key.c 12.1 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17 18 19 20 21
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"

J
Johannes Berg 已提交
22

J
Johannes Berg 已提交
23 24
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
25 26 27 28 29 30 31 32 33 34 35
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
36 37
 * All key operations are protected internally so you can call them at
 * any time.
38
 *
39 40 41 42 43 44 45 46
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
J
Johannes Berg 已提交
47 48 49 50 51
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
77 78 79 80 81 82
	/*
	 * Remove again if already on the list so that we move it to the end.
	 */
	if (!list_empty(&key->todo))
		list_del(&key->todo);
	list_add_tail(&key->todo, &todo_list);
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

J
Johannes Berg 已提交
111 112 113 114 115 116 117 118 119 120
static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
121 122
	    (key->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
	     key->sdata->vif.type == IEEE80211_IF_TYPE_VLAN))
J
Johannes Berg 已提交
123 124 125 126 127 128 129 130 131 132 133 134
		addr = zero_addr;

	if (key->sta)
		addr = key->sta->addr;

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
135
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
136

137 138 139
	assert_key_lock();
	might_sleep();

J
Johannes Berg 已提交
140 141 142 143 144 145 146 147 148
	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

149 150
	if (!ret) {
		spin_lock(&todo_lock);
J
Johannes Berg 已提交
151
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
152 153
		spin_unlock(&todo_lock);
	}
J
Johannes Berg 已提交
154 155 156

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
157
		       "(%d, %s) to hardware (%d)\n",
J
Johannes Berg 已提交
158
		       wiphy_name(key->local->hw.wiphy),
159
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
160 161 162 163 164 165
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;
166
	DECLARE_MAC_BUF(mac);
J
Johannes Berg 已提交
167

168 169 170
	assert_key_lock();
	might_sleep();

171
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
172 173
		return;

174 175 176
	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
J
Johannes Berg 已提交
177
		return;
178 179
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
180 181 182 183 184 185 186 187 188

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
189
		       "(%d, %s) from hardware (%d)\n",
J
Johannes Berg 已提交
190
		       wiphy_name(key->local->hw.wiphy),
191
		       key->conf.keyidx, print_mac(mac, addr), ret);
J
Johannes Berg 已提交
192

193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215
	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

J
Johannes Berg 已提交
216
	spin_lock_irqsave(&sdata->local->key_lock, flags);
217
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
218
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
259 260
}

261
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
262 263 264
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
265 266 267
{
	struct ieee80211_key *key;

268
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
J
Johannes Berg 已提交
269 270

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
271 272
	if (!key)
		return NULL;
J
Johannes Berg 已提交
273 274 275 276 277 278 279 280 281 282 283 284

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
	memcpy(key->conf.key, key_data, key_len);
285
	INIT_LIST_HEAD(&key->list);
286
	INIT_LIST_HEAD(&key->todo);
J
Johannes Berg 已提交
287 288 289 290 291 292 293 294

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
295
			kfree(key);
J
Johannes Berg 已提交
296 297 298 299
			return NULL;
		}
	}

300 301
	return key;
}
J
Johannes Berg 已提交
302

303 304 305 306 307
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
308
	unsigned long flags;
309 310 311 312 313 314 315 316 317 318
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
319 320 321 322 323 324 325 326
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
		if (sta->flags & WLAN_STA_WME)
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
	} else {
327
		if (sdata->vif.type == IEEE80211_IF_TYPE_STA) {
J
Johannes Berg 已提交
328 329
			struct sta_info *ap;

330 331 332 333
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
334

J
Johannes Berg 已提交
335 336 337 338 339 340 341 342 343 344
			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
				if (ap->flags & WLAN_STA_WME)
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
345
	spin_lock_irqsave(&sdata->local->key_lock, flags);
346

347
	if (sta)
348
		old_key = sta->key;
349
	else
350 351 352
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
353

J
Johannes Berg 已提交
354
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
355 356 357

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);
358

359
	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
360
	if (netif_running(sdata->dev))
J
Johannes Berg 已提交
361
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
362 363
}

J
Johannes Berg 已提交
364
static void __ieee80211_key_free(struct ieee80211_key *key)
365
{
366 367 368
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
369
	if (key->sdata)
370 371
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
372

373 374
	add_todo(key, KEY_FLAG_TODO_DELETE);
}
375

J
Johannes Berg 已提交
376
void ieee80211_key_free(struct ieee80211_key *key)
377
{
J
Johannes Berg 已提交
378
	unsigned long flags;
J
Johannes Berg 已提交
379

J
Johannes Berg 已提交
380
	if (!key)
381 382
		return;

J
Johannes Berg 已提交
383
	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
384
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
385
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
386 387 388 389 390 391 392 393 394 395 396 397 398 399
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;
400

J
Johannes Berg 已提交
401 402
	might_sleep();

J
Johannes Berg 已提交
403
	spin_lock_irqsave(&sdata->local->key_lock, flags);
404
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
405
		add_todo(key, todo_flags);
J
Johannes Berg 已提交
406
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
407

J
Johannes Berg 已提交
408
	ieee80211_key_todo();
409
}
J
Johannes Berg 已提交
410

J
Johannes Berg 已提交
411
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
412
{
J
Johannes Berg 已提交
413
	ASSERT_RTNL();
J
Johannes Berg 已提交
414

J
Johannes Berg 已提交
415 416
	if (WARN_ON(!netif_running(sdata->dev)))
		return;
J
Johannes Berg 已提交
417

J
Johannes Berg 已提交
418 419
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}
J
Johannes Berg 已提交
420

J
Johannes Berg 已提交
421 422 423
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();
J
Johannes Berg 已提交
424

J
Johannes Berg 已提交
425
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
J
Johannes Berg 已提交
426 427
}

J
Johannes Berg 已提交
428
static void __ieee80211_key_destroy(struct ieee80211_key *key)
J
Johannes Berg 已提交
429
{
430 431
	if (!key)
		return;
432

433
	ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
434

435 436 437 438 439
	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
J
Johannes Berg 已提交
440 441
}

442
static void __ieee80211_key_todo(void)
J
Johannes Berg 已提交
443 444
{
	struct ieee80211_key *key;
445 446
	bool work_done;
	u32 todoflags;
J
Johannes Berg 已提交
447

448 449 450 451 452 453 454 455 456 457 458
	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
J
Johannes Berg 已提交
459 460
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
J
Johannes Berg 已提交
476
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
477 478 479
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
J
Johannes Berg 已提交
480 481 482 483
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
484
		if (todoflags & KEY_FLAG_TODO_DELETE) {
J
Johannes Berg 已提交
485
			__ieee80211_key_destroy(key);
486 487
			work_done = true;
		}
488

489
		WARN_ON(!work_done);
J
Johannes Berg 已提交
490

491 492 493
		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
494 495
}

496
void ieee80211_key_todo(void)
J
Johannes Berg 已提交
497
{
498 499 500 501
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}
J
Johannes Berg 已提交
502

503 504 505
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
J
Johannes Berg 已提交
506
	unsigned long flags;
507

508 509 510 511
	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

J
Johannes Berg 已提交
512
	spin_lock_irqsave(&sdata->local->key_lock, flags);
513
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
514
		__ieee80211_key_free(key);
J
Johannes Berg 已提交
515
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
516 517 518 519

	__ieee80211_key_todo();

	ieee80211_key_unlock();
J
Johannes Berg 已提交
520
}