[PATCH 1/6] station: add two debug events for FT

[PATCH 1/6] station: add two debug events for FT

[James Prestwood]

These events are sent if IWD fails to authentiate
(ft-over-air-roam-failed) or if it falls back to over air after
failing to use FT-over-DS (try-ft-over-air)
---
 src/station.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/station.c b/src/station.c
index fdeab7c1..1ebd13ad 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2293,6 +2293,7 @@ static bool station_ft_work_ready(struct wiphy_radio_work_item *item)
 
 	ret = ft_associate(netdev_get_ifindex(station->netdev), bss->addr);
 	if (ret == -ENOENT) {
+		station_debug_event(station, "ft-over-air-roam-failed");
 try_next:
 		station_transition_start(station);
 		return true;
@@ -2337,9 +2338,10 @@ static bool station_fast_transition(struct station *station,
 		ret = ft_associate(netdev_get_ifindex(station->netdev),
 					bss->addr);
 		/* No action responses from this BSS, try over air */
-		if (ret == -ENOENT)
+		if (ret == -ENOENT) {
+			station_debug_event(station, "try-ft-over-air");
 			goto try_over_air;
-		else if (ret < 0)
+		} else if (ret < 0)
 			return false;
 
 		station->connected_bss = bss;
-- 
2.34.3

[PATCH 2/6] hwsim: fix early bail out processing rules

[James Prestwood]

If a rule was disabled it would cause hwsim to not continue processing
frames using rules further in the queue. _Most_ tests only use one
rule so this shouldn't have changed their behavior but others which
use multiple rules may be effected and the tests have not been
running properly.
---
 tools/hwsim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/hwsim.c b/tools/hwsim.c
index 8dcb75c4..e5501904 100644
--- a/tools/hwsim.c
+++ b/tools/hwsim.c
@@ -1204,7 +1204,7 @@ static void process_rules(const struct radio_info_rec *src_radio,
 		struct hwsim_rule *rule = rule_entry->data;
 
 		if (!rule->enabled)
-			return;
+			continue;
 
 		if (!rule->source_any &&
 				!radio_match_addr(src_radio, rule->source) &&
-- 
2.34.3

[PATCH 3/6] auto-t: remove rekey timeouts from autotests

[James Prestwood]

Any autotest which rekeys will do so explicitly. There is no need
to potentially introduce an unexpected rekey.
---
 autotests/testFILS/radius.conf                   | 2 --
 autotests/testFILS/ssidFILS-256.conf             | 2 --
 autotests/testFILS/ssidFILS-384.conf             | 2 --
 autotests/testFT-8021x-roam/ft-eap-ccmp-1.conf   | 2 --
 autotests/testFT-8021x-roam/ft-eap-ccmp-2.conf   | 2 --
 autotests/testFT-FILS/ft-eap-ccmp-1.conf         | 2 --
 autotests/testFT-FILS/ft-eap-ccmp-2.conf         | 2 --
 autotests/testFT-FILS/radius.conf                | 2 --
 autotests/testPSK-roam/ft-psk-ccmp-1.conf        | 2 --
 autotests/testPSK-roam/ft-psk-ccmp-2.conf        | 2 --
 autotests/testPreauth-roam/eaptls-preauth-1.conf | 2 --
 autotests/testPreauth-roam/eaptls-preauth-2.conf | 2 --
 autotests/testSAE-roam/ft-psk-3.conf             | 2 --
 autotests/testSAE-roam/ft-sae-1.conf             | 2 --
 autotests/testSAE-roam/ft-sae-2.conf             | 2 --
 15 files changed, 30 deletions(-)

diff --git a/autotests/testFILS/radius.conf b/autotests/testFILS/radius.conf
index 1ec52e46..f8f2b596 100644
--- a/autotests/testFILS/radius.conf
+++ b/autotests/testFILS/radius.conf
@@ -11,5 +11,3 @@ fils_realm=example.com
 disable_pmksa_caching=1
 
 pwd_group=19
-wpa_group_rekey=30
-wpa_ptk_rekey=30
diff --git a/autotests/testFILS/ssidFILS-256.conf b/autotests/testFILS/ssidFILS-256.conf
index 66d4bfb5..1ee9fc8f 100644
--- a/autotests/testFILS/ssidFILS-256.conf
+++ b/autotests/testFILS/ssidFILS-256.conf
@@ -17,6 +17,4 @@ nas_identifier=nas.w1.fi
 fils_realm=example.com
 disable_pmksa_caching=1
 
