key.c 13.3 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17
#include <linux/slab.h>
18 19
#include <net/mac80211.h>
#include "ieee80211_i.h"
20
#include "driver-ops.h"
21 22
#include "debugfs_key.h"
#include "aes_ccm.h"
23
#include "aes_cmac.h"
24

J
Johannes Berg 已提交
25

J
Johannes Berg 已提交
26 27
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
28 29 30 31 32
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
33 34 35 36 37 38 39
 * Hardware acceleration is done on a best-effort basis for algorithms
 * that are implemented in software,  for each key the hardware is asked
 * to enable that key for offloading but if it cannot do that the key is
 * simply kept for software encryption (unless it is for an algorithm
 * that isn't implemented in software).
 * There is currently no way of knowing whether a key is handled in SW
 * or HW except by looking into debugfs.
J
Johannes Berg 已提交
40
 *
41 42 43 44 45 46
 * All key management is internally protected by a mutex. Within all
 * other parts of mac80211, key references are, just as STA structure
 * references, protected by RCU. Note, however, that some things are
 * unprotected, namely the key->sta dereferences within the hardware
 * acceleration functions. This means that sta_info_destroy() must
 * remove the key which waits for an RCU grace period.
J
Johannes Berg 已提交
47 48 49 50
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };

J
Johannes Berg 已提交
51
static void assert_key_lock(struct ieee80211_local *local)
52
{
53
	lockdep_assert_held(&local->key_mtx);
54 55
}

56
static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
J
Johannes Berg 已提交
57 58
{
	if (key->sta)
59
		return &key->sta->sta;
J
Johannes Berg 已提交
60

61
	return NULL;
J
Johannes Berg 已提交
62 63
}

64
static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
J
Johannes Berg 已提交
65
{
66 67
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
68 69
	int ret;

70 71
	might_sleep();

72
	if (!key->local->ops->set_key)
73
		goto out_unsupported;
J
Johannes Berg 已提交
74

J
Johannes Berg 已提交
75 76
	assert_key_lock(key->local);

77 78
	sta = get_sta_for_key(key);

79 80 81 82 83 84 85 86
	/*
	 * If this is a per-STA GTK, check if it
	 * is supported; if not, return.
	 */
	if (sta && !(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE) &&
	    !(key->local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK))
		goto out_unsupported;

87
	sdata = key->sdata;
88 89 90 91 92 93 94
	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
		/*
		 * The driver doesn't know anything about VLAN interfaces.
		 * Hence, don't send GTKs for VLAN interfaces to the driver.
		 */
		if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
			goto out_unsupported;
95 96 97
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
98
	}
J
Johannes Berg 已提交
99

J
Johannes Berg 已提交
100
	ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
J
Johannes Berg 已提交
101

102
	if (!ret) {
J
Johannes Berg 已提交
103
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
104 105
		return 0;
	}
J
Johannes Berg 已提交
106

107
	if (ret != -ENOSPC && ret != -EOPNOTSUPP)
J
Joe Perches 已提交
108 109 110
		wiphy_err(key->local->hw.wiphy,
			  "failed to set key (%d, %pM) to hardware (%d)\n",
			  key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
111

112 113 114 115 116 117 118 119 120 121 122
 out_unsupported:
	switch (key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
	case WLAN_CIPHER_SUITE_TKIP:
	case WLAN_CIPHER_SUITE_CCMP:
	case WLAN_CIPHER_SUITE_AES_CMAC:
		/* all of these we can do in software */
		return 0;
	default:
		return -EINVAL;
123
	}
J
Johannes Berg 已提交
124 125 126 127
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
128 129
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
130 131
	int ret;

132 133
	might_sleep();

134
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
135 136
		return;

J
Johannes Berg 已提交
137 138 139
	assert_key_lock(key->local);

	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
J
Johannes Berg 已提交
140 141
		return;

142 143 144 145 146 147 148
	sta = get_sta_for_key(key);
	sdata = key->sdata;

	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
J
Johannes Berg 已提交
149

J
Johannes Berg 已提交
150
	ret = drv_set_key(key->local, DISABLE_KEY, sdata,
151
			  sta, &key->conf);
J
Johannes Berg 已提交
152 153

	if (ret)
J
Joe Perches 已提交
154 155 156
		wiphy_err(key->local->hw.wiphy,
			  "failed to remove key (%d, %pM) from hardware (%d)\n",
			  key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
J
Johannes Berg 已提交
157

158 159 160
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
}

161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180
void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
{
	struct ieee80211_key *key;

	key = container_of(key_conf, struct ieee80211_key, conf);

	might_sleep();
	assert_key_lock(key->local);

	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;

	/*
	 * Flush TX path to avoid attempts to use this key
	 * after this function returns. Until then, drivers
	 * must be prepared to handle the key.
	 */
	synchronize_rcu();
}
EXPORT_SYMBOL_GPL(ieee80211_key_removed);

181
static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
182
					int idx, bool uni, bool multi)
183 184 185
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
186 187
	assert_key_lock(sdata->local);

188
	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
J
Johannes Berg 已提交
189
		key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
190

191 192 193 194
	if (uni)
		rcu_assign_pointer(sdata->default_unicast_key, key);
	if (multi)
		rcu_assign_pointer(sdata->default_multicast_key, key);
195

196
	ieee80211_debugfs_key_update_default(sdata);
197 198
}

199 200
void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx,
			       bool uni, bool multi)
201
{
J
Johannes Berg 已提交
202
	mutex_lock(&sdata->local->key_mtx);
203
	__ieee80211_set_default_key(sdata, idx, uni, multi);
J
Johannes Berg 已提交
204
	mutex_unlock(&sdata->local->key_mtx);
205 206
}

207 208 209 210 211
static void
__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
212 213
	assert_key_lock(sdata->local);

214 215
	if (idx >= NUM_DEFAULT_KEYS &&
	    idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
J
Johannes Berg 已提交
216
		key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
217 218 219

	rcu_assign_pointer(sdata->default_mgmt_key, key);

220
	ieee80211_debugfs_key_update_default(sdata);
221 222 223 224 225
}

void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
				    int idx)
{
J
Johannes Berg 已提交
226
	mutex_lock(&sdata->local->key_mtx);
227
	__ieee80211_set_default_mgmt_key(sdata, idx);
J
Johannes Berg 已提交
228
	mutex_unlock(&sdata->local->key_mtx);
229 230
}

231 232 233

static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
234
				    bool pairwise,
235 236 237
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
238 239
	int idx;
	bool defunikey, defmultikey, defmgmtkey;
240 241 242 243

	if (new)
		list_add(&new->list, &sdata->key_list);

244 245 246 247 248 249 250 251
	if (sta && pairwise) {
		rcu_assign_pointer(sta->ptk, new);
	} else if (sta) {
		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;
		rcu_assign_pointer(sta->gtk[idx], new);
252 253 254 255 256 257 258 259
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

J
Johannes Berg 已提交
260 261 262 263 264 265 266 267 268
		defunikey = old &&
			old == key_mtx_dereference(sdata->local,
						sdata->default_unicast_key);
		defmultikey = old &&
			old == key_mtx_dereference(sdata->local,
						sdata->default_multicast_key);
		defmgmtkey = old &&
			old == key_mtx_dereference(sdata->local,
						sdata->default_mgmt_key);
269

270 271 272 273
		if (defunikey && !new)
			__ieee80211_set_default_key(sdata, -1, true, false);
		if (defmultikey && !new)
			__ieee80211_set_default_key(sdata, -1, false, true);
274 275
		if (defmgmtkey && !new)
			__ieee80211_set_default_mgmt_key(sdata, -1);
276 277

		rcu_assign_pointer(sdata->keys[idx], new);
278 279 280 281 282 283
		if (defunikey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx,
						    true, false);
		if (defmultikey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx,
						    false, true);
284 285 286
		if (defmgmtkey && new)
			__ieee80211_set_default_mgmt_key(sdata,
							 new->conf.keyidx);
287 288
	}

