mac80211: Allow station mode SAE to be implemented in user space

SAE uses two rounds of Authentication frames and both rounds require
considerable calculation to be done. This commit extends the existing
station mode authentication request to allow more control for user
space programs to build the SAE fields and to run the authentication
step ones. Only the second round with authentication transaction
sequence 2 will result in moving to authenticated state.

Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c06219fe90941dc77efcc472eadcd4be1d30984d..f17c41acb310a0cdebc7c87554f295b223829ac3 100644 (file)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -378,8 +378,9 @@ struct ieee80211_mgd_auth_data {
        u8 key_len, key_idx;
        bool done;
 
-       size_t ie_len;
-       u8 ie[];
+       u16 sae_trans, sae_status;
+       size_t data_len;
+       u8 data[];
 };
 
 struct ieee80211_mgd_assoc_data {

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2c8969b67851d5ed9f57321a045056fa7a78b998..473b755b349fc4a1a6400dbdd8e3300e80af47d8 100644 (file)
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -599,6 +599,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
        wiphy->features = NL80211_FEATURE_SK_TX_STATUS |
+                         NL80211_FEATURE_SAE |
                          NL80211_FEATURE_HT_IBSS;
 
        if (!ops->set_key)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 04334b0b6b4e5577bbd79ac729b79e2437782107..f24884a606140f35be380ff6a491d9102f58f466 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1917,6 +1917,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
        case WLAN_AUTH_OPEN:
        case WLAN_AUTH_LEAP:
        case WLAN_AUTH_FT:
+       case WLAN_AUTH_SAE:
                break;
        case WLAN_AUTH_SHARED_KEY:
                if (ifmgd->auth_data->expected_transaction != 4) {
@@ -1936,6 +1937,15 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
        ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
        run_again(ifmgd, ifmgd->auth_data->timeout);
 
+       if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
+           ifmgd->auth_data->expected_transaction != 2) {
+               /*
+                * Report auth frame to user space for processing since another
+                * round of Authentication frames is still needed.
+                */
+               return RX_MGMT_CFG80211_RX_AUTH;
+       }
+
        /* move station state to auth */
        mutex_lock(&sdata->local->sta_mtx);
        sta = sta_info_get(sdata, bssid);
@@ -2762,13 +2772,23 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
        drv_mgd_prepare_tx(local, sdata);
 
        if (auth_data->bss->proberesp_ies) {
+               u16 trans = 1;
+               u16 status = 0;
+
                sdata_info(sdata, "send auth to %pM (try %d/%d)\n",
                           auth_data->bss->bssid, auth_data->tries,
                           IEEE80211_AUTH_MAX_TRIES);
 
                auth_data->expected_transaction = 2;
-               ieee80211_send_auth(sdata, 1, auth_data->algorithm, 0,
-                                   auth_data->ie, auth_data->ie_len,
+
+               if (auth_data->algorithm == WLAN_AUTH_SAE) {
+                       trans = auth_data->sae_trans;
+                       status = auth_data->sae_status;
+                       auth_data->expected_transaction = trans;
+               }
+
+               ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
+                                   auth_data->data, auth_data->data_len,
                                    auth_data->bss->bssid,
                                    auth_data->bss->bssid, NULL, 0, 0);
        } else {
@@ -3329,19 +3349,33 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
        case NL80211_AUTHTYPE_NETWORK_EAP:
                auth_alg = WLAN_AUTH_LEAP;
                break;
+       case NL80211_AUTHTYPE_SAE:
+               auth_alg = WLAN_AUTH_SAE;
+               break;
        default:
                return -EOPNOTSUPP;
        }
 
-       auth_data = kzalloc(sizeof(*auth_data) + req->ie_len, GFP_KERNEL);
+       auth_data = kzalloc(sizeof(*auth_data) + req->sae_data_len +
+                           req->ie_len, GFP_KERNEL);
        if (!auth_data)
                return -ENOMEM;
 
        auth_data->bss = req->bss;
 
+       if (req->sae_data_len >= 4) {
+               __le16 *pos = (__le16 *) req->sae_data;
+               auth_data->sae_trans = le16_to_cpu(pos[0]);
+               auth_data->sae_status = le16_to_cpu(pos[1]);
+               memcpy(auth_data->data, req->sae_data + 4,
+                      req->sae_data_len - 4);
+               auth_data->data_len += req->sae_data_len - 4;
+       }
+
        if (req->ie && req->ie_len) {
-               memcpy(auth_data->ie, req->ie, req->ie_len);
-               auth_data->ie_len = req->ie_len;
+               memcpy(&auth_data->data[auth_data->data_len],
+                      req->ie, req->ie_len);
+               auth_data->data_len += req->ie_len;
        }
 
        if (req->key && req->key_len) {