-wpa_group_rekey=30
-wpa_ptk_rekey=30
 ocv=1
diff --git a/autotests/testFILS/ssidFILS-384.conf b/autotests/testFILS/ssidFILS-384.conf
index 5254d5f8..57ebe6e5 100644
--- a/autotests/testFILS/ssidFILS-384.conf
+++ b/autotests/testFILS/ssidFILS-384.conf
@@ -17,6 +17,4 @@ nas_identifier=nas.w1.fi
 fils_realm=example.com
 disable_pmksa_caching=1
 
-wpa_group_rekey=30
-wpa_ptk_rekey=30
 ocv=1
diff --git a/autotests/testFT-8021x-roam/ft-eap-ccmp-1.conf b/autotests/testFT-8021x-roam/ft-eap-ccmp-1.conf
index a7f220d9..5a04668f 100644
--- a/autotests/testFT-8021x-roam/ft-eap-ccmp-1.conf
+++ b/autotests/testFT-8021x-roam/ft-eap-ccmp-1.conf
@@ -17,8 +17,6 @@ eap_user_file=/tmp/secrets/eap-user.text
 ca_cert=/tmp/certs/cert-ca.pem
 server_cert=/tmp/certs/cert-server.pem
 private_key=/tmp/certs/cert-server-key.pem
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 disable_pmksa_caching=0
diff --git a/autotests/testFT-8021x-roam/ft-eap-ccmp-2.conf b/autotests/testFT-8021x-roam/ft-eap-ccmp-2.conf
index 289d7a17..98754fd1 100644
--- a/autotests/testFT-8021x-roam/ft-eap-ccmp-2.conf
+++ b/autotests/testFT-8021x-roam/ft-eap-ccmp-2.conf
@@ -17,8 +17,6 @@ eap_user_file=/tmp/secrets/eap-user.text
 ca_cert=/tmp/certs/cert-ca.pem
 server_cert=/tmp/certs/cert-server.pem
 private_key=/tmp/certs/cert-server-key.pem
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 disable_pmksa_caching=0
diff --git a/autotests/testFT-FILS/ft-eap-ccmp-1.conf b/autotests/testFT-FILS/ft-eap-ccmp-1.conf
index 1853ff70..4dbbfb50 100644
--- a/autotests/testFT-FILS/ft-eap-ccmp-1.conf
+++ b/autotests/testFT-FILS/ft-eap-ccmp-1.conf
@@ -15,8 +15,6 @@ ieee8021x=1
 
 fils_realm=example.com
 
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 disable_pmksa_caching=1
diff --git a/autotests/testFT-FILS/ft-eap-ccmp-2.conf b/autotests/testFT-FILS/ft-eap-ccmp-2.conf
index 585f1ca1..5f341bcd 100644
--- a/autotests/testFT-FILS/ft-eap-ccmp-2.conf
+++ b/autotests/testFT-FILS/ft-eap-ccmp-2.conf
@@ -15,8 +15,6 @@ ieee8021x=1
 
 fils_realm=example.com
 
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 disable_pmksa_caching=1
diff --git a/autotests/testFT-FILS/radius.conf b/autotests/testFT-FILS/radius.conf
index 1ec52e46..f8f2b596 100644
--- a/autotests/testFT-FILS/radius.conf
+++ b/autotests/testFT-FILS/radius.conf
@@ -11,5 +11,3 @@ fils_realm=example.com
 disable_pmksa_caching=1
 
