* [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
@ 2011-01-25 10:21 juuso.oikarinen
2011-01-25 10:27 ` Johannes Berg
2011-01-25 10:28 ` Johannes Berg
0 siblings, 2 replies; 6+ messages in thread
From: juuso.oikarinen @ 2011-01-25 10:21 UTC (permalink / raw)
To: linville; +Cc: linux-wireless
From: Juuso Oikarinen <juuso.oikarinen@nokia.com>
Some vendor specific cipher suites require non-zero key indexes for pairwise
keys, but as of currently, the cfg80211 does not allow it.
As validating they cipher parameters for vendor specific cipher suites is the
job of the driver or hardware/firmware, change the cfg80211 to allow also
non-zero pairwise key indexes for vendor specific ciphers.
Signed-off-by: Juuso Oikarinen <juuso.oikarinen@nokia.com>
---
net/wireless/util.c | 11 +++++++----
1 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4ed065d..6a750bc 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -167,12 +167,15 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
/*
* Disallow pairwise keys with non-zero index unless it's WEP
- * (because current deployments use pairwise WEP keys with
- * non-zero indizes but 802.11i clearly specifies to use zero)
+ * or a vendor specific cipher (because current deployments use
+ * pairwise WEP keys with non-zero indices and for vendor specific
+ * ciphers this should be validated in the driver or hardware level
+ * - but 802.11i clearly specifies to use zero)
*/
if (pairwise && key_idx &&
- params->cipher != WLAN_CIPHER_SUITE_WEP40 &&
- params->cipher != WLAN_CIPHER_SUITE_WEP104)
+ ((params->cipher == WLAN_CIPHER_SUITE_TKIP) ||
+ (params->cipher == WLAN_CIPHER_SUITE_CCMP) ||
+ (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC)))
return -EINVAL;
switch (params->cipher) {
--
1.7.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
2011-01-25 10:21 [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers juuso.oikarinen
@ 2011-01-25 10:27 ` Johannes Berg
2011-01-25 13:47 ` Juuso Oikarinen
2011-01-25 10:28 ` Johannes Berg
1 sibling, 1 reply; 6+ messages in thread
From: Johannes Berg @ 2011-01-25 10:27 UTC (permalink / raw)
To: juuso.oikarinen; +Cc: linville, linux-wireless
On Tue, 2011-01-25 at 12:21 +0200, juuso.oikarinen@nokia.com wrote:
> From: Juuso Oikarinen <juuso.oikarinen@nokia.com>
>
> Some vendor specific cipher suites require non-zero key indexes for pairwise
> keys, but as of currently, the cfg80211 does not allow it.
Well, technically, that is incorrect -- just adding a vendor-specific
cipher to 802.11-2007 (11i) will uphold that requirement. Using
different mechanisms like WAPI might run afoul of this check... But
technically WAPI could also use CCMP etc. and then you might have to use
non-zero even for CCMP, so this code would again be wrong.
OTOH, I don't really see a good way to capture this in code...
johannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
2011-01-25 10:27 ` Johannes Berg
@ 2011-01-25 13:47 ` Juuso Oikarinen
2011-01-25 13:57 ` Johannes Berg
0 siblings, 1 reply; 6+ messages in thread
From: Juuso Oikarinen @ 2011-01-25 13:47 UTC (permalink / raw)
To: ext Johannes Berg; +Cc: linville, linux-wireless
On Tue, 2011-01-25 at 11:27 +0100, ext Johannes Berg wrote:
> On Tue, 2011-01-25 at 12:21 +0200, juuso.oikarinen@nokia.com wrote:
> > From: Juuso Oikarinen <juuso.oikarinen@nokia.com>
> >
> > Some vendor specific cipher suites require non-zero key indexes for pairwise
> > keys, but as of currently, the cfg80211 does not allow it.
