summaryrefslogtreecommitdiff
path: root/src/core/supplicant
Commit message (Collapse)AuthorAgeFilesLines
* wifi: fix aggressively roaming (background Wi-Fi scanning) based on seen-bssidsThomas Haller2023-03-223-5/+10
| | | | | | | | | | | | | | | | | | | | | "wifi.seen-bssids" looks like a regular property, but it is not. Unlike almost all other properties, it does not contain user configuration, rather it gets filled by the daemon. The values are thus stored in "/var/lib/NetworkManager/seen-bssids" file, and the daemon maintains the values separately from the profile. Only before exporting the profile on D-Bus, the value gets merged (see NM_SETTINGS_CONNECTION_GET_PRIVATE(self)->>getsettings_cached and nm_connection_to_dbus_full(). Hence, looking at nm_setting_wireless_get_num_seen_bssids() is not working. Fix that. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1253 Fixes: 0f3203338c85 ('wifi: roam aggressively if we on a multi-AP network') https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1577
* all: use _NM_G_TYPE_CHECK_INSTANCE_CAST() for internal usesThomas Haller2022-12-163-3/+3
| | | | | | | | | | | | | | | | | | | | G_TYPE_CHECK_INSTANCE_CAST() can trigger a "-Wcast-align": src/core/devices/nm-device-macvlan.c: In function 'parent_changed_notify': /usr/include/glib-2.0/gobject/gtype.h:2421:42: error: cast increases required alignment of target type [-Werror=cast-align] 2421 | # define _G_TYPE_CIC(ip, gt, ct) ((ct*) ip) | ^ /usr/include/glib-2.0/gobject/gtype.h:501:66: note: in expansion of macro '_G_TYPE_CIC' 501 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) | ^~~~~~~~~~~ src/core/devices/nm-device-macvlan.h:13:6: note: in expansion of macro 'G_TYPE_CHECK_INSTANCE_CAST' 13 | (G_TYPE_CHECK_INSTANCE_CAST((obj), NM_TYPE_DEVICE_MACVLAN, NMDeviceMacvlan)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ Avoid that by using _NM_G_TYPE_CHECK_INSTANCE_CAST(). This can only be done for our internal usages. The public headers of libnm are not changed.
* macsec: allow CKN shorter than 64 charactersBeniamino Galvani2022-11-161-2/+12
| | | | | | | | | | | | | | | | | | | | | | | See wpa_supplicant commit [1]: macsec: Make pre-shared CKN variable length IEEE Std 802.1X-2010, 9.3.1 defines following restrictions for CKN: "MKA places no restriction on the format of the CKN, save that it comprise an integral number of octets, between 1 and 32 (inclusive), and that all potential members of the CA use the same CKN. No further constraints are placed on the CKNs used with PSKs, ..." Hence do not require a 32 octet long CKN but instead allow a shorter CKN to be configured. This fixes interoperability with some Aruba switches, that do not accept a 32 octet long CKN (only support shorter ones). [1] https://w1.fi/cgit/hostap/commit/?id=b678ed1efc50e8da4638d962f8eac13312a4048f
* glib-aux: drop duplicate _nm_dbus_error_has_name() for nm_dbus_error_is()Thomas Haller2022-11-142-3/+3
|
* supplicant: add NMSetting8021xAuthFlags for TLS v1.3 / enable a versionYufan You2022-11-082-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | In the commit 2a11c57c4e68 ('libnm/wifi: rework NMSetting8021xAuthFlags to explicitly disable TLS version'), it said: > In the future, supplicant may disable options by default, and > the inverse option can become interesting to configure > "tls_disable_tlsv1_0=0". When that happens, we can solve it by > adding another flag NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_0_ENABLE. This commit adds the `NM_SETTING_802_1X_AUTH_FLAGS_TLS_1_0_ENABLE` flag as well as similar flags for other TLS versions. This commit also adds flags for TLS v1.3, as the corresponding flags are now provided in wpa_supplicant. The NMSetting8021xAuthFlags setting is rejected when both enable and disable are set for the same TLS version. if-else-if is used in nm_supplicant_config_add_setting_8021x to guarantee this behavior. It prefers ENABLE over DISABLE to match the behavior of wpa_supplicant. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1133 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1450
* glib-aux,core: use nm_memdup_nul() and nm_memcpy()Thomas Haller2022-10-241-7/+7
|
* glib-aux: swap arguments for nm_array_find_bsearch()Thomas Haller2022-09-281-1/+1
| | | | | | | | | Have "len" before "elem_size". That is consistent with g_qsort_with_data() and bsearch(), and is also what I would expect. Note that the previous commit just renamed the function. If a user of the new, changed API gets backported to an older branch, we will get a compilation error and note that the arguments need to be adjusted.
* glib-aux: rename nm_utils_array_find_binary_search() to nm_array_bsearch()Thomas Haller2022-09-281-6/+6
| | | | | | | | | | | | The "nm_utils_" prefix is just too verbose. Drop it. Also, Posix has a bsearch function. As this function is similar, rename it. Note that currently the arguments are provided in differnt order from bsearch(). That will be partly addressed next. That is the main reason for the rename. The next commit will swap the arguments, so do a rename first to get a compilation error when backporting a patch that uses the changed API.
* wpa_supplicant: add tls_disable_time_checks flag to phase 1 auth flagsVojtech Bubela2022-09-282-1/+5
| | | | | | https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/978 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1378
* glib-aux: rename IP address related helpers from "nm-inet-utils.h"Thomas Haller2022-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - name things related to `in_addr_t`, `struct in6_addr`, `NMIPAddr` as `nm_ip4_addr_*()`, `nm_ip6_addr_*()`, `nm_ip_addr_*()`, respectively. - we have a wrapper `nm_inet_ntop()` for `inet_ntop()`. This name of our wrapper is chosen to be familiar with the libc underlying function. With this, also name functions that are about string representations of addresses `nm_inet_*()`, `nm_inet4_*()`, `nm_inet6_*()`. For example, `nm_inet_parse_str()`, `nm_inet_is_normalized()`. <<<< R() { git grep -l "$1" | xargs sed -i "s/\<$1\>/$2/g" } R NM_CMP_DIRECT_IN4ADDR_SAME_PREFIX NM_CMP_DIRECT_IP4_ADDR_SAME_PREFIX R NM_CMP_DIRECT_IN6ADDR_SAME_PREFIX NM_CMP_DIRECT_IP6_ADDR_SAME_PREFIX R NM_UTILS_INET_ADDRSTRLEN NM_INET_ADDRSTRLEN R _nm_utils_inet4_ntop nm_inet4_ntop R _nm_utils_inet6_ntop nm_inet6_ntop R _nm_utils_ip4_get_default_prefix nm_ip4_addr_get_default_prefix R _nm_utils_ip4_get_default_prefix0 nm_ip4_addr_get_default_prefix0 R _nm_utils_ip4_netmask_to_prefix nm_ip4_addr_netmask_to_prefix R _nm_utils_ip4_prefix_to_netmask nm_ip4_addr_netmask_from_prefix R nm_utils_inet4_ntop_dup nm_inet4_ntop_dup R nm_utils_inet6_ntop_dup nm_inet6_ntop_dup R nm_utils_inet_ntop nm_inet_ntop R nm_utils_inet_ntop_dup nm_inet_ntop_dup R nm_utils_ip4_address_clear_host_address nm_ip4_addr_clear_host_address R nm_utils_ip4_address_is_link_local nm_ip4_addr_is_link_local R nm_utils_ip4_address_is_loopback nm_ip4_addr_is_loopback R nm_utils_ip4_address_is_zeronet nm_ip4_addr_is_zeronet R nm_utils_ip4_address_same_prefix nm_ip4_addr_same_prefix R nm_utils_ip4_address_same_prefix_cmp nm_ip4_addr_same_prefix_cmp R nm_utils_ip6_address_clear_host_address nm_ip6_addr_clear_host_address R nm_utils_ip6_address_same_prefix nm_ip6_addr_same_prefix R nm_utils_ip6_address_same_prefix_cmp nm_ip6_addr_same_prefix_cmp R nm_utils_ip6_is_ula nm_ip6_addr_is_ula R nm_utils_ip_address_same_prefix nm_ip_addr_same_prefix R nm_utils_ip_address_same_prefix_cmp nm_ip_addr_same_prefix_cmp R nm_utils_ip_is_site_local nm_ip_addr_is_site_local R nm_utils_ipaddr_is_normalized nm_inet_is_normalized R nm_utils_ipaddr_is_valid nm_inet_is_valid R nm_utils_ipx_address_clear_host_address nm_ip_addr_clear_host_address R nm_utils_parse_inaddr nm_inet_parse_str R nm_utils_parse_inaddr_bin nm_inet_parse_bin R nm_utils_parse_inaddr_bin_full nm_inet_parse_bin_full R nm_utils_parse_inaddr_prefix nm_inet_parse_with_prefix_str R nm_utils_parse_inaddr_prefix_bin nm_inet_parse_with_prefix_bin R test_nm_utils_ip6_address_same_prefix test_nm_ip_addr_same_prefix ./contrib/scripts/nm-code-format.sh -F
