Enhance nl80211 and cfg80211 connect request and response APIs to support FILS shared key authentication offload. The new nl80211 attributes can be used to provide additional information to the driver to establish a FILS connection. Also enhance the set/del PMKSA to allow support for adding and deleting PMKSA based on FILS cache identifier. Add a new feature flag that drivers can use to advertize support for FILS shared key authentication and association in station mode when using their own SME.
Showing the changes to include/uapi/linux (1 of 5 files). Show all
Unified · Split
| @@ -172,6 +172,42 @@ · 171 unmodified lines | |||
| 172 | * Multiple such rules can be created. | 172 | * Multiple such rules can be created. |
| 173 | */ | 173 | */ |
| 174 | 174 | ||
| 175 | /** | ||
| 176 | * DOC: FILS shared key authentication offload | ||
| 177 | * | ||
| 178 | * FILS shared key authentication offload can be advertized by drivers by | ||
| 179 | * setting @NL80211_EXT_FEATURE_FILS_SK_OFFLOAD flag. The drivers that support | ||
| 180 | * FILS shared key authentication offload should be able to construct the | ||
| 181 | * authentication and association frames for FILS shared key authentication and | ||
| 182 | * eventually do a key derivation as per IEEE 802.11ai. The below additional | ||
| 183 | * parameters should be given to driver in %NL80211_CMD_CONNECT. | ||
| 184 | * %NL80211_ATTR_FILS_ERP_USERNAME - used to construct keyname_nai | ||
| 185 | * %NL80211_ATTR_FILS_ERP_REALM - used to construct keyname_nai | ||
| 186 | * %NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used to construct erp message | ||
| 187 | * %NL80211_ATTR_FILS_ERP_RRK - used to generate the rIK and rMSK | ||
| 188 | * rIK should be used to generate an authentication tag on the ERP message and | ||
| 189 | * rMSK should be used to derive a PMKSA. | ||
| 190 | * rIK, rMSK should be generated and keyname_nai, sequence number should be used | ||
| 191 | * as specified in IETF RFC 6696. | ||
| 192 | * | ||
| 193 | * When FILS shared key authentication is completed, driver needs to provide the | ||
| 194 | * below additional parameters to userspace. | ||
| 195 | * %NL80211_ATTR_FILS_KEK - used for key renewal | ||
| 196 | * %NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used in further EAP-RP exchanges | ||
| 197 | * %NL80211_ATTR_PMKID - used to identify the PMKSA used/generated | ||
| 198 | * %Nl80211_ATTR_PMK - used to update PMKSA cache in userspace | ||
| 199 | * The PMKSA can be maintained in userspace persistently so that it can be used | ||
| 200 | * later after reboots or wifi turn off/on also. | ||
| 201 | * | ||
| 202 | * %NL80211_ATTR_FILS_CACHE_ID is the cache identifier advertized by a FILS | ||
| 203 | * capable AP supporting PMK caching. It specifies the scope within which the | ||
| 204 | * PMKSAs are cached in an ESS. %NL80211_CMD_SET_PMKSA and | ||
| 205 | * %NL80211_CMD_DEL_PMKSA are enhanced to allow support for PMKSA caching based | ||
| 206 | * on FILS cache identifier. Additionally %NL80211_ATTR_PMK is used with | ||
| 207 | * %NL80211_SET_PMKSA to specify the PMK corresponding to a PMKSA for driver to | ||
| 208 | * use in a FILS shared key connection with PMKSA caching. | ||
| 209 | */ | ||
| 210 | |||
| 175 | /** | 211 | /** |
