[PATCH v2 1/6] wiphy: add getter for 'supports_cmds_auth_assoc'

[PATCH v2 1/6] wiphy: add getter for 'supports_cmds_auth_assoc'

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 1122 bytes --]

---
 src/wiphy.c | 5 +++++
 src/wiphy.h | 1 +
 2 files changed, 6 insertions(+)

diff --git a/src/wiphy.c b/src/wiphy.c
index 82e3ca87..e230b273 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -404,6 +404,11 @@ bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss)
 	return true;
 }
 
+bool wiphy_supports_cmds_auth_assoc(struct wiphy *wiphy)
+{
+	return wiphy->support_cmds_auth_assoc;
+}
+
 bool wiphy_has_feature(struct wiphy *wiphy, uint32_t feature)
 {
 	return wiphy->feature_flags & feature;
diff --git a/src/wiphy.h b/src/wiphy.h
index 1fd71f0d..6c91220c 100644
--- a/src/wiphy.h
+++ b/src/wiphy.h
@@ -79,6 +79,7 @@ uint32_t wiphy_get_supported_bands(struct wiphy *wiphy);
 const struct scan_freq_set *wiphy_get_supported_freqs(
 						const struct wiphy *wiphy);
 bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss);
+bool wiphy_supports_cmds_auth_assoc(struct wiphy *wiphy);
 bool wiphy_can_randomize_mac_addr(struct wiphy *wiphy);
 bool wiphy_rrm_capable(struct wiphy *wiphy);
 bool wiphy_has_feature(struct wiphy *wiphy, uint32_t feature);
-- 
2.26.2

[PATCH v2 2/6] wiphy: check SAE offload in wiphy_select_akm

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 3073 bytes --]

This allows an SAE AKM to be selected if the hardware does not
support SAE in userspace, but does support SAE offload.
---
 src/wiphy.c | 59 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 47 insertions(+), 12 deletions(-)

v2:
 * Added large comments explaing all the possible scenarios

diff --git a/src/wiphy.c b/src/wiphy.c
index e230b273..89186ce3 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -126,6 +126,52 @@ enum ie_rsn_cipher_suite wiphy_select_cipher(struct wiphy *wiphy, uint16_t mask)
 	return 0;
 }
 
+static bool wiphy_can_connect_sae(struct wiphy *wiphy)
+{
+	/*
+	 * SAE support in the kernel is a complete mess in that there are 3
+	 * different ways the hardware can support SAE:
+	 *
+	 * 1. Cards which allow SAE in userspace, meaning they support both
+	 *    CMD_AUTHENTICATE and CMD_ASSOCIATE as well as advertise support
+	 *    for FEATURE_SAE (SoftMAC).
+	 *
+	 * 2. Cards which allow SAE to be offloaded to hardware. These cards
+	 *    do not support AUTH/ASSOC commands, do not advertise FEATURE_SAE,
+	 *    but advertise support for EXT_FEATURE_SAE_OFFLOAD. With these
+	 *    cards the entire SAE protocol as well as the subsequent 4-way
+	 *    handshake are all done in the driver/firmware (fullMAC).
+	 *
+	 * 3. TODO: Cards which allow SAE in userspace via CMD_EXTERNAL_AUTH.
+	 *    These cards do not support AUTH/ASSOC commands but do implement
+	 *    CMD_EXTERNAL_AUTH which is supposed to allow userspace to
+	 *    generate Authenticate frames as it would for case (1). As it
+	 *    stands today only one driver actually uses CMD_EXTERNAL_AUTH and
+	 *    for now IWD will not allow connections to SAE networks using this
+	 *    mechanism.
+	 */
+
+	if (wiphy_has_feature(wiphy, NL80211_FEATURE_SAE)) {
+		/* Case (1) */
+		if (wiphy->support_cmds_auth_assoc)
+			return true;
+
+		/*
+		 * Case (3)
+		 *
+		 * TODO: No support for CMD_EXTERNAL_AUTH yet.
+		 */
+		return false;
+	} else {
+		/* Case (2) */
+		if (wiphy_has_ext_feature(wiphy,
+					NL80211_EXT_FEATURE_SAE_OFFLOAD))
+			return true;
+
+		return false;
+	}
+}
+
 enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
 					struct scan_bss *bss,
 					bool fils_capable_hint)
@@ -188,19 +234,8 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
 				goto wpa2_personal;
 			}
 
