[PATCH 1/7] netdev: use nl80211_parse_attrs for deauth event

[PATCH 1/7] netdev: use nl80211_parse_attrs for deauth event

[James Prestwood]

Especially for parsing a single attribute, nl80211_parse_attrs
makes the most sense to use here.
---
 src/netdev.c | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/src/netdev.c b/src/netdev.c
index 5b79d267..bada1ab5 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -1328,12 +1328,10 @@ static void netdev_cmd_disconnect_cb(struct l_genl_msg *msg, void *user_data)
 static void netdev_deauthenticate_event(struct l_genl_msg *msg,
 							struct netdev *netdev)
 {
-	struct l_genl_attr attr;
-	uint16_t type, len;
-	const void *data;
 	const struct mmpdu_header *hdr = NULL;
 	const struct mmpdu_deauthentication *deauth;
 	uint16_t reason_code;
+	struct iovec iov;
 
 	l_debug("");
 
@@ -1349,17 +1347,11 @@ static void netdev_deauthenticate_event(struct l_genl_msg *msg,
 	 * deauthenticating immediately afterwards
 	 */
 
-	if (L_WARN_ON(!l_genl_attr_init(&attr, msg)))
+	if (L_WARN_ON(nl80211_parse_attrs(msg, NL80211_ATTR_FRAME, &iov,
+						NL80211_ATTR_UNSPEC) < 0))
 		return;
 
-	while (l_genl_attr_next(&attr, &type, &len, &data)) {
-		switch (type) {
-		case NL80211_ATTR_FRAME:
-			hdr = mpdu_validate(data, len);
-			break;
-		}
-	}
-
+	hdr = mpdu_validate(iov.iov_base, iov.iov_len);
 	if (L_WARN_ON(!hdr))
 		return;
 
-- 
2.34.1

[PATCH 2/7] nl80211util: use nl80211_parse_attrs/nested for get_key_seq

[James Prestwood]

This really reduces the number of checks needed and overall function
length by using the helper APIs.
---
 src/nl80211util.c | 51 +++++++++++++++++++++++------------------------
 1 file changed, 25 insertions(+), 26 deletions(-)

diff --git a/src/nl80211util.c b/src/nl80211util.c
index ac4ad223..eaf9f610 100644
--- a/src/nl80211util.c
+++ b/src/nl80211util.c
@@ -184,6 +184,7 @@ static attr_handler handler_for_nl80211(int type)
 		return extract_iovec;
 	case NL80211_ATTR_WIPHY_BANDS:
 	case NL80211_ATTR_SURVEY_INFO:
+	case NL80211_ATTR_KEY:
 		return extract_nested;
 	case NL80211_ATTR_KEY_IDX:
 		return extract_u8;
@@ -208,6 +209,18 @@ static attr_handler handler_for_survey_info(int type)
 	return NULL;
 }
 
+static attr_handler handler_for_key(int type)
+{
+	switch (type) {
+	case NL80211_KEY_SEQ:
+		return extract_iovec;
+	default:
+		break;
+	}
+
+	return NULL;
+}
+
 struct attr_entry {
 	uint16_t type;
 	void *data;
@@ -322,6 +335,9 @@ int nl80211_parse_nested(struct l_genl_attr *attr, int type, int tag, ...)
 	case NL80211_ATTR_SURVEY_INFO:
 		handler = handler_for_survey_info;
 		break;
+	case NL80211_ATTR_KEY:
+		handler = handler_for_key;
+		break;
 	default:
 		return -ENOTSUP;
 	}
@@ -568,46 +584,29 @@ struct l_genl_msg *nl80211_build_get_key(uint32_t ifindex, uint8_t key_index)
 
 const void *nl80211_parse_get_key_seq(struct l_genl_msg *msg)
 {
-	struct l_genl_attr attr, nested;
-	uint16_t type, len;
-	const void *data;
+	struct l_genl_attr nested;
+	struct iovec iov;
 
-	if (l_genl_msg_get_error(msg) < 0 || !l_genl_attr_init(&attr, msg)) {
+	if (l_genl_msg_get_error(msg) < 0 ||
+			nl80211_parse_attrs(msg, NL80211_ATTR_KEY, &nested,
+						NL80211_ATTR_UNSPEC) < 0) {
 		l_error("GET_KEY failed for the GTK: %i",
 			l_genl_msg_get_error(msg));
 		return NULL;
 	}
 
