key.c 12.3 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17 18 19 20 21
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"

J
Johannes Berg 已提交
22

J
Johannes Berg 已提交
23 24
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
25 26 27 28 29 30 31 32 33 34 35
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
36 37
 * All key operations are protected internally so you can call them at
 * any time.
38
 *
39 40 41 42 43 44 45 46
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
J
Johannes Berg 已提交
47 48 49 50 51
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
77 78 79 80 81 82
	/*
	 * Remove again if already on the list so that we move it to the end.
	 */
	if (!list_empty(&key->todo))
		list_del(&key->todo);
	list_add_tail(&key->todo, &todo_list);
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

J
Johannes Berg 已提交
111 112 113 114 115 116 117 118 119 120
static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
121 122
	    (key->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
	     key->sdata->vif.type == IEEE80211_IF_TYPE_VLAN))
J
Johannes Berg 已提交
123 124 125 126 127 128 129 130 131 132 133 134
		addr = zero_addr;

	if (key->sta)
		addr = key->sta->addr;

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
135
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
136

137 138 139
	assert_key_lock();
	might_sleep();

J
Johannes Berg 已提交
140 141 142 143 144 145 146 147 148
	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

149 150
	if (!ret) {
		spin_lock(&todo_lock);
J
Johannes Berg 已提交
151
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
152 153
		spin_unlock(&todo_lock);
	}
J
Johannes Berg 已提交
154 155 156

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
157
		       "(%d, %s) to hardware (%d)\n",
J
Johannes Berg 已提交
158
		       wiphy_name(key->local->hw.wiphy),
159
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
160 161 162 163 164 165
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
166
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
167

168 169 170
	assert_key_lock();
	might_sleep();

171
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
172 173
		return;

174 175 176
	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
J
Johannes Berg 已提交
177
		return;
178 179
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
180 181 182 183 184 185 186 187 188

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
189
		       "(%d, %s) from hardware (%d)\n",
J
Johannes Berg 已提交
190
		       wiphy_name(key->local->hw.wiphy),
191
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
192

193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215
	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

J
Johannes Berg 已提交
216
	spin_lock_irqsave(&sdata->local->key_lock, flags);
217
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
218
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
259 260
}

261
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
262 263 264
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
265 266 267
{
	struct ieee80211_key *key;

268
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
J
Johannes Berg 已提交
269 270

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
271 272
	if (!key)
		return NULL;
J
Johannes Berg 已提交
273 274 275 276 277 278 279 280 281 282 283 284

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
	memcpy(key->conf.key, key_data, key_len);
285
	INIT_LIST_HEAD(&key->list);
286
	INIT_LIST_HEAD(&key->todo);
J
Johannes Berg 已提交
287 288 289 290 291 292 293 294

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
295
			kfree(key);
J
Johannes Berg 已提交
296 297 298 299
			return NULL;
		}
	}

300 301
	return key;
}
J
Johannes Berg 已提交
302

303 304 305 306 307
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
308
	unsigned long flags;
309 310 311 312 313 314 315 316 317 318
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
319 320 321 322 323 324 325
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
		if (sta->flags & WLAN_STA_WME)
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
326 327 328 329 330 331 332

		/*
		 * This key is for a specific sta interface,
		 * inform the driver that it should try to store
		 * this key as pairwise key.
		 */
		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
J
Johannes Berg 已提交
333
	} else {
334
		if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
J
Johannes Berg 已提交
335 336
			struct sta_info *ap;

337 338 339 340
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
341

J
Johannes Berg 已提交
342 343 344 345 346 347 348 349 350 351
			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
				if (ap->flags & WLAN_STA_WME)
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
352
	spin_lock_irqsave(&sdata->local->key_lock, flags);
353

354
	if (sta)
355
		old_key = sta->key;
356
	else
357 358 359
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
360

J
Johannes Berg 已提交
361
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
362 363 364

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);
365

366
	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
367
	if (netif_running(sdata->dev))
J
Johannes Berg 已提交
368
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
369 370
}

J
Johannes Berg 已提交
371
static void __ieee80211_key_free(struct ieee80211_key *key)
372
{
373 374 375
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
376
	if (key->sdata)
377 378
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
379

380 381
	add_todo(key, KEY_FLAG_TODO_DELETE);
}
382

J
Johannes Berg 已提交
383
void ieee80211_key_free(struct ieee80211_key *key)
384
{
J
Johannes Berg 已提交
385
	unsigned long flags;
J
Johannes Berg 已提交
386

J
Johannes Berg 已提交
387
	if (!key)
388 389
		return;

J
Johannes Berg 已提交
390
	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
391
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
392
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
393 394 395 396 397 398 399 400 401 402 403 404 405 406
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;
407

J
Johannes Berg 已提交
408 409
	might_sleep();

J
Johannes Berg 已提交
410
	spin_lock_irqsave(&sdata->local->key_lock, flags);
411
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
412
		add_todo(key, todo_flags);
J
Johannes Berg 已提交
413
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
414

J
Johannes Berg 已提交
415
	ieee80211_key_todo();
416
}
J
Johannes Berg 已提交
417

J
Johannes Berg 已提交
418
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
419
{
J
Johannes Berg 已提交
420
	ASSERT_RTNL();
J
Johannes Berg 已提交
421

J
Johannes Berg 已提交
422 423
	if (WARN_ON(!netif_running(sdata->dev)))
		return;
J
Johannes Berg 已提交
424

J
Johannes Berg 已提交
425 426
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}
J
Johannes Berg 已提交
427

J
Johannes Berg 已提交
428 429 430
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();
J
Johannes Berg 已提交
431

J
Johannes Berg 已提交
432
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
J
Johannes Berg 已提交
433 434
}

J
Johannes Berg 已提交
435
static void __ieee80211_key_destroy(struct ieee80211_key *key)
J
Johannes Berg 已提交
436
{
437 438
	if (!key)
		return;
439

440
	ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
441

442 443 444 445 446
	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
J
Johannes Berg 已提交
447 448
}

449
static void __ieee80211_key_todo(void)
J
Johannes Berg 已提交
450 451
{
	struct ieee80211_key *key;
452 453
	bool work_done;
	u32 todoflags;
J
Johannes Berg 已提交
454

455 456 457 458 459 460 461 462 463 464 465
	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
J
Johannes Berg 已提交
466 467
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
468 469 470 471 472 473 474 475 476 477 478 479 480 481 482
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
J
Johannes Berg 已提交
483
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
484 485 486
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
J
Johannes Berg 已提交
487 488 489 490
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
491
		if (todoflags & KEY_FLAG_TODO_DELETE) {
J
Johannes Berg 已提交
492
			__ieee80211_key_destroy(key);
493 494
			work_done = true;
		}
495

496
		WARN_ON(!work_done);
J
Johannes Berg 已提交
497

498 499 500
		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
501 502
}

503
void ieee80211_key_todo(void)
J
Johannes Berg 已提交
504
{
505 506 507 508
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}
J
Johannes Berg 已提交
509

510 511 512
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
J
Johannes Berg 已提交
513
	unsigned long flags;
514

515 516 517 518
	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

J
Johannes Berg 已提交
519
	spin_lock_irqsave(&sdata->local->key_lock, flags);
520
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
521
		__ieee80211_key_free(key);
J
Johannes Berg 已提交
522
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
523 524 525 526

	__ieee80211_key_todo();

	ieee80211_key_unlock();
J
Johannes Berg 已提交
527
}