projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
mac80111: Add BIP-CMAC-256 cipher
[deliverable/linux.git] / net / mac80211 / key.c
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007-2008 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 */
12
13 #include <linux/if_ether.h>
14 #include <linux/etherdevice.h>
15 #include <linux/list.h>
16 #include <linux/rcupdate.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/slab.h>
19 #include <linux/export.h>
20 #include <net/mac80211.h>
21 #include <asm/unaligned.h>
22 #include "ieee80211_i.h"
23 #include "driver-ops.h"
24 #include "debugfs_key.h"
25 #include "aes_ccm.h"
26 #include "aes_cmac.h"
27 #include "aes_gcm.h"
28
29
30 /**
31 * DOC: Key handling basics
32 *
33 * Key handling in mac80211 is done based on per-interface (sub_if_data)
34 * keys and per-station keys. Since each station belongs to an interface,
35 * each station key also belongs to that interface.
36 *
37 * Hardware acceleration is done on a best-effort basis for algorithms
38 * that are implemented in software, for each key the hardware is asked
39 * to enable that key for offloading but if it cannot do that the key is
40 * simply kept for software encryption (unless it is for an algorithm
41 * that isn't implemented in software).
42 * There is currently no way of knowing whether a key is handled in SW
43 * or HW except by looking into debugfs.
44 *
45 * All key management is internally protected by a mutex. Within all
46 * other parts of mac80211, key references are, just as STA structure
47 * references, protected by RCU. Note, however, that some things are
48 * unprotected, namely the key->sta dereferences within the hardware
49 * acceleration functions. This means that sta_info_destroy() must
50 * remove the key which waits for an RCU grace period.
51 */
52
53 static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
54
55 static void assert_key_lock(struct ieee80211_local *local)
56 {
57 lockdep_assert_held(&local->key_mtx);
58 }
59
60 static void increment_tailroom_need_count(struct ieee80211_sub_if_data *sdata)
61 {
62 /*
63 * When this count is zero, SKB resizing for allocating tailroom
64 * for IV or MMIC is skipped. But, this check has created two race
65 * cases in xmit path while transiting from zero count to one:
66 *
67 * 1. SKB resize was skipped because no key was added but just before
68 * the xmit key is added and SW encryption kicks off.
69 *
70 * 2. SKB resize was skipped because all the keys were hw planted but
71 * just before xmit one of the key is deleted and SW encryption kicks
72 * off.
73 *
74 * In both the above case SW encryption will find not enough space for
75 * tailroom and exits with WARN_ON. (See WARN_ONs at wpa.c)
76 *
77 * Solution has been explained at
78 * http://mid.gmane.org/1308590980.4322.19.camel@jlt3.sipsolutions.net
79 */
80
81 if (!sdata->crypto_tx_tailroom_needed_cnt++) {
82 /*
83 * Flush all XMIT packets currently using HW encryption or no
84 * encryption at all if the count transition is from 0 -> 1.
85 */
86 synchronize_net();
87 }
88 }
89
90 static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
91 {
92 struct ieee80211_sub_if_data *sdata;
93 struct sta_info *sta;
94 int ret = -EOPNOTSUPP;
95
96 might_sleep();
97
98 if (key->flags & KEY_FLAG_TAINTED) {
99 /* If we get here, it's during resume and the key is
100 * tainted so shouldn't be used/programmed any more.
101 * However, its flags may still indicate that it was
102 * programmed into the device (since we're in resume)
103 * so clear that flag now to avoid trying to remove
104 * it again later.
105 */
106 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
107 return -EINVAL;
108 }
109
110 if (!key->local->ops->set_key)
111 goto out_unsupported;
112
113 assert_key_lock(key->local);
114
115 sta = key->sta;
116
117 /*
118 * If this is a per-STA GTK, check if it
119 * is supported; if not, return.
120 */
121 if (sta && !(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE) &&
122 !(key->local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK))
123 goto out_unsupported;
124
125 if (sta && !sta->uploaded)
126 goto out_unsupported;
127
128 sdata = key->sdata;
129 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
130 /*
131 * The driver doesn't know anything about VLAN interfaces.
132 * Hence, don't send GTKs for VLAN interfaces to the driver.
