From 94bbe7465f35b69487f306ed60b99ae6d50784e6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ji=C5=99=C3=AD=20Klime=C5=A1?= Date: Wed, 16 Sep 2015 18:22:08 +0200 Subject: [PATCH] supplicant: adjust fragment_size according to MTU (bgo #755145) NetworkManager set wpa_supplicant's fragment_size option to 1300. But if MTU was lower, wpa_supplicant failed with "l2_packet_send - sendto: Message too long" due to fragmentation of EAP-TLS or EAP-PEAP packets. Actually, MTU has to be 14 bytes bigger than the "fragment_size" parameter. Ideally, wpa_supplicant would take MTU in the account and adjust the fragmentation limit accordingly. See discussion in http://lists.shmoo.com/pipermail/hostap/2015-August/033546.html https://bugzilla.gnome.org/show_bug.cgi?id=755145 --- configure.ac | 1 + src/devices/nm-device-ethernet.c | 5 +- src/devices/wifi/nm-device-wifi.c | 5 +- src/supplicant-manager/nm-supplicant-config.c | 19 ++- src/supplicant-manager/nm-supplicant-config.h | 4 +- src/supplicant-manager/tests/Makefile.am | 3 + .../tests/certs/Makefile.am | 6 + .../tests/certs/test-ca-cert.pem | 27 ++++ .../tests/certs/test-cert.p12 | Bin 0 -> 4092 bytes .../tests/test-supplicant-config.c | 143 +++++++++++++++++- 10 files changed, 204 insertions(+), 9 deletions(-) create mode 100644 src/supplicant-manager/tests/certs/Makefile.am create mode 100644 src/supplicant-manager/tests/certs/test-ca-cert.pem create mode 100644 src/supplicant-manager/tests/certs/test-cert.p12 diff --git a/configure.ac b/configure.ac index 0deb4a4098..d4f673f217 100644 --- a/configure.ac +++ b/configure.ac @@ -1014,6 +1014,7 @@ src/dhcp-manager/Makefile src/dhcp-manager/tests/Makefile src/dnsmasq-manager/tests/Makefile src/supplicant-manager/tests/Makefile +src/supplicant-manager/tests/certs/Makefile src/ppp-manager/Makefile src/settings/plugins/Makefile src/settings/plugins/ifupdown/Makefile diff --git a/src/devices/nm-device-ethernet.c b/src/devices/nm-device-ethernet.c index ff3994d127..319ce1fc85 100644 --- a/src/devices/nm-device-ethernet.c +++ b/src/devices/nm-device-ethernet.c @@ -566,15 +566,18 @@ build_supplicant_config (NMDeviceEthernet *self) NMSupplicantConfig *config = NULL; NMSetting8021x *security; NMConnection *connection; + guint32 mtu; connection = nm_device_get_applied_connection (NM_DEVICE (self)); g_assert (connection); con_uuid = nm_connection_get_uuid (connection); + mtu = nm_platform_link_get_mtu (NM_PLATFORM_GET, + nm_device_get_ifindex (NM_DEVICE (self))); config = nm_supplicant_config_new (); security = nm_connection_get_setting_802_1x (connection); - if (!nm_supplicant_config_add_setting_8021x (config, security, con_uuid, TRUE)) { + if (!nm_supplicant_config_add_setting_8021x (config, security, con_uuid, mtu, TRUE)) { _LOGW (LOGD_DEVICE, "Couldn't add 802.1X security setting to supplicant config."); g_object_unref (config); config = NULL; diff --git a/src/devices/wifi/nm-device-wifi.c b/src/devices/wifi/nm-device-wifi.c index 2996218ebc..225a477310 100644 --- a/src/devices/wifi/nm-device-wifi.c +++ b/src/devices/wifi/nm-device-wifi.c @@ -2225,13 +2225,16 @@ build_supplicant_config (NMDeviceWifi *self, if (s_wireless_sec) { NMSetting8021x *s_8021x; const char *con_uuid = nm_connection_get_uuid (connection); + guint32 mtu = nm_platform_link_get_mtu (NM_PLATFORM_GET, + nm_device_get_ifindex (NM_DEVICE (self))); g_assert (con_uuid); s_8021x = nm_connection_get_setting_802_1x (connection); if (!nm_supplicant_config_add_setting_wireless_security (config, s_wireless_sec, s_8021x, - con_uuid)) { + con_uuid, + mtu)) { _LOGE (LOGD_WIFI, "Couldn't add 802-11-wireless-security setting to supplicant config."); goto error; } diff --git a/src/supplicant-manager/nm-supplicant-config.c b/src/supplicant-manager/nm-supplicant-config.c index 86fd1814ca..65d6e2df44 100644 --- a/src/supplicant-manager/nm-supplicant-config.c +++ b/src/supplicant-manager/nm-supplicant-config.c @@ -610,7 +610,8 @@ gboolean nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self, NMSettingWirelessSecurity *setting, NMSetting8021x *setting_8021x, - const char *con_uuid) + const char *con_uuid, + guint32 mtu) { gboolean success = FALSE; const char *key_mgmt, *auth_alg; @@ -727,7 +728,7 @@ nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self, if (!strcmp (key_mgmt, "ieee8021x") || !strcmp (key_mgmt, "wpa-eap")) { if (!setting_8021x) return FALSE; - if (!nm_supplicant_config_add_setting_8021x (self, setting_8021x, con_uuid, FALSE)) + if (!nm_supplicant_config_add_setting_8021x (self, setting_8021x, con_uuid, mtu, FALSE)) return FALSE; } @@ -754,6 +755,7 @@ gboolean nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self, NMSetting8021x *setting, const char *con_uuid, + guint32 mtu, gboolean wired) { NMSupplicantConfigPrivate *priv; @@ -766,6 +768,8 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self, guint32 i, num_eap; gboolean fast_provisoning_allowed = FALSE; const char *ca_path_override = NULL, *ca_cert_override = NULL; + guint32 frag, hdrs; + gs_free char *frag_str = NULL; g_return_val_if_fail (NM_IS_SUPPLICANT_CONFIG (self), FALSE); g_return_val_if_fail (setting != NULL, FALSE); @@ -817,8 +821,15 @@ nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self, } } - /* Drop the fragment size a bit for better