key.c 11.0 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17
#include <linux/slab.h>
18 19
#include <net/mac80211.h>
#include "ieee80211_i.h"
20
#include "driver-ops.h"
21 22
#include "debugfs_key.h"
#include "aes_ccm.h"
23
#include "aes_cmac.h"
24

J
Johannes Berg 已提交
25

J
Johannes Berg 已提交
26 27
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
28 29 30 31 32 33 34 35 36 37 38
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
J
Johannes Berg 已提交
39
 * All key operations are protected internally.
40
 *
41 42 43
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
J
Johannes Berg 已提交
44 45
 * functions. This means that sta_info_destroy() must remove the key
 * which waits for an RCU grace period.
J
Johannes Berg 已提交
46 47 48 49
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };

J
Johannes Berg 已提交
50
static void assert_key_lock(struct ieee80211_local *local)
51
{
J
Johannes Berg 已提交
52
	WARN_ON(!mutex_is_locked(&local->key_mtx));
53 54
}

55
static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
J
Johannes Berg 已提交
56 57
{
	if (key->sta)
58
		return &key->sta->sta;
J
Johannes Berg 已提交
59

60
	return NULL;
J
Johannes Berg 已提交
61 62 63 64
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
65 66
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
67 68
	int ret;

69 70
	might_sleep();

J
Johannes Berg 已提交
71 72 73
	if (!key->local->ops->set_key)
		return;

J
Johannes Berg 已提交
74 75
	assert_key_lock(key->local);

76 77 78 79 80 81 82
	sta = get_sta_for_key(key);

	sdata = key->sdata;
	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
J
Johannes Berg 已提交
83

J
Johannes Berg 已提交
84
	ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
J
Johannes Berg 已提交
85

J
Johannes Berg 已提交
86
	if (!ret)
J
Johannes Berg 已提交
87 88 89 90
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
91
		       "(%d, %pM) to hardware (%d)\n",
J
Johannes Berg 已提交
92
		       wiphy_name(key->local->hw.wiphy),
93
		       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
J
Johannes Berg 已提交
94 95 96 97
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
98 99
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
100 101
	int ret;

102 103
	might_sleep();

104
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
105 106
		return;

J
Johannes Berg 已提交
107 108 109
	assert_key_lock(key->local);

	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
J
Johannes Berg 已提交
110 111
		return;

112 113 114 115 116 117 118
	sta = get_sta_for_key(key);
	sdata = key->sdata;

	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
J
Johannes Berg 已提交
119

J
Johannes Berg 已提交
120
	ret = drv_set_key(key->local, DISABLE_KEY, sdata,
121
			  sta, &key->conf);
J
Johannes Berg 已提交
122 123 124

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
125
		       "(%d, %pM) from hardware (%d)\n",
J
Johannes Berg 已提交
126
		       wiphy_name(key->local->hw.wiphy),
127
		       key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
J
Johannes Berg 已提交
128

129 130 131 132 133 134 135 136
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
137 138
	assert_key_lock(sdata->local);

139 140 141 142 143
	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

J
Johannes Berg 已提交
144 145 146 147
	if (key) {
		ieee80211_debugfs_key_remove_default(key->sdata);
		ieee80211_debugfs_key_add_default(key->sdata);
	}
148 149 150 151
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
J
Johannes Berg 已提交
152
	mutex_lock(&sdata->local->key_mtx);
153
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
154
	mutex_unlock(&sdata->local->key_mtx);
155 156
}

157 158 159 160 161
static void
__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
162 163
	assert_key_lock(sdata->local);

164 165 166 167 168 169
	if (idx >= NUM_DEFAULT_KEYS &&
	    idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_mgmt_key, key);

J
Johannes Berg 已提交
170 171 172 173
	if (key) {
		ieee80211_debugfs_key_remove_mgmt_default(key->sdata);
		ieee80211_debugfs_key_add_mgmt_default(key->sdata);
	}
174 175 176 177 178
}

void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
				    int idx)
{
J
Johannes Berg 已提交
179
	mutex_lock(&sdata->local->key_mtx);
180
	__ieee80211_set_default_mgmt_key(sdata, idx);
J
Johannes Berg 已提交
181
	mutex_unlock(&sdata->local->key_mtx);
182 183
}

184 185 186 187 188 189

static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
190
	int idx, defkey, defmgmtkey;
191 192 193 194 195 196 197 198 199 200 201 202 203 204 205

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;
206
		defmgmtkey = old && sdata->default_mgmt_key == old;
207 208 209

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);
210 211
		if (defmgmtkey && !new)
			__ieee80211_set_default_mgmt_key(sdata, -1);
212 213 214 215

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
216 217 218
		if (defmgmtkey && new)
			__ieee80211_set_default_mgmt_key(sdata,
							 new->conf.keyidx);
219 220 221 222 223 224 225 226 227
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
228 229
}

230
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
231 232
					  int idx,
					  size_t key_len,
233 234
					  const u8 *key_data,
					  size_t seq_len, const u8 *seq)
235 236
{
	struct ieee80211_key *key;
237
	int i, j;
238

239
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
J
Johannes Berg 已提交
240 241

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
242 243
	if (!key)
		return NULL;
J
Johannes Berg 已提交
244 245 246 247 248 249 250 251 252 253 254