133 */
134 if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
135 goto out_unsupported;
136 }
137
138 ret = drv_set_key(key->local, SET_KEY, sdata,
139 sta ? &sta->sta : NULL, &key->conf);
140
141 if (!ret) {
142 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
143
144 if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
145 (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
146 sdata->crypto_tx_tailroom_needed_cnt--;
147
148 WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
149 (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV));
150
151 return 0;
152 }
153
154 if (ret != -ENOSPC && ret != -EOPNOTSUPP && ret != 1)
155 sdata_err(sdata,
156 "failed to set key (%d, %pM) to hardware (%d)\n",
157 key->conf.keyidx,
158 sta ? sta->sta.addr : bcast_addr, ret);
159
160 out_unsupported:
161 switch (key->conf.cipher) {
162 case WLAN_CIPHER_SUITE_WEP40:
163 case WLAN_CIPHER_SUITE_WEP104:
164 case WLAN_CIPHER_SUITE_TKIP:
165 case WLAN_CIPHER_SUITE_CCMP:
166 case WLAN_CIPHER_SUITE_CCMP_256:
167 case WLAN_CIPHER_SUITE_AES_CMAC:
168 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
169 case WLAN_CIPHER_SUITE_GCMP:
170 case WLAN_CIPHER_SUITE_GCMP_256:
171 /* all of these we can do in software - if driver can */
172 if (ret == 1)
173 return 0;
174 if (key->local->hw.flags & IEEE80211_HW_SW_CRYPTO_CONTROL)
175 return -EINVAL;
176 return 0;
177 default:
178 return -EINVAL;
179 }
180 }
181
182 static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
183 {
184 struct ieee80211_sub_if_data *sdata;
185 struct sta_info *sta;
186 int ret;
187
188 might_sleep();
189
190 if (!key || !key->local->ops->set_key)
191 return;
192
193 assert_key_lock(key->local);
194
195 if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
196 return;
197
198 sta = key->sta;
199 sdata = key->sdata;
200
201 if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
202 (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
203 increment_tailroom_need_count(sdata);
204
205 ret = drv_set_key(key->local, DISABLE_KEY, sdata,
206 sta ? &sta->sta : NULL, &key->conf);
207
208 if (ret)
209 sdata_err(sdata,
210 "failed to remove key (%d, %pM) from hardware (%d)\n",
211 key->conf.keyidx,
212 sta ? sta->sta.addr : bcast_addr, ret);
213
214 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
215 }
216
217 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
218 int idx, bool uni, bool multi)
219 {
220 struct ieee80211_key *key = NULL;
221
222 assert_key_lock(sdata->local);
223
224 if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
225 key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
226
227 if (uni) {
228 rcu_assign_pointer(sdata->default_unicast_key, key);
229 drv_set_default_unicast_key(sdata->local, sdata, idx);
230 }
231
232 if (multi)
233 rcu_assign_pointer(sdata->default_multicast_key, key);
234
235 ieee80211_debugfs_key_update_default(sdata);
236 }
237
238 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx,
239 bool uni, bool multi)
240 {
241 mutex_lock(&sdata->local->key_mtx);
242 __ieee80211_set_default_key(sdata, idx, uni, multi);
243 mutex_unlock(&sdata->local->key_mtx);
244 }
245
246 static void
247 __ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
248 {
249 struct ieee80211_key *key = NULL;
250
251 assert_key_lock(sdata->local);
252
253 if (idx >= NUM_DEFAULT_KEYS &&
254 idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
255 key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
256
257 rcu_assign_pointer(sdata->default_mgmt_key, key);
258
259 ieee80211_debugfs_key_update_default(sdata);
260 }
261
262 void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
263 int idx)
264 {
265 mutex_lock(&sdata->local->key_mtx);
266 __ieee80211_set_default_mgmt_key(sdata, idx);
267 mutex_unlock(&sdata->local->key_mtx);
268 }
269
270
271 static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
272 struct sta_info *sta,
273 bool pairwise,
274 struct ieee80211_key *old,
275 struct ieee80211_key *new)
276 {
277 int idx;
278 bool defunikey, defmultikey, defmgmtkey;
279
280 /* caller must provide at least one old/new */
281 if (WARN_ON(!new && !old))
282 return;
283
284 if (new)
285 list_add_tail(&new->list, &sdata->key_list);
286
287 WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);
288
289 if (old)
290 idx = old->conf.keyidx;
291 else
292 idx = new->conf.keyidx;
293
294 if (sta) {
295 if (pairwise) {
296 rcu_assign_pointer(sta->ptk[idx], new);
297 sta->ptk_idx = idx;
298 } else {
299 rcu_assign_pointer(sta->gtk[idx], new);
300 sta->gtk_idx = idx;
301 }
302 } else {
303 defunikey = old &&
304 old == key_mtx_dereference(sdata->local,
305 sdata->default_unicast_key);
306 defmultikey = old &&
307 old == key_mtx_dereference(sdata->local,
308 sdata->default_multicast_key);
309 defmgmtkey = old &&
310 old == key_mtx_dereference(sdata->local,
311 sdata->default_mgmt_key);
312
313 if (defunikey && !new)
314 __ieee80211_set_default_key(sdata, -1, true, false);
315 if (defmultikey && !new)
316 __ieee80211_set_default_key(sdata, -1, false, true);
317 if (defmgmtkey && !new)
318 __ieee80211_set_default_mgmt_key(sdata, -1);
319
320 rcu_assign_pointer(sdata->keys[idx], new);
321 if (defunikey && new)
322 __ieee80211_set_default_key(sdata, new->conf.keyidx,
323 true, false);
324 if (defmultikey && new)
325 __ieee80211_set_default_key(sdata, new->conf.keyidx,
326 false, true);
327 if (defmgmtkey && new)
328 __ieee80211_set_default_mgmt_key(sdata,
329 new->conf.keyidx);
330 }
331
332 if (old)
333 list_del(&old->list);
334 }
335
336 struct ieee80211_key *
337 ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
338 const u8 *key_data,
339 size_t seq_len, const u8 *seq,
340 const struct ieee80211_cipher_scheme *cs)
341 {
342 struct ieee80211_key *key;
343 int i, j, err;
344
345 if (WARN_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS))
346 return ERR_PTR(-EINVAL);
347
348 key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
349 if (!key)
350 return ERR_PTR(-ENOMEM);
351
352 /*
353 * Default to software encryption; we'll later upload the
354 * key to the hardware if possible.
355 */
356 key->conf.flags = 0;
357 key->flags = 0;
358
359 key->conf.cipher = cipher;
360 key->conf.keyidx = idx;
361 key->conf.keylen = key_len;
362 switch (cipher) {
363 case WLAN_CIPHER_SUITE_WEP40:
364 case WLAN_CIPHER_SUITE_WEP104:
365 key->conf.iv_len = IEEE80211_WEP_IV_LEN;
366 key->conf.icv_len = IEEE80211_WEP_ICV_LEN;
367 break;
368 case WLAN_CIPHER_SUITE_TKIP:
369 key->conf.iv_len = IEEE80211_TKIP_IV_LEN;
370 key->conf.icv_len = IEEE80211_TKIP_ICV_LEN;
371 if (seq) {
372 for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
373 key->u.tkip.rx[i].iv32 =
374 get_unaligned_le32(&seq[2]);
375 key->u.tkip.rx[i].iv16 =
376 get_unaligned_le16(seq);
377 }
378 }
379 spin_lock_init(&key->u.tkip.txlock);
380 break;
381 case WLAN_CIPHER_SUITE_CCMP:
382 key->conf.iv_len = IEEE80211_CCMP_HDR_LEN;
383 key->conf.icv_len = IEEE80211_CCMP_MIC_LEN;
384 if (seq) {
385 for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
386 for (j = 0; j < IEEE80211_CCMP_PN_LEN; j++)
387 key->u.ccmp.rx_pn[i][j] =
388 seq[IEEE80211_CCMP_PN_LEN - j - 1];
389 }
390 /*
391 * Initialize AES key state here as an optimization so that
392 * it does not need to be initialized for every packet.
393 */
394 key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(
395 key_data, key_len, IEEE80211_CCMP_MIC_LEN);
396 if (IS_ERR(key->u.ccmp.tfm)) {
397 err = PTR_ERR(key->u.ccmp.tfm);
398 kfree(key);
399 return ERR_PTR(err);
400 }
401 break;
402 case WLAN_CIPHER_SUITE_CCMP_256:
403 key->conf.iv_len = IEEE80211_CCMP_256_HDR_LEN;
404 key->conf.icv_len = IEEE80211_CCMP_256_MIC_LEN;
405 for (i = 0; seq && i < IEEE80211_NUM_TIDS + 1; i++)
406 for (j = 0; j < IEEE80211_CCMP_256_PN_LEN; j++)
407 key->u.ccmp.rx_pn[i][j] =
408 seq[IEEE80211_CCMP_256_PN_LEN - j - 1];
409 /* Initialize AES key state here as an optimization so that
410 * it does not need to be initialized for every packet.
411 */
412 key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(
413 key_data, key_len, IEEE80211_CCMP_256_MIC_LEN);
414 if (IS_ERR(key->u.ccmp.tfm)) {
415 err = PTR_ERR(key->u.ccmp.tfm);
416 kfree(key);
417 return ERR_PTR(err);
418 }
419 break;
420 case WLAN_CIPHER_SUITE_AES_CMAC:
421 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
422 key->conf.iv_len = 0;
423 if (cipher == WLAN_CIPHER_SUITE_AES_CMAC)
424 key->conf.icv_len = sizeof(struct ieee80211_mmie);
425 else
426 key->conf.icv_len = sizeof(struct ieee80211_mmie_16);
427 if (seq)
428 for (j = 0; j < IEEE80211_CMAC_PN_LEN; j++)
429 key->u.aes_cmac.rx_pn[j] =
430 seq[IEEE80211_CMAC_PN_LEN - j - 1];
431 /*
432 * Initialize AES key state here as an optimization so that
433 * it does not need to be initialized for every packet.