289 290
	if (old)
		list_del(&old->list);
J
Johannes Berg 已提交
291 292
}

293
struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
294 295
					  const u8 *key_data,
					  size_t seq_len, const u8 *seq)
296 297
{
	struct ieee80211_key *key;
298
	int i, j, err;
299

300
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
J
Johannes Berg 已提交
301 302

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
303
	if (!key)
304
		return ERR_PTR(-ENOMEM);
J
Johannes Berg 已提交
305 306 307 308 309 310 311 312

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

313
	key->conf.cipher = cipher;
J
Johannes Berg 已提交
314 315
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
316 317 318
	switch (cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
319 320 321
		key->conf.iv_len = WEP_IV_LEN;
		key->conf.icv_len = WEP_ICV_LEN;
		break;
322
	case WLAN_CIPHER_SUITE_TKIP:
323 324
		key->conf.iv_len = TKIP_IV_LEN;
		key->conf.icv_len = TKIP_ICV_LEN;
325
		if (seq) {
326 327 328 329 330 331 332
			for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
				key->u.tkip.rx[i].iv32 =
					get_unaligned_le32(&seq[2]);
				key->u.tkip.rx[i].iv16 =
					get_unaligned_le16(seq);
			}
		}
333
		break;
334
	case WLAN_CIPHER_SUITE_CCMP:
335 336
		key->conf.iv_len = CCMP_HDR_LEN;
		key->conf.icv_len = CCMP_MIC_LEN;
337
		if (seq) {
338
			for (i = 0; i < NUM_RX_DATA_QUEUES + 1; i++)
339 340 341 342
				for (j = 0; j < CCMP_PN_LEN; j++)
					key->u.ccmp.rx_pn[i][j] =
						seq[CCMP_PN_LEN - j - 1];
		}
J
Johannes Berg 已提交
343 344 345 346 347
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
348 349
		if (IS_ERR(key->u.ccmp.tfm)) {
			err = PTR_ERR(key->u.ccmp.tfm);
350
			kfree(key);
351
			return ERR_PTR(err);
J
Johannes Berg 已提交
352
		}
J
Johannes Berg 已提交
353 354 355 356 357 358 359
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		key->conf.iv_len = 0;
		key->conf.icv_len = sizeof(struct ieee80211_mmie);
		if (seq)
			for (j = 0; j < 6; j++)
				key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
360 361 362 363 364 365
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.aes_cmac.tfm =
			ieee80211_aes_cmac_key_setup(key_data);
366 367
		if (IS_ERR(key->u.aes_cmac.tfm)) {
			err = PTR_ERR(key->u.aes_cmac.tfm);
368
			kfree(key);
369
			return ERR_PTR(err);
370
		}
J
Johannes Berg 已提交
371
		break;
372
	}
J
Johannes Berg 已提交
373 374
	memcpy(key->conf.key, key_data, key_len);
	INIT_LIST_HEAD(&key->list);
375

376 377
	return key;
}
J
Johannes Berg 已提交
378

J
Johannes Berg 已提交
379 380 381 382 383
static void __ieee80211_key_destroy(struct ieee80211_key *key)
{
	if (!key)
		return;

384 385 386 387 388 389
	/*
	 * Synchronize so the TX path can no longer be using
	 * this key before we free/remove it.
	 */
	synchronize_rcu();

390 391
	if (key->local)
		ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
392

393
	if (key->conf.cipher == WLAN_CIPHER_SUITE_CCMP)
J
Johannes Berg 已提交
394
		ieee80211_aes_key_free(key->u.ccmp.tfm);
395
	if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
J
Johannes Berg 已提交
396
		ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
397
	if (key->local)
398
		ieee80211_debugfs_key_remove(key);
J
Johannes Berg 已提交
399 400 401 402

	kfree(key);
}

403 404 405
int ieee80211_key_link(struct ieee80211_key *key,
		       struct ieee80211_sub_if_data *sdata,
		       struct sta_info *sta)
406 407
{
	struct ieee80211_key *old_key;
408
	int idx, ret;
409
	bool pairwise;
410 411 412 413