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
255 256 257 258 259 260 261 262
	switch (alg) {
	case ALG_WEP:
		key->conf.iv_len = WEP_IV_LEN;
		key->conf.icv_len = WEP_ICV_LEN;
		break;
	case ALG_TKIP:
		key->conf.iv_len = TKIP_IV_LEN;
		key->conf.icv_len = TKIP_ICV_LEN;
263
		if (seq) {
264 265 266 267 268 269 270
			for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
				key->u.tkip.rx[i].iv32 =
					get_unaligned_le32(&seq[2]);
				key->u.tkip.rx[i].iv16 =
					get_unaligned_le16(seq);
			}
		}
271 272 273 274
		break;
	case ALG_CCMP:
		key->conf.iv_len = CCMP_HDR_LEN;
		key->conf.icv_len = CCMP_MIC_LEN;
275
		if (seq) {
276 277 278 279 280
			for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
				for (j = 0; j < CCMP_PN_LEN; j++)
					key->u.ccmp.rx_pn[i][j] =
						seq[CCMP_PN_LEN - j - 1];
		}
281
		break;
282 283 284
	case ALG_AES_CMAC:
		key->conf.iv_len = 0;
		key->conf.icv_len = sizeof(struct ieee80211_mmie);
285
		if (seq)
286 287
			for (j = 0; j < 6; j++)
				key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
288
		break;
289
	}
J
Johannes Berg 已提交
290
	memcpy(key->conf.key, key_data, key_len);
291
	INIT_LIST_HEAD(&key->list);
J
Johannes Berg 已提交
292 293 294 295 296 297 298 299

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
300
			kfree(key);
J
Johannes Berg 已提交
301 302 303 304
			return NULL;
		}
	}

305 306 307 308 309 310 311 312 313 314 315 316 317
	if (alg == ALG_AES_CMAC) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.aes_cmac.tfm =
			ieee80211_aes_cmac_key_setup(key_data);
		if (!key->u.aes_cmac.tfm) {
			kfree(key);
			return NULL;
		}
	}

318 319
	return key;
}
J
Johannes Berg 已提交
320

J
Johannes Berg 已提交
321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336
static void __ieee80211_key_destroy(struct ieee80211_key *key)
{
	if (!key)
		return;

	ieee80211_key_disable_hw_accel(key);

	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	if (key->conf.alg == ALG_AES_CMAC)
		ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
}

337 338 339 340 341 342 343 344 345 346 347 348 349 350 351
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
352 353 354 355 356
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
357
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
358
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
359 360 361 362 363 364 365

		/*
		 * This key is for a specific sta interface,
		 * inform the driver that it should try to store
		 * this key as pairwise key.
		 */
		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
J
Johannes Berg 已提交
366
	} else {
367
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
368 369
			struct sta_info *ap;

370 371 372 373
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
374

J
Johannes Berg 已提交
375
			/* same here, the AP could be using QoS */
376
			ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
J
Johannes Berg 已提交
377
			if (ap) {
378
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
379 380 381 382 383 384
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
385
	mutex_lock(&sdata->local->key_mtx);
386

387
	if (sta)
388
		old_key = sta->key;
389
	else
390 391 392
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
J
Johannes Berg 已提交
393
	__ieee80211_key_destroy(old_key);
394

J
Johannes Berg 已提交
395
	ieee80211_debugfs_key_add(key);
396

J
Johannes Berg 已提交
397
	ieee80211_key_enable_hw_accel(key);
J
Johannes Berg 已提交
398

J
Johannes Berg 已提交
399
	mutex_unlock(&sdata->local->key_mtx);
400 401
}

J
Johannes Berg 已提交
402
static void __ieee80211_key_free(struct ieee80211_key *key)
403
{
404 405 406
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
407
	if (key->sdata)
408 409
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
410
	__ieee80211_key_destroy(key);
411
}
412

J
Johannes Berg 已提交
413
void ieee80211_key_free(struct ieee80211_key *key)
414
{
J
Johannes Berg 已提交
415
	struct ieee80211_local *local;
J
Johannes Berg 已提交
416

J
Johannes Berg 已提交
417
	if (!key)
418 419
		return;

J
Johannes Berg 已提交
420
	local = key->sdata->local;
421

J
Johannes Berg 已提交
422
	mutex_lock(&local->key_mtx);
J
Johannes Berg 已提交
423
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
424
	mutex_unlock(&local->key_mtx);
J
Johannes Berg 已提交
425 426
}

J
Johannes Berg 已提交
427
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
428 429
{
	struct ieee80211_key *key;
J
Johannes Berg 已提交
430

J
Johannes Berg 已提交
431
	ASSERT_RTNL();
J
Johannes Berg 已提交
432

433
	if (WARN_ON(!ieee80211_sdata_running(sdata)))
J
Johannes Berg 已提交
434
		return;
J
Johannes Berg 已提交
435

J
Johannes Berg 已提交
436
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
437

J
Johannes Berg 已提交
438 439
	list_for_each_entry(key, &sdata->key_list, list)
		ieee80211_key_enable_hw_accel(key);
440

J
Johannes Berg 已提交
441
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
442 443
}

J
Johannes Berg 已提交
444
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
445 446 447
{
	struct ieee80211_key *key;

J
Johannes Berg 已提交
448
	ASSERT_RTNL();
449

J
Johannes Berg 已提交
450
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
451

J
Johannes Berg 已提交
452 453
	list_for_each_entry(key, &sdata->key_list, list)
		ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
454

J
Johannes Berg 已提交
455
	mutex_unlock(&sdata->local->key_mtx);
456
}
J
Johannes Berg 已提交
457

458 459 460
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
461

J
Johannes Berg 已提交
462
	mutex_lock(&sdata->local->key_mtx);
463 464

	ieee80211_debugfs_key_remove_default(sdata);
465
	ieee80211_debugfs_key_remove_mgmt_default(sdata);
466 467

	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
468
		__ieee80211_key_free(key);
469

J
Johannes Berg 已提交
470
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
471
}