compatibility */ - if (!nm_supplicant_config_add_option (self, "fragment_size", "1300", -1, FALSE)) + /* Adjust the fragment size according to MTU, but do not set it higher than 1280-14 + * for better compatibility */ + hdrs = 14; /* EAPOL + EAP-TLS */ + frag = 1280 - hdrs; + if (mtu > hdrs) + frag = CLAMP (mtu - hdrs, 100, frag); + frag_str = g_strdup_printf ("%u", frag); + + if (!nm_supplicant_config_add_option (self, "fragment_size", frag_str, -1, FALSE)) return FALSE; phase1 = g_string_new (NULL); diff --git a/src/supplicant-manager/nm-supplicant-config.h b/src/supplicant-manager/nm-supplicant-config.h index 76a404ddd7..0cd3243ebf 100644 --- a/src/supplicant-manager/nm-supplicant-config.h +++ b/src/supplicant-manager/nm-supplicant-config.h @@ -70,13 +70,15 @@ gboolean nm_supplicant_config_add_setting_wireless (NMSupplicantConfig *self, gboolean nm_supplicant_config_add_setting_wireless_security (NMSupplicantConfig *self, NMSettingWirelessSecurity *setting, NMSetting8021x *setting_8021x, - const char *con_uuid); + const char *con_uuid, + guint32 mtu); gboolean nm_supplicant_config_add_no_security (NMSupplicantConfig *self); gboolean nm_supplicant_config_add_setting_8021x (NMSupplicantConfig *self, NMSetting8021x *setting, const char *con_uuid, + guint32 mtu, gboolean wired); G_END_DECLS diff --git a/src/supplicant-manager/tests/Makefile.am b/src/supplicant-manager/tests/Makefile.am index 63193a1b35..e786664779 100644 --- a/src/supplicant-manager/tests/Makefile.am +++ b/src/supplicant-manager/tests/Makefile.am @@ -1,3 +1,5 @@ +SUBDIRS=certs + AM_CPPFLAGS = \ -I$(top_srcdir)/include \ -I$(top_srcdir)/libnm-core \ @@ -7,6 +9,7 @@ AM_CPPFLAGS = \ -DG_LOG_DOMAIN=\""NetworkManager"\" \ -DNETWORKMANAGER_COMPILATION=NM_NETWORKMANAGER_COMPILATION_INSIDE_DAEMON \ -DNM_VERSION_MAX_ALLOWED=NM_VERSION_NEXT_STABLE \ + -DTEST_CERT_DIR=\"$(srcdir)/certs/\" \ $(GLIB_CFLAGS) noinst_PROGRAMS = test-supplicant-config diff --git a/src/supplicant-manager/tests/certs/Makefile.am b/src/supplicant-manager/tests/certs/Makefile.am new file mode 100644 index 0000000000..f2e889f7ca --- /dev/null +++ b/src/supplicant-manager/tests/certs/Makefile.am @@ -0,0 +1,6 @@ +CERTS = \ + test-ca-cert.pem \ + test-cert.p12 + +EXTRA_DIST = $(CERTS) + diff --git a/src/supplicant-manager/tests/certs/test-ca-cert.pem b/src/supplicant-manager/tests/certs/test-ca-cert.pem new file mode 100644 index 0000000000..ef1be20d2b --- /dev/null +++ b/src/supplicant-manager/tests/certs/test-ca-cert.pem @@ -0,0 +1,27 @@ +-----BEGIN CERTIFICATE----- +MIIEjzCCA3egAwIBAgIJAOvnZPt59yIZMA0GCSqGSIb3DQEBBQUAMIGLMQswCQYD +VQQGEwJVUzESMBAGA1UECBMJQmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcw +FQYDVQQKEw5NeSBDb21wYW55IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UE +AxMEdGVzdDEcMBoGCSqGSIb3DQEJARYNdGVzdEB0ZXN0LmNvbTAeFw0wOTAzMTAx +NTEyMTRaFw0xOTAzMDgxNTEyMTRaMIGLMQswCQYDVQQGEwJVUzESMBAGA1UECBMJ +QmVya3NoaXJlMRAwDgYDVQQHEwdOZXdidXJ5MRcwFQYDVQQKEw5NeSBDb21wYW55 +IEx0ZDEQMA4GA1UECxMHVGVzdGluZzENMAsGA1UEAxMEdGVzdDEcMBoGCSqGSIb3 +DQEJARYNdGVzdEB0ZXN0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBAKot9j+/+CX1/gZLgJHIXCRgCItKLGnf7qGbgqB9T2ACBqR0jllKWwDKrcWU +xjXNIc+GF9Wnv+lX6G0Okn4Zt3/uRNobL+2b/yOF7M3Td3/9W873zdkQQX930YZc +Rr8uxdRPP5bxiCgtcw632y21sSEbG9mjccAUnV/0jdvfmMNj0i8gN6E0fMBiJ9S3 +FkxX/KFvt9JWE9CtoyL7ki7UIDq+6vj7Gd5N0B3dOa1y+rRHZzKlJPcSXQSEYUS4 +HmKDwiKSVahft8c4tDn7KPi0vex91hlgZVd3usL2E/Vq7o5D9FAZ5kZY0AdFXwdm +J4lO4Mj7ac7GE4vNERNcXVIX59sCAwEAAaOB8zCB8DAdBgNVHQ4EFgQUuDU3Mr7P +T3n1e3Sy8hBauoDFahAwgcAGA1UdIwSBuDCBtYAUuDU3Mr7PT3n1e3Sy8hBauoDF +ahChgZGkgY4wgYsxCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlCZXJrc2hpcmUxEDAO +BgNVBAcTB05ld2J1cnkxFzAVBgNVBAoTDk15IENvbXBhbnkgTHRkMRAwDgYDVQQL +EwdUZXN0aW5nMQ0wCwYDVQQDEwR0ZXN0MRwwGgYJKoZIhvcNAQkBFg10ZXN0QHRl +c3QuY29tggkA6+dk+3n3IhkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOC +AQEAVRG4aALIvCXCiKfe7K+iJxjBVRDFPEf7JWA9LGgbFOn6pNvbxonrR+0BETdc +JV1ET4ct2xsE7QNFIkp9GKRC+6J32zCo8qtLCD5+v436r8TUG2/t2JRMkb9I2XVT +p7RJoot6M0Ltf8KNQUPYh756xmKZ4USfQUwc58MOSDGY8VWEXJOYij9Pf0e0c52t +qiCEjXH7uXiS8Pgq9TYm7AkWSOrglYhSa83x0f8mtT8Q15nBESIHZ6o8FAS2bBgn +B0BkrKRjtBUkuJG3vTox+bYINh2Gxi1JZHWSV1tN5z3hd4VFcKqanW5OgQwToBqp +3nniskIjbH0xjgZf/nVMyLnjxg== +-----END CERTIFICATE----- diff --git a/src/supplicant-manager/tests/certs/test-cert.p12 b/src/supplicant-manager/tests/certs/test-cert.p12 new file mode 100644 index 0000000000000000000000000000000000000000..ae4a68304973f7e8fec78c8e8f53d169df2afe59 GIT binary patch literal 4092 zcmY+GbyO1!+r~$1glrD!l7>kRP#OtAx)}ma2`Om>aVq5~ky0240wa{JF_3n2OV+?{&*z-)`=0mxJ4XYH~BThq(0VhSFJCm_yqN2ye*m(=5D+EJ%3CftWZt_&Ve&OUDWNf za}UZPveG_kaaQA#6dcwiD)I;Y(l0mqWBa>f)2OG2=WEHyX}aNL{}&pzz2C4(_wn?L z%|{B>*WANgaW9uHLTV)5G#7C1|H@SF!&5r!epnS98!4Z8HC4=H%y@#1N)*V4a&gFx z)vT<0FL5Y7d3f|zT`^x}LFo#}m2W|PhRrZ7d=ODtWD#hx<`UHw{;&e>>7vv~e23Ap zWGJpLDcb=kg5>Q?J(Csqh)geVrUe)uvsYfAs&@M;Cj4ytm$YZXBn|Ego1!(NcQXl{ zmr_<_Q&d#FiIt zR%>3cv!~$0F5;%vKAMl|uKzxb=FG`yUEn!eZrfGZAX$&*Z2-l-{#y_cU)+Sw2QfdRhx#;(g z*^KOeCKS6E7avXBVYkr)+IVI{BkKwgbs{|~$g5#dyl;&H?lh#(NX>X=%YHPedG#2o z%^Px`6K&wyex)L-+ksEsDj&3L<(}Mu%=HLXkcPS}RGlNX6UNjhm>X#%zFdggcx*H6 zCJD;gUSS1iWj+u{U_ua<`f~L&Or^4S6H0m9yrVc@D#ii?p9@^lAGJ?Qq}K zTHtoLp^vAG@1VL6ME9i`@?r_~G3SOwtB59T_O&;IBy{l*f}l){s+40H6T%<^l&>%PMzhq)Pa zaqi0UO{JB$U*?v%N zxJl6u2lLTo!