key.c 12.8 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17 18 19 20 21
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"

J
Johannes Berg 已提交
22

J
Johannes Berg 已提交
23 24
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
25 26 27 28 29 30 31 32 33 34 35
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
36 37
 * All key operations are protected internally so you can call them at
 * any time.
38
 *
39 40 41 42 43 44 45 46
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
J
Johannes Berg 已提交
47 48 49 50 51
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
77 78 79 80 81 82
	/*
	 * Remove again if already on the list so that we move it to the end.
	 */
	if (!list_empty(&key->todo))
		list_del(&key->todo);
	list_add_tail(&key->todo, &todo_list);
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

J
Johannes Berg 已提交
111 112 113 114 115 116 117 118 119 120
static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
121 122
	    (key->sdata->vif.type == NL80211_IFTYPE_AP ||
	     key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
J
Johannes Berg 已提交
123 124 125
		addr = zero_addr;

	if (key->sta)
126
		addr = key->sta->sta.addr;
J
Johannes Berg 已提交
127 128 129 130 131 132 133 134

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
135
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
136

137 138 139
	assert_key_lock();
	might_sleep();

J
Johannes Berg 已提交
140 141 142 143 144 145 146 147 148
	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

149 150
	if (!ret) {
		spin_lock(&todo_lock);
J
Johannes Berg 已提交
151
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
152 153
		spin_unlock(&todo_lock);
	}
J
Johannes Berg 已提交
154 155 156

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
157
		       "(%d, %s) to hardware (%d)\n",
J
Johannes Berg 已提交
158
		       wiphy_name(key->local->hw.wiphy),
159
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
160 161 162 163 164 165
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
166
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
167

168 169 170
	assert_key_lock();
	might_sleep();

171
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
172 173
		return;

174 175 176
	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
J
Johannes Berg 已提交
177
		return;
178 179
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
180 181 182 183 184 185 186 187 188

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
189
		       "(%d, %s) from hardware (%d)\n",
J
Johannes Berg 已提交
190
		       wiphy_name(key->local->hw.wiphy),
191
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
192

193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215
	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

J
Johannes Berg 已提交
216
	spin_lock_irqsave(&sdata->local->key_lock, flags);
217
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
218
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
259 260
}

261
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
262 263 264
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
265 266 267
{
	struct ieee80211_key *key;

268
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
J
Johannes Berg 已提交
269 270

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
271 272
	if (!key)
		return NULL;
J
Johannes Berg 已提交
273 274 275 276 277 278 279 280 281 282 283

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
284 285 286 287 288 289 290 291 292 293 294 295 296 297
	switch (alg) {
	case ALG_WEP:
		key->conf.iv_len = WEP_IV_LEN;
		key->conf.icv_len = WEP_ICV_LEN;
		break;
	case ALG_TKIP:
		key->conf.iv_len = TKIP_IV_LEN;
		key->conf.icv_len = TKIP_ICV_LEN;
		break;
	case ALG_CCMP:
		key->conf.iv_len = CCMP_HDR_LEN;
		key->conf.icv_len = CCMP_MIC_LEN;
		break;
	}
J
Johannes Berg 已提交
298
	memcpy(key->conf.key, key_data, key_len);
299
	INIT_LIST_HEAD(&key->list);
300
	INIT_LIST_HEAD(&key->todo);
J
Johannes Berg 已提交
301 302 303 304 305 306 307 308

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
309
			kfree(key);
J
Johannes Berg 已提交
310 311 312 313
			return NULL;
		}
	}

314 315
	return key;
}
J
Johannes Berg 已提交
316

317 318 319 320 321
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
322
	unsigned long flags;
323 324 325 326 327 328 329 330 331 332
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
333 334 335 336 337
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
338
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
339
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
340 341 342 343 344 345 346

		/*
		 * This key is for a specific sta interface,
		 * inform the driver that it should try to store
		 * this key as pairwise key.
		 */
		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
J
Johannes Berg 已提交
347
	} else {
348
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
349 350
			struct sta_info *ap;

351 352 353 354
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
355

J
Johannes Berg 已提交
356 357 358
			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
359
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
360 361 362 363 364 365
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
366
	spin_lock_irqsave(&sdata->local->key_lock, flags);
367

