History

wifi: cfg80211: add LTF keyseed support for secure ranging

Currently there is no way to install an LTF key seed that can be used in non-trigger-based (NTB) and trigger-based (TB) FTM ranging to protect NDP frames. Without this, drivers cannot enable PHY-layer security for peer measurement sessions, leaving ranging measurements vulnerable to eavesdropping and manipulation. Introduce NL80211_KEY_LTF_SEED attribute and the dedicated extended feature flag NL80211_EXT_FEATURE_SET_KEY_LTF_SEED to allow drivers to advertise and install LTF key seeds via nl80211. The key seed must be configured beforehand to ensure the peer measurement session is secure. The driver must advertise both NL80211_EXT_FEATURE_SECURE_LTF and NL80211_EXT_FEATURE_SET_KEY_LTF_SEED for the key seed installation to be permitted. The LTF key seed is pairwise key material and must only be used with pairwise key type. Reject attempts to use it with other key types.

Peddolla Harshavardhan Reddy committed 6 months ago

Commit 4bb6e581 parent 410aa475 files · +47 −0Browse files

Unified · Split

5 files
  1. include/linux/ieee80211.h +1 −0
  2. include/net/cfg80211.h +4 −0
  3. include/uapi/linux/nl80211.h +18 −0
  4. net/wireless/nl80211.c +9 −0
  5. net/wireless/util.c +15 −0
include/linux/ieee80211.h+1−0
@@ -2236,6 +2236,7 @@ struct ieee80211_multiple_bssid_configuration { · 2235 unmodified lines
2236#define WLAN_AKM_SUITE_WFA_DPP SUITE(WLAN_OUI_WFA, 2)2236#define WLAN_AKM_SUITE_WFA_DPP SUITE(WLAN_OUI_WFA, 2)
2237 2237
2238#define WLAN_MAX_KEY_LEN 322238#define WLAN_MAX_KEY_LEN 32
2239#define WLAN_MAX_SECURE_LTF_KEYSEED_LEN 48
2239 2240
2240#define WLAN_PMK_NAME_LEN 162241#define WLAN_PMK_NAME_LEN 16
2241#define WLAN_PMKID_LEN 162242#define WLAN_PMKID_LEN 16
include/net/cfg80211.h+4−0
@@ -830,6 +830,8 @@ struct vif_params { · 829 unmodified lines
830 * @seq_len: length of @seq.830 * @seq_len: length of @seq.
831 * @vlan_id: vlan_id for VLAN group key (if nonzero)831 * @vlan_id: vlan_id for VLAN group key (if nonzero)
832 * @mode: key install mode (RX_TX, NO_TX or SET_TX)832 * @mode: key install mode (RX_TX, NO_TX or SET_TX)
833 * @ltf_keyseed: LTF key seed material
834 * @ltf_keyseed_len: length of LTF key seed material
833 */835 */
834struct key_params {836struct key_params {
835 const u8 *key;837 const u8 *key;
@@ -839,6 +841,8 @@ struct key_params { · 3 unmodified lines
839 u16 vlan_id;841 u16 vlan_id;
840 u32 cipher;842 u32 cipher;
841 enum nl80211_key_mode mode;843 enum nl80211_key_mode mode;
844 const u8 *ltf_keyseed;
845 size_t ltf_keyseed_len;
842};846};
843 847
844/**848/**
include/uapi/linux/nl80211.h+18−0
@@ -5814,6 +5814,18 @@ enum nl80211_key_default_types { · 5813 unmodified lines
5814 * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode.5814 * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode.
5815 * Defaults to @NL80211_KEY_RX_TX.5815 * Defaults to @NL80211_KEY_RX_TX.
5816 * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key5816 * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key
5817 * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate
5818 * secure LTF keys used in case of peer measurement request with FTM
5819 * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED
5820 * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED. Secure LTF key seeds
5821 * will help enable PHY security in peer measurement session.
5822 * The LTF key seed is installed along with the TK (Temporal Key) using
5823 * %NL80211_CMD_NEW_KEY. The TK is configured using the
5824 * %NL80211_ATTR_KEY_DATA attribute, while the LTF key seed is configured
5825 * using this attribute. Both keys must be configured before initiation
5826 * of peer measurement to ensure peer measurement session is secure.
5827 * Only valid if %NL80211_EXT_FEATURE_SET_KEY_LTF_SEED is set. This
5828 * attribute is restricted to pairwise keys (%NL80211_KEYTYPE_PAIRWISE).
5817 *5829 *
5818 * @__NL80211_KEY_AFTER_LAST: internal5830 * @__NL80211_KEY_AFTER_LAST: internal
5819 * @NL80211_KEY_MAX: highest key attribute5831 * @NL80211_KEY_MAX: highest key attribute
@@ -5830,6 +5842,7 @@ enum nl80211_key_attributes { · 10 unmodified lines
5830 NL80211_KEY_DEFAULT_TYPES,5842 NL80211_KEY_DEFAULT_TYPES,
5831 NL80211_KEY_MODE,5843 NL80211_KEY_MODE,
5832 NL80211_KEY_DEFAULT_BEACON,5844 NL80211_KEY_DEFAULT_BEACON,
5845 NL80211_KEY_LTF_SEED,
5833 5846
5834 /* keep last */5847 /* keep last */
5835 __NL80211_KEY_AFTER_LAST,5848 __NL80211_KEY_AFTER_LAST,
@@ -7059,6 +7072,10 @@ enum nl80211_feature_flags { · 1223 unmodified lines
7059 * forward frames with a matching MAC address to userspace during7072 * forward frames with a matching MAC address to userspace during
7060 * the off-channel period.7073 * the off-channel period.
7061 *7074 *
7075 * @NL80211_EXT_FEATURE_SET_KEY_LTF_SEED: Driver supports installing the
7076 * LTF key seed via %NL80211_KEY_LTF_SEED. The seed is used to generate
7077 * secure LTF keys for secure LTF measurement sessions.
7078 *
7062 * @NUM_NL80211_EXT_FEATURES: number of extended features.7079 * @NUM_NL80211_EXT_FEATURES: number of extended features.
7063 * @MAX_NL80211_EXT_FEATURES: highest extended feature index.7080 * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
7064 */7081 */
@@ -7139,6 +7156,7 @@ enum nl80211_ext_feature_index { · 74 unmodified lines
7139 NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION,7156 NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION,
7140 NL80211_EXT_FEATURE_IEEE8021X_AUTH,7157 NL80211_EXT_FEATURE_IEEE8021X_AUTH,
7141 NL80211_EXT_FEATURE_ROC_ADDR_FILTER,7158 NL80211_EXT_FEATURE_ROC_ADDR_FILTER,
7159 NL80211_EXT_FEATURE_SET_KEY_LTF_SEED,
7142 7160
7143 /* add new features before the definition below */7161 /* add new features before the definition below */
7144 NUM_NL80211_EXT_FEATURES,7162 NUM_NL80211_EXT_FEATURES,
net/wireless/nl80211.c+9−0
@@ -1103,6 +1103,10 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { · 1102 unmodified lines
1103 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),1103 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
1104 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },1104 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
1105 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),1105 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
1106 [NL80211_KEY_LTF_SEED] = {
1107 .type = NLA_BINARY,
1108 .len = WLAN_MAX_SECURE_LTF_KEYSEED_LEN,
1109 },
1106};1110};
1107 1111
1108/* policy for the key default flags */1112/* policy for the key default flags */
@@ -1634,6 +1638,11 @@ static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, · 525 unmodified lines
1634 if (tb[NL80211_KEY_MODE])1638 if (tb[NL80211_KEY_MODE])
1635 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);1639 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1636 1640
1641 if (tb[NL80211_KEY_LTF_SEED]) {
1642 k->p.ltf_keyseed = nla_data(tb[NL80211_KEY_LTF_SEED]);
1643 k->p.ltf_keyseed_len = nla_len(tb[NL80211_KEY_LTF_SEED]);
1644 }
1645
1637 return 0;1646 return 0;
1638}1647}
1639 1648
net/wireless/util.c+15−0
@@ -434,6 +434,21 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, · 433 unmodified lines
434 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))434 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
435 return -EINVAL;435 return -EINVAL;
436 436
437 if (params->ltf_keyseed) {
438 if (!wiphy_ext_feature_isset(&rdev->wiphy,
439 NL80211_EXT_FEATURE_SECURE_LTF) ||
440 !wiphy_ext_feature_isset(&rdev->wiphy,
441 NL80211_EXT_FEATURE_SET_KEY_LTF_SEED))
442 return -EOPNOTSUPP;
443
444 /*
445 * LTF key seed is pairwise key material and must only be
446 * used with a pairwise key
447 */
448 if (!pairwise)
449 return -EINVAL;
450 }
451
437 return 0;452 return 0;
438}453}
439 454