From patchwork Tue Aug 14 10:42:53 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Wetzel X-Patchwork-Id: 10565327 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3C5AB1515 for ; Tue, 14 Aug 2018 10:43:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2A8AA28D5B for ; Tue, 14 Aug 2018 10:43:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1EAE728DA3; Tue, 14 Aug 2018 10:43:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7054328D88 for ; Tue, 14 Aug 2018 10:43:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732190AbeHNNaK (ORCPT ); Tue, 14 Aug 2018 09:30:10 -0400 Received: from 3.mo179.mail-out.ovh.net ([178.33.251.175]:60376 "EHLO 3.mo179.mail-out.ovh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729567AbeHNNaK (ORCPT ); Tue, 14 Aug 2018 09:30:10 -0400 Received: from player694.ha.ovh.net (unknown [10.109.160.253]) by mo179.mail-out.ovh.net (Postfix) with ESMTP id B5348E1AB5 for ; Tue, 14 Aug 2018 12:43:32 +0200 (CEST) Received: from awhome.eu (p4FF910D8.dip0.t-ipconnect.de [79.249.16.216]) (Authenticated sender: postmaster@awhome.eu) by player694.ha.ovh.net (Postfix) with ESMTPSA id 761742C00B2; Tue, 14 Aug 2018 12:43:31 +0200 (CEST) From: Alexander Wetzel DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=wetzel-home.de; s=wetzel-home; t=1534243404; bh=T1FrQUoiL7z4ZRwc+ofJK+dP919xm2cvruBQBGTXv2Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VILw2NDMj92icIPuPgmdHl5Fnsy978+O6gI1+Mf/DB1QuHoXfRO3TZRMhTAYojHyO BztWsGuA7Zs5gQjEkRwFRFboOK2OhLnf2B6xxbvsqVm5nQTepLpH75t17hMBGILeqg iCdAcaD1Kwh3BHnmvFqYl6ZrOzEyWq2l8A2D+WWU= To: johannes@sipsolutions.net Cc: linux-wireless@vger.kernel.org, Alexander Wetzel Subject: [PATCH v6 1/3] nl80211: Add ATOMIC_KEY_REPLACE API Date: Tue, 14 Aug 2018 12:42:53 +0200 Message-Id: <20180814104255.4183-2-alexander@wetzel-home.de> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20180814104255.4183-1-alexander@wetzel-home.de> References: <20180814104255.4183-1-alexander@wetzel-home.de> X-Ovh-Tracer-Id: 12849895638445006023 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: 0 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedtjedrudehgdeffecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemuceftddtnecu Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Drivers able to correctly replace a in-use key should set NL80211_EXT_FEATURE_ATOMIC_KEY_REPLACE to allow the userspace (e.g. hostapd or wpa_supplicant) to rekey PTK keys. The userspace must detect a PTK rekey attempt and only go ahead with the rekey when the driver has set this flag. If the driver is not supporting the feature the userspace either must not replace the PTK key or perform a full re-association. Ignoring this flag and continuing to rekey the connection can still work but has to be considered insecure and broken. It can leak cleartext packets or freeze the connection and is only supported to allow the userspace to be updated. Signed-off-by: Alexander Wetzel Reviewed-by: Denis Kenzior --- include/uapi/linux/nl80211.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 7acc16f34942..b41b9ade0449 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -5224,6 +5224,11 @@ enum nl80211_feature_flags { * except for supported rates from the probe request content if requested * by the %NL80211_SCAN_FLAG_MIN_PREQ_CONTENT flag. * + * @NL80211_EXT_FEATURE_ATOMIC_KEY_REPLACE: Driver/device confirm that they are + * able to rekey an in-use key correctly. Userspace must not rekey PTK keys + * if this flag is not set. Ignoring this can leak clear text packets and/or + * freeze the connection. + * * @NUM_NL80211_EXT_FEATURES: number of extended features. * @MAX_NL80211_EXT_FEATURES: highest extended feature index. */ @@ -5259,6 +5264,7 @@ enum nl80211_ext_feature_index { NL80211_EXT_FEATURE_TXQS, NL80211_EXT_FEATURE_SCAN_RANDOM_SN, NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT, + NL80211_EXT_FEATURE_ATOMIC_KEY_REPLACE, /* add new features before the definition below */ NUM_NL80211_EXT_FEATURES,