key.c 13.5 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

J
Johannes Berg 已提交
12 13 14
#include <linux/if_ether.h>
#include <linux/etherdevice.h>
#include <linux/list.h>
15
#include <linux/rcupdate.h>
16
#include <linux/rtnetlink.h>
17
#include <linux/slab.h>
18 19
#include <net/mac80211.h>
#include "ieee80211_i.h"
20
#include "driver-ops.h"
21 22
#include "debugfs_key.h"
#include "aes_ccm.h"
23
#include "aes_cmac.h"
24

J
Johannes Berg 已提交
25

J
Johannes Berg 已提交
26 27
/**
 * DOC: Key handling basics
J
Johannes Berg 已提交
28 29 30 31 32
 *
 * Key handling in mac80211 is done based on per-interface (sub_if_data)
 * keys and per-station keys. Since each station belongs to an interface,
 * each station key also belongs to that interface.
 *
33 34 35 36 37 38 39
 * Hardware acceleration is done on a best-effort basis for algorithms
 * that are implemented in software,  for each key the hardware is asked
 * to enable that key for offloading but if it cannot do that the key is
 * simply kept for software encryption (unless it is for an algorithm
 * that isn't implemented in software).
 * There is currently no way of knowing whether a key is handled in SW
 * or HW except by looking into debugfs.
J
Johannes Berg 已提交
40
 *
41 42 43 44 45 46
 * All key management is internally protected by a mutex. Within all
 * other parts of mac80211, key references are, just as STA structure
 * references, protected by RCU. Note, however, that some things are
 * unprotected, namely the key->sta dereferences within the hardware
 * acceleration functions. This means that sta_info_destroy() must
 * remove the key which waits for an RCU grace period.
J
Johannes Berg 已提交
47 48 49 50
 */

static const u8 bcast_addr[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };

J
Johannes Berg 已提交
51
static void assert_key_lock(struct ieee80211_local *local)
52
{
53
	lockdep_assert_held(&local->key_mtx);
54 55
}

56
static struct ieee80211_sta *get_sta_for_key(struct ieee80211_key *key)
J
Johannes Berg 已提交
57 58
{
	if (key->sta)
59
		return &key->sta->sta;
J
Johannes Berg 已提交
60

61
	return NULL;
J
Johannes Berg 已提交
62 63
}

64
static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
J
Johannes Berg 已提交
65
{
66 67
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
68 69
	int ret;

70 71
	might_sleep();

72
	if (!key->local->ops->set_key)
73
		goto out_unsupported;
J
Johannes Berg 已提交
74

J
Johannes Berg 已提交
75 76
	assert_key_lock(key->local);

77 78
	sta = get_sta_for_key(key);

79 80 81 82 83 84 85 86
	/*
	 * If this is a per-STA GTK, check if it
	 * is supported; if not, return.
	 */
	if (sta && !(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE) &&
	    !(key->local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK))
		goto out_unsupported;

87
	sdata = key->sdata;
88 89 90 91 92 93 94
	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
		/*
		 * The driver doesn't know anything about VLAN interfaces.
		 * Hence, don't send GTKs for VLAN interfaces to the driver.
		 */
		if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
			goto out_unsupported;
95 96 97
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
98
	}
J
Johannes Berg 已提交
99

J
Johannes Berg 已提交
100
	ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
J
Johannes Berg 已提交
101

102
	if (!ret) {
J
Johannes Berg 已提交
103
		key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
104

105 106
		if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
		      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
107 108
			key->local->crypto_tx_tailroom_needed_cnt--;

109 110
		return 0;
	}
J
Johannes Berg 已提交
111

112
	if (ret != -ENOSPC && ret != -EOPNOTSUPP)
J
Joe Perches 已提交
113 114 115
		wiphy_err(key->local->hw.wiphy,
			  "failed to set key (%d, %pM) to hardware (%d)\n",
			  key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
116

117 118 119 120 121 122 123 124 125 126 127
 out_unsupported:
	switch (key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
	case WLAN_CIPHER_SUITE_TKIP:
	case WLAN_CIPHER_SUITE_CCMP:
	case WLAN_CIPHER_SUITE_AES_CMAC:
		/* all of these we can do in software */
		return 0;
	default:
		return -EINVAL;
128
	}
J
Johannes Berg 已提交
129 130 131 132
}

static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
{
133 134
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_sta *sta;
J
Johannes Berg 已提交
135 136
	int ret;

137 138
	might_sleep();

139
	if (!key || !key->local->ops->set_key)
J
Johannes Berg 已提交
140 141
		return;

J
Johannes Berg 已提交
142 143 144
	assert_key_lock(key->local);

	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
J
Johannes Berg 已提交
145 146
		return;

