nl80211: Add RSC configuration for new keys

When setting a key with NL80211_CMD_NEW_KEY, we should allow the key
sequence number (RSC) to be set in order to allow replay protection to
work correctly for group keys. This patch documents this use for
nl80211 and adds the couple of missing pieces in nl80211/cfg80211 and
mac80211 to support this. In addition, WEXT SIOCSIWENCODEEXT compat
processing in cfg80211 is extended to handle the RSC (this was already
specified in WEXT, but just not implemented in cfg80211/mac80211).

Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2781525b03d5d450aa750beea60a95ec0a9b8e09..dbea93b694e5aa6e30749949df01fe4dce25f3d3 100644 (file)
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -79,8 +79,8 @@
  * @NL80211_CMD_SET_KEY: Set key attributes %NL80211_ATTR_KEY_DEFAULT,
  *     %NL80211_ATTR_KEY_DEFAULT_MGMT, or %NL80211_ATTR_KEY_THRESHOLD.
  * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA,
- *     %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC and %NL80211_ATTR_KEY_CIPHER
- *     attributes.
+ *     %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER,
+ *     and %NL80211_ATTR_KEY_SEQ attributes.
  * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX
  *     or %NL80211_ATTR_MAC.
  *

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6464bfd232c946c13972fd69c9bd7035bfbea8c5..77e9ff5ec4f3771f5aa400859edc458328e05598 100644 (file)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -141,7 +141,8 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                return -EINVAL;
        }
 
-       key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key);
+       key = ieee80211_key_alloc(alg, key_idx, params->key_len, params->key,
+                                 params->seq_len, params->seq);
        if (!key)
                return -ENOMEM;
 

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index b7e1350273bb139eaacb7b3e222b7327089d53d1..827ea8e6ee0a3855387f77f33d68c51ab35a3abf 100644 (file)
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -290,9 +290,11 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                          int idx,
                                          size_t key_len,
-                                         const u8 *key_data)
+                                         const u8 *key_data,
+                                         size_t seq_len, const u8 *seq)
 {
        struct ieee80211_key *key;
+       int i, j;
 
        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
 
@@ -318,14 +320,31 @@ struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
        case ALG_TKIP:
                key->conf.iv_len = TKIP_IV_LEN;
                key->conf.icv_len = TKIP_ICV_LEN;
+               if (seq && seq_len == 6) {
+                       for (i = 0; i < NUM_RX_DATA_QUEUES; i++) {
+                               key->u.tkip.rx[i].iv32 =
+                                       get_unaligned_le32(&seq[2]);
+                               key->u.tkip.rx[i].iv16 =
+                                       get_unaligned_le16(seq);
+                       }
+               }
                break;
        case ALG_CCMP:
                key->conf.iv_len = CCMP_HDR_LEN;
                key->conf.icv_len = CCMP_MIC_LEN;
+               if (seq && seq_len == CCMP_PN_LEN) {
+                       for (i = 0; i < NUM_RX_DATA_QUEUES; i++)
+                               for (j = 0; j < CCMP_PN_LEN; j++)
+                                       key->u.ccmp.rx_pn[i][j] =
+                                               seq[CCMP_PN_LEN - j - 1];
+               }
                break;
        case ALG_AES_CMAC:
                key->conf.iv_len = 0;
                key->conf.icv_len = sizeof(struct ieee80211_mmie);
+               if (seq && seq_len == 6)
+                       for (j = 0; j < 6; j++)
+                               key->u.aes_cmac.rx_pn[j] = seq[6 - j - 1];
                break;
        }
        memcpy(key->conf.key, key_data, key_len);

diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 215d3ef42a4f3c8a3db8017d9792caca7bddff6f..9572e00f532cc670696efb07088a6d0731e2ac17 100644 (file)
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -144,7 +144,8 @@ struct ieee80211_key {
 struct ieee80211_key *ieee80211_key_alloc(enum ieee80211_key_alg alg,
                                          int idx,
                                          size_t key_len,
-                                         const u8 *key_data);
+                                         const u8 *key_data,
+                                         size_t seq_len, const u8 *seq);
 /*
  * Insert a key into data structures (sdata, sta if necessary)
  * to make it used, free old key.

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cad281390cfa2750fcedafc4285b9a7137fa687e..f0fec2f4982889c98b76a7bb9064c5ad52f21ff9 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1115,6 +1115,11 @@ static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
                params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
        }
 
+       if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
+               params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
+               params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
+       }
+
        if (info->attrs[NL80211_ATTR_KEY_IDX])
                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 

diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index ffc98a8d6e5cba5fd74f9fd419acfd335ac68933..f98090b90fbf88e59c4bf7c84b875dc4bd3426af 100644 (file)
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -663,6 +663,11 @@ int cfg80211_wext_siwencodeext(struct net_device *dev,
        params.key_len = ext->key_len;
        params.cipher = cipher;
 
+       if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
+               params.seq = ext->rx_seq;
+               params.seq_len = 6;
+       }
+
        return cfg80211_set_encryption(
                        rdev, dev, addr, remove,
                        ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY,