History

cfg80211: Add support for FILS shared key authentication offload

Enhance nl80211 and cfg80211 connect request and response APIs to support FILS shared key authentication offload. The new nl80211 attributes can be used to provide additional information to the driver to establish a FILS connection. Also enhance the set/del PMKSA to allow support for adding and deleting PMKSA based on FILS cache identifier. Add a new feature flag that drivers can use to advertize support for FILS shared key authentication and association in station mode when using their own SME.

Vidyullatha Kanchanapally committed 9 years ago

Commit a3caf741 parent 5349a0f5 files · +259 −12Browse files

Showing the changes to include/uapi/linux (1 of 5 files). Show all

Unified · Split

include/uapi/linux/nl80211.h+83−3
@@ -172,6 +172,42 @@ · 171 unmodified lines
172172 * Multiple such rules can be created.
173173 */
174174
175+/**
176+ * DOC: FILS shared key authentication offload
177+ *
178+ * FILS shared key authentication offload can be advertized by drivers by
179+ * setting @NL80211_EXT_FEATURE_FILS_SK_OFFLOAD flag. The drivers that support
180+ * FILS shared key authentication offload should be able to construct the
181+ * authentication and association frames for FILS shared key authentication and
182+ * eventually do a key derivation as per IEEE 802.11ai. The below additional
183+ * parameters should be given to driver in %NL80211_CMD_CONNECT.
184+ * %NL80211_ATTR_FILS_ERP_USERNAME - used to construct keyname_nai
185+ * %NL80211_ATTR_FILS_ERP_REALM - used to construct keyname_nai
186+ * %NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used to construct erp message
187+ * %NL80211_ATTR_FILS_ERP_RRK - used to generate the rIK and rMSK
188+ * rIK should be used to generate an authentication tag on the ERP message and
189+ * rMSK should be used to derive a PMKSA.
190+ * rIK, rMSK should be generated and keyname_nai, sequence number should be used
191+ * as specified in IETF RFC 6696.
192+ *
193+ * When FILS shared key authentication is completed, driver needs to provide the
194+ * below additional parameters to userspace.
195+ * %NL80211_ATTR_FILS_KEK - used for key renewal
196+ * %NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM - used in further EAP-RP exchanges
197+ * %NL80211_ATTR_PMKID - used to identify the PMKSA used/generated
198+ * %Nl80211_ATTR_PMK - used to update PMKSA cache in userspace
199+ * The PMKSA can be maintained in userspace persistently so that it can be used
200+ * later after reboots or wifi turn off/on also.
201+ *
202+ * %NL80211_ATTR_FILS_CACHE_ID is the cache identifier advertized by a FILS
203+ * capable AP supporting PMK caching. It specifies the scope within which the
204+ * PMKSAs are cached in an ESS. %NL80211_CMD_SET_PMKSA and
205+ * %NL80211_CMD_DEL_PMKSA are enhanced to allow support for PMKSA caching based
206+ * on FILS cache identifier. Additionally %NL80211_ATTR_PMK is used with
207+ * %NL80211_SET_PMKSA to specify the PMK corresponding to a PMKSA for driver to
208+ * use in a FILS shared key connection with PMKSA caching.
209+ */
210+
175211 /**
176212 * enum nl80211_commands - supported nl80211 commands
177213 *
@@ -370,10 +406,18 @@ · 192 unmodified lines
370406 * @NL80211_CMD_NEW_SURVEY_RESULTS: survey data notification (as a reply to
371407 * NL80211_CMD_GET_SURVEY and on the "scan" multicast group)