147 148 149 150 151 152 153
	sta = get_sta_for_key(key);
	sdata = key->sdata;

	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data,
				     u.ap);
J
Johannes Berg 已提交
154

J
Johannes Berg 已提交
155
	ret = drv_set_key(key->local, DISABLE_KEY, sdata,
156
			  sta, &key->conf);
J
Johannes Berg 已提交
157 158

	if (ret)
J
Joe Perches 已提交
159 160 161
		wiphy_err(key->local->hw.wiphy,
			  "failed to remove key (%d, %pM) from hardware (%d)\n",
			  key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
J
Johannes Berg 已提交
162

163
	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
164

165 166
	if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
	      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
167
		key->local->crypto_tx_tailroom_needed_cnt++;
168 169
}

170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
{
	struct ieee80211_key *key;

	key = container_of(key_conf, struct ieee80211_key, conf);

	might_sleep();
	assert_key_lock(key->local);

	key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;

	/*
	 * Flush TX path to avoid attempts to use this key
	 * after this function returns. Until then, drivers
	 * must be prepared to handle the key.
	 */
	synchronize_rcu();
}
EXPORT_SYMBOL_GPL(ieee80211_key_removed);

190
static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
191
					int idx, bool uni, bool multi)
192 193 194
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
195 196
	assert_key_lock(sdata->local);

197 198 199
	if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
		key = sdata->keys[idx];

200 201 202 203
	if (uni)
		rcu_assign_pointer(sdata->default_unicast_key, key);
	if (multi)
		rcu_assign_pointer(sdata->default_multicast_key, key);
204

205
	ieee80211_debugfs_key_update_default(sdata);
206 207
}

208 209
void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx,
			       bool uni, bool multi)
210
{
J
Johannes Berg 已提交
211
	mutex_lock(&sdata->local->key_mtx);
212
	__ieee80211_set_default_key(sdata, idx, uni, multi);
J
Johannes Berg 已提交
213
	mutex_unlock(&sdata->local->key_mtx);
214 215
}

216 217 218 219 220
static void
__ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
{
	struct ieee80211_key *key = NULL;

J
Johannes Berg 已提交
221 222
	assert_key_lock(sdata->local);

223 224 225 226 227 228
	if (idx >= NUM_DEFAULT_KEYS &&
	    idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
		key = sdata->keys[idx];

	rcu_assign_pointer(sdata->default_mgmt_key, key);

229
	ieee80211_debugfs_key_update_default(sdata);
230 231 232 233 234
}

void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
				    int idx)
{
J
Johannes Berg 已提交
235
	mutex_lock(&sdata->local->key_mtx);
236
	__ieee80211_set_default_mgmt_key(sdata, idx);
J
Johannes Berg 已提交
237
	mutex_unlock(&sdata->local->key_mtx);
238 239
}

240 241 242

static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
				    struct sta_info *sta,
243
				    bool pairwise,
244 245 246
				    struct ieee80211_key *old,
				    struct ieee80211_key *new)
{
247 248
	int idx;
	bool defunikey, defmultikey, defmgmtkey;
249 250 251 252

	if (new)
		list_add(&new->list, &sdata->key_list);

253 254 255 256 257 258 259 260
	if (sta && pairwise) {
		rcu_assign_pointer(sta->ptk, new);
	} else if (sta) {
		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;
		rcu_assign_pointer(sta->gtk[idx], new);
261 262 263 264 265 266 267 268
	} else {
		WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);

		if (old)
			idx = old->conf.keyidx;
		else
			idx = new->conf.keyidx;

269 270
		defunikey = old && sdata->default_unicast_key == old;
		defmultikey = old && sdata->default_multicast_key == old;
271
		defmgmtkey = old && sdata->default_mgmt_key == old;
272

273 274 275 276
		if (defunikey && !new)
			__ieee80211_set_default_key(sdata, -1, true, false);
		if (defmultikey && !new)
			__ieee80211_set_default_key(sdata, -1, false, true);
277 278
		if (defmgmtkey && !new)
			__ieee80211_set_default_mgmt_key(sdata, -1);
279 280

		rcu_assign_pointer(sdata->keys[idx], new);
281 282 283 284 285 286
		if (defunikey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx,
						    true, false);
		if (defmultikey && new)
			__ieee80211_set_default_key(sdata, new->conf.keyidx,
						    false, true);
287 288 289
		if (defmgmtkey && new)
			__ieee80211_set_default_mgmt_key(sdata,
							 new->conf.keyidx);
290 291
	}

292 293
	if (old)
		list_del(&old->list);
J
Johannes Berg 已提交
294 295
}

296
struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
297 298
					  const u8 *key_data,
					  size_t seq_len, const u8 *seq)
299 300
{
	struct ieee80211_key *key;
301
	int i, j, err;
302

303
	BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
J
Johannes Berg 已提交
304 305

	key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
306
	if (!key)
307
		return ERR_PTR(-ENOMEM);
J
Johannes Berg 已提交
308 309 310 311 312 313 314 315

	/*
	 * Default to software encryption; we'll later upload the
	 * key to the hardware if possible.
	 */
	key->conf.flags = 0;
	key->flags = 0;

316
	key->conf.cipher = cipher;
J
Johannes Berg 已提交
317 318
	key->conf.keyidx = idx;
	key->conf.keylen = key_len;
319 320 321
	switch (cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
322 323 324
		key->conf.iv_len = WEP_IV_LEN;
		key->conf.icv_len = WEP_ICV_LEN;
		break;
325
	case WLAN_CIPHER_SUITE_TKIP:
326 327
		key->conf.iv_len = TKIP_IV_LEN;
		key->conf.icv_len = TKIP_ICV_LEN;
328
		if (seq) {
329 330 331 332 333 334 335
			for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
				key->u.tkip.rx[i].iv32 =
					get_unaligned_le32(&seq[2]);
				key->u.tkip.rx[i].iv16 =
					get_unaligned_le16(seq);
			}
		}
336
		break;
337
	case WLAN_CIPHER_SUITE_CCMP:
338 339
		key->conf.iv_len = CCMP_HDR_LEN;
		key->conf.icv_len = CCMP_MIC_LEN;
340
		if (seq) {
341
			for (i = 0; i < NUM_RX_DATA_QUEUES + 1; i++)
342 343 344 345
				for (j = 0; j < CCMP_PN_LEN; j++)
					key->u.ccmp.rx_pn[i][j] =
						seq[CCMP_PN_LEN - j - 1];
		}
J
Johannes Berg 已提交
346 347 348 349 350
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.ccmp.tfm = ieee80211_aes_key_setup_encrypt(key_data);
351 352
		if (IS_ERR(key->u.ccmp.tfm)) {
			err = PTR_ERR(key->u.ccmp.tfm);
353
			kfree(key);
354
			return ERR_PTR(err);
J
Johannes Berg 已提交
355
		}
J
Johannes Berg 已提交
356 357 358 359 360 361 362
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		key->conf.iv_len = 0;
		key->conf.icv_len = sizeof(struct ieee80211_mmie);
		if (seq)
			for (j = 0; j < 6; j++)
				key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
363 364 365 366 367 368
		/*
		 * Initialize AES key state here as an optimization so that
		 * it does not need to be initialized for every packet.
		 */
		key->u.aes_cmac.tfm =
			ieee80211_aes_cmac_key_setup(key_data);
369 370
		if (IS_ERR(key->u.aes_cmac.tfm)) {
			err = PTR_ERR(key->u.aes_cmac.tfm);
371
			kfree(key);
372
			return ERR_PTR(err);
373
		}
J
Johannes Berg 已提交
374
		break;
375
	}
J
Johannes Berg 已提交
376 377
	memcpy(key->conf.key, key_data, key_len);
	INIT_LIST_HEAD(&key->list);
378

379 380
	return key;
}
J
Johannes Berg 已提交
381

J
Johannes Berg 已提交
382 383 384 385 386
static void __ieee80211_key_destroy(struct ieee80211_key *key)
{
	if (!key)
		return;

387 388 389 390 391 392
	/*
	 * Synchronize so the TX path can no longer be using
	 * this key before we free/remove it.
	 */
	synchronize_rcu();

393 394
	if (key->local)
		ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
395

396
	if (key->conf.cipher == WLAN_CIPHER_SUITE_CCMP)
J
Johannes Berg 已提交
397
		ieee80211_aes_key_free(key->u.ccmp.tfm);
398
	if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
J
Johannes Berg 已提交
399
		ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
400
	if (key->local) {
401
		ieee80211_debugfs_key_remove(key);
402 403
		key->local->crypto_tx_tailroom_needed_cnt--;
	}
J
Johannes Berg 已提交
404 405 406 407

	kfree(key);
}

408 409 410
int ieee80211_key_link(struct ieee80211_key *key,
		       struct ieee80211_sub_if_data *sdata,
		       struct sta_info *sta)
411 412
{
	struct ieee80211_key *old_key;
413
	int idx, ret;
414
	bool pairwise;
415 416 417 418

	BUG_ON(!sdata);
	BUG_ON(!key);

419
	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
420 421 422 423 424
	idx = key->conf.keyidx;
	key->local = sdata->local;
	key->sdata = sdata;
	key->sta = sta;

