+Igc/kGjQsDrnvX63RHaHzdN1WIRY4MQJV2Y7+q+9B60+IEdnpBa8ITMDdqYHmG 1ecrv91wQfCNDm8NCPjiwxoRJxlZ+8clvjQ4gTm6oVCjNIhofh4X7JmB4H+UmBrG FGggJdiHfceEM579FWdbqFy6YVRnCtf+7uPaVv+QsBcrAgMBAAGjgaIwgZ8wDAYD VR0TAQH/BAIwADAdBgNVHQ4EFgQUOKirC47tSr4uKumXhZuEVnK4bygwCwYDVR0P BAQDAgO4MBMGA1UdJQQMMAoGCCsGAQUFBwMCMBsGA1UdEQQUMBKBEGpvc2VmQHZ5 YmloYWwuY3owEQYJYIZIAYb4QgEBBAQDAgWgMB4GCWCGSAGG+EIBDQQRFg94Y2Eg Y2VydGlmaWNhdGUwDQYJKoZIhvcNAQELBQADggIBAHMSGs8vpl1aZoVAPBWfEWBT JyVtpO+Kexbpol47UQJZunws3e0NJcF6Zu39K09InilhS31ZHWjmzJLx/+Dc+FFM Y3FHI6lY7kuukPxAMo1lm7a0NZ7R6jxlCTacvkEcGwCGLKzw0lvDICUTqS04S/0/ mPnk94xKJ0Lua1nPwY/MOiuyYVCVeF6QRQqI18EgGDlHLAmW/I9S6mmbvo1U2vak xNS/G3lNaeeCmT6oQJLlMS9/cNCgz6SM432eG478thiGYeo9UNeGGCqaxuFKwASc YYBidFDlgfJ89+DLBimqDesf0ZF6GxOJ4H6Rf05MzsXWqymp71MWnTKMHFWFRQHH VJN2rbRZySTuRJQ+Dp1zJUOOxSjFiFtQMoU+lTnlX7uVcqitaEsSr05ACKfn2LVw ryv4hR+7kvr6/SSJheVnVwcgC752eS9W/95MGcxITN37XsVeifQ8CWSXUPJqYbNp ooR5xY4xipnumHA/aOpRaitdnRBUvcunX1i5r+E+HvdCTVZmEhnuLoAYUy6MZhYk gzNLrJAWP3emIC0dATmxzNLaioKd4xZnFuLcMsE33/y9SYuwW3ePbyOqWkBRrnFW yqBwVmzeg79q+OO4dSYVtW6akDeslicQekoxKNzKu9tz509knacLcgtDYZ2Mivb0 2vfVdPUcVAWv9llNe3Fq -----END CERTIFICATE----- [@pem@pepa-VYBIHAL-CA_client_key] -----BEGIN RSA PRIVATE KEY----- redacted -----END RSA PRIVATE KEY----- I also manage the radius server, the bad auth is seen there, but the error is not helpful: ERROR: (20339) eap_tls: ERROR: TLS Alert write:fatal:handshake failure Error: tls: TLS_accept: Error in error Other clients (wpa supplicant on other laptop, android phone, windows) does not have this problem. Only this laptop using iwd is acting this way :( Any idea what could be going on here? Josef