 pwd_group=19
-wpa_group_rekey=30
-wpa_ptk_rekey=30
diff --git a/autotests/testPSK-roam/ft-psk-ccmp-1.conf b/autotests/testPSK-roam/ft-psk-ccmp-1.conf
index c012b4ef..4a2ceba5 100644
--- a/autotests/testPSK-roam/ft-psk-ccmp-1.conf
+++ b/autotests/testPSK-roam/ft-psk-ccmp-1.conf
@@ -13,8 +13,6 @@ wpa=2
 wpa_key_mgmt=FT-PSK
 wpa_pairwise=CCMP
 wpa_passphrase=EasilyGuessedPassword
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 rsn_preauth_interfaces=lo
diff --git a/autotests/testPSK-roam/ft-psk-ccmp-2.conf b/autotests/testPSK-roam/ft-psk-ccmp-2.conf
index 84875fdc..a42e175d 100644
--- a/autotests/testPSK-roam/ft-psk-ccmp-2.conf
+++ b/autotests/testPSK-roam/ft-psk-ccmp-2.conf
@@ -13,8 +13,6 @@ wpa=2
 wpa_key_mgmt=FT-PSK
 wpa_pairwise=CCMP
 wpa_passphrase=EasilyGuessedPassword
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 rsn_preauth=1
 rsn_preauth_interfaces=lo
diff --git a/autotests/testPreauth-roam/eaptls-preauth-1.conf b/autotests/testPreauth-roam/eaptls-preauth-1.conf
index dac086e6..5b4c9d6f 100644
--- a/autotests/testPreauth-roam/eaptls-preauth-1.conf
+++ b/autotests/testPreauth-roam/eaptls-preauth-1.conf
@@ -7,8 +7,6 @@ wpa=2
 wpa_key_mgmt=WPA-EAP
 wpa_pairwise=CCMP
 ieee8021x=1
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 
 # Run the RADIUS server in the BSS 0 hostapd only, listen for BSS 1 connections
diff --git a/autotests/testPreauth-roam/eaptls-preauth-2.conf b/autotests/testPreauth-roam/eaptls-preauth-2.conf
index 6d3a18e7..edb97fe0 100644
--- a/autotests/testPreauth-roam/eaptls-preauth-2.conf
+++ b/autotests/testPreauth-roam/eaptls-preauth-2.conf
@@ -7,8 +7,6 @@ wpa=2
 wpa_key_mgmt=WPA-EAP
 wpa_pairwise=CCMP
 ieee8021x=1
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=1
 
 # For EAP connect to the RADIUS server in the BSS 0
diff --git a/autotests/testSAE-roam/ft-psk-3.conf b/autotests/testSAE-roam/ft-psk-3.conf
index 8918cf9e..705f2e6c 100644
--- a/autotests/testSAE-roam/ft-psk-3.conf
+++ b/autotests/testSAE-roam/ft-psk-3.conf
@@ -13,8 +13,6 @@ wpa=2
 wpa_key_mgmt=FT-PSK
 wpa_pairwise=CCMP
 wpa_passphrase=EasilyGuessedPassword
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=2
 disable_pmksa_caching=0
 # Allow PMK cache to be shared opportunistically among configured interfaces
diff --git a/autotests/testSAE-roam/ft-sae-1.conf b/autotests/testSAE-roam/ft-sae-1.conf
index aa40494a..bccac375 100644
--- a/autotests/testSAE-roam/ft-sae-1.conf
+++ b/autotests/testSAE-roam/ft-sae-1.conf
@@ -13,8 +13,6 @@ wpa=2
 wpa_key_mgmt=FT-SAE SAE
 sae_password=EasilyGuessedPassword|mac=ff:ff:ff:ff:ff:ff
 wpa_pairwise=CCMP
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=2
 disable_pmksa_caching=0
 # Allow PMK cache to be shared opportunistically among configured interfaces
diff --git a/autotests/testSAE-roam/ft-sae-2.conf b/autotests/testSAE-roam/ft-sae-2.conf
index 5bff6c9d..bb7ecff4 100644
--- a/autotests/testSAE-roam/ft-sae-2.conf
+++ b/autotests/testSAE-roam/ft-sae-2.conf
@@ -13,8 +13,6 @@ wpa=2
 wpa_key_mgmt=FT-SAE SAE
 sae_password=EasilyGuessedPassword|mac=ff:ff:ff:ff:ff:ff
 wpa_pairwise=CCMP
-wpa_ptk_rekey=30
-wpa_group_rekey=80
 ieee80211w=2
 disable_pmksa_caching=0
 # Allow PMK cache to be shared opportunistically among configured interfaces
-- 
2.34.3

[PATCH 4/6] auto-t: remove old debug print from wpas.py

[James Prestwood]

---
 autotests/util/wpas.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/autotests/util/wpas.py b/autotests/util/wpas.py
index c1a12b62..442f0dce 100644
--- a/autotests/util/wpas.py
+++ b/autotests/util/wpas.py
@@ -72,7 +72,6 @@ class Wpas:
 
     def _check_event(self, event):
         if not event and len(self._rx_data) >= 1:
-            print("returning %s" % self._rx_data[0])
             return self._rx_data[0]
 
         for e in self._rx_data:
-- 
2.34.3

[PATCH 5/6] auto-t: add two tests for new FT behavior

[James Prestwood]