J
Johannes Berg 已提交
425 426 427 428 429
	if (sta) {
		/*
		 * some hardware cannot handle TKIP with QoS, so
		 * we indicate whether QoS could be in use.
		 */
430
		if (test_sta_flags(sta, WLAN_STA_WME))
J
Johannes Berg 已提交
431 432
			key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
	} else {
433
		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
J
Johannes Berg 已提交
434 435
			struct sta_info *ap;

436
			/*
437 438
			 * We're getting a sta pointer in, so must be under
			 * appropriate locking for sta_info_get().
439
			 */
440

J
Johannes Berg 已提交
441
			/* same here, the AP could be using QoS */
442
			ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
J
Johannes Berg 已提交
443
			if (ap) {
444
				if (test_sta_flags(ap, WLAN_STA_WME))
J
Johannes Berg 已提交
445 446 447 448 449 450
					key->conf.flags |=
						IEEE80211_KEY_FLAG_WMM_STA;
			}
		}
	}

J
Johannes Berg 已提交
451
	mutex_lock(&sdata->local->key_mtx);
452

453 454 455 456
	if (sta && pairwise)
		old_key = sta->ptk;
	else if (sta)
		old_key = sta->gtk[idx];
457
	else
458 459
		old_key = sdata->keys[idx];

460
	__ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
J
Johannes Berg 已提交
461
	__ieee80211_key_destroy(old_key);
462

J
Johannes Berg 已提交
463
	ieee80211_debugfs_key_add(key);
464

465 466
	key->local->crypto_tx_tailroom_needed_cnt++;

467
	ret = ieee80211_key_enable_hw_accel(key);
J
Johannes Berg 已提交
468

J
Johannes Berg 已提交
469
	mutex_unlock(&sdata->local->key_mtx);
470 471

	return ret;
472 473
}

474
void __ieee80211_key_free(struct ieee80211_key *key)
475
{
476 477 478
	if (!key)
		return;

479 480 481
	/*
	 * Replace key with nothingness if it was ever used.
	 */
J
Johannes Berg 已提交
482
	if (key->sdata)
483
		__ieee80211_key_replace(key->sdata, key->sta,
484 485
				key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
				key, NULL);
J
Johannes Berg 已提交
486
	__ieee80211_key_destroy(key);
487
}
488

489 490
void ieee80211_key_free(struct ieee80211_local *local,
			struct ieee80211_key *key)
491
{
J
Johannes Berg 已提交
492
	mutex_lock(&local->key_mtx);
J
Johannes Berg 已提交
493
	__ieee80211_key_free(key);
J
Johannes Berg 已提交
494
	mutex_unlock(&local->key_mtx);
J
Johannes Berg 已提交
495 496
}

J
Johannes Berg 已提交
497
void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
498 499
{
	struct ieee80211_key *key;
J
Johannes Berg 已提交
500

J
Johannes Berg 已提交
501
	ASSERT_RTNL();
J
Johannes Berg 已提交
502

503
	if (WARN_ON(!ieee80211_sdata_running(sdata)))
J
Johannes Berg 已提交
504
		return;
J
Johannes Berg 已提交
505

J
Johannes Berg 已提交
506
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
507

508 509 510 511
	sdata->local->crypto_tx_tailroom_needed_cnt = 0;

	list_for_each_entry(key, &sdata->key_list, list) {
		sdata->local->crypto_tx_tailroom_needed_cnt++;
J
Johannes Berg 已提交
512
		ieee80211_key_enable_hw_accel(key);
513
	}
514

J
Johannes Berg 已提交
515
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
516 517
}

J
Johannes Berg 已提交
518
void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
J
Johannes Berg 已提交
519 520 521
{
	struct ieee80211_key *key;

J
Johannes Berg 已提交
522
	ASSERT_RTNL();
523

J
Johannes Berg 已提交
524
	mutex_lock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
525

J
Johannes Berg 已提交
526 527
	list_for_each_entry(key, &sdata->key_list, list)
		ieee80211_key_disable_hw_accel(key);
J
Johannes Berg 已提交
528

J
Johannes Berg 已提交
529
	mutex_unlock(&sdata->local->key_mtx);
530
}
J
Johannes Berg 已提交
531

532 533 534
void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_key *key, *tmp;
535

J
Johannes Berg 已提交
536
	mutex_lock(&sdata->local->key_mtx);
537

538
	ieee80211_debugfs_key_remove_mgmt_default(sdata);
539 540

	list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
J
Johannes Berg 已提交
541
		__ieee80211_key_free(key);
542

543 544
	ieee80211_debugfs_key_update_default(sdata);

J
Johannes Berg 已提交
545
	mutex_unlock(&sdata->local->key_mtx);
J
Johannes Berg 已提交
546
}