* Revert "wifi: support ↵Thomas Haller2022-08-111-3/+0
| | | | | | | | | | | | | | | "802-1x.phase1-auth-flags=tls-allow-unsafe-renegotiation" flag" There is still no agreement, about how to name this option, or whether it should exist at all. Revert the addition of the flag. As the new release is coming up, drop the new API. https://bugzilla.redhat.com/show_bug.cgi?id=2072070#c64 https://bugzilla.redhat.com/show_bug.cgi?id=2077973#c24 http://lists.infradead.org/pipermail/hostap/2022-July/040665.html This reverts commit a5a4aea2e627214a3da3c6fdb2651d65a7182ea8.
* supplicant: increase the PMK lifetime for WPA-EAPBeniamino Galvani2022-07-261-0/+42
| | | | | | | | | | | | | | | | | | | | | By default, wpa_supplicant sets these parameters according to the 802.11 standard: dot11RSNAConfigPMKLifetime = 43200 seconds (12 hours) dot11RSNAConfigPMKReauthThreshold = 70% With these, the supplicant triggers a new EAP authentication every 8 hours and 24 minutes. If the network uses one-time secrets, the reauthentication fails and the supplicant disconnects. It doesn't seem desirable that the client starts a reauthentication so early; bump the lifetime to a week. Currently, due to a bug, the new value is ignored by wpa_supplicant when set via D-Bus. This patch needs the fix at [1], not yet merged. [1] http://lists.infradead.org/pipermail/hostap/2022-July/040664.html https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1306
* supplicant: fix a memory leakSlava Monich2022-07-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | ==30980== 8 bytes in 1 blocks are definitely lost in loss record 1,117 of 6,137 ==30980== at 0x4841C38: malloc (vg_replace_malloc.c:309) ==30980== by 0x4A246C7: g_malloc (gmem.c:106) ==30980== by 0x4A4A4BB: g_variant_get_strv (gvariant.c:1607) ==30980== by 0x4A4CA73: g_variant_valist_get_nnp (gvariant.c:4901) ==30980== by 0x4A4CA73: g_variant_valist_get_leaf (gvariant.c:5058) ==30980== by 0x4A4CA73: g_variant_valist_get (gvariant.c:5239) ==30980== by 0x4A4D11D: g_variant_get_va (gvariant.c:5502) ==30980== by 0x4A4D1BD: g_variant_lookup (gvariant.c:989) ==30980== by 0xE9389: parse_capabilities (nm-supplicant-interface.c:1241) ==30980== by 0xEBF99: _properties_changed_main (nm-supplicant-interface.c:1941) ==30980== by 0xEF549: _properties_changed (nm-supplicant-interface.c:2867) ==30980== by 0xEF7ED: _get_all_main_cb (nm-supplicant-interface.c:2972) ==30980== by 0x262057: _nm_dbus_connection_call_default_cb (nm-dbus-aux.c:70) ==30980== by 0x48DB6A3: g_task_return_now (gtask.c:1215) ==30980== by 0x48DBF43: g_task_return.part.3 (gtask.c:1285) ==30980== by 0x4918885: g_dbus_connection_call_done (gdbusconnection.c:5765) ==30980== by 0x48DB6A3: g_task_return_now (gtask.c:1215) ==30980== by 0x48DB6D7: complete_in_idle_cb (gtask.c:1229) ==30980== by 0x4A20981: g_main_dispatch (gmain.c:3325) ==30980== by 0x4A20981: g_main_context_dispatch (gmain.c:4016) ==30980== by 0x4A20BEF: g_main_context_iterate.isra.23 (gmain.c:4092) ==30980== by 0x4A20E33: g_main_loop_run (gmain.c:4290) ==30980== by 0x2C5C9: main (main.c:509) Fixes: cd1e0193abcf ('supplicant: add BIP interface capability')
* all: use internal _nm_utils_ip4_netmask_to_prefix()Thomas Haller2022-06-271-1/+1
| | | | | | We have two variants of the function: nm_utils_ip4_netmask_to_prefix() and _nm_utils_ip4_netmask_to_prefix(). The former only exists because it is public API in libnm. Internally, only use the latter.
* supplicant/config: supplicant: prevent OWE downgradeDavid Bauer2022-06-172-0/+9
| | | | | | | Prevent downgrade of Enhanced Open / OWE connection profiles to unencrypted connections by forcing wpa_supplicant to use OWE. Signed-off-by: David Bauer <mail@david-bauer.net>
* wifi: support "802-1x.phase1-auth-flags=tls-allow-unsafe-renegotiation" flagThomas Haller2022-05-161-0/+3
| | | | | | | | | | | | | For details, read the linked sources. This requires a new supplicant option, but it seems that supplicant will silently ignore unrecognized options. https://bugzilla.redhat.com/show_bug.cgi?id=2072070#c48 https://lists.infradead.org/pipermail/hostap/2022-May/040522.html https://w1.fi/cgit/hostap/commit/?id=566ce69a8d0e64093309cbde80235aa522fbf84e https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1218
* supplicant: Disable WPA3 transition mode when PMF is set to disabled谢致邦 (XIE Zhibang)2022-04-111-1/+12
| | | | | | | | | | | | | | | | According to WPA3_Specification_v3.0 section 2.3, when operating in WPA3-Personal transition mode an AP: - shall set MFPC to 1, MFPR to 0. Therefore, do not operate in WPA3-Personal transition mode when PMF is set to disabled. This also provides a way to be compatible with some devices that are not fully compatible with WPA3-Personal transition mode. Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1186 (cherry picked from commit b6eb237a271c91f6ca9d74f0db8f7e80b9998d51)
* wifi: disable FT in AP modeBeniamino Galvani2022-04-083-6/+17
| | | | | | | | | | | | | | | | | | | | | Currently wpa_supplicant doesn't support FT in AP mode. FT-PSK and FT-EAP are simply not negotiated with the STA. FT-SAE gets negotiated but then the key derivation is not supported, leading to a authentication failure. Even if support for FT in AP mode is introduced in wpa_supplicant in the future, it will require additional parameters as the nas identifier and the mobility domain, which are currently not provided by NM. Disable all FT key-mgmts in AP mode since they are useless and cause issues (FT-SAE). See-also: https://mail.gnome.org/archives/networkmanager-list/2022-March/msg00016.html See-also: http://lists.infradead.org/pipermail/hostap/2022-April/040352.html https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1184 (cherry picked from commit 82980f7791660ede5f2982cdfbda266f3f6384a0)
* supplicant: enable WPA3 transition mode only when interface supports PMFBeniamino Galvani2022-04-041-1/+18
| | | | | | | | | | | | | | | | | | | | We have some reports of APs that advertise WPA2/WPA3 with MFP-required=0/MFP-capable=0, and reject the association when the client doesn't support 802.11w. According to WPA3_Specification_v3.0 section 2.3, when operating in WPA3-Personal transition mode a STA: - should allow AKM suite selector: 00-0F-AC:6 (WPA-PSK-SHA256) to be selected for an association; - shall negotiate PMF when associating to an AP using SAE. The first is guaranteed by capability PMF; the second by checking that the interface supports BIP ciphers suitable for PMF. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/964 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1003907
* supplicant: add BIP interface capabilityBeniamino Galvani2022-04-042-2/+28
| | | | | Introduce a new capability indicating whether the interface supports any of the BIP ciphers that can be used for 802.11w (PMF).
* supplicant: check whether WEP is availableLubomir Rintel2022-03-172-1/+10
| | | | | | | | | | | | Since version 2.10, it's possible to build wpa_supplicant without WEP support. In fact, it's disabled by default. Regrettably, there's no indication in that version as to whether WEP is enabled or not. A patch has been sent upstream that exposes the information on D-Bus: https://patchwork.ozlabs.org/project/hostap/patch/20220307085446.706024-1-lkundrak@v3.sk/ This makes use of the above to indicate presence or absence of WEP support.
* supplicant: add a comment about extending NMSupplCapTypeLubomir Rintel2022-03-171-0/+2
| | | | | We've failed to amend logging in relevant places twice. Let's add a hopefully helpful remark.
* supplicant: log WPA-EAP-SUITE-B-192 capabilityLubomir Rintel2022-03-171-1/+3
| | | | Fixes: e874ccc9177c ('wifi: add WPA-EAP-SUITE-B-192 support')
* supplicant: use nm_ref_string_reset_str() in _properties_changed_main()Thomas Haller2022-01-271-4/+1
|
* supplicant: enable SAE-H2EBeniamino Galvani2022-01-111-0/+18
| | | | | | | | | | | | | H2E (hash to element) is a newer method for generating the PWE (password element) for SAE, alternative to the existing "hunting-and-pecking". It is considered more secure and it is mandatory for the WPA3 certification; also, SAE in the 6GHz band can only use H2E (hunting-and-pecking is disallowed). Enable H2E in addition to hunting-and-pecking. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/753 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1045
* format: reformat source tree with clang-format 13.0Thomas Haller2021-11-299-519/+519
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | We use clang-format for automatic formatting of our source files. Since clang-format is actively maintained software, the actual formatting depends on the used version of clang-format. That is unfortunate and painful, but really unavoidable unless clang-format would be strictly bug-compatible. So the version that we must use is from the current Fedora release, which is also tested by our gitlab-ci. Previously, we were using Fedora 34 with clang-tools-extra-12.0.1-1.fc34.x86_64. As Fedora 35 comes along, we need to update our formatting as Fedora 35 comes with version "13.0.0~rc1-1.fc35". An alternative would be to freeze on version 12, but that has different problems (like, it's cumbersome to rebuild clang 12 on Fedora 35 and it would be cumbersome for our developers which are on Fedora 35 to use a clang that they cannot easily install). The (differently painful) solution is to reformat from time to time, as we switch to a new Fedora (and thus clang) version. Usually we would expect that such a reformatting brings minor changes. But this time, the changes are huge. That is mentioned in the release notes [1] as Makes PointerAligment: Right working with AlignConsecutiveDeclarations. (Fixes https://llvm.org/PR27353) [1] https://releases.llvm.org/13.0.0/tools/clang/docs/ReleaseNotes.html#clang-format
* glib-aux/trivial: rename GBytes helper APIThomas Haller2021-11-042-6/+5
| | | | | | | | | Give a consistent name. A bit odd are now the names nm_g_bytes_hash() and nm_g_bytes_equal() as they go together with nm_pg_bytes_hash()/nm_pg_bytes_equal(). But here the problem is more with the naming of "nm_p*_{equal,hash}()" functions, which probably should be renamed to "nm_*_ptr_{equal,hash}()".
* all: prefer g_snprintf() over snprintf()Thomas Haller2021-08-261-1/+1
| | | | | | While both functions are basically the same, the majority of the time we use g_snprintf(). There is no strong reason to prefer one or the other, but let's keep using one variant.
