Re: [PATCH 5/8] cfg80211: Add KEK/nonces for FILS association frames

[Johannes Berg <johannes@sipsolutions.net>]

> +++ b/net/wireless/nl80211.c
> @@ -414,6 +414,10 @@ enum nl80211_multicast_groups {
>  	[NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
>  	[NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
>  	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
> +	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
> +				    .len = FILS_MAX_KEK_LEN },
> +	[NL80211_ATTR_FILS_NONCES] = { .type = NLA_BINARY,
> +				       .len = 2 * FILS_NONCE_LEN },
>  };

If you remove the type = NLA_BINARY and just leave the type zero, then
you'll get *minimum* length validation, rather than limiting the
maximum length. That seems more appropriate for the nonces?

> +	if (info->attrs[NL80211_ATTR_FILS_NONCES]) {
> +		if (nla_len(info->attrs[NL80211_ATTR_FILS_NONCES])
> !=
> +		    2 * FILS_NONCE_LEN)
> +			return -EINVAL;

You're validating the *exact* length here, which unfortunately nlattr
doesn't support right now, but perhaps we can live with checking that
it's at least that many bytes, and using only 2*nonces? We do that for
most other attributes (like MAC addresses).

Or do we expect to extend this to more than 2 nonces in the future, at
which point we'll need the length?

johannes