nl80211: support 4-way handshake offloading for WPA/WPA2-PSK in AP mode

Let drivers advertise support for AP-mode WPA/WPA2-PSK 4-way handshake
offloading with a new NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK flag.

Extend use of NL80211_ATTR_PMK attribute indicating it might be passed
as part of NL80211_CMD_START_AP command, and contain the PSK (which is
the PMK, hence the name).

The driver is assumed to handle the 4-way handshake by itself in this
case, instead of relying on userspace.

Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
Link: https://lore.kernel.org/r/20200623134938.39997-2-chi-hsien.lin@cypress.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index a3ae2b0..631f3a9 100644 (file)
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -183,18 +183,27 @@
  *
  * By setting @NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK flag drivers
  * can indicate they support offloading EAPOL handshakes for WPA/WPA2
- * preshared key authentication. In %NL80211_CMD_CONNECT the preshared
- * key should be specified using %NL80211_ATTR_PMK. Drivers supporting
- * this offload may reject the %NL80211_CMD_CONNECT when no preshared
- * key material is provided, for example when that driver does not
- * support setting the temporal keys through %CMD_NEW_KEY.
+ * preshared key authentication in station mode. In %NL80211_CMD_CONNECT
+ * the preshared key should be specified using %NL80211_ATTR_PMK. Drivers
+ * supporting this offload may reject the %NL80211_CMD_CONNECT when no
+ * preshared key material is provided, for example when that driver does
+ * not support setting the temporal keys through %NL80211_CMD_NEW_KEY.
  *
  * Similarly @NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X flag can be
  * set by drivers indicating offload support of the PTK/GTK EAPOL
- * handshakes during 802.1X authentication. In order to use the offload
- * the %NL80211_CMD_CONNECT should have %NL80211_ATTR_WANT_1X_4WAY_HS
- * attribute flag. Drivers supporting this offload may reject the
- * %NL80211_CMD_CONNECT when the attribute flag is not present.
+ * handshakes during 802.1X authentication in station mode. In order to
+ * use the offload the %NL80211_CMD_CONNECT should have
+ * %NL80211_ATTR_WANT_1X_4WAY_HS attribute flag. Drivers supporting this
+ * offload may reject the %NL80211_CMD_CONNECT when the attribute flag is
+ * not present.
+ *
+ * By setting @NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK flag drivers
+ * can indicate they support offloading EAPOL handshakes for WPA/WPA2
+ * preshared key authentication in AP mode. In %NL80211_CMD_START_AP
+ * the preshared key should be specified using %NL80211_ATTR_PMK. Drivers
+ * supporting this offload may reject the %NL80211_CMD_START_AP when no
+ * preshared key material is provided, for example when that driver does
+ * not support setting the temporal keys through %NL80211_CMD_NEW_KEY.
  *
  * For 802.1X the PMK or PMK-R0 are set by providing %NL80211_ATTR_PMK
  * using %NL80211_CMD_SET_PMK. For offloaded FT support also
@@ -2362,10 +2371,11 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_PMK: attribute for passing PMK key material. Used with
  *     %NL80211_CMD_SET_PMKSA for the PMKSA identified by %NL80211_ATTR_PMKID.
- *     For %NL80211_CMD_CONNECT it is used to provide PSK for offloading 4-way
- *     handshake for WPA/WPA2-PSK networks. For 802.1X authentication it is
- *     used with %NL80211_CMD_SET_PMK. For offloaded FT support this attribute
- *     specifies the PMK-R0 if NL80211_ATTR_PMKR0_NAME is included as well.
+ *     For %NL80211_CMD_CONNECT and %NL80211_CMD_START_AP it is used to provide
+ *     PSK for offloading 4-way handshake for WPA/WPA2-PSK networks. For 802.1X
+ *     authentication it is used with %NL80211_CMD_SET_PMK. For offloaded FT
+ *     support this attribute specifies the PMK-R0 if NL80211_ATTR_PMKR0_NAME
+ *     is included as well.
  *
  * @NL80211_ATTR_SCHED_SCAN_MULTI: flag attribute which user-space shall use to
  *     indicate that it supports multiple active scheduled scan requests.
@@ -5807,6 +5817,10 @@ enum nl80211_feature_flags {
  * @NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION: Driver supports Operating
  *     Channel Validation (OCV) when using driver's SME for RSNA handshakes.
  *
+ * @NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK: Device wants to do 4-way
+ *     handshake with PSK in AP mode (PSK is passed as part of the start AP
+ *     command).
+ *
  * @NUM_NL80211_EXT_FEATURES: number of extended features.
  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
  */
@@ -5863,6 +5877,7 @@ enum nl80211_ext_feature_index {
        NL80211_EXT_FEATURE_SCAN_FREQ_KHZ,
        NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS,
        NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION,
+       NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK,
 
        /* add new features before the definition below */
        NUM_NL80211_EXT_FEATURES,

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 8d78a6f..a096682 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9442,7 +9442,9 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
                        return -EINVAL;
                if (!wiphy_ext_feature_isset(&rdev->wiphy,
-                                            NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
+                                            NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
+                   !wiphy_ext_feature_isset(&rdev->wiphy,
+                                            NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
                        return -EINVAL;
                settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
        }