* all: rename nm_utils_strdup_reset*() to nm_strdup_reset*()Thomas Haller2021-08-021-7/+7
|
* all: unify and rename strv helper APIThomas Haller2021-07-292-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Naming is important, because the name of a thing should give you a good idea what it does. Also, to find a thing, it needs a good name in the first place. But naming is also hard. Historically, some strv helper API was named as nm_utils_strv_*(), and some API had a leading underscore (as it is internal API). This was all inconsistent. Do some renaming and try to unify things. We get rid of the leading underscore if this is just a regular (internal) helper. But not for example from _nm_strv_find_first(), because that is the implementation of nm_strv_find_first(). - _nm_utils_strv_cleanup() -> nm_strv_cleanup() - _nm_utils_strv_cleanup_const() -> nm_strv_cleanup_const() - _nm_utils_strv_cmp_n() -> _nm_strv_cmp_n() - _nm_utils_strv_dup() -> _nm_strv_dup() - _nm_utils_strv_dup_packed() -> _nm_strv_dup_packed() - _nm_utils_strv_find_first() -> _nm_strv_find_first() - _nm_utils_strv_sort() -> _nm_strv_sort() - _nm_utils_strv_to_ptrarray() -> nm_strv_to_ptrarray() - _nm_utils_strv_to_slist() -> nm_strv_to_gslist() - nm_utils_strv_cmp_n() -> nm_strv_cmp_n() - nm_utils_strv_dup() -> nm_strv_dup() - nm_utils_strv_dup_packed() -> nm_strv_dup_packed() - nm_utils_strv_dup_shallow_maybe_a() -> nm_strv_dup_shallow_maybe_a() - nm_utils_strv_equal() -> nm_strv_equal() - nm_utils_strv_find_binary_search() -> nm_strv_find_binary_search() - nm_utils_strv_find_first() -> nm_strv_find_first() - nm_utils_strv_make_deep_copied() -> nm_strv_make_deep_copied() - nm_utils_strv_make_deep_copied_n() -> nm_strv_make_deep_copied_n() - nm_utils_strv_make_deep_copied_nonnull() -> nm_strv_make_deep_copied_nonnull() - nm_utils_strv_sort() -> nm_strv_sort() Note that no names are swapped and none of the new names existed previously. That means, all the new names are really new, which simplifies to find errors due to this larger refactoring. E.g. if you backport a patch from after this change to an old branch, you'll get a compiler error and notice that something is missing.
* all: drop unnecessary casts from nm_utils_strv_find_first()Thomas Haller2021-07-291-1/+1
| | | | | And, where the argument is a GPtrArray, use nm_strv_ptrarray_find_first() instead.
* clang-format: use "IndentPPDirectives:None" instead of "BeforeHash"Thomas Haller2021-07-091-2/+2
| | | | Subjectively, I think this looks better.
* supplicant: suppress warning log for P2PDevice.Cancel()Thomas Haller2021-06-241-29/+67
| | | | | | | | | | | | A failure to cancel something is not worth a warning. It probably just means that no operation was in progress. In my logs I always see a warning: CODE_FILE=src/core/supplicant/nm-supplicant-interface.c CODE_LINE=391 MESSAGE=<warn> [1624517233.8822] sup-iface[a22b181a321ffd9b,9,wlan0]: call-p2p-cancel: failed with P2P cancel failed Downgrade this to trace level.
* supplicant: Store assigned addr for P2P group joinsBenjamin Berg2021-06-232-0/+63
| | | | | | A P2P Group Owner may assign an IP address and netmask to us. Store this address so that it can be retrieved later during the IP configuration stage.
* core: avoid accessing opaque NMSetting typeThomas Haller2021-06-111-2/+2
| | | | | | | Next, NMSetting will be hidden from public headers and become an opaque type. We cannot do typeof(*setting) anymore. (cherry picked from commit 0d6c35a6d920c51100bde31a00183121959417e1)
* supplicant: fix leaking handle in nm_supplicant_manager_create_interface()Thomas Haller2021-06-101-1/+1
| | | | | | | Found by valgrind. Fixes: b83f07916a54 ('supplicant: large rework of wpa_supplicant handling') (cherry picked from commit 01df4a5ad0becdc031e39704173ea922c5dc4bd6)
* glib-aux/trivial: rename nm_ref_string_equals_str() to nm_ref_string_equal_str()Thomas Haller2021-05-271-1/+1
|
* wifi: refactor parsing secrutiy flags of supplicant in security_from_vardict()Thomas Haller2021-05-111-20/+27
| | | | | | | | I think if-else is easier to read. It also makes it clear that the options are really exclusive, and for each option only one flag is set. That was not easy to see previously. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/844
* wifi: fix WPS PBC string typoWade Berrier2021-05-091-1/+1
| | | | | | Fixes: b83f07916a54 ('supplicant: large rework of wpa_supplicant handling') https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/845
* supplicant/interface: Match more ciphers to determine AP securityJonas Dreßler2021-05-061-6/+10
| | | | | | There can also be APs which don't do wpa-psk, but do support wpa-psk-sha256, so we should match all AKM suites the AP offers to determine the security type we want to assign it.
