From patchwork Thu Dec 1 15:43:43 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Ostruszka X-Patchwork-Id: 1711066 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=FSkTN81M; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=semihalf.com header.i=@semihalf.com header.a=rsa-sha256 header.s=google header.b=ASwQukFa; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4NNL3p4vWtz23mf for ; Fri, 2 Dec 2022 02:44:38 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=wdJ3YCKmtQOtT2/Rd1MqyCg0WeSpyTJm+3yIfUqmItQ=; b=FSkTN81M6/PpOb 4rcuf6O5r/LzQLlCWi3hDMWVHnNE3gdHwJVlH/ut/djR+tjNhR1OpLtm1bQ1DjgZl2ArFAKXGZWsa hVp+w4au/fjsnqOP/+g1jhp3p/tr1W/EthTpGgBpGeJu89bkjnb1qvyZwXORChJFDlmjXxcW2pIdH S6SjThPzThFtc0EuUscEWbGDibPVSHfqBH3Ubg+cZBJLB635Y7yQ/l+UwPy8PCtJ5QSrb44++wDuV 1MSE19TouWVU58chcXunv4hBFpDtso40mI6ddvEFsPEulL5sB6KPFJ0DUcgXkx6tFMWesLNxD+Fer VLtQujpkiUp8OWOWJH4Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1p0ljC-008Ja4-JB; Thu, 01 Dec 2022 15:43:58 +0000 Received: from mail-lf1-x12b.google.com ([2a00:1450:4864:20::12b]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1p0lj9-008JXC-17 for hostap@lists.infradead.org; Thu, 01 Dec 2022 15:43:56 +0000 Received: by mail-lf1-x12b.google.com with SMTP id g12so3101581lfh.3 for ; Thu, 01 Dec 2022 07:43:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=semihalf.com; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+tJnAb1ZeDGutJ/aiLnD4+J+Oivm9T9qlHQ822QSINs=; b=ASwQukFaAWrBr4v5xSlH762IOjrs16B0Rz8Gao96EtKC1de73w/Ao1W6zPlbwAbqlG FV2kqPFFG55JRg25T648fI7oBY36hW/zbz/gffJrJlYo3c9DKnk2oHA/yTvbzwTi3yLE lv9gWIx/qWjtR8k2DJVOmPly3oqlz6ea05yXCRFPpLT2Novk3rmESN53rlgIHMK2DawV RVIFnMBGvtcHUH4bIXzECQjz05JnArq/9Pn4K74n+66aww5FhaNirM446o9RTZViRZsm ylNWjuM9vPuE+3mT7jmgpjbYVHrLUGU+CN6RajrmZpD6+ZEWzI7LO7vtxgxfvpMS1D9R n0fA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=+tJnAb1ZeDGutJ/aiLnD4+J+Oivm9T9qlHQ822QSINs=; b=z1ZW2Uhx1wdsJhWrTfJ0/n5TjiLxO9WB6JDtTQfz9epH0tVLXvFecaNyb0eVt7TECG 26r6PI7lfWjNu7iknLB9j9wCsxYgTHd+d04lcdS2sZik0Lnlf8j6jyHLYyWNMLWFaUTj 1eGLB6zaDFbxcQXVM23YSSGXtWS3Tt4CqBZ+C99FOW9Mm07fhZrmhU6rwH+o3is1T3kN f+lAUZad8Xp8yCH8jLJm9uLo1bkC4xmmFuXOpra0OhaKqPalUlpaqgo47x6GvAQ5q9K7 gy1af+PTxqABjJa8+Ng5nC6vEUpFjPkLVTZjH898D+YEMKx6oqsDfmid6gUNmsEf01c7 P/qw== X-Gm-Message-State: ANoB5pnDSu1JerCnx1iy6rz4YeKp2pxUynYXXxwVVRvGJvUPnQTAWLi5 4dZ+z7UNjIoxIH2ysEOJKSREPtlkeY1koQ== X-Google-Smtp-Source: AA0mqf5G+c56g1zaelpwC94U06EVuP5TeeURZJeuGReN1VmzRZk7OpNu1S9bGgNAvlWGo2qiM2xq2g== X-Received: by 2002:a19:914a:0:b0:4b5:269f:f880 with SMTP id y10-20020a19914a000000b004b5269ff880mr4793536lfj.136.1669909431635; Thu, 01 Dec 2022 07:43:51 -0800 (PST) Received: from localhost.office.semihalf.net ([83.142.187.84]) by smtp.googlemail.com with ESMTPSA id i17-20020a2e8091000000b00278a21bb7b9sm394555ljg.100.2022.12.01.07.43.