434 */
435 key->u.aes_cmac.tfm =
436 ieee80211_aes_cmac_key_setup(key_data, key_len);
437 if (IS_ERR(key->u.aes_cmac.tfm)) {
438 err = PTR_ERR(key->u.aes_cmac.tfm);
439 kfree(key);
440 return ERR_PTR(err);
441 }
442 break;
443 case WLAN_CIPHER_SUITE_GCMP:
444 case WLAN_CIPHER_SUITE_GCMP_256:
445 key->conf.iv_len = IEEE80211_GCMP_HDR_LEN;
446 key->conf.icv_len = IEEE80211_GCMP_MIC_LEN;
447 for (i = 0; seq && i < IEEE80211_NUM_TIDS + 1; i++)
448 for (j = 0; j < IEEE80211_GCMP_PN_LEN; j++)
449 key->u.gcmp.rx_pn[i][j] =
450 seq[IEEE80211_GCMP_PN_LEN - j - 1];
451 /* Initialize AES key state here as an optimization so that
452 * it does not need to be initialized for every packet.
453 */
454 key->u.gcmp.tfm = ieee80211_aes_gcm_key_setup_encrypt(key_data,
455 key_len);
456 if (IS_ERR(key->u.gcmp.tfm)) {
457 err = PTR_ERR(key->u.gcmp.tfm);
458 kfree(key);
459 return ERR_PTR(err);
460 }
461 break;
462 default:
463 if (cs) {
464 size_t len = (seq_len > MAX_PN_LEN) ?
465 MAX_PN_LEN : seq_len;
466
467 key->conf.iv_len = cs->hdr_len;
468 key->conf.icv_len = cs->mic_len;
469 for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
470 for (j = 0; j < len; j++)
471 key->u.gen.rx_pn[i][j] =
472 seq[len - j - 1];
473 }
474 }
475 memcpy(key->conf.key, key_data, key_len);
476 INIT_LIST_HEAD(&key->list);
477
478 return key;
479 }
480
481 static void ieee80211_key_free_common(struct ieee80211_key *key)
482 {
483 switch (key->conf.cipher) {
484 case WLAN_CIPHER_SUITE_CCMP:
485 case WLAN_CIPHER_SUITE_CCMP_256:
486 ieee80211_aes_key_free(key->u.ccmp.tfm);
487 break;
488 case WLAN_CIPHER_SUITE_AES_CMAC:
489 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
490 ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
491 break;
492 case WLAN_CIPHER_SUITE_GCMP:
493 case WLAN_CIPHER_SUITE_GCMP_256:
494 ieee80211_aes_gcm_key_free(key->u.gcmp.tfm);
495 break;
496 }
497 kzfree(key);
498 }
499
500 static void __ieee80211_key_destroy(struct ieee80211_key *key,
501 bool delay_tailroom)
502 {
503 if (key->local)
504 ieee80211_key_disable_hw_accel(key);
505
506 if (key->local) {
507 struct ieee80211_sub_if_data *sdata = key->sdata;
508
509 ieee80211_debugfs_key_remove(key);
510
511 if (delay_tailroom) {
512 /* see ieee80211_delayed_tailroom_dec */
513 sdata->crypto_tx_tailroom_pending_dec++;
514 schedule_delayed_work(&sdata->dec_tailroom_needed_wk,
515 HZ/2);
516 } else {
517 sdata->crypto_tx_tailroom_needed_cnt--;
518 }
519 }
520
521 ieee80211_key_free_common(key);
522 }
523
524 static void ieee80211_key_destroy(struct ieee80211_key *key,
525 bool delay_tailroom)
526 {
527 if (!key)
528 return;
529
530 /*
531 * Synchronize so the TX path can no longer be using
532 * this key before we free/remove it.
533 */
534 synchronize_net();
535
536 __ieee80211_key_destroy(key, delay_tailroom);
537 }
538
539 void ieee80211_key_free_unused(struct ieee80211_key *key)
540 {
541 WARN_ON(key->sdata || key->local);
542 ieee80211_key_free_common(key);
543 }
544
545 int ieee80211_key_link(struct ieee80211_key *key,
546 struct ieee80211_sub_if_data *sdata,
547 struct sta_info *sta)
548 {
549 struct ieee80211_local *local = sdata->local;
550 struct ieee80211_key *old_key;
551 int idx, ret;
552 bool pairwise;
553
554 pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
555 idx = key->conf.keyidx;
556 key->local = sdata->local;
557 key->sdata = sdata;
558 key->sta = sta;
559
560 mutex_lock(&sdata->local->key_mtx);
561
562 if (sta && pairwise)
563 old_key = key_mtx_dereference(sdata->local, sta->ptk[idx]);
564 else if (sta)
565 old_key = key_mtx_dereference(sdata->local, sta->gtk[idx]);
566 else
567 old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
568
569 increment_tailroom_need_count(sdata);
570
571 ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
572 ieee80211_key_destroy(old_key, true);
573
574 ieee80211_debugfs_key_add(key);
575
576 if (!local->wowlan) {
577 ret = ieee80211_key_enable_hw_accel(key);
578 if (ret)
579 ieee80211_key_free(key, true);
580 } else {
581 ret = 0;
582 }
583
584 mutex_unlock(&sdata->local->key_mtx);
585
586 return ret;
587 }
588
589 void ieee80211_key_free(struct ieee80211_key *key, bool delay_tailroom)
590 {
591 if (!key)
592 return;
593
594 /*
595 * Replace key with nothingness if it was ever used.
596 */
597 if (key->sdata)
598 ieee80211_key_replace(key->sdata, key->sta,
599 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
600 key, NULL);
601 ieee80211_key_destroy(key, delay_tailroom);
602 }
603
604 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
605 {
606 struct ieee80211_key *key;
607
608 ASSERT_RTNL();
609
610 if (WARN_ON(!ieee80211_sdata_running(sdata)))
611 return;
612
613 mutex_lock(&sdata->local->key_mtx);
614
615 sdata->crypto_tx_tailroom_needed_cnt = 0;
616
617 list_for_each_entry(key, &sdata->key_list, list) {
618 increment_tailroom_need_count(sdata);
619 ieee80211_key_enable_hw_accel(key);
620 }
621
622 mutex_unlock(&sdata->local->key_mtx);
623 }
624
625 void ieee80211_iter_keys(struct ieee80211_hw *hw,
626 struct ieee80211_vif *vif,
627 void (*iter)(struct ieee80211_hw *hw,
628 struct ieee80211_vif *vif,
629 struct ieee80211_sta *sta,
630 struct ieee80211_key_conf *key,
631 void *data),
632 void *iter_data)
633 {
634 struct ieee80211_local *local = hw_to_local(hw);
635 struct ieee80211_key *key, *tmp;
636 struct ieee80211_sub_if_data *sdata;
637
638 ASSERT_RTNL();
639
640 mutex_lock(&local->key_mtx);
641 if (vif) {
642 sdata = vif_to_sdata(vif);
643 list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
644 iter(hw, &sdata->vif,
645 key->sta ? &key->sta->sta : NULL,
646 &key->conf, iter_data);
647 } else {
648 list_for_each_entry(sdata, &local->interfaces, list)
649 list_for_each_entry_safe(key, tmp,
650 &sdata->key_list, list)
651 iter(hw, &sdata->vif,
652 key->sta ? &key->sta->sta : NULL,
653 &key->conf, iter_data);
654 }
655 mutex_unlock(&local->key_mtx);
656 }
657 EXPORT_SYMBOL(ieee80211_iter_keys);
658
659 static void ieee80211_free_keys_iface(struct ieee80211_sub_if_data *sdata,
660 struct list_head *keys)
661 {
662 struct ieee80211_key *key, *tmp;
663
664 sdata->crypto_tx_tailroom_needed_cnt -=
665 sdata->crypto_tx_tailroom_pending_dec;
666 sdata->crypto_tx_tailroom_pending_dec = 0;
667
668 ieee80211_debugfs_key_remove_mgmt_default(sdata);
669
670 list_for_each_entry_safe(key, tmp, &sdata->key_list, list) {
671 ieee80211_key_replace(key->sdata, key->sta,
672 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
673 key, NULL);
674 list_add_tail(&key->list, keys);