* supplicant/config: Allow using FT ciphers with WPA-EAP-SUITE-B-192Jonas Dreßler2021-05-061-0/+3
| | | | | | | | According to [1], the only suitable FT cipher suite for WPA3 Enterprise 192-bit mode is "FT over 802.1X, SHA-384", so enable that in case of key-mgmt is WPA-EAP-SUITE-B-192 to support FT in that case too. [1] https://mrncciew.com/2020/08/17/wpa3-enterprise/
* supplicant/config: Disallow SHA1 ciphers when using required PMFJonas Dreßler2021-05-061-2/+4
| | | | | | | As mentioned in the wpa_supplicant reference config, when setting PMF to required with WPA2 (personal or enterprise) authentication, we want to only enable SHA256 and upwards as HMAC. So enforce that by not passing WPA-PSK and WPA-EAP to the config in case pmf is set to REQUIRED.
* supplicant/config: Require pmf for owe, sae and wpa-eap-suite-b-192Jonas Dreßler2021-05-062-6/+32
| | | | | | | | | When using modern WPA3 encryption like owe, sae or wpa-eap-suite-b-192 without fallbacks (so not WPA3+WPA2), protected management frames are required to be enabled by the specification. For wpa-eap-suite-b-192 we already do this and force PMF to REQUIRED, we should also do it for OWE and SAE.
* supplicant/config: Refactor key_mgmt config generationJonas Dreßler2021-05-061-27/+45
| | | | | | | | Refactor the generation of the key_mgmt option of the wpa_supplicant config we generate. The goal of this is to lay out all the cases we support more obviously and to make it a bit clearer that our key-mgmt property of NMSettingsWirelessSecurity is not the same as the "key_mgmt" config we set in wpa_supplicant.
* clang-format: reformat code with clang 12Thomas Haller2021-05-041-4/+4
| | | | | The format depends on the version of the tool. Now that Fedora 34 is released, update to clang 12 (clang-tools-extra-12.0.0-0.3.rc1.fc34.x86_64).
* supplicant/config: Make sure PMF gets enabled with wpa-eap-suite-b-192Jonas Dreßler2021-04-302-27/+33
| | | | | | | | | | | | | | | | | | wpa-eap-suite-b-192 key-mgmt method uses special values for "pairwise" and "group" ciphers, we can also handle that a few lines underneath where those are set to make this a bit easier to read. We currently set the supplicants PMF config (ieee80211w) inside an if block that tries to detect whether WPA is used. That if-block doesn't include the "wpa-eap-suite-b-192" case because we want special "pairwise" and "group" handling for wpa-eap-suite-b-192. This means we're currently missing to enable PMF in the "wpa-eap-suite-b-192" case, even though it's set to REQUIRED. Fix it by moving the "pairwise" and "group" special-casing down a bit so we can include "wpa-eap-suite-b-192" in the "Only WPA-specific things when using WPA" check, that will make sure ieee80211w gets set in the wpa-eap-suite-b-192 case.
* supplicant/config: Remove superfluous check to disable PMFJonas Dreßler2021-04-301-4/+0
| | | | | | | We only set the "ieee80211w" option in the wpa_supplicant config in case we're using WPA (see the if-block underneath), otherwise the value of "pmf" is completely ignored. That means the override here (in case WPA isn't used) isn't getting applied anyway, so just remove it.
* supplicant/config: Add a comment mentioning global pmf config valueJonas Dreßler2021-04-301-0/+3
| | | | | | | It looks a bit weird on the first glance that we do nothing when NM_SETTING_WIRELESS_SECURITY_PMF_OPTIONAL is used. The reason for this is that we already intialize the global option "pmf" of wpa_supplicant to "1" (optional), so add a brief comment about that here.
* all: use nm_g_variant_new_ay() helperThomas Haller2021-04-162-10/+8
|
* platform: move more platform code to src/libnm-platform/Thomas Haller2021-03-051-1/+1
|
View Lorry Controller Status