%NeIE)O4(QfmfGGnH zlS6;u0QHr2Zg97E5QM2DYl`Ta`#v66kp1ND!j)ko!$=C2rPR1c_!!plMeF_E&+^jd zYq}%Ff;?)+YSY1(GrmZOg`f!A0ra7`$7&k`o>lHLE_jpf`+nL|Z_k{9&eQjK@jKh5 zAGZF;A1i5iGW17!)C`2UVU&U!!JG2>BE4(-)d5Su=hiMNmoq+BrEc8Ap!G@qcTWYN z?h7+9?Iz;xt`y3w!KXkI*GDqY_;3t>2gcv8|LpruiNFVQiu%L)^P|`zH^`!ps`Dte zKl)VeEH4b0{fS?^!VAw^#PgQz%dlU?TJGy_dwa^#cC{9%GOa;Tw=jnRW{0ahI=5nL z=?QS%E9$YSr{BA`4@FB0d$hW^cP{1BC^2qd&BHYu+%uhq)YNqPX}v=@X860_?0v7YRfei^4sZ)mPi|%_B!wwR^!>IqH#st* z1FGeS(!?4R>fh`+4){F(JP$!lnq?Ynn~W0;fJe;wHaakvUwieI5Dhk)|2j*O=4Z*@ zEFh#aQ07>CC*+usLgMpTxLGnpl&H>eExw#{Z?$Zj{VF@}PIn2Di0ZL9b)OlRUuG;y z)JMVd;jmvkr#@EC^+9aOZ|28pIVnK9016$fG)AQQ;;T`5h0j;Zp`2(BO{(}t=Jlab zA*2wraNuc@${n8>#^DL(j8OZLP=euG{+#9OD{0xf3>{QwEkAqSHaQdj9GZpYic(0x z%N+I~hjP8tupVH<$xQusi0HR1xa{1p4gR|D&L<*=x6El0yR!-pbio-(zME^+i;T$JGTFDifmZS;{cpJ zY)0kSPT=k-2Dl(KA-GB*jg{i;s{J824(9zW)`$Eg$p_vjvh1nz1zZ)k>;+cOly+4F z-=se55%i)xPw|v@al;r_HYwhJ8yp9vxhKhh5DlCDk^TmvPrqd!VU_8mC7Je%K`Y%r z%?5As;O zyIoaqCjkLy`!xN8$SGd<#=vO0`JrG#Pg-*KCt0PjE^6Q3$yaMm-*`PV)BQhb-erPK z5lobMYkU1E^}0|R!!>nW0_(gUhC<30%6#17f?-&nLC4xquv_Tew0Vg>+ZFVRWoi8( zbDeaVRiVS;uk|YGgr+0*O`3Bk1yfn~M~`Q*buKR+0N}W|Hb+1oi%;x0Cokp*js`ma z2OwskftKWGAmXoV{I~Q$*ZvO|sYysP(B#{2H2L~}Q6$+v6uC!gz&}?SS@I7>lB3Bx zaW_=t5o%|x&<`f{yrV2O8u$46z|5oERmHKtc<-&i?oR~o-SJTSjh#NlcE;K?QJiZ> zLBW{xl)<+{4RsCR$xE0C_zgeOJ0|*mj`wV-LG(jBF@T!q^~Er1`9pOA$!nZEVS(A^ zemvs?x*Xy+f$~DTMCl2ykdAvH8Z~ddP+6-;i$lNf9^Qi9Xzl^o?kX0O+mj4AP(R4VFyQQ%_%L(M^iwt8CKc6OCo?*w*l7eL7r6g1;P2xsb+ z&sF^#5UR;xZQUOI9JZvLV!P6mCo{;3qO|dupcjXiNa+{=^D=%CZ)e~A7D+luCv54w zPLz`-`WcSi#fBFc(DU^2%-{+UR@MQ@&T~XJZIlc0m)Lk^=_9_IFIBv@X=!#ub{eoR zgYpkp+vdHCB}&BH55P;==2N(hwO^2vdOL4smbuA7O3~E?&kk-qaSh8qp`;K{iQYWt zQ|<>H2LaqMNlARkxml6=1D;OhkMDDr4G(kj^48#N!MxBZV3fNNO;oTjS4t zRYxO7&4x7X+K(cAIGS)zCPDW8-uGaML|YDa_BfFGyxNDR1`V@=Hs4(nM=0a4%;)3_ z%Gk$?yb&zQJB^j#$muJIT-p+@ZO@c!VKFV7UA8qq)`M+v2^yZ2Eix@@;ej|XoXr0m zqmx@I?zo);QMUL>A?+LPoavC5Z1in%>$ELqjN1MIU4O%mjv*biD2vtm2>sM6rZ_dU z&51MV`lFL8fv677FAtcI#z&gfg&y6~&u?*I=WhTQK$qG~Gl_s#Z&DMV{w%RL?esU= z7h~lLGM!r)0e*VpmP%&Y8IU08Rr(RORZ~0AU7O2PetT%@xPVt13)&^fBE7v@sdI6* zF@4jf=T}bnX=NnqbxHhAE%^(XB}~`wOjZ4-ihvEpM2*CYkI|43K2?%=cfv-?Fjeh= zq&Pr&*&8YWL$j_ZEFvGXa(=>5L`T}_s=Sx6V*P`#hH$zzp>qA^4M_! zV{TEsT_ssX+iuE9`<^Wm>4O+?3Z>6^-vj$u)*%sFxz*x}1pIy-ihXcyP?kD|5@XxG zeh(z%e^Q|CLlqsKMpC+hSa0=waaV^zl~H?Y(d9&1@dMB6`cF1Y$i? zhK!i@vLQY(z)`NpsI_+OU|=jru2E&I6d`93oOcq!PYV!ooU@ObfP~q+Aj}W@{l4MK zIm|ZeD9m5c(rw^`xxY(8TZ7W!*|g=&zfxil9-GsHzNnDb`T9=ta~ze~A&j^lbiVF; z?{;a({^#`xtd@aEQ0lQW-%704X|;@{hMsC^%ZKa2Dv6#LYx=+(5hk_g&(vLnMXF}} zSi)xS_b?M~O@c9WS;&u_b1~YM{w*Wtmd0cfdT`$VPe&>S2}W}IL@r^hc{1U90RdK$ zvK1IXw9np!^Z$E9FTs415#R%G0C@lHq5v;|E8xlBT>>Bpmw