These tests ensure proper behavior if FT fails to authenticate
---
 autotests/testPSK-roam/failed_roam_test.py | 160 +++++++++++++++++++++
 1 file changed, 160 insertions(+)
 create mode 100644 autotests/testPSK-roam/failed_roam_test.py

diff --git a/autotests/testPSK-roam/failed_roam_test.py b/autotests/testPSK-roam/failed_roam_test.py
new file mode 100644
index 00000000..cac2ff4d
--- /dev/null
+++ b/autotests/testPSK-roam/failed_roam_test.py
@@ -0,0 +1,160 @@
+#! /usr/bin/python3
+
+import unittest
+import os, sys
+
+sys.path.append('../util')
+from iwd import IWD
+from iwd import NetworkType, DeviceState
+from hwsim import Hwsim
+from hostapd import HostapdCLI
+import testutil
+
+class Test(unittest.TestCase):
+    def connect(self, wd, device, hostapd):
+        ordered_network = device.get_ordered_network('TestFT', full_scan=True)
+
+        self.assertEqual(ordered_network.type, NetworkType.psk)
+
+        condition = 'not obj.connected'
+        wd.wait_for_object_condition(ordered_network.network_object, condition)
+
+        device.connect_bssid(hostapd.bssid)
+
+        condition = 'obj.state == DeviceState.connected'
+        wd.wait_for_object_condition(device, condition)
+
+        hostapd.wait_for_event('AP-STA-CONNECTED %s' % device.address)
+
+        testutil.test_iface_operstate(device.name)
+        testutil.test_ifaces_connected(hostapd.ifname, device.name)
+
+    def verify_roam(self, wd, device, prev, new):
+        from_condition = 'obj.state == DeviceState.roaming'
+        to_condition = 'obj.state == DeviceState.connected'
+        wd.wait_for_object_change(device, from_condition, to_condition)
+
+        new.wait_for_event('AP-STA-CONNECTED %s' % device.address)
+
+        testutil.test_iface_operstate(device.name)
+        testutil.test_ifaces_connected(new.ifname, device.name)
+        self.assertRaises(Exception, testutil.test_ifaces_connected,
+                          (prev.ifname, device.name, True, True))
+
+
+    # FT-over-Air failure, should stay connected
+    def test_ft_over_air_failure(self):
+        self.bss_hostapd[0].set_value('wpa_key_mgmt', 'FT-PSK')
+        self.bss_hostapd[0].set_value('ft_over_ds', '0')
+        self.bss_hostapd[0].reload()
+        self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+
+        self.bss_hostapd[1].set_value('wpa_key_mgmt', 'FT-PSK')
+        self.bss_hostapd[1].set_value('ft_over_ds', '0')
+        self.bss_hostapd[1].reload()
+        self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+
+        wd = IWD(True)
+
+        device = wd.list_devices(1)[0]
+
+        self.connect(wd, device, self.bss_hostapd[0])
+
+        self.rule0.enabled = True
+
+        device.roam(self.bss_hostapd[1].bssid)
+
+        # Roam should fail...
+        device.wait_for_event('ft-over-air-roam-failed')
+        # ... but IWD should remain connected
+        self.assertTrue(device.state == DeviceState.connected)
+
+        self.rule0.enabled = False
+
+        # Try again once more
+        device.roam(self.bss_hostapd[1].bssid)
+
+        self.verify_roam(wd, device, self.bss_hostapd[0], self.bss_hostapd[1])
+
+        self.bss_hostapd[1].deauthenticate(device.address)
+        condition = 'obj.state == DeviceState.disconnected'
+        wd.wait_for_object_condition(device, condition)
+
+    # Network sets over-DS bit, but fails to authenticate. IWD should still be
+    # able to roam using FT-over-Air.
+    def test_fallback_to_over_air(self):
+        self.bss_hostapd[0].set_value('wpa_key_mgmt', 'FT-PSK')
+        self.bss_hostapd[0].set_value('ft_over_ds', '1')
+        self.bss_hostapd[0].reload()
+        self.bss_hostapd[0].wait_for_event("AP-ENABLED")
+
+        self.bss_hostapd[1].set_value('wpa_key_mgmt', 'FT-PSK')
+        self.bss_hostapd[1].set_value('ft_over_ds', '1')
+        self.bss_hostapd[1].reload()
+        self.bss_hostapd[1].wait_for_event("AP-ENABLED")
+
+        wd = IWD(True)
+
+        device = wd.list_devices(1)[0]
+
+        # Drop action frames, this will prevent FT-over-DS authentication
+        self.rule1.enabled = True
+
+        self.connect(wd, device, self.bss_hostapd[0])
+
+        device.roam(self.bss_hostapd[1].bssid)
+
+        self.rule1.enabled = False
+
+        # FT-over-DS should fail, and over-Air should take over leading to a
+        # successful roam
+        device.wait_for_event('try-ft-over-air')
+
+        self.verify_roam(wd, device, self.bss_hostapd[0], self.bss_hostapd[1])
+
+        self.bss_hostapd[1].deauthenticate(device.address)
+        condition = 'obj.state == DeviceState.disconnected'
+        wd.wait_for_object_condition(device, condition)
+
+    def tearDown(self):
+        os.system('ip link set "' + self.bss_hostapd[0].ifname + '" down')
+        os.system('ip link set "' + self.bss_hostapd[1].ifname + '" down')
+        os.system('ip link set "' + self.bss_hostapd[0].ifname + '" up')
+        os.system('ip link set "' + self.bss_hostapd[1].ifname + '" up')
+
+        self.rule0.enabled = False
+        self.rule1.enabled = False
+
+    @classmethod
+    def setUpClass(cls):
+        hwsim = Hwsim()
+
+        IWD.copy_to_storage('TestFT.psk')
+
+        cls.bss_hostapd = [ HostapdCLI(config='ft-psk-ccmp-1.conf'),
+                            HostapdCLI(config='ft-psk-ccmp-2.conf') ]
+
+        cls.bss_hostapd[0].set_address('12:00:00:00:00:01')
+        cls.bss_hostapd[1].set_address('12:00:00:00:00:02')
+
+        # Drop Authenticate frames
+        cls.rule0 = hwsim.rules.create()
+        cls.rule0.bidirectional = True
+        cls.rule0.prefix = 'b0'
+        cls.rule0.drop = True
+
+        # Drop Action frames
+        cls.rule1 = hwsim.rules.create()
+        cls.rule1.bidirectional = True
+        cls.rule1.prefix = 'd0'
+        cls.rule1.drop = True
+
+    @classmethod
+    def tearDownClass(cls):
+        IWD.clear_storage()
+        cls.bss_hostapd = None
+        cls.rule0.remove()
+        cls.rule1.remove()
+
+if __name__ == '__main__':
+    unittest.main(exit=True)
-- 
2.34.3

