key.c 12.5 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17 18 19 20 21
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"

J
Johannes Berg 已提交
22

J
Johannes Berg 已提交
23 24
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
25 26 27 28 29 30 31 32 33 34 35
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
36 37
 * All key operations are protected internally so you can call them at
 * any time.
38
 *
39 40 41 42 43 44 45 46
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
J
Johannes Berg 已提交
47 48 49 50 51
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
77 78 79 80 81 82
	/*
	 * Remove again if already on the list so that we move it to the end.
	 */
	if (!list_empty(&key->todo))
		list_del(&key->todo);
	list_add_tail(&key->todo, &todo_list);
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

J
Johannes Berg 已提交
111 112 113 114 115 116 117 118 119 120
static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
121 122
	    (key->sdata->vif.type == NL80211_IFTYPE_AP ||
	     key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
J
Johannes Berg 已提交
123 124 125
		addr = zero_addr;

	if (key->sta)
126
		addr = key->sta->sta.addr;
J
Johannes Berg 已提交
127 128 129 130 131 132 133 134

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
135
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
136

137 138 139
	assert_key_lock();
	might_sleep();

J
Johannes Berg 已提交
140 141 142 143 144 145 146 147 148
	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

149 150
	if (!ret) {
		spin_lock(&todo_lock);
J
Johannes Berg 已提交
151
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
152 153
		spin_unlock(&todo_lock);
	}
J
Johannes Berg 已提交
154 155 156

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
157
		       "(%d, %s) to hardware (%d)\n",
J
Johannes Berg 已提交
158
		       wiphy_name(key->local->hw.wiphy),
159
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
160 161 162 163 164 165
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
166
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
167

168 169 170
	assert_key_lock();
	might_sleep();

171
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
172 173
		return;

174 175 176
	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
J
Johannes Berg 已提交
177
		return;
178 179
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
180 181 182 183 184 185 186 187 188

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
189
		       "(%d, %s) from hardware (%d)\n",
J
Johannes Berg 已提交
190
		       wiphy_name(key->local->hw.wiphy),
191
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
192

193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215
	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

J
Johannes Berg 已提交
216
	spin_lock_irqsave(&sdata->local->key_lock, flags);
217
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
218
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
259 260
}

261
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
262 263 264
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
265 266 267
{
	struct ieee80211_key *key;

268
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
J
Johannes Berg 已提交
269 270

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
271 272
	if (!key)
		return NULL;
J
Johannes Berg 已提交
273 274 275 276 277 278 279 280 281 282 283 284

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
	memcpy(key->conf.key, key_data, key_len);
285
	INIT_LIST_HEAD(&key->list);
286
	INIT_LIST_HEAD(&key->todo);
J
Johannes Berg 已提交
287 288 289 290 291 292 293 294

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
295
			kfree(key);
J
Johannes Berg 已提交
296 297 298 299
			return NULL;
		}
	}

300 301
	return key;
}
J
Johannes Berg 已提交
302

303 304 305 306 307
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
308
	unsigned long flags;
309 310 311 312 313 314 315 316 317 318
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
319 320 321 322 323
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
324
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
325
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
326 327 328 329 330 331 332

		/*
		 * This key is for a specific sta interface,
		 * inform the driver that it should try to store
		 * this key as pairwise key.
		 */
		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
J
Johannes Berg 已提交
333
	} else {
334
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
335 336
			struct sta_info *ap;

337 338 339 340
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
341

J
Johannes Berg 已提交
342 343 344
			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
345
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
346 347 348 349 350 351
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
352
	spin_lock_irqsave(&sdata->local->key_lock, flags);
353

354
	if (sta)
355
		old_key = sta->key;
356
	else
357 358 359
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
360

J
Johannes Berg 已提交
361
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
362 363 364

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);
365

366
	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
367
	if (netif_running(sdata->dev))
J
Johannes Berg 已提交
368
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
369 370
}

J
Johannes Berg 已提交
371
static void __ieee80211_key_free(struct ieee80211_key *key)
372
{
373 374 375
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
376
	if (key->sdata)
377 378
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
379

380 381
	add_todo(key, KEY_FLAG_TODO_DELETE);
}
382

J
Johannes Berg 已提交
383
void ieee80211_key_free(struct ieee80211_key *key)
384
{
J
Johannes Berg 已提交
385
	unsigned long flags;
J
Johannes Berg 已提交
386

J
Johannes Berg 已提交
387
	if (!key)
388 389
		return;

390 391 392 393 394 395 396 397 398
	if (!key->sdata) {
		/* The key has not been linked yet, simply free it
		 * and don't Oops */
		if (key->conf.alg == ALG_CCMP)
			ieee80211_aes_key_free(key->u.ccmp.tfm);
		kfree(key);
		return;
	}

J
Johannes Berg 已提交
399
	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
400
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
401
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
402 403 404 405 406 407 408 409 410 411 412 413 414 415
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;
416

J
Johannes Berg 已提交
417 418
	might_sleep();

J
Johannes Berg 已提交
419
	spin_lock_irqsave(&sdata->local->key_lock, flags);
420
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
421
		add_todo(key, todo_flags);
J
Johannes Berg 已提交
422
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
423

J
Johannes Berg 已提交
424
	ieee80211_key_todo();
425
}
J
Johannes Berg 已提交
426

J
Johannes Berg 已提交
427
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
428
{
J
Johannes Berg 已提交
429
	ASSERT_RTNL();
J
Johannes Berg 已提交
430

J
Johannes Berg 已提交
431 432
	if (WARN_ON(!netif_running(sdata->dev)))
		return;
J
Johannes Berg 已提交
433

J
Johannes Berg 已提交
434 435
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}
J
Johannes Berg 已提交
436

J
Johannes Berg 已提交
437 438 439
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();
J
Johannes Berg 已提交
440

J
Johannes Berg 已提交
441
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
J
Johannes Berg 已提交
442 443
}

J
Johannes Berg 已提交
444
static void __ieee80211_key_destroy(struct ieee80211_key *key)
J
Johannes Berg 已提交
445
{
446 447
	if (!key)
		return;
448

449
	ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
450

451 452 453 454 455
	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
J
Johannes Berg 已提交
456 457
}

458
static void __ieee80211_key_todo(void)
J
Johannes Berg 已提交
459 460
{
	struct ieee80211_key *key;
461 462
	bool work_done;
	u32 todoflags;
J
Johannes Berg 已提交
463

464 465 466 467 468 469 470 471 472 473 474
	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
J
Johannes Berg 已提交
475 476
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
477 478 479 480 481 482 483 484 485 486 487 488 489 490 491
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
J
Johannes Berg 已提交
492
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
493 494 495
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
J
Johannes Berg 已提交
496 497 498 499
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
500
		if (todoflags & KEY_FLAG_TODO_DELETE) {
J
Johannes Berg 已提交
501
			__ieee80211_key_destroy(key);
502 503
			work_done = true;
		}
504

505
		WARN_ON(!work_done);
J
Johannes Berg 已提交
506

507 508 509
		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
510 511
}

512
void ieee80211_key_todo(void)
J
Johannes Berg 已提交
513
{
514 515 516 517
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}
J
Johannes Berg 已提交
518

519 520 521
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
J
Johannes Berg 已提交
522
	unsigned long flags;
523

524 525 526 527
	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

J
Johannes Berg 已提交
528
	spin_lock_irqsave(&sdata->local->key_lock, flags);
529
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
530
		__ieee80211_key_free(key);
J
Johannes Berg 已提交
531
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
532 533 534 535

	__ieee80211_key_todo();

	ieee80211_key_unlock();
J
Johannes Berg 已提交
536
}