From patchwork Fri Dec 8 13:32:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Govind Singh X-Patchwork-Id: 10102551 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AE279602A0 for ; Fri, 8 Dec 2017 13:32:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A415228C86 for ; Fri, 8 Dec 2017 13:32:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 95BB528C88; Fri, 8 Dec 2017 13:32:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 22A0F28C86 for ; Fri, 8 Dec 2017 13:32:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753311AbdLHNcR (ORCPT ); Fri, 8 Dec 2017 08:32:17 -0500 Received: from sabertooth01.qualcomm.com ([65.197.215.72]:44489 "EHLO sabertooth01.qualcomm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752965AbdLHNcQ (ORCPT ); Fri, 8 Dec 2017 08:32:16 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1512739936; x=1544275936; h=from:to:cc:subject:date:message-id; bh=TEeH8LmdbdmHmAgLMWBpRB05pyK3RAIGNH51UzdBCcY=; b=tybjA4MqXDvNP4hZ+mb0WB8siyXhT+1ONf3ROBEihF9Rz09mzE6+E0o1 si9F5sAuisT6xXXz7fyL9tRgl0XFF6M+TNYPCKBDmiRWQ96YxKV4GeL/O Wbo1N/8ubwH8aR/L1RnvlnD+mYlJRzO4vihBdVn+YFtNmDQgkfMCPl2M5 w=; X-IronPort-AV: E=Sophos;i="5.45,377,1508828400"; d="scan'208";a="117515987" Received: from unknown (HELO ironmsg02-L.qualcomm.com) ([10.53.140.109]) by sabertooth01.qualcomm.com with ESMTP; 08 Dec 2017 05:32:16 -0800 X-IronPort-AV: E=McAfee;i="5900,7806,8738"; a="1052831864" X-MGA-submission: =?us-ascii?q?MDG7lwkRkeVzK3gPh9XGrObFVpxdbw5Joc+sEM?= =?us-ascii?q?DdO/XCLMjiqrrPkETzD4VuJpabMJETaJMISg6RdrqsnSpvzATxLD2yCG?= =?us-ascii?q?NdNkeL0o8P7SO1Vxs4+k7LJw/YN3fqY3bZPYTEGMP4R34oOXxIMBqRX4?= =?us-ascii?q?3W?= Received: from govinds-linux.qualcomm.com ([10.204.116.70]) by ironmsg02-L.qualcomm.com with ESMTP; 08 Dec 2017 05:32:14 -0800 Received: by govinds-linux.qualcomm.com (Postfix, from userid 399420) id E567F358C; Fri, 8 Dec 2017 19:02:13 +0530 (IST) From: Govind Singh To: ath10k@lists.infradead.org Cc: linux-wireless@vger.kernel.org, Govind Singh Subject: [PATCH 2/2] ath10k: Populate RSC counter to firmware Date: Fri, 8 Dec 2017 19:02:12 +0530 Message-Id: <1512739932-1577-1-git-send-email-govinds@qti.qualcomm.com> X-Mailer: git-send-email 1.9.1 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Access Point (AP) re-transmits message 3 of 4 way handshake if AP does not receive an appropriate response as acknowledgment. As a result, the client may receive message 3 multiple times. Each time it receives this message, it reinstalls the same encryption key, and thereby reset the incremental transmit packet number (nonce) and receive replay counter used by the encryption protocol. By forcing nonce reuse in this manner, the encryption protocol can be attacked, e.g., packets can be replayed, decrypted, and/or forged. Send RSC counter to FW in set key WMI command, so that FW can drop the packet in PN check if received packet sequence no is less than current RSC counter during group keys(GTK) exchange. Tested on QCA6174 HW3.0 with firmware version RM.4.4.1.c1-00035-QCARMSWP-1. Signed-off-by: Govind Singh --- drivers/net/wireless/ath/ath10k/mac.c | 1 + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++ drivers/net/wireless/ath/ath10k/wmi.h | 4 +++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c index 06383e7..43f78e3 100644 --- a/drivers/net/wireless/ath/ath10k/mac.c +++ b/drivers/net/wireless/ath/ath10k/mac.c @@ -226,6 +226,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif, .macaddr = macaddr, }; + memcpy(arg.key_rsc_counter, key->rx_pn, IEEE80211_MAX_PN_LEN); lockdep_assert_held(&arvif->ar->conf_mutex); switch (key->cipher) { diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 7616c1c..e7148f0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -1849,6 +1849,9 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar) if (arg->macaddr) ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr); + memcpy(&cmd->key_rsc_counter, &arg->key_rsc_counter, + WMI_MAX_RSC_LEN); + ptr += sizeof(*tlv); ptr += sizeof(*cmd); diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h index c02b21c..4849787 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.h +++ b/drivers/net/wireless/ath/ath10k/wmi.h @@ -4752,6 +4752,7 @@ struct wmi_key_seq_counter { #define WMI_CIPHER_CKIP 0x6 #define WMI_CIPHER_AES_CMAC 0x7 #define WMI_CIPHER_AES_GCM 0x8 +#define WMI_MAX_RSC_LEN 0x8 struct wmi_vdev_install_key_cmd { __le32 vdev_id; @@ -4759,7 +4760,7 @@ struct wmi_vdev_install_key_cmd { __le32 key_idx; __le32 key_flags; __le32 key_cipher; /* %WMI_CIPHER_ */ - struct wmi_key_seq_counter key_rsc_counter; + u8 key_rsc_counter[WMI_MAX_RSC_LEN]; struct wmi_key_seq_counter key_global_rsc_counter; struct wmi_key_seq_counter key_tsc_counter; u8 wpi_key_rsc_counter[16]; @@ -4782,6 +4783,7 @@ struct wmi_vdev_install_key_arg { u32 key_txmic_len; u32 key_rxmic_len; const void *key_data; + u8 key_rsc_counter[IEEE80211_MAX_PN_LEN]; }; /*