Commit 093a48d2 authored by Nathan Errera's avatar Nathan Errera Committed by Johannes Berg
Browse files

cfg80211: support bigger kek/kck key length 



With some newer AKMs, the KCK and KEK are bigger, so allow that
if the driver advertises support for it. In addition, add a new
attribute for the AKM so we can use it for offloaded rekeying.

Signed-off-by: default avatarNathan Errera <nathan.errera@intel.com>
[reword commit message]
Link: https://lore.kernel.org/r/20200528212237.5eb58b00a5d1.I61b09d77c4f382e8d58a05dcca78096e99a6bc15@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 07c12d61

include/net/cfg80211.h

+9 −3
Original line number Diff line number Diff line
@@ -2936,12 +2936,17 @@ struct cfg80211_wowlan_wakeup { 


/**

 * struct cfg80211_gtk_rekey_data - rekey data

 * @kek: key encryption key (NL80211_KEK_LEN bytes)

 * @kck: key confirmation key (NL80211_KCK_LEN bytes)

 * @kek: key encryption key (@kek_len bytes)

 * @kck: key confirmation key (@kck_len bytes)

 * @replay_ctr: replay counter (NL80211_REPLAY_CTR_LEN bytes)

 * @kek_len: length of kek

 * @kck_len length of kck

 * @akm: akm (oui, id)

 */

struct cfg80211_gtk_rekey_data {

	const u8 *kek, *kck, *replay_ctr;

	u32 akm;

	u8 kek_len, kck_len;

};



/**
@@ -4166,9 +4171,10 @@ struct cfg80211_ops { 
 *	beaconing mode (AP, IBSS, Mesh, ...).

 * @WIPHY_FLAG_HAS_STATIC_WEP: The device supports static WEP key installation

 *	before connection.

 * @WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK: The device supports bigger kek and kck keys

 */

enum wiphy_flags {

	/* use hole at 0 */

	WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK		= BIT(0),

	/* use hole at 1 */

	/* use hole at 2 */

	WIPHY_FLAG_NETNS_OK			= BIT(3),

include/uapi/linux/nl80211.h

+4 −0
Original line number Diff line number Diff line
@@ -5396,6 +5396,8 @@ enum plink_actions { 


#define NL80211_KCK_LEN			16

#define NL80211_KEK_LEN			16

#define NL80211_KCK_EXT_LEN		24

#define NL80211_KEK_EXT_LEN		32

#define NL80211_REPLAY_CTR_LEN		8



/**
@@ -5404,6 +5406,7 @@ enum plink_actions { 
 * @NL80211_REKEY_DATA_KEK: key encryption key (binary)

 * @NL80211_REKEY_DATA_KCK: key confirmation key (binary)

 * @NL80211_REKEY_DATA_REPLAY_CTR: replay counter (binary)

 * @NL80211_REKEY_DATA_AKM: AKM data (OUI, suite type)

 * @NUM_NL80211_REKEY_DATA: number of rekey attributes (internal)

 * @MAX_NL80211_REKEY_DATA: highest rekey attribute (internal)

 */
@@ -5412,6 +5415,7 @@ enum nl80211_rekey_data { 
	NL80211_REKEY_DATA_KEK,

	NL80211_REKEY_DATA_KCK,

	NL80211_REKEY_DATA_REPLAY_CTR,

	NL80211_REKEY_DATA_AKM,



	/* keep last */

	NUM_NL80211_REKEY_DATA,

net/wireless/nl80211.c

+19 −4
Original line number Diff line number Diff line
@@ -730,9 +730,16 @@ nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 
/* policy for GTK rekey offload attributes */

static const struct nla_policy

nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {

	[NL80211_REKEY_DATA_KEK] = NLA_POLICY_EXACT_LEN_WARN(NL80211_KEK_LEN),

	[NL80211_REKEY_DATA_KCK] = NLA_POLICY_EXACT_LEN_WARN(NL80211_KCK_LEN),

	[NL80211_REKEY_DATA_KEK] = {

		.type = NLA_BINARY,

		.len = NL80211_KEK_EXT_LEN

	},

	[NL80211_REKEY_DATA_KCK] = {

		.type = NLA_BINARY,

		.len = NL80211_KCK_EXT_LEN

	},

	[NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN_WARN(NL80211_REPLAY_CTR_LEN),

	[NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },

};



static const struct nla_policy
@@ -12347,14 +12354,22 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 
		return -EINVAL;

	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)

		return -ERANGE;

	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)

	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&

	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&

	      nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))

		return -ERANGE;

	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)

	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&

	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&

	      nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))

		return -ERANGE;



	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);

	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);

	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);

	rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);

	rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);

	if (tb[NL80211_REKEY_DATA_AKM])

		rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);



	wdev_lock(wdev);

	if (!wdev->current_bss) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE