key.c 12.7 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17 18 19 20 21
#include <net/mac80211.h>
#include "ieee80211_i.h"
#include "debugfs_key.h"
#include "aes_ccm.h"

J
Johannes Berg 已提交
22

J
Johannes Berg 已提交
23 24
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
25 26 27 28 29 30 31 32 33 34 35
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
 * Hardware acceleration is done on a best-effort basis, for each key
 * that is eligible the hardware is asked to enable that key but if
 * it cannot do that they key is simply kept for software encryption.
 * There is currently no way of knowing this except by looking into
 * debugfs.
 *
36 37
 * All key operations are protected internally so you can call them at
 * any time.
38
 *
39 40 41 42 43 44 45 46
 * Within mac80211, key references are, just as STA structure references,
 * protected by RCU. Note, however, that some things are unprotected,
 * namely the key->sta dereferences within the hardware acceleration
 * functions. This means that sta_info_destroy() must flush the key todo
 * list.
 *
 * All the direct key list manipulation functions must not sleep because
 * they can operate on STA info structs that are protected by RCU.
J
Johannes Berg 已提交
47 48 49 50 51
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
static const u8 zero_addr[ETH_ALEN];

52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76
/* key mutex: used to synchronise todo runners */
static DEFINE_MUTEX(key_mutex);
static DEFINE_SPINLOCK(todo_lock);
static LIST_HEAD(todo_list);

static void key_todo(struct work_struct *work)
{
	ieee80211_key_todo();
}

static DECLARE_WORK(todo_work, key_todo);

/**
 * add_todo - add todo item for a key
 *
 * @key: key to add to do item for
 * @flag: todo flag(s)
 */
static void add_todo(struct ieee80211_key *key, u32 flag)
{
	if (!key)
		return;

	spin_lock(&todo_lock);
	key->flags |= flag;
77 78 79 80 81 82
	/*
	 * Remove again if already on the list so that we move it to the end.
	 */
	if (!list_empty(&key->todo))
		list_del(&key->todo);
	list_add_tail(&key->todo, &todo_list);
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110
	schedule_work(&todo_work);
	spin_unlock(&todo_lock);
}

/**
 * ieee80211_key_lock - lock the mac80211 key operation lock
 *
 * This locks the (global) mac80211 key operation lock, all
 * key operations must be done under this lock.
 */
static void ieee80211_key_lock(void)
{
	mutex_lock(&key_mutex);
}

/**
 * ieee80211_key_unlock - unlock the mac80211 key operation lock
 */
static void ieee80211_key_unlock(void)
{
	mutex_unlock(&key_mutex);
}

static void assert_key_lock(void)
{
	WARN_ON(!mutex_is_locked(&key_mutex));
}

J
Johannes Berg 已提交
111 112 113 114 115 116 117 118 119 120
static const u8 *get_mac_for_key(struct ieee80211_key *key)
{
	const u8 *addr = bcast_addr;

	/*
	 * If we're an AP we won't ever receive frames with a non-WEP
	 * group key so we tell the driver that by using the zero MAC
	 * address to indicate a transmit-only key.
	 */
	if (key->conf.alg != ALG_WEP &&
121 122
	    (key->sdata->vif.type == NL80211_IFTYPE_AP ||
	     key->sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
J
Johannes Berg 已提交
123 124 125
		addr = zero_addr;

	if (key->sta)
126
		addr = key->sta->sta.addr;
J
Johannes Berg 已提交
127 128 129 130 131 132 133 134 135

	return addr;
}

static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;

136 137 138
	assert_key_lock();
	might_sleep();

J
Johannes Berg 已提交
139 140 141 142 143 144 145 146 147
	if (!key->local->ops->set_key)
		return;

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), SET_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

148 149
	if (!ret) {
		spin_lock(&todo_lock);
J
Johannes Berg 已提交
150
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
151 152
		spin_unlock(&todo_lock);
	}
J
Johannes Berg 已提交
153 154 155

	if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
		printk(KERN_ERR "mac80211-%s: failed to set key "
156
		       "(%d, %pM) to hardware (%d)\n",
J
Johannes Berg 已提交
157
		       wiphy_name(key->local->hw.wiphy),
158
		       key->conf.keyidx, addr, ret);
J
Johannes Berg 已提交
159 160 161 162 163 164 165
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
	const u8 *addr;
	int ret;

