Make net80211 expose reasons for association failures to userland and have

ifconfig display them in 'scan' output and on the ieee80211 status line if
the failure is applicable to an already selected AP (e.g. wrong WPA key).

This will hopefully reduce the amount of help requests for what often
turn out to be trivial misconfiguration issues that were previously
hard to diagnose without debug mode.

ifconfig must be recompiled with the new ieee80211_ioctl.h to stay in
sync with the kernel. A full 'make build' will do the right thing!

Very helpful input by mpi@ and deraadt@

1 files changed, 32 insertions, 1 deletions

diff --git a/sys/net80211/ieee80211_proto.c b/sys/net80211/ieee80211_proto.c
index 30c784c7b2f..d00d1b631f2 100644
--- a/sys/net80211/ieee80211_proto.c
+++ b/sys/net80211/ieee80211_proto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_proto.c,v 1.94 2019/07/29 10:50:09 stsp Exp $	*/
+/*	$OpenBSD: ieee80211_proto.c,v 1.95 2019/09/02 12:54:21 stsp Exp $	*/
 /*	$NetBSD: ieee80211_proto.c,v 1.8 2004/04/30 23:58:20 dyoung Exp $	*/
 
 /*-
@@ -939,6 +939,33 @@ ieee80211_stop_ampdu_tx(struct ieee80211com *ic, struct ieee80211_node *ni,
 	}
 }
 
+void
+ieee80211_check_wpa_supplicant_failure(struct ieee80211com *ic,
+    struct ieee80211_node *ni)
+{
+	struct ieee80211_node *ni2;
+
+	if (ic->ic_opmode != IEEE80211_M_STA
+#ifndef IEEE80211_STA_ONLY
+	    && ic->ic_opmode != IEEE80211_M_IBSS
+#endif
+	    )
+		return;
+
+	if (ni->ni_rsn_supp_state != RSNA_SUPP_PTKNEGOTIATING)
+		return;
+
+	ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_WPA_KEY;
+
+	if (ni != ic->ic_bss)
+		return;
+
+	/* Also update the copy of our AP's node in the node cache. */
+	ni2 = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr);
+	if (ni2)
+		ni2->ni_assoc_fail |= ic->ic_bss->ni_assoc_fail;
+}
+
 int
 ieee80211_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
     int mgt)
@@ -1037,6 +1064,7 @@ justcleanup:
 			break;
 		}
 		ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE;
+		ni->ni_assoc_fail = 0;
 		if (ic->ic_flags & IEEE80211_F_RSNON)
 			ieee80211_crypto_clear_groupkeys(ic);
 		break;
@@ -1097,6 +1125,8 @@ justcleanup:
 		}
 		break;
 	case IEEE80211_S_AUTH:
+		if (ostate == IEEE80211_S_RUN)
+			ieee80211_check_wpa_supplicant_failure(ic, ni);
 		ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE;
 		if (ic->ic_flags & IEEE80211_F_RSNON)
 			ieee80211_crypto_clear_groupkeys(ic);
@@ -1218,6 +1248,7 @@ justcleanup:
 				 * the link up until the port is valid.
 				 */
 				ieee80211_set_link_state(ic, LINK_STATE_UP);
+				ni->ni_assoc_fail = 0;
 			}
 			ic->ic_mgt_timer = 0;
 			ieee80211_set_beacon_miss_threshold(ic);