-	while (l_genl_attr_next(&attr, &type, &len, &data)) {
-		if (type != NL80211_ATTR_KEY)
-			continue;
-
-		break;
-	}
-
-	if (type != NL80211_ATTR_KEY || !l_genl_attr_recurse(&attr, &nested)) {
+	if (nl80211_parse_nested(&nested, NL80211_ATTR_KEY, NL80211_KEY_SEQ,
+					&iov, NL80211_ATTR_UNSPEC)) {
 		l_error("Can't recurse into ATTR_KEY in GET_KEY reply");
 		return NULL;
 	}
 
-	while (l_genl_attr_next(&nested, &type, &len, &data)) {
-		if (type != NL80211_KEY_SEQ)
-			continue;
-
-		break;
-	}
-
-	if (type != NL80211_KEY_SEQ) {
-		l_error("KEY_SEQ not returned in GET_KEY reply");
-		return NULL;
-	}
-
-	if (len != 6) {
+	if (iov.iov_len != 6) {
 		l_error("KEY_SEQ length != 6 in GET_KEY reply");
 		return NULL;
 	}
 
-	return data;
+	return iov.iov_base;
 }
 
 struct l_genl_msg *nl80211_build_cmd_frame(uint32_t ifindex,
-- 
2.34.1

[PATCH 3/7] netdev: reuse NETDEV_EVENT_{AUTHENTICATING,ASSOCIATING}

[James Prestwood]

The authenticating event was not used anymore and the associating
event use was questionable (after the CMD_CONNECT callback).

No other modules actually utilize these events but they are useful
for autotests. Move these events around to map 1:1 when the kernel
sends the auth/assoc events.
---
 src/netdev.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/netdev.c b/src/netdev.c
index bada1ab5..153001ab 100644
--- a/src/netdev.c
+++ b/src/netdev.c
@@ -2422,10 +2422,6 @@ static void netdev_driver_connected(struct netdev *netdev)
 {
 	netdev->connected = true;
 
-	if (netdev->event_filter)
-		netdev->event_filter(netdev, NETDEV_EVENT_ASSOCIATING, NULL,
-					netdev->user_data);
-
 	/*
 	 * We register the eapol state machine here, in case the PAE
 	 * socket receives EAPoL packets before the nl80211 socket
@@ -2919,6 +2915,10 @@ static void netdev_authenticate_event(struct l_genl_msg *msg,
 		return;
 	}
 
+	if (netdev->event_filter)
+		netdev->event_filter(netdev, NETDEV_EVENT_AUTHENTICATING,
+					NULL, netdev->user_data);
+
 	/*
 	 * During Fast Transition we use the authenticate event to start the
 	 * reassociation step because the FTE necessary before we can build
@@ -3040,6 +3040,10 @@ static void netdev_associate_event(struct l_genl_msg *msg,
 	if (!netdev->connected || netdev->aborting)
 		return;
 
+	if (netdev->event_filter)
+		netdev->event_filter(netdev, NETDEV_EVENT_ASSOCIATING,
+					NULL, netdev->user_data);
+
 	if (!netdev->ap && !netdev->in_ft) {
 		netdev->associated = true;
 		netdev->in_reassoc = false;
-- 
2.34.1

Re: [PATCH 3/7] netdev: reuse NETDEV_EVENT_{AUTHENTICATING,ASSOCIATING}

[Denis Kenzior]

Hi James,

On 6/25/24 8:06 AM, James Prestwood wrote:
> The authenticating event was not used anymore and the associating
> event use was questionable (after the CMD_CONNECT callback).
> 
> No other modules actually utilize these events but they are useful
> for autotests. Move these events around to map 1:1 when the kernel
> sends the auth/assoc events.

So I went ahead and applied all of these since these events weren't really used. 
  One thing to keep in mind is that the ASSOCIATE event firing in 
netdev_driver_connected was to take care of full-mac hardware that doesn't send 
authenticate / associate events over NL80211.  I think at some point this was 
used as a hint for something, even on full mac cards, but isn't any more.