166 167 168
	assert_key_lock();
	might_sleep();

169
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
170 171
		return;

172 173 174
	spin_lock(&todo_lock);
	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
		spin_unlock(&todo_lock);
J
Johannes Berg 已提交
175
		return;
176 177
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
178 179 180 181 182 183 184 185 186

	addr = get_mac_for_key(key);

	ret = key->local->ops->set_key(local_to_hw(key->local), DISABLE_KEY,
				       key->sdata->dev->dev_addr, addr,
				       &key->conf);

	if (ret)
		printk(KERN_ERR "mac80211-%s: failed to remove key "
187
		       "(%d, %pM) from hardware (%d)\n",
J
Johannes Berg 已提交
188
		       wiphy_name(key->local->hw.wiphy),
189
		       key->conf.keyidx, addr, ret);
J
Johannes Berg 已提交
190

191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213
	spin_lock(&todo_lock);
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
	spin_unlock(&todo_lock);
}

static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
					int idx)
{
	struct ieee80211_key *key = NULL;

	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_key, key);

	if (key)
		add_todo(key, KEY_FLAG_TODO_DEFKEY);
}

void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	unsigned long flags;

J
Johannes Berg 已提交
214
	spin_lock_irqsave(&sdata->local->key_lock, flags);
215
	__ieee80211_set_default_key(sdata, idx);
J
Johannes Berg 已提交
216
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256
}


static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
	int idx, defkey;

	if (new)
		list_add(&new->list, &sdata->key_list);

	if (sta) {
		rcu_assign_pointer(sta->key, new);
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

		defkey = old && sdata->default_key == old;

		if (defkey && !new)
			__ieee80211_set_default_key(sdata, -1);

		rcu_assign_pointer(sdata->keys[idx], new);
		if (defkey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx);
	}

	if (old) {
		/*
		 * We'll use an empty list to indicate that the key
		 * has already been removed.
		 */
		list_del_init(&old->list);
	}
J
Johannes Berg 已提交
257 258
}

259
struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
J
Johannes Berg 已提交
260 261 262
					  int idx,
					  size_t key_len,
					  const u8 *key_data)
263 264 265
{
	struct ieee80211_key *key;

266
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS);
J
Johannes Berg 已提交
267 268

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
269 270
	if (!key)
		return NULL;
J
Johannes Berg 已提交
271 272 273 274 275 276 277 278 279 280 281

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

	key->conf.alg = alg;
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
282 283 284 285 286 287 288 289 290 291 292 293 294 295
	switch (alg) {
	case ALG_WEP:
		key->conf.iv_len = WEP_IV_LEN;
		key->conf.icv_len = WEP_ICV_LEN;
		break;
	case ALG_TKIP:
		key->conf.iv_len = TKIP_IV_LEN;
		key->conf.icv_len = TKIP_ICV_LEN;
		break;
	case ALG_CCMP:
		key->conf.iv_len = CCMP_HDR_LEN;
		key->conf.icv_len = CCMP_MIC_LEN;
		break;
	}
J
Johannes Berg 已提交
296
	memcpy(key->conf.key, key_data, key_len);
297
	INIT_LIST_HEAD(&key->list);
298
	INIT_LIST_HEAD(&key->todo);
J
Johannes Berg 已提交
299 300 301 302 303 304 305 306

	if (alg == ALG_CCMP) {
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
		if (!key->u.ccmp.tfm) {
307
			kfree(key);
J
Johannes Berg 已提交
308 309 310 311
			return NULL;
		}
	}

312 313
	return key;
}
J
Johannes Berg 已提交
314

315 316 317 318 319
void ieee80211_key_link(struct ieee80211_key *key,
			struct ieee80211_sub_if_data *sdata,
			struct sta_info *sta)
{
	struct ieee80211_key *old_key;
320
	unsigned long flags;
321 322 323 324 325 326 327 328 329 330
	int idx;

	BUG_ON(!sdata);
	BUG_ON(!key);

	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
331 332 333 334 335
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
336
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
337
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
338 339 340 341 342 343 344

		/*
		 * This key is for a specific sta interface,
		 * inform the driver that it should try to store
		 * this key as pairwise key.
		 */
		key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
J
Johannes Berg 已提交
345
	} else {
346
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
347 348
			struct sta_info *ap;

349 350 351 352
			/*
			 * We're getting a sta pointer in,
			 * so must be under RCU read lock.
			 */
353

J
Johannes Berg 已提交
354 355 356
			/* same here, the AP could be using QoS */
			ap = sta_info_get(key->local, key->sdata->u.sta.bssid);
			if (ap) {
357
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
358 359 360 361 362 363
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
364
	spin_lock_irqsave(&sdata->local->key_lock, flags);
365

366
	if (sta)
367
		old_key = sta->key;
368
	else
369 370 371
		old_key = sdata->keys[idx];

	__ieee80211_key_replace(sdata, sta, old_key, key);
372

J
Johannes Berg 已提交
373
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
374 375 376

	/* free old key later */
	add_todo(old_key, KEY_FLAG_TODO_DELETE);
377

378
	add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
379
	if (netif_running(sdata->dev))
J
Johannes Berg 已提交
380
		add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
381 382
}

J
Johannes Berg 已提交
383
static void __ieee80211_key_free(struct ieee80211_key *key)
384
{
385 386 387
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
388
	if (key->sdata)
389 390
		__ieee80211_key_replace(key->sdata, key->sta,
					key, NULL);
J
Johannes Berg 已提交
391

392 393
	add_todo(key, KEY_FLAG_TODO_DELETE);
}
394

J
Johannes Berg 已提交
395
void ieee80211_key_free(struct ieee80211_key *key)
396
{
J
Johannes Berg 已提交
397
	unsigned long flags;
J
Johannes Berg 已提交
398

J
Johannes Berg 已提交
399
	if (!key)
400 401
		return;

402 403 404 405 406 407 408 409 410
	if (!key->sdata) {
		/* The key has not been linked yet, simply free it
		 * and don't Oops */
		if (key->conf.alg == ALG_CCMP)
			ieee80211_aes_key_free(key->u.ccmp.tfm);
		kfree(key);
		return;
	}

J
Johannes Berg 已提交
411
	spin_lock_irqsave(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
412
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
413
	spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
J
Johannes Berg 已提交
414 415 416 417 418 419 420 421 422 423 424 425 426 427
}

/*
 * To be safe against concurrent manipulations of the list (which shouldn't
 * actually happen) we need to hold the spinlock. But under the spinlock we
 * can't actually do much, so we defer processing to the todo list. Then run
 * the todo list to be sure the operation and possibly previously pending
 * operations are completed.
 */
static void ieee80211_todo_for_each_key(struct ieee80211_sub_if_data *sdata,
					u32 todo_flags)
{
	struct ieee80211_key *key;
	unsigned long flags;
428

J
Johannes Berg 已提交
429 430
	might_sleep();

J
Johannes Berg 已提交
431
	spin_lock_irqsave(&sdata->local->key_lock, flags);
432
	list_for_each_entry(key, &sdata->key_list, list)
J
Johannes Berg 已提交
433
		add_todo(key, todo_flags);
J
Johannes Berg 已提交
434
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
435

J
Johannes Berg 已提交
436
	ieee80211_key_todo();
437
}
J
Johannes Berg 已提交
438

J
Johannes Berg 已提交
439
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
440
{
J
Johannes Berg 已提交
441
	ASSERT_RTNL();
J
Johannes Berg 已提交
442

J
Johannes Berg 已提交
443 444
	if (WARN_ON(!netif_running(sdata->dev)))
		return;
J
Johannes Berg 已提交
445

J
Johannes Berg 已提交
446 447
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
}
J
Johannes Berg 已提交
448