>
> Well, technically, that is incorrect -- just adding a vendor-specific
> cipher to 802.11-2007 (11i) will uphold that requirement. Using
> different mechanisms like WAPI might run afoul of this check... But
> technically WAPI could also use CCMP etc. and then you might have to use
> non-zero even for CCMP, so this code would again be wrong.
I guess thats right. I was assuming this was for SMS-4 only, but I guess
it extends to other ciphers too in association with WAPI.
> OTOH, I don't really see a good way to capture this in code...
I would be surprised to see WAPI used with CCMP though - or any other
voluntary manner for that matter - although it is possible ;)
So you think this patch is ok as is, or do I need to find some other
way?
-Juuso
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
2011-01-25 13:47 ` Juuso Oikarinen
@ 2011-01-25 13:57 ` Johannes Berg
0 siblings, 0 replies; 6+ messages in thread
From: Johannes Berg @ 2011-01-25 13:57 UTC (permalink / raw)
To: Juuso Oikarinen; +Cc: linville, linux-wireless
On Tue, 2011-01-25 at 15:47 +0200, Juuso Oikarinen wrote:
> I would be surprised to see WAPI used with CCMP though - or any other
> voluntary manner for that matter - although it is possible ;)
:)
> So you think this patch is ok as is, or do I need to find some other
> way?
I guess it's fine -- I was trying to figure out what they tried to do
with the key index but the WAPI "standard" is kinda vague on that ...
johannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
2011-01-25 10:21 [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers juuso.oikarinen
2011-01-25 10:27 ` Johannes Berg
@ 2011-01-25 10:28 ` Johannes Berg
2011-01-25 10:38 ` Juuso Oikarinen
1 sibling, 1 reply; 6+ messages in thread
From: Johannes Berg @ 2011-01-25 10:28 UTC (permalink / raw)
To: juuso.oikarinen; +Cc: linville, linux-wireless
On Tue, 2011-01-25 at 12:21 +0200, juuso.oikarinen@nokia.com wrote:
> From: Juuso Oikarinen <juuso.oikarinen@nokia.com>
>
> Some vendor specific cipher suites require non-zero key indexes for pairwise
> keys, but as of currently, the cfg80211 does not allow it.
Hmm, also -- does this mean that WAPI might use multiple pairwise keys?
That's most definitely not supported at all in mac80211.
johannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers
2011-01-25 10:28 ` Johannes Berg
@ 2011-01-25 10:38 ` Juuso Oikarinen
0 siblings, 0 replies; 6+ messages in thread
From: Juuso Oikarinen @ 2011-01-25 10:38 UTC (permalink / raw)
To: ext Johannes Berg; +Cc: linville, linux-wireless
On Tue, 2011-01-25 at 11:28 +0100, ext Johannes Berg wrote:
> On Tue, 2011-01-25 at 12:21 +0200, juuso.oikarinen@nokia.com wrote:
> > From: Juuso Oikarinen <juuso.oikarinen@nokia.com>
> >
> > Some vendor specific cipher suites require non-zero key indexes for pairwise
> > keys, but as of currently, the cfg80211 does not allow it.
>
> Hmm, also -- does this mean that WAPI might use multiple pairwise keys?
> That's most definitely not supported at all in mac80211.
Hi, AFAIK no, it does not use multiple pairwise keys. At least the
wl12xx hardware does not appear to support that - it just uses the
latest set key.
Still, in WAPI, the key index is toggled between 0 and 1 for each key
re-negotiation. I don't know the exact encryption details, but the key
index is present in the encrypted data, so it needs to be set correctly
for successful encryption/decryption.
-Juuso
> johannes
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-01-25 13:57 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-01-25 10:21 [PATCH] cfg80211: Allow non-zero indexes for device specific pair-wise ciphers juuso.oikarinen
2011-01-25 10:27 ` Johannes Berg
2011-01-25 13:47 ` Juuso Oikarinen
2011-01-25 13:57 ` Johannes Berg
2011-01-25 10:28 ` Johannes Berg
2011-01-25 10:38 ` Juuso Oikarinen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.