368
	if (sta)
369
		old_key = sta->key;
370
	else
371 372 373
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
374

J
Johannes Berg 已提交
375
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
376 377 378

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);
379

380
	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
381
	if (netif_running(sdata->dev))
J
Johannes Berg 已提交
382
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
383 384
}

J
Johannes Berg 已提交
385
static void __ieee80211_key_free(struct ieee80211_key *key)
386
{
387 388 389
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
390
	if (key->sdata)
391 392
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
393

394 395
	add_todo(key, KEY_FLAG_TODO_DELETE);
}
396

J
Johannes Berg 已提交
397
void ieee80211_key_free(struct ieee80211_key *key)
398
{
J
Johannes Berg 已提交
399
	unsigned long flags;
J
Johannes Berg 已提交
400

J
Johannes Berg 已提交
401
	if (!key)
402 403
		return;

404 405 406 407 408 409 410 411 412
	if (!key->sdata) {
		/* The key has not been linked yet, simply free it
		 * and don't Oops */
		if (key->conf.alg == ALG_CCMP)
			ieee80211_aes_key_free(key->u.ccmp.tfm);
		kfree(key);
		return;
	}

J
Johannes Berg 已提交
413
	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
414
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
415
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
416 417 418 419 420 421 422 423 424 425 426 427 428 429
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;
430

J
Johannes Berg 已提交
431 432
	might_sleep();

J
Johannes Berg 已提交
433
	spin_lock_irqsave(&sdata->local->key_lock, flags);
434
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
435
		add_todo(key, todo_flags);
J
Johannes Berg 已提交
436
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
437

J
Johannes Berg 已提交
438
	ieee80211_key_todo();
439
}
J
Johannes Berg 已提交
440

J
Johannes Berg 已提交
441
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
442
{
J
Johannes Berg 已提交
443
	ASSERT_RTNL();
J
Johannes Berg 已提交
444

J
Johannes Berg 已提交
445 446
	if (WARN_ON(!netif_running(sdata->dev)))
		return;
J
Johannes Berg 已提交
447

J
Johannes Berg 已提交
448 449
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}
J
Johannes Berg 已提交
450

J
Johannes Berg 已提交
451 452 453
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();
J
Johannes Berg 已提交
454

J
Johannes Berg 已提交
455
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
J
Johannes Berg 已提交
456 457
}

J
Johannes Berg 已提交
458
static void __ieee80211_key_destroy(struct ieee80211_key *key)
J
Johannes Berg 已提交
459
{
460 461
	if (!key)
		return;
462

463
	ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
464

465 466 467 468 469
	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
J
Johannes Berg 已提交
470 471
}

472
static void __ieee80211_key_todo(void)
J
Johannes Berg 已提交
473 474
{
	struct ieee80211_key *key;
475 476
	bool work_done;
	u32 todoflags;
J
Johannes Berg 已提交
477

478 479 480 481 482 483 484 485 486 487 488
	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
J
Johannes Berg 已提交
489 490
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
491 492 493 494 495 496 497 498 499 500 501 502 503 504 505
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
J
Johannes Berg 已提交
506
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
507 508 509
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
J
Johannes Berg 已提交
510 511 512 513
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
514
		if (todoflags & KEY_FLAG_TODO_DELETE) {
J
Johannes Berg 已提交
515
			__ieee80211_key_destroy(key);
516 517
			work_done = true;
		}
518

519
		WARN_ON(!work_done);
J
Johannes Berg 已提交
520

521 522 523
		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
524 525
}

526
void ieee80211_key_todo(void)
J
Johannes Berg 已提交
527
{
528 529 530 531
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}
J
Johannes Berg 已提交
532

533 534 535
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
J
Johannes Berg 已提交
536
	unsigned long flags;
537

538 539 540 541
	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

J
Johannes Berg 已提交
542
	spin_lock_irqsave(&sdata->local->key_lock, flags);
543
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
544
		__ieee80211_key_free(key);
J
Johannes Berg 已提交
545
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
546 547 548 549

	__ieee80211_key_todo();

	ieee80211_key_unlock();
J
Johannes Berg 已提交
550
}