1 month

1
0
0 / 0

Unsupported finite cyclic group

by Michael Johnson

Hi, After updating to master (f12cf1ab9db iwd, 43e99ec5f21 ell) I've started seeing a few new errors which are causing the client to disconnect and stay disconnected for a brief time. The previous version I was running (1.21 iwd and 0.47 ell) didn't have these but it's possible this is new functionality that was enabled and the AP vendor doesn't support it properly. If there is anything else I can gather to help debug what is going wrong please let me know. The first error happens during an FT roam and the AP reports this association failure: 802.11 STATUS (CODE 77) - Unsupported finite cyclic group. Most FT roams happen fine so I'm not sure why this one is different. ``` May 19 16:16:11.647803 r2-19105 iwd[462]: src/station.c:station_enter_state() Old State: connected, new state: roaming May 19 16:16:11.647803 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_done() Work item 201 done May 19 16:16:11.647803 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_next() Starting work item 202 May 19 16:16:11.692387 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20) May 19 16:16:11.692387 r2-19105 iwd[462]: src/netdev.c:netdev_link_notify() event 16 on ifindex 5 May 19 16:16:11.692387 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Deauthenticate(39) May 19 16:16:11.692588 r2-19105 iwd[462]: src/netdev.c:netdev_deauthenticate_event() May 19 16:16:11.692588 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Disconnect(48) May 19 16:16:11.692588 r2-19105 iwd[462]: src/netdev.c:netdev_disconnect_event() May 19 16:16:11.692588 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification New Station(19) May 19 16:16:11.692588 r2-19105 iwd[462]: src/netdev.c:netdev_link_notify() event 16 on ifindex 5 May 19 16:16:11.692588 r2-19105 iwd[462]: src/wiphy.c:wiphy_reg_notify() Notification of command Reg Change(36) May 19 16:16:11.692588 r2-19105 iwd[462]: src/wiphy.c:wiphy_update_reg_domain() New reg domain country code for (global) is XX May 19 16:16:11.696000 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37) May 19 16:16:11.696000 r2-19105 iwd[462]: src/netdev.c:netdev_authenticate_event() May 19 16:16:11.696723 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20) May 19 16:16:11.696723 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Deauthenticate(39) May 19 16:16:11.696848 r2-19105 iwd[462]: src/netdev.c:netdev_deauthenticate_event() May 19 16:16:11.696848 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_done() Work item 202 done May 19 16:16:11.696848 r2-19105 iwd[462]: src/station.c:station_fast_transition_cb() 5, result: 2 May 19 16:16:11.696848 r2-19105 iwd[462]: src/station.c:station_roam_failed() 5 May 19 16:16:11.696848 r2-19105 iwd[462]: src/station.c:station_disassociated() 5 May 19 16:16:11.696848 r2-19105 iwd[462]: src/resolve.c:resolve_systemd_revert() ifindex: 5 ``` The second error is a CMD_ASSOCIATE timeout which happens when trying to autoconnect after the first error and so is possibly related. ``` May 19 16:16:12.812461 r2-19105 iwd[462]: src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal... May 19 16:16:12.812461 r2-19105 iwd[462]: src/sae.c:sae_sm_new() Using SAE Hunting and Pecking May 19 16:16:12.812461 r2-19105 iwd[462]: src/netdev.c:netdev_cqm_rssi_update() May 19 16:16:12.812461 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_insert() Inserting work item 204 May 19 16:16:12.812461 r2-19105 iwd[462]: src/station.c:__station_connect_network() connecting to BSS f6:9e:38:*:*:* May 19 16:16:12.812461 r2-19105 iwd[462]: src/station.c:station_enter_state() Old State: autoconnect_quick, new state: connecting (auto) May 19 16:16:12.812461 r2-19105 iwd[462]: src/scan.c:scan_cancel() Trying to cancel scan id 203 for wdev 2 May 19 16:16:12.812461 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_done() Work item 203 done May 19 16:16:12.812461 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_next() Starting work item 204 May 19 16:16:12.863949 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification New Station(19) May 19 16:16:12.865712 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37) May 19 16:16:12.865712 r2-19105 iwd[462]: src/netdev.c:netdev_authenticate_event() May 19 16:16:12.865712 r2-19105 iwd[462]: src/sae.c:sae_verify_packet() rx trans=1, state=committed May 19 16:16:12.930662 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20) May 19 16:16:12.930662 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification New Station(19) May 19 16:16:12.946796 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37) May 19 16:16:12.946796 r2-19105 iwd[462]: src/netdev.c:netdev_authenticate_event() May 19 16:16:12.946796 r2-19105 iwd[462]: src/sae.c:sae_verify_packet() rx trans=1, state=committed May 19 16:16:12.950893 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37) May 19 16:16:12.950893 r2-19105 iwd[462]: src/netdev.c:netdev_authenticate_event() May 19 16:16:12.950893 r2-19105 iwd[462]: src/sae.c:sae_verify_packet() rx trans=2, state=confirmed May 19 16:16:14.234437 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20) May 19 16:16:14.234749 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Associate(38) May 19 16:16:14.234749 r2-19105 iwd[462]: src/netdev.c:netdev_associate_event() May 19 16:16:14.234749 r2-19105 iwd[462]: association timed out May 19 16:16:14.234883 r2-19105 iwd[462]: Error sending CMD_ASSOCIATE (-2) May 19 16:16:14.234883 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_done() Work item 204 done May 19 16:16:14.234883 r2-19105 iwd[462]: src/station.c:station_connect_cb() 5, result: 2 ``` Finally, after connecting (iwd eventually does the full eapol handshake which reconnects) the request for the neighbor report times out. This doesn't cause any disconnect but does cause another neighbor request to be sent before roaming (which works). ``` May 19 16:50:54.229861 r2-19105 iwd[462]: src/station.c:station_enter_state() Old State: roaming, new state: connected May 19 16:50:54.229861 r2-19105 iwd[462]: src/wiphy.c:wiphy_radio_work_done() Work item 216 done May 19 16:50:54.229861 r2-19105 iwd[462]: src/netdev.c:netdev_link_notify() event 16 on ifindex 5 May 19 16:50:54.230062 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Frame TX Status(60) May 19 16:50:54.623293 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Notify CQM(64) May 19 16:50:57.229499 r2-19105 iwd[462]: src/station.c:station_early_neighbor_report_cb() ifindex: 5, error: -110(Connection timed out) ... May 19 17:00:54.060111 r2-19105 iwd[462]: src/station.c:station_roam_trigger_cb() 5 May 19 17:00:54.060111 r2-19105 iwd[462]: src/station.c:station_roam_trigger_cb() Requesting neighbor report for roam May 19 17:00:54.060492 r2-19105 iwd[462]: src/netdev.c:netdev_mlme_notify() MLME notification Frame TX Status(60) May 19 17:00:54.061519 r2-19105 iwd[462]: src/netdev.c:netdev_unicast_notify() Unicast notification Frame(59) May 19 17:00:54.061519 r2-19105 iwd[462]: src/station.c:station_neighbor_report_cb() ifindex: 5, error: 0() May 19 17:00:54.061519 r2-19105 iwd[462]: src/station.c:parse_neighbor_report() Neighbor report received for f6:9e:38:*:*:*: ch 149 (oper class 3), MD not set ``` Regards, Michael