> ---
>   src/netdev.c | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
> 

Regards,
-Denis

[PATCH 4/7] station: add auth/assoc debug events

[James Prestwood]

These will be useful to trigger behavior around authentication and
association.
---
 src/station.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/station.c b/src/station.c
index 2e5febee..1e8846b4 100644
--- a/src/station.c
+++ b/src/station.c
@@ -3486,10 +3486,10 @@ static void station_netdev_event(struct netdev *netdev, enum netdev_event event,
 
 	switch (event) {
 	case NETDEV_EVENT_AUTHENTICATING:
-		l_debug("Authenticating");
+		station_debug_event(station, "authenticating");
 		break;
 	case NETDEV_EVENT_ASSOCIATING:
-		l_debug("Associating");
+		station_debug_event(station, "associating");
 		break;
 	case NETDEV_EVENT_DISCONNECT_BY_AP:
 	case NETDEV_EVENT_DISCONNECT_BY_SME:
-- 
2.34.1

[PATCH 5/7] auto-t: add test for deauth after authentication

[James Prestwood]

This code path is not exercised in the autotest but commonly does
happen in the real world. There is no associated bug with this, but
its helpful to have this event triggered in case something got
introduced in the future.
---
 autotests/testWPA2/failure_test.py | 32 +++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/autotests/testWPA2/failure_test.py b/autotests/testWPA2/failure_test.py
index 61cf6ade..c8ecb33c 100644
--- a/autotests/testWPA2/failure_test.py
+++ b/autotests/testWPA2/failure_test.py
@@ -8,11 +8,12 @@ import iwd
 from iwd import IWD
 from iwd import PSKAgent
 from iwd import NetworkType
+from hostapd import HostapdCLI
 import testutil
 
 class Test(unittest.TestCase):
 
-    def test_connection_success(self):
+    def test_incorrect_password(self):
         wd = IWD(True)
 
         psk_agent = PSKAgent("InvalidPassword")
@@ -34,6 +35,35 @@ class Test(unittest.TestCase):
 
         wd.unregister_psk_agent(psk_agent)
 
+    def test_deauth_after_connection(self):
+        wd = IWD(True)
+        hostapd = HostapdCLI(config="ssidWPA2.conf")
+
+        psk_agent = PSKAgent("secret123")
+        wd.register_psk_agent(psk_agent)
+
+        devices = wd.list_devices(1)
+        self.assertIsNotNone(devices)
+        device = devices[0]
+
+        ordered_network = device.get_ordered_network('ssidWPA2')
+
+        self.assertEqual(ordered_network.type, NetworkType.psk)
+
+        condition = 'not obj.connected'
+        wd.wait_for_object_condition(ordered_network.network_object, condition)
+
+        ordered_network.network_object.connect(wait=False)
+
+        device.wait_for_event("authenticating")
+
+        # Trigger a deauth just after authenticating
+        hostapd.deauthenticate(device.address)
+
+        device.wait_for_event("disconnected")
+
+        wd.unregister_psk_agent(psk_agent)
+
     @classmethod
     def setUpClass(cls):
         pass
-- 
2.34.1

[PATCH 6/7] station: add debug event prior to sending an FT-auth frame

[James Prestwood]

---
 src/station.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/station.c b/src/station.c
index 1e8846b4..509d919c 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2449,6 +2449,8 @@ static bool station_fast_transition(struct station *station,
 		goto done;
 	}
 
+	station_debug_event(station, "ft-authenticating");
+
 	if (station->connected_bss->frequency == bss->frequency) {
 		ft_authenticate_onchannel(netdev_get_ifindex(station->netdev),
 						bss);
-- 
2.34.1

[PATCH 7/7] auto-t: add test for a deauth coming in during an FT-roam

[James Prestwood]

---
 autotests/testPSK-roam/failed_roam_test.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/autotests/testPSK-roam/failed_roam_test.py b/autotests/testPSK-roam/failed_roam_test.py
index 8cce8bb5..60bcf366 100644
--- a/autotests/testPSK-roam/failed_roam_test.py
+++ b/autotests/testPSK-roam/failed_roam_test.py
@@ -149,6 +149,21 @@ class Test(unittest.TestCase):
         condition = 'obj.state == DeviceState.disconnected'
         self.wd.wait_for_object_condition(device, condition)
 
+    def test_ft_deauth_before_association(self):
+        self.rule2.enabled = True
+        self.rule3.enabled = True
+
+        device = self.wd.list_devices(1)[0]
+
+        self.connect(self.wd, device, self.bss_hostapd[0])
+
+        device.wait_for_event('ft-authenticating', timeout=60)
+
+        self.bss_hostapd[1].deauthenticate(device.address)
+
+        condition = 'obj.state == DeviceState.disconnected'
+        self.wd.wait_for_object_condition(device, condition)
+
     def setUp(self):
         self.wd = IWD(True)
 
-- 
2.34.1