Re: Compatibility problems with wired 802.1x
by Denis Kenzior
Hi Diego,
<snip>
>> Hmm, its been a while since I looked into ead. On the iwd side we
>> default to replying with the same protocol version as the request, but
>> looks like ead does indeed hard-code 2004 as the version.
>>
>
> In ead context I think there is not always something to reply to, the EAPPOL-Start message is sent unsolicited, so there is no request to look at to get the version. That may explain why it is hardcoded.
Yes, with WiFi it is a bit simpler because 95% of the time the AP sends
us a RequestIdentity right away with a protocol version set. So we just
use that one. However, there have been instances where even this
strategy fails. For example, Time Warner / Spectrum hotspots send a
RequestIdentity with 2004 version, but refuse to process any packets
unless they're sent with 2001 version. We do send EAPOL-Start with 2001
in iwd, but for some reason ead uses 2004.
<snip>
>> Yes, indeed it should. I suspect the reason is that it sort of just
>> happened to work even when the operstate wasn't set properly, but this
>> should be fixed.
>>
>
> I have second thoughts about this. At least in the switch I am playing with, it can be configured so that an unauthenticated supplicant is put into a guest VLAN and one which fails authentication into an auth-fail VLAN (but my guess is that this is pretty common functionality). If ead were to put the link into dormant state until authentication succeeded it would mean daemons that look at the link's running flag would not attempt to communicate before authentication succeeded (e.g., DHCP client), thus loosing the possibility to use the guest or auth-fail VLAN.
This area is tricky and not very well documented (on Linux and in
general) At least according to
https://www.kernel.org/doc/Documentation/networking/operstates.txt, dhcp
daemons expect the supplicant to take the interface out of dormant mode
as a hint that DHCP requests can now be sent. So ideally,
EAP-RequestIdentity should trigger the interface going into OPER_DORMANT
mode. And EAP-Success should trigger it going into OPER_UP.
But, the complication is that there are implementations that send
RequestIdentity / reply to EAPoL-Start only after the initial DHCP
Discover has been sent out. This is a big reason why we think it makes
sense to put dhcp right into ead eventually.
I suspect ead will need to try to auto-detect (or have the user
configure) if this 'guest-vlan' type scenario is supported. And if it
isn't, leave the interface in OPER_DORMANT state.
Regards,
-Denis
10 months
[PATCH 1/4] netconfig: Move EnableNetworkConfiguration check to station
by Andrew Zaborowski
Allow p2p to use netconfig even if not enabled for Infrastructure mode
connections.
---
src/netconfig.c | 17 -----------------
src/station.c | 19 ++++++++++++++++++-
2 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/src/netconfig.c b/src/netconfig.c
index 1e6af3d2..6a618e8f 100644
--- a/src/netconfig.c
+++ b/src/netconfig.c
@@ -1193,28 +1193,11 @@ void netconfig_destroy(struct netconfig *netconfig)
static int netconfig_init(void)
{
- bool enabled;
uint32_t r;
if (netconfig_list)
return -EALREADY;
- if (!l_settings_get_bool(iwd_get_config(), "General",
- "EnableNetworkConfiguration",
- &enabled)) {
- if (l_settings_get_bool(iwd_get_config(), "General",
- "enable_network_config", &enabled))
- l_warn("[General].enable_network_config is deprecated,"
- " use [General].EnableNetworkConfiguration");
- else
- enabled = false;
- }
-
- if (!enabled) {
- l_info("netconfig: Network configuration is disabled.");
- return 0;
- }
-
rtnl = iwd_get_rtnl();
r = l_netlink_register(rtnl, RTNLGRP_IPV4_IFADDR,
diff --git a/src/station.c b/src/station.c
index 3b3bb30a..c532319a 100644
--- a/src/station.c
+++ b/src/station.c
@@ -58,6 +58,7 @@ static struct l_queue *station_list;
static uint32_t netdev_watch;
static uint32_t mfp_setting;
static bool anqp_disabled;
+static bool netconfig_enabled;
struct station {
enum station_state state;
@@ -3098,7 +3099,8 @@ static struct station *station_create(struct netdev *netdev)
l_dbus_object_add_interface(dbus, netdev_get_path(netdev),
IWD_STATION_INTERFACE, station);
- station->netconfig = netconfig_new(netdev_get_ifindex(netdev));
+ if (netconfig_enabled)
+ station->netconfig = netconfig_new(netdev_get_ifindex(netdev));
station->anqp_pending = l_queue_new();
@@ -3250,6 +3252,21 @@ static int station_init(void)
&anqp_disabled))
anqp_disabled = true;
+ if (!l_settings_get_bool(iwd_get_config(), "General",
+ "EnableNetworkConfiguration",
+ &netconfig_enabled)) {
+ if (l_settings_get_bool(iwd_get_config(), "General",
+ "enable_network_config",
+ &netconfig_enabled))
+ l_warn("[General].enable_network_config is deprecated,"
+ " use [General].EnableNetworkConfiguration");
+ else
+ netconfig_enabled = false;
+ }
+
+ if (!netconfig_enabled)
+ l_info("station: Network configuration is disabled.");
+
return 0;
}
--
2.25.1
10 months