1 month

3
3
0 / 0

[PATCH] ft: remove frame type check in FT

by James Prestwood

A user reported that IWD was failing to FT in some cases and this was due to the AP setting the Retry bit in the frame type. This was unexpected by IWD since it directly checks the frame type against 0x00b0 which does not account for any B8-B15 bits being set. IWD doesn't need to verify the frame type field for a few reasons: First mpdu_validate checks the management frame type, Second the kernel checks prior to forwarding the event. Because of this the check was removed completely. --- src/ft.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/ft.c b/src/ft.c index 2b41ae18..2285a86f 100644 --- a/src/ft.c +++ b/src/ft.c @@ -122,16 +122,11 @@ static bool ft_parse_authentication_resp_frame(const uint8_t *data, size_t len, uint16_t *out_status, const uint8_t **out_ies, size_t *out_ies_len) { - const uint16_t frame_type = 0x00b0; uint16_t status = 0; if (len < 30) return false; - /* Check FC == Management Frame -> Authentication */ - if (l_get_le16(data + 0) != frame_type) - return false; - if (memcmp(data + 4, addr1, 6)) return false; if (memcmp(data + 10, addr2, 6)) -- 2.34.1

1 month

2
1
0 / 0

[PATCH 1/2] station: Simplify usage of station_signal_agent_notify()

by Jesse Lentz

station_signal_agent_notify() has been refactored so that its usage is simpler. station_rssi_level_changed() has been replaced by an inlined call to station_signal_agent_notify(). --- src/station.c | 38 ++++++++++++-------------------------- 1 file changed, 12 insertions(+), 26 deletions(-) diff --git a/src/station.c b/src/station.c index a356339e..6aad40cb 100644 --- a/src/station.c +++ b/src/station.c @@ -1438,6 +1438,8 @@ static void station_set_drop_unicast_l2_multicast(struct station *station, "drop_unicast_in_l2_multicast", v); } +static void station_signal_agent_notify(struct station *station); + static void station_enter_state(struct station *station, enum station_state state) { @@ -2754,9 +2756,6 @@ static void station_event_channel_switched(struct station *station, network_bss_update(network, station->connected_bss); } -static void station_rssi_level_changed(struct station *station, - uint8_t level_idx); - static bool station_try_next_bss(struct station *station) { struct scan_bss *next; @@ -3011,7 +3010,8 @@ static void station_netdev_event(struct netdev *netdev, enum netdev_event event, station_ok_rssi(station); break; case NETDEV_EVENT_RSSI_LEVEL_NOTIFY: - station_rssi_level_changed(station, l_get_u8(event_data)); + if (station->signal_agent) + station_signal_agent_notify(station); break; case NETDEV_EVENT_ROAMING: station_enter_state(station, STATION_STATE_ROAMING); @@ -3645,9 +3645,13 @@ struct signal_agent { unsigned int disconnect_watch; }; -static void station_signal_agent_notify(struct signal_agent *agent, - const char *device_path, uint8_t level) +static void station_signal_agent_notify(struct station *station) { + struct signal_agent *agent = station->signal_agent; + struct netdev *netdev = station->netdev; + const char *device_path = netdev_get_path(netdev); + uint8_t level = netdev_get_rssi_level_idx(netdev); + struct l_dbus_message *msg; msg = l_dbus_message_new_method_call(dbus_get_bus(), @@ -3660,18 +3664,6 @@ static void station_signal_agent_notify(struct signal_agent *agent, l_dbus_send(dbus_get_bus(), msg); } -static void station_rssi_level_changed(struct station *station, - uint8_t level_idx) -{ - struct netdev *netdev = station->netdev; - - if (!station->signal_agent) - return; - - station_signal_agent_notify(station->signal_agent, - netdev_get_path(netdev), level_idx); -} - static void station_signal_agent_release(struct signal_agent *agent, const char *device_path) { @@ -3762,14 +3754,8 @@ static struct l_dbus_message *station_dbus_signal_agent_register( reply = l_dbus_message_new_method_return(message); l_dbus_send(dbus, reply); - if (station->connected_network) { - struct netdev *netdev = station->netdev; - uint8_t level = netdev_get_rssi_level_idx(netdev); - - station_signal_agent_notify(station->signal_agent, - netdev_get_path(netdev), - level); - } + if (station->connected_network) + station_signal_agent_notify(station); return NULL; } -- 2.36.0

1 month

2
2
0 / 0

2022

2021

2020

2019

iwd May 2022