From 96a604128bdbbcfd0dcc909f59113680817a2099 Mon Sep 17 00:00:00 2001 From: Vinay Gannevaram Date: Sun, 20 Mar 2022 19:26:02 +0530 Subject: [PATCH] Use separate PASN capabilities for AP and STA modes Use separate capabilities for AP and STA modes for P802.11az security parameters secure LTF support, secure RTT measurement exchange support, and protection of range negotiation and measurement management frames support. P802.11az security parameters are considered to be supported for both station and AP modes if the driver sets NL80211_EXT_FEATURE_SECURE_LTF, NL80211_EXT_FEATURE_SECURE_RTT, and NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE flags. The driver can advertize capabilities specific to each mode using QCA_WLAN_VENDOR_FEATURE_SECURE_LTF*, QCA_WLAN_VENDOR_FEATURE_SECURE_RTT*, and QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE* flags. Signed-off-by: Jouni Malinen --- src/ap/ieee802_11.c | 2 +- src/ap/ieee802_11_shared.c | 6 +++--- src/ap/wpa_auth_glue.c | 7 ++++--- src/drivers/driver.h | 21 +++++++++++++------ src/drivers/driver_nl80211_capa.c | 35 +++++++++++++++++++++++++++++++ wpa_supplicant/pasn_supplicant.c | 8 +++---- 6 files changed, 62 insertions(+), 17 deletions(-) diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c index e9288bed9..86cb3965c 100644 --- a/src/ap/ieee802_11.c +++ b/src/ap/ieee802_11.c @@ -3167,7 +3167,7 @@ static void handle_auth_pasn_1(struct hostapd_data *hapd, struct sta_info *sta, sta->pasn->akmp = rsn_data.key_mgmt; sta->pasn->cipher = rsn_data.pairwise_cipher; - derive_kdk = (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) && + derive_kdk = (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP) && ieee802_11_rsnx_capab_len(elems.rsnxe, elems.rsnxe_len, WLAN_RSNX_CAPAB_SECURE_LTF); #ifdef CONFIG_TESTING_OPTIONS diff --git a/src/ap/ieee802_11_shared.c b/src/ap/ieee802_11_shared.c index 72f59113f..d962cc0d5 100644 --- a/src/ap/ieee802_11_shared.c +++ b/src/ap/ieee802_11_shared.c @@ -1074,11 +1074,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len) #endif /* CONFIG_SAE_PK */ } - if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) + if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP) capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF); - if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT) + if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP) capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT); - if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG) + if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP) capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG); flen = (capab & 0xff00) ? 2 : 1; diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c index 9d776db2d..bef8fd261 100644 --- a/src/ap/wpa_auth_glue.c +++ b/src/ap/wpa_auth_glue.c @@ -1551,11 +1551,12 @@ int hostapd_setup_wpa(struct hostapd_data *hapd) #endif /* CONFIG_OCV */ _conf.secure_ltf = - !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF); + !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP); _conf.secure_rtt = - !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT); + !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP); _conf.prot_range_neg = - !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG); + !!(hapd->iface->drv_flags2 & + WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP); hapd->wpa_auth = wpa_init(hapd->own_addr, &_conf, &cb, hapd); if (hapd->wpa_auth == NULL) { diff --git a/src/drivers/driver.h b/src/drivers/driver.h index ccbae59a3..7daedfe2d 100644 --- a/src/drivers/driver.h +++ b/src/drivers/driver.h @@ -2060,15 +2060,15 @@ struct wpa_driver_capa { #define WPA_DRIVER_FLAGS2_CONTROL_PORT_RX 0x0000000000000001ULL /** Driver supports TX status reports for EAPOL frames through control port */ #define WPA_DRIVER_FLAGS2_CONTROL_PORT_TX_STATUS 0x0000000000000002ULL -/** Driver supports secure LTF */ -#define WPA_DRIVER_FLAGS2_SEC_LTF 0x0000000000000004ULL -/** Driver supports secure RTT measurement exchange */ -#define WPA_DRIVER_FLAGS2_SEC_RTT 0x0000000000000008ULL +/** Driver supports secure LTF in AP mode */ +#define WPA_DRIVER_FLAGS2_SEC_LTF_AP 0x0000000000000004ULL +/** Driver supports secure RTT measurement exchange in AP mode */ +#define WPA_DRIVER_FLAGS2_SEC_RTT_AP 0x0000000000000008ULL /** * Driver supports protection of range negotiation and measurement management - * frames + * frames in AP mode */ -#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG 0x0000000000000010ULL +#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP 0x0000000000000010ULL /** Driver supports Beacon frame TX rate configuration (HE rates) */ #define WPA_DRIVER_FLAGS2_BEACON_RATE_HE 0x0000000000000020ULL /** Driver supports Beacon protection only in client mode */ @@ -2081,6 +2081,15 @@ struct wpa_driver_capa { #define WPA_DRIVER_FLAGS2_SA_QUERY_OFFLOAD_AP 0x0000000000000200ULL /** Driver supports background radar/CAC detection */ #define WPA_DRIVER_RADAR_BACKGROUND 0x0000000000000400ULL +/** Driver supports secure LTF in STA mode */ +#define WPA_DRIVER_FLAGS2_SEC_LTF_STA 0x0000000000000800ULL +/** Driver supports secure RTT measurement exchange in STA mode */ +#define WPA_DRIVER_FLAGS2_SEC_RTT_STA 0x0000000000001000ULL +/** + * Driver supports protection of range negotiation and measurement management + * frames in STA mode + */ +#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA 0x0000000000002000ULL u64 flags2; #define FULL_AP_CLIENT_STATE_SUPP(drv_flags) \ diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c index f5b62705a..03ac9345b 100644 --- a/src/drivers/driver_nl80211_capa.c +++ b/src/drivers/driver_nl80211_capa.c @@ -675,6 +675,25 @@ static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info, if (ext_feature_isset(ext_features, len, NL80211_EXT_FEATURE_RADAR_BACKGROUND)) capa->flags2 |= WPA_DRIVER_RADAR_BACKGROUND; + + if (ext_feature_isset(ext_features, len, + NL80211_EXT_FEATURE_SECURE_LTF)) { + capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_STA; + capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_AP; + } + + if (ext_feature_isset(ext_features, len, + NL80211_EXT_FEATURE_SECURE_RTT)) { + capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_STA; + capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_AP; + } + + if (ext_feature_isset( + ext_features, len, + NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE)) { + capa->flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA; + capa->flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP; + } } @@ -1334,6 +1353,22 @@ static void qca_nl80211_get_features(struct wpa_driver_nl80211_data *drv) drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_AP; if (check_feature(QCA_WLAN_VENDOR_FEATURE_OCE_STA_CFON, &info)) drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_STA_CFON; + if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_LTF_STA, &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_STA; + if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_LTF_AP, &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_AP; + if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_RTT_STA, &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_STA; + if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_RTT_AP, &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_AP; + if (check_feature( + QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE_STA, + &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA; + if (check_feature( + QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE_AP, + &info)) + drv->capa.flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP; os_free(info.flags); } diff --git a/wpa_supplicant/pasn_supplicant.c b/wpa_supplicant/pasn_supplicant.c index dc21b6a3c..aa5fc087b 100644 --- a/wpa_supplicant/pasn_supplicant.c +++ b/wpa_supplicant/pasn_supplicant.c @@ -732,11 +732,11 @@ static struct wpabuf * wpas_pasn_build_auth_1(struct wpa_supplicant *wpa_s, /* Add own RNSXE */ capab = 0; capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E); - if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) + if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF); - if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT) + if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_STA) capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT); - if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG) + if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA) capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG); wpa_pasn_add_rsnxe(buf, capab); @@ -1080,7 +1080,7 @@ static int wpas_pasn_start(struct wpa_supplicant *wpa_s, const u8 *bssid, pasn->group = group; pasn->freq = freq; - derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) && + derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) && ieee802_11_rsnx_capab(beacon_rsnxe, WLAN_RSNX_CAPAB_SECURE_LTF); #ifdef CONFIG_TESTING_OPTIONS