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Dec 2022 07:43:50 -0800 (PST) From: Andrzej Ostruszka To: hostap@lists.infradead.org Cc: upstream@semihalf.com, Andrzej Ostruszka Subject: [PATCH 1/2] wpa_supplicant: Handle randomization changes for same ESS Date: Thu, 1 Dec 2022 16:43:43 +0100 Message-Id: <20221201154344.620775-1-amo@semihalf.com> X-Mailer: git-send-email 2.38.1.584.g0f3c55d4c2-goog MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20221201_074355_103488_A12E04CC X-CRM114-Status: GOOD ( 17.70 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When MAC randomization settings change we should use new MAC address even if we are associating to the same ESS. For example consider this scenario: - hardware MAC is being used, - we disconnect from [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2a00:1450:4864:20:0:0:0:12b listed in] [list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-BeenThere: hostap@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Hostap" Errors-To: hostap-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org When MAC randomization settings change we should use new MAC address even if we are associating to the same ESS. For example consider this scenario: - hardware MAC is being used, - we disconnect from the network, - policy/style is changed via D-Bus to turn randomization on, - we reconnect to the same network. In the last step the randomized address should be used. Changes to the randomization settings include both changes to the policy/style to be used and changes to the pregenerated MAC address value in case of mac_addr==3. Signed-off-by: Andrzej Ostruszka --- wpa_supplicant/wpa_supplicant.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 9c711d154..349933c39 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -2238,14 +2238,23 @@ int wpas_update_random_addr(struct wpa_supplicant *wpa_s, int style, os_get_reltime(&now); if (wpa_s->last_mac_addr_style == style && - /* Pregenerated addresses do not expire */ - wpa_s->last_mac_addr_style != 3 && - wpa_s->last_mac_addr_change.sec != 0 && - !os_reltime_expired(&now, &wpa_s->last_mac_addr_change, - wpa_s->conf->rand_addr_lifetime)) { - wpa_msg(wpa_s, MSG_DEBUG, - "Previously selected random MAC address has not yet expired"); - return 0; + /* Random addresses are valid within given ESS so do not check + * expiration/value when changing ESS. */ + wpa_s->reassoc_same_ess) { + if (style != 3) { + if (wpa_s->last_mac_addr_change.sec != 0 && + !os_reltime_expired(&now, &wpa_s->last_mac_addr_change, + wpa_s->conf->rand_addr_lifetime)) { + wpa_msg(wpa_s, MSG_DEBUG, + "Previously selected random MAC address has not yet expired"); + return 0; + } + } else { + /* Pregenerated addresses do not expire but their value + * might have changed, so let's check that. */ + if (os_memcmp(wpa_s->own_addr, ssid->mac_value, ETH_ALEN) == 0) + return 0; + } } switch (style) { @@ -2436,7 +2445,7 @@ void wpa_supplicant_associate(struct wpa_supplicant *wpa_s, wpa_s_setup_sae_pt(wpa_s->conf, ssid); #endif /* CONFIG_SAE */ - if (rand_style > 0 && !wpa_s->reassoc_same_ess) { + if (rand_style > 0) { if (wpas_update_random_addr(wpa_s, rand_style, ssid) < 0) return; wpa_sm_pmksa_cache_flush(wpa_s->wpa, ssid);