675 }
676
677 ieee80211_debugfs_key_update_default(sdata);
678 }
679
680 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,
681 bool force_synchronize)
682 {
683 struct ieee80211_local *local = sdata->local;
684 struct ieee80211_sub_if_data *vlan;
685 struct ieee80211_key *key, *tmp;
686 LIST_HEAD(keys);
687
688 cancel_delayed_work_sync(&sdata->dec_tailroom_needed_wk);
689
690 mutex_lock(&local->key_mtx);
691
692 ieee80211_free_keys_iface(sdata, &keys);
693
694 if (sdata->vif.type == NL80211_IFTYPE_AP) {
695 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
696 ieee80211_free_keys_iface(vlan, &keys);
697 }
698
699 if (!list_empty(&keys) || force_synchronize)
700 synchronize_net();
701 list_for_each_entry_safe(key, tmp, &keys, list)
702 __ieee80211_key_destroy(key, false);
703
704 WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
705 sdata->crypto_tx_tailroom_pending_dec);
706 if (sdata->vif.type == NL80211_IFTYPE_AP) {
707 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
708 WARN_ON_ONCE(vlan->crypto_tx_tailroom_needed_cnt ||
709 vlan->crypto_tx_tailroom_pending_dec);
710 }
711
712 mutex_unlock(&local->key_mtx);
713 }
714
715 void ieee80211_free_sta_keys(struct ieee80211_local *local,
716 struct sta_info *sta)
717 {
718 struct ieee80211_key *key;
719 int i;
720
721 mutex_lock(&local->key_mtx);
722 for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
723 key = key_mtx_dereference(local, sta->gtk[i]);
724 if (!key)
725 continue;
726 ieee80211_key_replace(key->sdata, key->sta,
727 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
728 key, NULL);
729 __ieee80211_key_destroy(key, true);
730 }
731
732 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
733 key = key_mtx_dereference(local, sta->ptk[i]);
734 if (!key)
735 continue;
736 ieee80211_key_replace(key->sdata, key->sta,
737 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
738 key, NULL);
739 __ieee80211_key_destroy(key, true);
740 }
741
742 mutex_unlock(&local->key_mtx);
743 }
744
745 void ieee80211_delayed_tailroom_dec(struct work_struct *wk)
746 {
747 struct ieee80211_sub_if_data *sdata;
748
749 sdata = container_of(wk, struct ieee80211_sub_if_data,
750 dec_tailroom_needed_wk.work);
751
752 /*
753 * The reason for the delayed tailroom needed decrementing is to
754 * make roaming faster: during roaming, all keys are first deleted
755 * and then new keys are installed. The first new key causes the
756 * crypto_tx_tailroom_needed_cnt to go from 0 to 1, which invokes
757 * the cost of synchronize_net() (which can be slow). Avoid this
758 * by deferring the crypto_tx_tailroom_needed_cnt decrementing on
759 * key removal for a while, so if we roam the value is larger than
760 * zero and no 0->1 transition happens.
761 *
762 * The cost is that if the AP switching was from an AP with keys
763 * to one without, we still allocate tailroom while it would no
764 * longer be needed. However, in the typical (fast) roaming case
765 * within an ESS this usually won't happen.
766 */
767
768 mutex_lock(&sdata->local->key_mtx);
769 sdata->crypto_tx_tailroom_needed_cnt -=
770 sdata->crypto_tx_tailroom_pending_dec;
771 sdata->crypto_tx_tailroom_pending_dec = 0;
772 mutex_unlock(&sdata->local->key_mtx);
773 }
774
775 void ieee80211_gtk_rekey_notify(struct ieee80211_vif *vif, const u8 *bssid,
776 const u8 *replay_ctr, gfp_t gfp)
777 {
778 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
779
780 trace_api_gtk_rekey_notify(sdata, bssid, replay_ctr);
781
782 cfg80211_gtk_rekey_notify(sdata->dev, bssid, replay_ctr, gfp);
783 }
784 EXPORT_SYMBOL_GPL(ieee80211_gtk_rekey_notify);
785
786 void ieee80211_get_key_tx_seq(struct ieee80211_key_conf *keyconf,
787 struct ieee80211_key_seq *seq)
788 {
789 struct ieee80211_key *key;
