| Message ID | 20240506003518.320176-15-brandtwjohn@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Basic WPA3 support in AP mode | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| prestwoj/iwd-ci-gitlint | success | GitLint |
Hi John, On 5/5/24 7:30 PM, John Brandt wrote: > When wanting to use SAE, confirm that MFP is also supported, and > automatically enable MFP. Advertise as MFP capable in the beacon. > --- > src/ap.c | 13 +++++++++++-- > src/wiphy.c | 2 +- > src/wiphy.h | 2 ++ > 3 files changed, 14 insertions(+), 3 deletions(-) > > diff --git a/src/ap.c b/src/ap.c > index ae406e16..8cebef42 100644 > --- a/src/ap.c > +++ b/src/ap.c > @@ -82,6 +82,7 @@ struct ap_state { > > unsigned int ciphers; > enum ie_rsn_cipher_suite group_cipher; > + enum ie_rsn_cipher_suite group_management_cipher; > unsigned int akm_suites; > uint32_t beacon_interval; > struct l_uintset *rates; > @@ -93,6 +94,7 @@ struct ap_state { > struct l_timeout *wsc_pbc_timeout; > uint16_t wsc_dpid; > uint8_t wsc_uuid_r[16]; > + bool mfpc; > > uint16_t last_aid; > struct l_queue *sta_states; > @@ -639,6 +641,9 @@ static void ap_set_rsn_info(struct ap_state *ap, struct ie_rsn_info *rsn) > rsn->akm_suites = ap->akm_suites; > rsn->pairwise_ciphers = ap->ciphers; > rsn->group_cipher = ap->group_cipher; > + > + rsn->group_management_cipher = ap->group_management_cipher; > + rsn->mfpc = ap->mfpc; > } > > static void ap_wsc_exit_pbc(struct ap_state *ap) > @@ -3916,9 +3921,13 @@ static int ap_load_config(struct ap_state *ap, const struct l_settings *config, > for (i = 0; akms_str && akms_str[i]; i++) { > if (!strcmp(akms_str[i], "PSK")) > ap->akm_suites |= IE_RSN_AKM_SUITE_PSK; > - else if (!strcmp(akms_str[i], "SAE")) > + else if (!strcmp(akms_str[i], "SAE")) { > + if (!wiphy_can_connect_sae(wiphy)) wiphy_can_connect_sae checks NL80211_FEATURE_SAE and NL80211_EXT_FEATURE_SAE_OFFLOAD bit, which is for clients only. The AP equivalent is NL80211_EXT_FEATURE_SAE_OFFLOAD_AP. Refer to linux/nl80211.h for more details. You're probably better off using wiphy_get_supported_ciphers instead. > + return -ENOTSUP; > ap->akm_suites |= IE_RSN_AKM_SUITE_SAE_SHA256; > - else { > + ap->group_management_cipher = IE_RSN_CIPHER_SUITE_BIP_CMAC; > + ap->mfpc = true; > + } else { > l_warn("Unsupported or unknown AKM suite %s", > akms_str[i]); > return -ENOTSUP; Regards, -Denis
diff --git a/src/ap.c b/src/ap.c index ae406e16..8cebef42 100644 --- a/src/ap.c +++ b/src/ap.c @@ -82,6 +82,7 @@ struct ap_state { unsigned int ciphers; enum ie_rsn_cipher_suite group_cipher; + enum ie_rsn_cipher_suite group_management_cipher; unsigned int akm_suites; uint32_t beacon_interval; struct l_uintset *rates; @@ -93,6 +94,7 @@ struct ap_state { struct l_timeout *wsc_pbc_timeout; uint16_t wsc_dpid; uint8_t wsc_uuid_r[16]; + bool mfpc; uint16_t last_aid; struct l_queue *sta_states; @@ -639,6 +641,9 @@ static void ap_set_rsn_info(struct ap_state *ap, struct ie_rsn_info *rsn) rsn->akm_suites = ap->akm_suites; rsn->pairwise_ciphers = ap->ciphers; rsn->group_cipher = ap->group_cipher; + + rsn->group_management_cipher = ap->group_management_cipher; + rsn->mfpc = ap->mfpc; } static void ap_wsc_exit_pbc(struct ap_state *ap) @@ -3916,9 +3921,13 @@ static int ap_load_config(struct ap_state *ap, const struct l_settings *config, for (i = 0; akms_str && akms_str[i]; i++) { if (!strcmp(akms_str[i], "PSK")) ap->akm_suites |= IE_RSN_AKM_SUITE_PSK; - else if (!strcmp(akms_str[i], "SAE")) + else if (!strcmp(akms_str[i], "SAE")) { + if (!wiphy_can_connect_sae(wiphy)) + return -ENOTSUP; ap->akm_suites |= IE_RSN_AKM_SUITE_SAE_SHA256; - else { + ap->group_management_cipher = IE_RSN_CIPHER_SUITE_BIP_CMAC; + ap->mfpc = true; + } else { l_warn("Unsupported or unknown AKM suite %s", akms_str[i]); return -ENOTSUP; diff --git a/src/wiphy.c b/src/wiphy.c index fb36ebb2..fb30e7a6 100644 --- a/src/wiphy.c +++ b/src/wiphy.c @@ -195,7 +195,7 @@ uint16_t wiphy_get_supported_ciphers(struct wiphy *wiphy, uint16_t mask) return wiphy->supported_ciphers & mask; } -static bool wiphy_can_connect_sae(struct wiphy *wiphy) +bool wiphy_can_connect_sae(struct wiphy *wiphy) { /* * WPA3 Specification version 3, Section 2.2: diff --git a/src/wiphy.h b/src/wiphy.h index bc82a007..9472b253 100644 --- a/src/wiphy.h +++ b/src/wiphy.h @@ -72,6 +72,8 @@ enum ie_rsn_cipher_suite wiphy_select_cipher(struct wiphy *wiphy, uint16_t mask); uint16_t wiphy_get_supported_ciphers(struct wiphy *wiphy, uint16_t mask); +bool wiphy_can_connect_sae(struct wiphy *wiphy); + enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy, const struct scan_bss *bss, enum security security,