Re: [PATCH v2] p54: connect to 11w protected networks

[Johannes Berg <johannes@sipsolutions.net>]

On Tue, 2012-09-04 at 16:37 +0200, Johannes Berg wrote:
> On Tue, 2012-09-04 at 09:33 -0500, Dan Williams wrote:
> > On Tue, 2012-09-04 at 16:15 +0200, Johannes Berg wrote:
> > > On Tue, 2012-09-04 at 15:19 +0200, Christian Lamparter wrote:
> > > 
> > > > As you feared: the firmware is corrupting incoming management
> > > > frames. However, it does so only when a rxkey was configured.
> > > > So as a possible trade-off, MFP will only be supported by p54,
> > > > when the firmware crypto offloading is relieved of his duties
> > > > (disabled). 
> > > > 
> > > > Note: Strictly speaking, it would be enough to no longer upload
> > > > any rx key which could affect management frames, as the firmware
> > > > does not decrypt any frames unless there is a fitting key candidate.
> > > 
> > > Right, however, that would kinda defeat the point. Unless ... maybe we
> > > can tell the driver if 11w is going to be used at all? If we did that,
> > > we could make it work in the set_key callback.
> > > 
> > > For now your patch looks good though.
> > 
> > We can't get this to happen without a module option?  Is there a way to
> > turn the crypto offloading off when we know we're connecting to a W
> > protected AP?
> 
> Yeah that's what I was thinking. I suppose we *could* somehow do this by
> setting some key flag in mac80211 that the driver can check.

Something like this perhaps:

http://p.sipsolutions.net/76d17d49f4685cda.txt

But I'd want somebody to check if the mesh code is right and maybe we
need to think about the AP case (have hostapd tell us whether it uses
MFP or not) ... and maybe docs should be improved

johannes