[PATCH 6/6] monitor: parse DPP frame types

[James Prestwood]

Parses the type of frame for easier debugging.
---
 monitor/nlmon.c | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/monitor/nlmon.c b/monitor/nlmon.c
index 2e232130..2222db09 100644
--- a/monitor/nlmon.c
+++ b/monitor/nlmon.c
@@ -4724,6 +4724,36 @@ static void print_anqp_frame(unsigned int level, const uint8_t *anqp,
 	}
 }
 
+static void print_dpp_public_action_frame(unsigned int level,
+					const uint8_t *data, size_t len)
+{
+	print_attr(level, "DPP Action Frame");
+
+	print_attr(level + 1, "Crypto Suite: %u", *data);
+	data++;
+
+	switch (*data) {
+	case 0:
+		print_attr(level + 1, "Type: Authentication Request");
+		break;
+	case 1:
+		print_attr(level + 1, "Type: Authentication Response");
+		break;
+	case 2:
+		print_attr(level + 1, "Type: Authentication Confirm");
+		break;
+	case 11:
+		print_attr(level + 1, "Type: Configuration Result");
+		break;
+	case 13:
+		print_attr(level + 1, "Type: Presence Announcement");
+		break;
+	default:
+		print_attr(level + 1, "Type: Unknown (%u)", *data);
+		break;
+	}
+}
+
 static void print_public_action_frame(unsigned int level, const uint8_t *body,
 					size_t body_len)
 {
@@ -4791,6 +4821,12 @@ static void print_public_action_frame(unsigned int level, const uint8_t *body,
 
 		print_p2p_public_action_frame(level + 1, body + 5,
 						body_len - 5);
+	} else if (!memcmp(oui, wifi_alliance_oui, 3) && oui[3] == 0x1a) {
+		if (!print_oui(level, oui))
+			return;
+
+		print_dpp_public_action_frame(level + 1, body + 5,
+						body_len - 5);
 	} else if (body[0] == 0x0a) {
 		if (body_len < 9)
 			return;
-- 
2.34.3

Re: [PATCH 1/6] station: add two debug events for FT

[Denis Kenzior]

Hi James,

On 10/5/22 17:46, James Prestwood wrote:
> These events are sent if IWD fails to authentiate
> (ft-over-air-roam-failed) or if it falls back to over air after
> failing to use FT-over-DS (try-ft-over-air)
> ---
>   src/station.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 

All applied, thanks.

Regards,
-Denis