| 176 | * enum nl80211_commands - supported nl80211 commands | 212 | * enum nl80211_commands - supported nl80211 commands |
| 177 | * | 213 | * |
| @@ -370,10 +406,18 @@ · 192 unmodified lines | |||
| 370 | * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to | 406 | * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to |
| 371 | * NL80211_CMD_GET_SURVEY and on the "scan" multicast group) | 407 | * NL80211_CMD_GET_SURVEY and on the "scan" multicast group) |
| 372 | * | 408 | * |
| 373 | * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry, using %NL80211_ATTR_MAC | 409 | * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry using %NL80211_ATTR_MAC |
| 374 | * (for the BSSID) and %NL80211_ATTR_PMKID. | 410 | * (for the BSSID), %NL80211_ATTR_PMKID, and optionally %NL80211_ATTR_PMK |
| 411 | * (PMK is used for PTKSA derivation in case of FILS shared key offload) or | ||
| 412 | * using %NL80211_ATTR_SSID, %NL80211_ATTR_FILS_CACHE_ID, | ||
| 413 | * %NL80211_ATTR_PMKID, and %NL80211_ATTR_PMK in case of FILS | ||
| 414 | * authentication where %NL80211_ATTR_FILS_CACHE_ID is the identifier | ||
| 415 | * advertized by a FILS capable AP identifying the scope of PMKSA in an | ||
| 416 | * ESS. | ||
| 375 | * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC | 417 | * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC |
| 376 | * (for the BSSID) and %NL80211_ATTR_PMKID. | 418 | * (for the BSSID) and %NL80211_ATTR_PMKID or using %NL80211_ATTR_SSID, |
| 419 | * %NL80211_ATTR_FILS_CACHE_ID, and %NL80211_ATTR_PMKID in case of FILS | ||
| 420 | * authentication. | ||
| 377 | * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries. | 421 | * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries. |
| 378 | * | 422 | * |
| 379 | * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain | 423 | * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain |
| @@ -2012,6 +2056,31 @@ enum nl80211_commands { · 1632 unmodified lines | |||
| 2012 | * u32 attribute with an &enum nl80211_timeout_reason value. This is used, | 2056 | * u32 attribute with an &enum nl80211_timeout_reason value. This is used, |
| 2013 | * e.g., with %NL80211_CMD_CONNECT event. | 2057 | * e.g., with %NL80211_CMD_CONNECT event. |
| 2014 | * | 2058 | * |
| 2059 | * @NL80211_ATTR_FILS_ERP_USERNAME: EAP Re-authentication Protocol (ERP) | ||
| 2060 | * username part of NAI used to refer keys rRK and rIK. This is used with | ||
| 2061 | * %NL80211_CMD_CONNECT. | ||
| 2062 | * | ||
| 2063 | * @NL80211_ATTR_FILS_ERP_REALM: EAP Re-authentication Protocol (ERP) realm part | ||
| 2064 | * of NAI specifying the domain name of the ER server. This is used with | ||
| 2065 | * %NL80211_CMD_CONNECT. | ||
| 2066 | * | ||
| 2067 | * @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM: Unsigned 16-bit ERP next sequence number | ||
| 2068 | * to use in ERP messages. This is used in generating the FILS wrapped data | ||
| 2069 | * for FILS authentication and is used with %NL80211_CMD_CONNECT. | ||
| 2070 | * | ||
| 2071 | * @NL80211_ATTR_FILS_ERP_RRK: ERP re-authentication Root Key (rRK) for the | ||
| 2072 | * NAI specified by %NL80211_ATTR_FILS_ERP_USERNAME and | ||
| 2073 | * %NL80211_ATTR_FILS_ERP_REALM. This is used for generating rIK and rMSK | ||
| 2074 | * from successful FILS authentication and is used with | ||