-			/*
-			 * TODO: Only SoftMAC (mac80211) drivers are currently
-			 * capable of SAE since it requires ability to send
-			 * Authenticate and Associate frames (which is given by
-			 * support_cmds_auth_assoc).  FullMAC drivers require
-			 * SAE offload which we do not support nor supported
-			 * in any upstream driver as of this time.
-			 */
-			if (!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) ||
-					!wiphy->support_cmds_auth_assoc) {
-				l_debug("No HW WPA3 support, trying WPA2");
+			if (!wiphy_can_connect_sae(wiphy))
 				goto wpa2_personal;
-			}
 
 			if (info.akm_suites &
 					IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256)
-- 
2.26.2

[PATCH v2 3/6] wiphy: check SAE offload in wiphy_can_connect

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 1043 bytes --]

This allows this wiphy_can_connect to pass for an SAE BSS
if the hardware does not support user space SAE, but does
support SAE offload.
---
 src/wiphy.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/src/wiphy.c b/src/wiphy.c
index 89186ce3..676f236c 100644
--- a/src/wiphy.c
+++ b/src/wiphy.c
@@ -411,15 +411,7 @@ bool wiphy_can_connect(struct wiphy *wiphy, struct scan_bss *bss)
 		switch (rsn_info.akm_suites) {
 		case IE_RSN_AKM_SUITE_SAE_SHA256:
 		case IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256:
-			/*
-			 * if the AP ONLY supports SAE/WPA3, then we can only
-			 * connect if the wiphy feature is supported. Otherwise
-			 * the AP may list SAE as one of the AKM's but also
-			 * support PSK (hybrid). In this case we still want to
-			 * allow a connection even if SAE is not supported.
-			 */
-			if (!wiphy_has_feature(wiphy, NL80211_FEATURE_SAE) ||
-						!wiphy->support_cmds_auth_assoc)
+			if (!wiphy_can_connect_sae(wiphy))
 				return false;
 
 			break;
-- 
2.26.2

[PATCH v2 4/6] handshake: add offload flag

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 495 bytes --]

If true, this flag indicates the handshake is being offloaded to
the kernel/hardware.
---
 src/handshake.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/handshake.h b/src/handshake.h
index b738efd9..e667fccd 100644
--- a/src/handshake.h
+++ b/src/handshake.h
@@ -116,6 +116,7 @@ struct handshake_state {
 	bool wait_for_gtk : 1;
 	bool no_rekey : 1;
 	bool support_fils : 1;
+	bool offload : 1;
 	uint8_t ssid[32];
 	size_t ssid_len;
 	char *passphrase;
-- 
2.26.2

[PATCH v2 5/6] netdev: add SAE offload support

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 3559 bytes --]

SAE offload support requires some minor tweaks to CMD_CONNECT
as well as special checks once the connect event comes in. Since
at this point we are fully connected.
---
 src/netdev.c | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

v2:
 * More comments explaining things.

diff --git a/src/netdev.c b/src/netdev.c
index 66a781bc..0cd139c2 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -1212,6 +1212,11 @@ static void netdev_connect_ok(struct netdev *netdev)
 		netdev->fw_roam_bss = NULL;
 	}
 
+	/* Allow station to sync the PSK to disk */
+	if (netdev->handshake->offload)
+		handshake_event(netdev->handshake,
+				HANDSHAKE_EVENT_SETTING_KEYS);
+
 	if (netdev->connect_cb) {
 		netdev->connect_cb(netdev, NETDEV_RESULT_OK, NULL,
 					netdev->user_data);
@@ -1979,6 +1984,14 @@ process_resp_ies:
 			netdev_send_qos_map_set(netdev, qos_set, qos_len);
 	}
 
+	/*
+	 * TODO: Only SAE/WPA3-personal offload is supported. In this case IWD
+	 * is 'done'. In the case of 8021x offload EAP still needs to take
+	 * place, so this must be updated accordingly when that is implemented.
+	 */
+	if (netdev->handshake->offload)
+		goto done;
+
 	if (netdev->sm) {
 		/*
 		 * Let station know about the roam so a state change can occur.
@@ -2002,6 +2015,7 @@ process_resp_ies:
 		return;
 	}
 
