11:32 p.m.
All uses of this macro will work with a bitwise comparison which is
needed for 6GHz checks and somewhat more flexible since it can be
used to compare RSN info, not only single AKM values.
---
src/ie.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/ie.h b/src/ie.h
index 302cda70..9b57cf66 100644
--- a/src/ie.h
+++ b/src/ie.h
@@ -337,8 +337,8 @@ enum ie_rsn_akm_suite {
};
#define IE_AKM_IS_SAE(akm) \
- ((akm == IE_RSN_AKM_SUITE_SAE_SHA256) || \
- (akm == IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
+ (akm & (IE_RSN_AKM_SUITE_SAE_SHA256 | \
+ IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
#define IE_AKM_IS_FT(akm) \
(akm & (IE_RSN_AKM_SUITE_FT_OVER_8021X | \
--
2.34.1
11:32 p.m.
New subject: [PATCH v3 2/7] ie: update IE_AKM_IS_FILS to be bitwise
Currently nothing actually uses this macro, but switching it to a bitwise
comparison makes it more useful and consistent with the others.
---
src/ie.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/ie.h b/src/ie.h
index 9b57cf66..fac766d5 100644
--- a/src/ie.h
+++ b/src/ie.h
@@ -349,10 +349,10 @@ enum ie_rsn_akm_suite {
IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384))
#define IE_AKM_IS_FILS(akm) \
- ((akm == IE_RSN_AKM_SUITE_FILS_SHA256) || \
- (akm == IE_RSN_AKM_SUITE_FILS_SHA384) || \
- (akm == IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA256) || \
- (akm == IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384))
+ (akm & (IE_RSN_AKM_SUITE_FILS_SHA256 | \
+ IE_RSN_AKM_SUITE_FILS_SHA384 | \
+ IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA256 | \
+ IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384))
#define IE_LEN(ie) \
((ie) ? (ie)[1] + 2 : 0)
--
2.34.1
11:32 p.m.
New subject: [PATCH v3 3/7] station: use IE_AKM_IS_FILS
Use this macro instead of manually checking
---
src/station.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/src/station.c b/src/station.c
index cd119ff1..637d03d1 100644
--- a/src/station.c
+++ b/src/station.c
@@ -1144,10 +1144,7 @@ build_ie:
* a reference now so it remains valid (in case of expiration) until
* FILS starts.
*/
- if (hs->akm_suite & (IE_RSN_AKM_SUITE_FILS_SHA256 |
- IE_RSN_AKM_SUITE_FILS_SHA384 |
- IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA256 |
- IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384))
+ if (IE_AKM_IS_FILS(hs->akm_suite))
hs->erp_cache = erp_cache;
else if (erp_cache)
erp_cache_put(erp_cache);
--
2.34.1
11:32 p.m.
New subject: [PATCH v3 4/7] ie: add IE_AKM_IS_8021X
---
src/ie.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/ie.h b/src/ie.h
index fac766d5..7786ea74 100644
--- a/src/ie.h
+++ b/src/ie.h
@@ -354,6 +354,12 @@ enum ie_rsn_akm_suite {
IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA256 | \
IE_RSN_AKM_SUITE_FT_OVER_FILS_SHA384))
+#define IE_AKM_IS_8021X(akm) \
+ (akm & (IE_RSN_AKM_SUITE_8021X | \
+ IE_RSN_AKM_SUITE_FT_OVER_8021X | \
+ IE_RSN_AKM_SUITE_8021X_SHA256 | \
+ IE_RSN_AKM_SUITE_FT_OVER_8021X_SHA384))
+
#define IE_LEN(ie) \
((ie) ? (ie)[1] + 2 : 0)
--
2.34.1
11:32 p.m.
New subject: [PATCH v3 5/7] network: add 6GHz restrictions to network_can_connect_bss
The 802.11ax standards adds some restrictions for the 6GHz band. In short
stations must use SAE, OWE, or 8021x on this band and frame protection is
required.