J
Johannes Berg 已提交
449 450 451
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
{
	ASSERT_RTNL();
J
Johannes Berg 已提交
452

J
Johannes Berg 已提交
453
	ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_REMOVE);
J
Johannes Berg 已提交
454 455
}

J
Johannes Berg 已提交
456
static void __ieee80211_key_destroy(struct ieee80211_key *key)
J
Johannes Berg 已提交
457
{
458 459
	if (!key)
		return;
460

461
	ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
462

463 464 465 466 467
	if (key->conf.alg == ALG_CCMP)
		ieee80211_aes_key_free(key->u.ccmp.tfm);
	ieee80211_debugfs_key_remove(key);

	kfree(key);
J
Johannes Berg 已提交
468 469
}

470
static void __ieee80211_key_todo(void)
J
Johannes Berg 已提交
471 472
{
	struct ieee80211_key *key;
473 474
	bool work_done;
	u32 todoflags;
J
Johannes Berg 已提交
475

476 477 478 479 480 481 482 483 484 485 486
	/*
	 * NB: sta_info_destroy relies on this!
	 */
	synchronize_rcu();

	spin_lock(&todo_lock);
	while (!list_empty(&todo_list)) {
		key = list_first_entry(&todo_list, struct ieee80211_key, todo);
		list_del_init(&key->todo);
		todoflags = key->flags & (KEY_FLAG_TODO_ADD_DEBUGFS |
					  KEY_FLAG_TODO_DEFKEY |
J
Johannes Berg 已提交
487 488
					  KEY_FLAG_TODO_HWACCEL_ADD |
					  KEY_FLAG_TODO_HWACCEL_REMOVE |
489 490 491 492 493 494 495 496 497 498 499 500 501 502 503
					  KEY_FLAG_TODO_DELETE);
		key->flags &= ~todoflags;
		spin_unlock(&todo_lock);

		work_done = false;

		if (todoflags & KEY_FLAG_TODO_ADD_DEBUGFS) {
			ieee80211_debugfs_key_add(key);
			work_done = true;
		}
		if (todoflags & KEY_FLAG_TODO_DEFKEY) {
			ieee80211_debugfs_key_remove_default(key->sdata);
			ieee80211_debugfs_key_add_default(key->sdata);
			work_done = true;
		}
J
Johannes Berg 已提交
504
		if (todoflags & KEY_FLAG_TODO_HWACCEL_ADD) {
505 506 507
			ieee80211_key_enable_hw_accel(key);
			work_done = true;
		}
J
Johannes Berg 已提交
508 509 510 511
		if (todoflags & KEY_FLAG_TODO_HWACCEL_REMOVE) {
			ieee80211_key_disable_hw_accel(key);
			work_done = true;
		}
512
		if (todoflags & KEY_FLAG_TODO_DELETE) {
J
Johannes Berg 已提交
513
			__ieee80211_key_destroy(key);
514 515
			work_done = true;
		}
516

517
		WARN_ON(!work_done);
J
Johannes Berg 已提交
518

519 520 521
		spin_lock(&todo_lock);
	}
	spin_unlock(&todo_lock);
J
Johannes Berg 已提交
522 523
}

524
void ieee80211_key_todo(void)
J
Johannes Berg 已提交
525
{
526 527 528 529
	ieee80211_key_lock();
	__ieee80211_key_todo();
	ieee80211_key_unlock();
}
J
Johannes Berg 已提交
530

531 532 533
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
J
Johannes Berg 已提交
534
	unsigned long flags;
535

536 537 538 539
	ieee80211_key_lock();

	ieee80211_debugfs_key_remove_default(sdata);

J
Johannes Berg 已提交
540
	spin_lock_irqsave(&sdata->local->key_lock, flags);
541
	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
542
		__ieee80211_key_free(key);
J
Johannes Berg 已提交
543
	spin_unlock_irqrestore(&sdata->local->key_lock, flags);
544 545 546 547

	__ieee80211_key_todo();

	ieee80211_key_unlock();
J
Johannes Berg 已提交
548
}