+done:
 	netdev_connect_ok(netdev);
 
 	return;
@@ -2601,7 +2615,9 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev *netdev,
 						const struct iovec *vendor_ies,
 						size_t num_vendor_ies)
 {
-	uint32_t auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
+	uint32_t auth_type = IE_AKM_IS_SAE(hs->akm_suite) ?
+					NL80211_AUTHTYPE_SAE :
+					NL80211_AUTHTYPE_OPEN_SYSTEM;
 	struct l_genl_msg *msg;
 	struct iovec iov[4 + num_vendor_ies];
 	int iov_elems = 0;
@@ -2618,6 +2634,12 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev *netdev,
 						bss->ssid_len, bss->ssid);
 	l_genl_msg_append_attr(msg, NL80211_ATTR_AUTH_TYPE, 4, &auth_type);
 
+	if (hs->offload) {
+		if (IE_AKM_IS_SAE(hs->akm_suite))
+			l_genl_msg_append_attr(msg, NL80211_ATTR_SAE_PASSWORD,
+					strlen(hs->passphrase), hs->passphrase);
+	}
+
 	if (prev_bssid)
 		l_genl_msg_append_attr(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
 						prev_bssid);
@@ -2659,7 +2681,9 @@ static struct l_genl_msg *netdev_build_cmd_connect(struct netdev *netdev,
 			l_genl_msg_append_attr(msg, NL80211_ATTR_AKM_SUITES,
 							4, &nl_akm);
 
-		if (hs->wpa_ie)
+		if (IE_AKM_IS_SAE(hs->akm_suite))
+			wpa_version = NL80211_WPA_VERSION_3;
+		else if (hs->wpa_ie)
 			wpa_version = NL80211_WPA_VERSION_1;
 		else
 			wpa_version = NL80211_WPA_VERSION_2;
@@ -3020,6 +3044,9 @@ int netdev_connect(struct netdev *netdev, struct scan_bss *bss,
 	switch (hs->akm_suite) {
 	case IE_RSN_AKM_SUITE_SAE_SHA256:
 	case IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256:
+		if (hs->offload)
+			goto build_cmd_connect;
+
 		netdev->ap = sae_sm_new(hs, netdev_sae_tx_authenticate,
 						netdev_sae_tx_associate,
 						netdev);
@@ -3038,13 +3065,14 @@ int netdev_connect(struct netdev *netdev, struct scan_bss *bss,
 						netdev);
 		break;
 	default:
+build_cmd_connect:
 		cmd_connect = netdev_build_cmd_connect(netdev, bss, hs,
 					NULL, vendor_ies, num_vendor_ies);
 
 		if (!cmd_connect)
 			return -EINVAL;
 
-		if (is_rsn || hs->settings_8021x)
+		if (!hs->offload && (is_rsn || hs->settings_8021x))
 			sm = eapol_sm_new(hs);
 	}
 
-- 
2.26.2

[PATCH v2 6/6] station: set handshake offload if required

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 1080 bytes --]

If IWD is connecting to a SAE/WPA3 BSS and Auth/Assoc commands
are not supported the only option is SAE offload. At this point
network_connect should have verified that the extended feature
for SAE offload exists so we can simply enable offload if these
commands are not supported.
---
 src/station.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/station.c b/src/station.c
index 2e577290..385dc7da 100644
--- a/src/station.c
+++ b/src/station.c
@@ -979,6 +979,16 @@ static struct handshake_state *station_handshake_setup(struct station *station,
 				goto no_psk;
 
 			handshake_state_set_passphrase(hs, passphrase);
+
+			/*
+			 * TODO: This check isn't strictly correct since
+			 * some drivers may support EXTERNAL_AUTH but since
+			 * wiphy_can_connect takes this into account IWD should
+			 * have already rejected the connection if this was the
+			 * case.
+			 */
+			if (!wiphy_supports_cmds_auth_assoc(wiphy))
+				hs->offload = true;
 		} else {
 			const uint8_t *psk = network_get_psk(network);
 
-- 
2.26.2

Re: [PATCH v2 1/6] wiphy: add getter for 'supports_cmds_auth_assoc'

[Denis Kenzior]

[-- Attachment #1: Type: text/plain, Size: 201 bytes --]

Hi James,

On 3/22/21 11:01 AM, James Prestwood wrote:
> ---
>   src/wiphy.c | 5 +++++
>   src/wiphy.h | 1 +
>   2 files changed, 6 insertions(+)
> 

All applied, thanks.

Regards,
-Denis