790 u64 pn64;
791
792 if (WARN_ON(!(keyconf->flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
793 return;
794
795 key = container_of(keyconf, struct ieee80211_key, conf);
796
797 switch (key->conf.cipher) {
798 case WLAN_CIPHER_SUITE_TKIP:
799 seq->tkip.iv32 = key->u.tkip.tx.iv32;
800 seq->tkip.iv16 = key->u.tkip.tx.iv16;
801 break;
802 case WLAN_CIPHER_SUITE_CCMP:
803 case WLAN_CIPHER_SUITE_CCMP_256:
804 pn64 = atomic64_read(&key->u.ccmp.tx_pn);
805 seq->ccmp.pn[5] = pn64;
806 seq->ccmp.pn[4] = pn64 >> 8;
807 seq->ccmp.pn[3] = pn64 >> 16;
808 seq->ccmp.pn[2] = pn64 >> 24;
809 seq->ccmp.pn[1] = pn64 >> 32;
810 seq->ccmp.pn[0] = pn64 >> 40;
811 break;
812 case WLAN_CIPHER_SUITE_AES_CMAC:
813 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
814 pn64 = atomic64_read(&key->u.aes_cmac.tx_pn);
815 seq->ccmp.pn[5] = pn64;
816 seq->ccmp.pn[4] = pn64 >> 8;
817 seq->ccmp.pn[3] = pn64 >> 16;
818 seq->ccmp.pn[2] = pn64 >> 24;
819 seq->ccmp.pn[1] = pn64 >> 32;
820 seq->ccmp.pn[0] = pn64 >> 40;
821 break;
822 case WLAN_CIPHER_SUITE_GCMP:
823 case WLAN_CIPHER_SUITE_GCMP_256:
824 pn64 = atomic64_read(&key->u.gcmp.tx_pn);
825 seq->gcmp.pn[5] = pn64;
826 seq->gcmp.pn[4] = pn64 >> 8;
827 seq->gcmp.pn[3] = pn64 >> 16;
828 seq->gcmp.pn[2] = pn64 >> 24;
829 seq->gcmp.pn[1] = pn64 >> 32;
830 seq->gcmp.pn[0] = pn64 >> 40;
831 break;
832 default:
833 WARN_ON(1);
834 }
835 }
836 EXPORT_SYMBOL(ieee80211_get_key_tx_seq);
837
838 void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
839 int tid, struct ieee80211_key_seq *seq)
840 {
841 struct ieee80211_key *key;
842 const u8 *pn;
843
844 key = container_of(keyconf, struct ieee80211_key, conf);
845
846 switch (key->conf.cipher) {
847 case WLAN_CIPHER_SUITE_TKIP:
848 if (WARN_ON(tid < 0 || tid >= IEEE80211_NUM_TIDS))
849 return;
850 seq->tkip.iv32 = key->u.tkip.rx[tid].iv32;
851 seq->tkip.iv16 = key->u.tkip.rx[tid].iv16;
852 break;
853 case WLAN_CIPHER_SUITE_CCMP:
854 case WLAN_CIPHER_SUITE_CCMP_256:
855 if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
856 return;
857 if (tid < 0)
858 pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
859 else
860 pn = key->u.ccmp.rx_pn[tid];
861 memcpy(seq->ccmp.pn, pn, IEEE80211_CCMP_PN_LEN);
862 break;
863 case WLAN_CIPHER_SUITE_AES_CMAC:
864 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
865 if (WARN_ON(tid != 0))
866 return;
867 pn = key->u.aes_cmac.rx_pn;
868 memcpy(seq->aes_cmac.pn, pn, IEEE80211_CMAC_PN_LEN);
869 break;
870 case WLAN_CIPHER_SUITE_GCMP:
871 case WLAN_CIPHER_SUITE_GCMP_256:
872 if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
873 return;
874 if (tid < 0)
875 pn = key->u.gcmp.rx_pn[IEEE80211_NUM_TIDS];
876 else
877 pn = key->u.gcmp.rx_pn[tid];
878 memcpy(seq->gcmp.pn, pn, IEEE80211_GCMP_PN_LEN);
879 break;
880 }
881 }
882 EXPORT_SYMBOL(ieee80211_get_key_rx_seq);
883
884 void ieee80211_set_key_tx_seq(struct ieee80211_key_conf *keyconf,
885 struct ieee80211_key_seq *seq)
886 {
887 struct ieee80211_key *key;
888 u64 pn64;
889
890 key = container_of(keyconf, struct ieee80211_key, conf);
891
892 switch (key->conf.cipher) {
893 case WLAN_CIPHER_SUITE_TKIP:
894 key->u.tkip.tx.iv32 = seq->tkip.iv32;
895 key->u.tkip.tx.iv16 = seq->tkip.iv16;
896 break;
897 case WLAN_CIPHER_SUITE_CCMP:
898 case WLAN_CIPHER_SUITE_CCMP_256:
899 pn64 = (u64)seq->ccmp.pn[5] |
900 ((u64)seq->ccmp.pn[4] << 8) |
901 ((u64)seq->ccmp.pn[3] << 16) |
902 ((u64)seq->ccmp.pn[2] << 24) |
903 ((u64)seq->ccmp.pn[1] << 32) |
904 ((u64)seq->ccmp.pn[0] << 40);
905 atomic64_set(&key->u.ccmp.tx_pn, pn64);
906 break;
907 case WLAN_CIPHER_SUITE_AES_CMAC:
908 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
909 pn64 = (u64)seq->aes_cmac.pn[5] |
910 ((u64)seq->aes_cmac.pn[4] << 8) |
911 ((u64)seq->aes_cmac.pn[3] << 16) |