| 2075 | * %NL80211_CMD_CONNECT. | ||
| 2076 | * | ||
| 2077 | * @NL80211_ATTR_FILS_CACHE_ID: A 2-octet identifier advertized by a FILS AP | ||
| 2078 | * identifying the scope of PMKSAs. This is used with | ||
| 2079 | * @NL80211_CMD_SET_PMKSA and @NL80211_CMD_DEL_PMKSA. | ||
| 2080 | * | ||
| 2081 | * @NL80211_ATTR_PMK: PMK for the PMKSA identified by %NL80211_ATTR_PMKID. | ||
| 2082 | * This is used with @NL80211_CMD_SET_PMKSA. | ||
| 2083 | * | ||
| 2015 | * @NUM_NL80211_ATTR: total number of nl80211_attrs available | 2084 | * @NUM_NL80211_ATTR: total number of nl80211_attrs available |
| 2016 | * @NL80211_ATTR_MAX: highest attribute number currently defined | 2085 | * @NL80211_ATTR_MAX: highest attribute number currently defined |
| 2017 | * @__NL80211_ATTR_AFTER_LAST: internal use | 2086 | * @__NL80211_ATTR_AFTER_LAST: internal use |
| @@ -2423,6 +2492,14 @@ enum nl80211_attrs { · 405 unmodified lines | |||
| 2423 | 2492 | ||
| 2424 | NL80211_ATTR_TIMEOUT_REASON, | 2493 | NL80211_ATTR_TIMEOUT_REASON, |
| 2425 | 2494 | ||
| 2495 | NL80211_ATTR_FILS_ERP_USERNAME, | ||
| 2496 | NL80211_ATTR_FILS_ERP_REALM, | ||
| 2497 | NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, | ||
| 2498 | NL80211_ATTR_FILS_ERP_RRK, | ||
| 2499 | NL80211_ATTR_FILS_CACHE_ID, | ||
| 2500 | |||
| 2501 | NL80211_ATTR_PMK, | ||
| 2502 | |||
| 2426 | /* add attributes here, update the policy in nl80211.c */ | 2503 | /* add attributes here, update the policy in nl80211.c */ |
| 2427 | 2504 | ||
| 2428 | __NL80211_ATTR_AFTER_LAST, | 2505 | __NL80211_ATTR_AFTER_LAST, |
| @@ -4759,6 +4836,8 @@ enum nl80211_feature_flags { · 2330 unmodified lines | |||
| 4759 | * @NL80211_EXT_FEATURE_CQM_RSSI_LIST: With this driver the | 4836 | * @NL80211_EXT_FEATURE_CQM_RSSI_LIST: With this driver the |
| 4760 | * %NL80211_ATTR_CQM_RSSI_THOLD attribute accepts a list of zero or more | 4837 | * %NL80211_ATTR_CQM_RSSI_THOLD attribute accepts a list of zero or more |
| 4761 | * RSSI threshold values to monitor rather than exactly one threshold. | 4838 | * RSSI threshold values to monitor rather than exactly one threshold. |
| 4839 | * @NL80211_EXT_FEATURE_FILS_SK_OFFLOAD: Driver SME supports FILS shared key | ||
| 4840 | * authentication with %NL80211_CMD_CONNECT. | ||
| 4762 | * | 4841 | * |
| 4763 | * @NUM_NL80211_EXT_FEATURES: number of extended features. | 4842 | * @NUM_NL80211_EXT_FEATURES: number of extended features. |
| 4764 | * @MAX_NL80211_EXT_FEATURES: highest extended feature index. | 4843 | * @MAX_NL80211_EXT_FEATURES: highest extended feature index. |
| @@ -4778,6 +4857,7 @@ enum nl80211_ext_feature_index { · 13 unmodified lines | |||
| 4778 | NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED, | 4857 | NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED, |
| 4779 | NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI, | 4858 | NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI, |
| 4780 | NL80211_EXT_FEATURE_CQM_RSSI_LIST, | 4859 | NL80211_EXT_FEATURE_CQM_RSSI_LIST, |
| 4860 | NL80211_EXT_FEATURE_FILS_SK_OFFLOAD, | ||
| 4781 | 4861 | ||
| 4782 | /* add new features before the definition below */ | 4862 | /* add new features before the definition below */ |
| 4783 | NUM_NL80211_EXT_FEATURES, | 4863 | NUM_NL80211_EXT_FEATURES, |