---
src/network.c | 58 +++++++++++++++++++++++++++++++++++++++------------
1 file changed, 45 insertions(+), 13 deletions(-)
v3:
* Combined some of the WPA3 checks with 6GHz that duplicated
* Used macros rather than checking all valid AKMs
diff --git a/src/network.c b/src/network.c
index 4e7af27c..4a4a64ee 100644
--- a/src/network.c
+++ b/src/network.c
@@ -55,6 +55,7 @@
#include "src/util.h"
#include "src/erp.h"
#include "src/handshake.h"
+#include "src/band.h"
#define SAE_PT_SETTING "SAE-PT-Group%u"
@@ -774,6 +775,7 @@ int network_can_connect_bss(struct network *network, const struct
scan_bss *bss)
struct network_config *config = info ? &info->config : NULL;
bool can_transition_disable = wiphy_can_transition_disable(wiphy);
struct ie_rsn_info rsn;
+ enum band_freq band;
int ret;
switch (security) {
@@ -785,6 +787,9 @@ int network_can_connect_bss(struct network *network, const struct
scan_bss *bss)
return -ENOSYS;
}
+ if (!band_freq_to_channel(bss->frequency, &band))
+ return -ENOTSUP;
+
memset(&rsn, 0, sizeof(rsn));
ret = scan_bss_get_rsn_info(bss, &rsn);
if (ret < 0) {
@@ -797,6 +802,13 @@ int network_can_connect_bss(struct network *network, const struct
scan_bss *bss)
* We assume the spec means us to check bit 3 here
*/
if (ret == -ENOENT && security == SECURITY_NONE) {
+ /*
+ * 802.11ax 12.12.2 - STA shall not use Open System
+ * authentication without encryption
+ */
+ if (band == BAND_FREQ_6_GHZ)
+ return -EPERM;
+
if (!config)
return 0;
@@ -814,26 +826,21 @@ int network_can_connect_bss(struct network *network, const struct
scan_bss *bss)
return ret;
}
- if (!config || !config->have_transition_disable)
+ if (!config || !config->have_transition_disable) {
+ if (band == BAND_FREQ_6_GHZ)
+ goto check_6ghz;
+
goto no_transition_disable;
+ }
if (!can_transition_disable) {
+ if (band == BAND_FREQ_6_GHZ)
+ return -EPERM;
+
l_debug("HW not capable of Transition Disable, skip");
goto no_transition_disable;
}
- /*
- * WPA3 Specification, v3, Section 8:
- * - Disable use of WEP and TKIP
- * - Disallow association without negotiation of PMF
- */
- rsn.pairwise_ciphers &= ~IE_RSN_CIPHER_SUITE_TKIP;
-
- if (!rsn.group_management_cipher)
- return -EPERM;
-
- rsn.mfpr = true;
-
/* WPA3-Personal */
if (test_bit(&config->transition_disable, 0)) {
rsn.akm_suites &= ~IE_RSN_AKM_SUITE_PSK;
@@ -851,6 +858,31 @@ int network_can_connect_bss(struct network *network, const struct
scan_bss *bss)
return -EPERM;
}
+check_6ghz:
+ /*
+ * WPA3 Specification, v3, Section 8:
+ * - Disable use of WEP and TKIP
+ * - Disallow association without negotiation of PMF
+ */
+ rsn.pairwise_ciphers &= ~IE_RSN_CIPHER_SUITE_TKIP;
+
+ if (!rsn.group_management_cipher)
+ return -EPERM;
+
+ rsn.mfpr = true;
+
+ /* 802.11ax Section 12.12.2 */
+ if (band == BAND_FREQ_6_GHZ) {
+ /* STA shall not use the following cipher suite selectors */
+ rsn.pairwise_ciphers &= ~IE_RSN_CIPHER_SUITE_USE_GROUP_CIPHER;
+
+ /* Basically the STA must use OWE, SAE, or 8021x */
+ if (!IE_AKM_IS_SAE(rsn.akm_suites &&
+ !IE_AKM_IS_8021X(rsn.akm_suites) &&
+ (!(rsn.akm_suites | IE_RSN_AKM_SUITE_OWE))))
+ return -EPERM;
+ }
+
no_transition_disable:
if (!wiphy_select_cipher(wiphy, rsn.pairwise_ciphers))
return -ENOTSUP;
--
2.34.1
12:04 a.m.
New subject: [PATCH v3 5/7] network: add 6GHz restrictions to
network_can_connect_bss
Hi James,
On 2/25/22 17:32, James Prestwood wrote:
The 802.11ax standards adds some restrictions for the 6GHz band. In
short
stations must use SAE, OWE, or 8021x on this band and frame protection is
required.
---
src/network.c | 58 +++++++++++++++++++++++++++++++++++++++------------
1 file changed, 45 insertions(+), 13 deletions(-)
v3:
* Combined some of the WPA3 checks with 6GHz that duplicated
* Used macros rather than checking all valid AKMs
<snip>
+ /* 802.11ax Section 12.12.2 */
+ if (band == BAND_FREQ_6_GHZ) {
+ /* STA shall not use the following cipher suite selectors */
+ rsn.pairwise_ciphers &= ~IE_RSN_CIPHER_SUITE_USE_GROUP_CIPHER;
+
+ /* Basically the STA must use OWE, SAE, or 8021x */
+ if (!IE_AKM_IS_SAE(rsn.akm_suites &&
This looks like it is missing a ')'
+ !IE_AKM_IS_8021X(rsn.akm_suites) &&
+ (!(rsn.akm_suites | IE_RSN_AKM_SUITE_OWE))))
!(rsn.akm_suites & IE_RSN_AKM_SUITE_OWE) ?
+ return -EPERM;
+ }
+
no_transition_disable:
if (!wiphy_select_cipher(wiphy, rsn.pairwise_ciphers))
return -ENOTSUP;
Regards,
-Denis
11:32 p.m.
New subject: [PATCH v3 6/7] station: check supported frequencies in neighbor report
If the report has an unsupported frequency don't add it to the list.
---
src/station.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/station.c b/src/station.c
index 637d03d1..00f3d178 100644
--- a/src/station.c
+++ b/src/station.c
@@ -1712,6 +1712,8 @@ static void parse_neighbor_report(struct station *station,
struct scan_freq_set *freq_set_md, *freq_set_no_md;
uint32_t current_freq = 0;
struct handshake_state *hs = netdev_get_handshake(station->netdev);
+ const struct scan_freq_set *supported =
+ wiphy_get_supported_freqs(station->wiphy);
freq_set_md = scan_freq_set_new();
freq_set_no_md = scan_freq_set_new();
@@ -1748,6 +1750,10 @@ static void parse_neighbor_report(struct station *station,
if (!(band & wiphy_get_supported_bands(station->wiphy)))
continue;
+ /* Skip if frequency is not supported */
+ if (!scan_freq_set_contains(supported, freq))
+ continue;
+
if (!memcmp(info.addr,
station->connected_bss->addr, ETH_ALEN)) {
/*
--
2.34.1
11:32 p.m.
New subject: [PATCH v3 7/7] station: enforce MFPR=1 for 6GHz frequencies
This adds checks if MFP is set to 0 or 1:
0 - Always fail if the frequency is 6GHz
1 - Fail if MFPC=0 and the frequency is 6GHz.
If HW is capable set MFPR=1 for 6GHz
---
src/station.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/src/station.c b/src/station.c
index 00f3d178..a5210a7d 100644
--- a/src/station.c
+++ b/src/station.c
@@ -1012,9 +1012,13 @@ static int station_build_handshake_rsn(struct handshake_state *hs,
struct ie_rsn_info info;
uint8_t *ap_ie;
bool disable_ocv;
+ enum band_freq band;
memset(&info, 0, sizeof(info));
+ if (!band_freq_to_channel(bss->frequency, &band))
+ goto not_supported;
+
memset(&bss_info, 0, sizeof(bss_info));
scan_bss_get_rsn_info(bss, &bss_info);
@@ -1061,12 +1065,31 @@ static int station_build_handshake_rsn(struct handshake_state
*hs,
switch (mfp_setting) {
case 0:
- break;
+ if (band != BAND_FREQ_6_GHZ)
+ break;
+
+ l_error("MFP turned off by [General].ManagementFrameProtection,"
+ " 6GHz frequencies are disabled");
+ goto not_supported;
case 1:
info.group_management_cipher =
wiphy_select_cipher(wiphy,
bss_info.group_management_cipher);
info.mfpc = info.group_management_cipher != 0;
+
+ if (band != BAND_FREQ_6_GHZ)
+ break;
+
+ if (!info.mfpc)
+ goto not_supported;
+
+ /*
+ * 802.11ax Section 12.12.2
+ * The STA shall use management frame protection
+ * (MFPR=1) when using RSN.
+ */
+ info.mfpr = true;
+
break;
case 2:
info.group_management_cipher =
--
2.34.1
12:02 a.m.
Hi James,
On 2/25/22 17:32, James Prestwood wrote:
All uses of this macro will work with a bitwise comparison which is
needed for 6GHz checks and somewhat more flexible since it can be
used to compare RSN info, not only single AKM values.
---
src/ie.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
Patches 1-4 applied. (6-7 were applied earlier).
Regards,
-Denis
171
days inactive
172
days old
8 comments
2 participants
participants (2)
-
Denis Kenzior -
James Prestwood