	BUG_ON(!sdata);
	BUG_ON(!key);

414
	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
415 416 417 418 419
	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
420 421 422 423 424
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
425
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
426 427
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
	} else {
428
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
429 430
			struct sta_info *ap;

431
			/*
432 433
			 * We're getting a sta pointer in, so must be under
			 * appropriate locking for sta_info_get().
434
			 */
435

J
Johannes Berg 已提交
436
			/* same here, the AP could be using QoS */
437
			ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
J
Johannes Berg 已提交
438
			if (ap) {
439
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
440 441 442 443 444 445
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
446
	mutex_lock(&sdata->local->key_mtx);
447

448
	if (sta && pairwise)
J
Johannes Berg 已提交
449
		old_key = key_mtx_dereference(sdata->local, sta->ptk);
450
	else if (sta)
J
Johannes Berg 已提交
451
		old_key = key_mtx_dereference(sdata->local, sta->gtk[idx]);
452
	else
J
Johannes Berg 已提交
453
		old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
454

455
	__ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
J
Johannes Berg 已提交
456
	__ieee80211_key_destroy(old_key);
457

J
Johannes Berg 已提交
458
	ieee80211_debugfs_key_add(key);
459

460
	ret = ieee80211_key_enable_hw_accel(key);
J
Johannes Berg 已提交
461

J
Johannes Berg 已提交
462
	mutex_unlock(&sdata->local->key_mtx);
463 464

	return ret;
465 466
}

467
void __ieee80211_key_free(struct ieee80211_key *key)
468
{
469 470 471
	if (!key)
		return;

472 473 474
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
475
	if (key->sdata)
476
		__ieee80211_key_replace(key->sdata, key->sta,
477 478
				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
				key, NULL);
J
Johannes Berg 已提交
479
	__ieee80211_key_destroy(key);
480
}
481

482 483
void ieee80211_key_free(struct ieee80211_local *local,
			struct ieee80211_key *key)
484
{
J
Johannes Berg 已提交
485
	mutex_lock(&local->key_mtx);
J
Johannes Berg 已提交
486
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
487
	mutex_unlock(&local->key_mtx);
J
Johannes Berg 已提交
488 489
}

J
Johannes Berg 已提交
490
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
491 492
{
	struct ieee80211_key *key;
J
Johannes Berg 已提交
493

J
Johannes Berg 已提交
494
	ASSERT_RTNL();
J
Johannes Berg 已提交
495

496
	if (WARN_ON(!ieee80211_sdata_running(sdata)))
J
Johannes Berg 已提交
497
		return;
J
Johannes Berg 已提交
498

J
Johannes Berg 已提交
499
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
500

501
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
502
		ieee80211_key_enable_hw_accel(key);
503

J
Johannes Berg 已提交
504
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
505 506
}

J
Johannes Berg 已提交
507
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
508 509 510
{
	struct ieee80211_key *key;

J
Johannes Berg 已提交
511
	ASSERT_RTNL();
512

J
Johannes Berg 已提交
513
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
514

J
Johannes Berg 已提交
515 516
	list_for_each_entry(key, &sdata->key_list, list)
		ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
517

J
Johannes Berg 已提交
518
	mutex_unlock(&sdata->local->key_mtx);
519
}
J
Johannes Berg 已提交
520

521 522 523
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
524

J
Johannes Berg 已提交
525
	mutex_lock(&sdata->local->key_mtx);
526

527
	ieee80211_debugfs_key_remove_mgmt_default(sdata);
528 529

	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
530
		__ieee80211_key_free(key);
531

532 533
	ieee80211_debugfs_key_update_default(sdata);

J
Johannes Berg 已提交
534
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
535
}