912 ((u64)seq->aes_cmac.pn[2] << 24) |
913 ((u64)seq->aes_cmac.pn[1] << 32) |
914 ((u64)seq->aes_cmac.pn[0] << 40);
915 atomic64_set(&key->u.aes_cmac.tx_pn, pn64);
916 break;
917 case WLAN_CIPHER_SUITE_GCMP:
918 case WLAN_CIPHER_SUITE_GCMP_256:
919 pn64 = (u64)seq->gcmp.pn[5] |
920 ((u64)seq->gcmp.pn[4] << 8) |
921 ((u64)seq->gcmp.pn[3] << 16) |
922 ((u64)seq->gcmp.pn[2] << 24) |
923 ((u64)seq->gcmp.pn[1] << 32) |
924 ((u64)seq->gcmp.pn[0] << 40);
925 atomic64_set(&key->u.gcmp.tx_pn, pn64);
926 break;
927 default:
928 WARN_ON(1);
929 break;
930 }
931 }
932 EXPORT_SYMBOL_GPL(ieee80211_set_key_tx_seq);
933
934 void ieee80211_set_key_rx_seq(struct ieee80211_key_conf *keyconf,
935 int tid, struct ieee80211_key_seq *seq)
936 {
937 struct ieee80211_key *key;
938 u8 *pn;
939
940 key = container_of(keyconf, struct ieee80211_key, conf);
941
942 switch (key->conf.cipher) {
943 case WLAN_CIPHER_SUITE_TKIP:
944 if (WARN_ON(tid < 0 || tid >= IEEE80211_NUM_TIDS))
945 return;
946 key->u.tkip.rx[tid].iv32 = seq->tkip.iv32;
947 key->u.tkip.rx[tid].iv16 = seq->tkip.iv16;
948 break;
949 case WLAN_CIPHER_SUITE_CCMP:
950 case WLAN_CIPHER_SUITE_CCMP_256:
951 if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
952 return;
953 if (tid < 0)
954 pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
955 else
956 pn = key->u.ccmp.rx_pn[tid];
957 memcpy(pn, seq->ccmp.pn, IEEE80211_CCMP_PN_LEN);
958 break;
959 case WLAN_CIPHER_SUITE_AES_CMAC:
960 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
961 if (WARN_ON(tid != 0))
962 return;
963 pn = key->u.aes_cmac.rx_pn;
964 memcpy(pn, seq->aes_cmac.pn, IEEE80211_CMAC_PN_LEN);
965 break;
966 case WLAN_CIPHER_SUITE_GCMP:
967 case WLAN_CIPHER_SUITE_GCMP_256:
968 if (WARN_ON(tid < -1 || tid >= IEEE80211_NUM_TIDS))
969 return;
970 if (tid < 0)
971 pn = key->u.gcmp.rx_pn[IEEE80211_NUM_TIDS];
972 else
973 pn = key->u.gcmp.rx_pn[tid];
974 memcpy(pn, seq->gcmp.pn, IEEE80211_GCMP_PN_LEN);
975 break;
976 default:
977 WARN_ON(1);
978 break;
979 }
980 }
981 EXPORT_SYMBOL_GPL(ieee80211_set_key_rx_seq);
982
983 void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
984 {
985 struct ieee80211_key *key;
986
987 key = container_of(keyconf, struct ieee80211_key, conf);
988
989 assert_key_lock(key->local);
990
991 /*
992 * if key was uploaded, we assume the driver will/has remove(d)
993 * it, so adjust bookkeeping accordingly
994 */
995 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
996 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
997
998 if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
999 (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
1000 increment_tailroom_need_count(key->sdata);
1001 }
1002
1003 ieee80211_key_free(key, false);
1004 }
1005 EXPORT_SYMBOL_GPL(ieee80211_remove_key);
1006
1007 struct ieee80211_key_conf *
1008 ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
1009 struct ieee80211_key_conf *keyconf)
1010 {
1011 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1012 struct ieee80211_local *local = sdata->local;
1013 struct ieee80211_key *key;
1014 int err;
1015
1016 if (WARN_ON(!local->wowlan))
1017 return ERR_PTR(-EINVAL);
1018
1019 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
1020 return ERR_PTR(-EINVAL);
1021
1022 key = ieee80211_key_alloc(keyconf->cipher, keyconf->keyidx,
1023 keyconf->keylen, keyconf->key,
1024 0, NULL, NULL);
1025 if (IS_ERR(key))
1026 return ERR_CAST(key);
1027
1028 if (sdata->u.mgd.mfp != IEEE80211_MFP_DISABLED)
1029 key->conf.flags |= IEEE80211_KEY_FLAG_RX_MGMT;
1030
1031 err = ieee80211_key_link(key, sdata, NULL);
1032 if (err)
1033 return ERR_PTR(err);
1034
1035 return &key->conf;
1036 }
1037 EXPORT_SYMBOL_GPL(ieee80211_gtk_rekey_add);
Linux kernel - Deliverables
This page took 0.055314 seconds and 5 git commands to generate.