usr-sse2/Black80211-Catalina

Don't autoconnect to found open networks if nothing is selected

usr-sse2 opened this issue · 13 comments

Don't autoconnect to found open networks if nothing is selected

@zxystd, what do you think about this project?

Currently I can't find why itlwm associates to any found open networks if I explicitly disassociate, clear ess list and unset desired essid.

@zxystd, what do you think about this project?

Currently I can't find why itlwm associates to any found open networks if I explicitly disassociate, clear ess list and unset desired essid.

Really a good idea of native integration. As I don't have too much spare time on doing reversing until we full implement hardware and net80211 software capabilities.

How does it happened ? Have you clean the ess_len?

@zxystd When disassociating, I remove all entries from ic_ess list, deselect desired ESS, disassociate from current AP and disable autojoin.
When associating, I add specified entry to ic_ess list and switch to that ESS.

void itlwm_disassociate(IONetworkController *self) {
	itlwm* controller = (itlwm*)self;
	struct ieee80211com *ic = &controller->com.sc_ic;
	_fCommandGate->runActionBlock(^IOReturn{
		controller->protect_des_ess = false;
		ieee80211_set_link_state(ic, LINK_STATE_DOWN);
		ieee80211_del_ess(ic, nullptr, 0, 1);
		ieee80211_deselect_ess(ic);
		controller->iwm_disassoc(&controller->com);
                ic->ic_flags &= ~IEEE80211_F_AUTO_JOIN;
		return kIOReturnSuccess;
	});
}

someone also reported this problem(auto trying to connect to a open wifi or hidden wifi), I think it is some default behavior in ieee80211_node_choose_bss when the ssid is empty/no security. need some trace logs to prove.

someone also reported this problem(auto trying to connect to a open wifi or hidden wifi), I think it is some default behavior in ieee80211_node_choose_bss when the ssid is empty/no security. need some trace logs to prove.

I thought that there should be an option to suppress joining at all. Ideally, for my use case of integration with Black80211, itlwm shouldn't join when not asked to and shouldn't scan when not asked to.

@zxystd I found that if auto join is disabled and des_bsslen is 0, then ieee80211_node_choose_bss will actually connect to any network with currently selected encryption settings (in this case, open network). So the workaround is to enable auto-join with des_bsslen set to 0 and empty ESS list, so it would scan but not choose anything.

Besides, did you ever encounter a panic (or some other undesired behavior) with some variables in the stack or heap being zeroed? I'm struggling for a few days with an issue that definitely initialized to non-null fields are null, and after adding null check, log messages or modifying unrelated code the null moves to other fields. On each build the panic is always in the same place. Looks like something is zeroing wrong addresses in the stack or in heap.

@zxystd Or do you have any tips and tricks for debugging “device timeout” issues?

Sent with GitHawk

hmmm, I found it will auto connect a open network even if I haven't do anything, just load it and put it into scan state.
Also met this wired problem before in itlwmx, I have alloced a lock in init state, check it is not null, when I use it in start method, it panic with Lock==null, and I found that an array address is changing, very strange. When I put all the code in one cpp file, the problem solved.
I also have tried to integrate Black80211 into itlwm few months before, When I save the IE data, and release them when free node, I get free red zone random panic, free for correct size fix this problem.But now, I haven't met panic and no one reported panic for about a month, so I think maybe you can check other alloc and release code? these two cases for your reference.

@zxystd So now I have a case to reproduce it with bare itlwm from your master, with password in Info.plist (without user client).

  1. In Network Utility only Tx statistics works, but Rx statistics is 0.
  2. In _if_input, ifq->netStat is NULL although it was assigned to a non-null value in configureInterface. So something is overwriting this field.
  3. Add netStat2 field in struct ifnet as the last field.
  4. In configureInterface write fNetStats to both netStat and netStat2 – and everything goes wrong:
  • attachInterface fails (MAC address is overwritten or what?)
  • then releaseAll is called, it tries to delete a timeout and panics inside CTimeout::timeout_del

hmmm, I try it, the netStat variable is null, so strange. but before I change this code, although I count the Rx packets, the statistics still works abnormal.

I found the reason!
_mbuf.cpp and mac80211.cpp get different definitions of struct ifnet, and the offset of netStat in one of them is 184, and in the other it's 200. You can check that with static_assert(offsetof(struct ifnet2, netStat) == 200, "Wrong offset"); in both files – one fails and the other succeeds. Currently I'm investigating what's different.

@zxystd IFNAMSIZ is defined to 32, but it also comes from macOS headers and is 16, hence the difference. Also struct ifnet name is bad because it can accidentally be mixed with struct ifnet from system headers.
This also explains why moving code to one cpp file helped you.

Now netStat isn't NULL and I see changing values in the ioreg, but Network Utility still doesn't show rx stats.

Yes, but the RTL8111 driver can correctly count the result, I don't know why.