372408 *
373− * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry, using %NL80211_ATTR_MAC
374− * (for the BSSID) and %NL80211_ATTR_PMKID.
409+ * @NL80211_CMD_SET_PMKSA: Add a PMKSA cache entry using %NL80211_ATTR_MAC
410+ * (for the BSSID), %NL80211_ATTR_PMKID, and optionally %NL80211_ATTR_PMK
411+ * (PMK is used for PTKSA derivation in case of FILS shared key offload) or
412+ * using %NL80211_ATTR_SSID, %NL80211_ATTR_FILS_CACHE_ID,
413+ * %NL80211_ATTR_PMKID, and %NL80211_ATTR_PMK in case of FILS
414+ * authentication where %NL80211_ATTR_FILS_CACHE_ID is the identifier
415+ * advertized by a FILS capable AP identifying the scope of PMKSA in an
416+ * ESS.
375417 * @NL80211_CMD_DEL_PMKSA: Delete a PMKSA cache entry, using %NL80211_ATTR_MAC
376− * (for the BSSID) and %NL80211_ATTR_PMKID.
418+ * (for the BSSID) and %NL80211_ATTR_PMKID or using %NL80211_ATTR_SSID,
419+ * %NL80211_ATTR_FILS_CACHE_ID, and %NL80211_ATTR_PMKID in case of FILS
420+ * authentication.
377421 * @NL80211_CMD_FLUSH_PMKSA: Flush all PMKSA cache entries.
378422 *
379423 * @NL80211_CMD_REG_CHANGE: indicates to userspace the regulatory domain
@@ -2012,6 +2056,31 @@ enum nl80211_commands { · 1632 unmodified lines
20122056 * u32 attribute with an &enum nl80211_timeout_reason value. This is used,
20132057 * e.g., with %NL80211_CMD_CONNECT event.
20142058 *
2059+ * @NL80211_ATTR_FILS_ERP_USERNAME: EAP Re-authentication Protocol (ERP)
2060+ * username part of NAI used to refer keys rRK and rIK. This is used with
2061+ * %NL80211_CMD_CONNECT.
2062+ *
2063+ * @NL80211_ATTR_FILS_ERP_REALM: EAP Re-authentication Protocol (ERP) realm part
2064+ * of NAI specifying the domain name of the ER server. This is used with
2065+ * %NL80211_CMD_CONNECT.
2066+ *
2067+ * @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM: Unsigned 16-bit ERP next sequence number
2068+ * to use in ERP messages. This is used in generating the FILS wrapped data
2069+ * for FILS authentication and is used with %NL80211_CMD_CONNECT.
2070+ *
2071+ * @NL80211_ATTR_FILS_ERP_RRK: ERP re-authentication Root Key (rRK) for the
2072+ * NAI specified by %NL80211_ATTR_FILS_ERP_USERNAME and
2073+ * %NL80211_ATTR_FILS_ERP_REALM. This is used for generating rIK and rMSK
2074+ * from successful FILS authentication and is used with
2075+ * %NL80211_CMD_CONNECT.
2076+ *
2077+ * @NL80211_ATTR_FILS_CACHE_ID: A 2-octet identifier advertized by a FILS AP
2078+ * identifying the scope of PMKSAs. This is used with
2079+ * @NL80211_CMD_SET_PMKSA and @NL80211_CMD_DEL_PMKSA.
2080+ *
2081+ * @NL80211_ATTR_PMK: PMK for the PMKSA identified by %NL80211_ATTR_PMKID.
2082+ * This is used with @NL80211_CMD_SET_PMKSA.
2083+ *
20152084 * @NUM_NL80211_ATTR: total number of nl80211_attrs available
20162085 * @NL80211_ATTR_MAX: highest attribute number currently defined
20172086 * @__NL80211_ATTR_AFTER_LAST: internal use
@@ -2423,6 +2492,14 @@ enum nl80211_attrs { · 405 unmodified lines
24232492
24242493 NL80211_ATTR_TIMEOUT_REASON,
24252494
2495+ NL80211_ATTR_FILS_ERP_USERNAME,
2496+ NL80211_ATTR_FILS_ERP_REALM,
2497+ NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
2498+ NL80211_ATTR_FILS_ERP_RRK,
2499+ NL80211_ATTR_FILS_CACHE_ID,
2500+
2501+ NL80211_ATTR_PMK,
2502+
24262503 /* add attributes here, update the policy in nl80211.c */
24272504
24282505 __NL80211_ATTR_AFTER_LAST,
@@ -4759,6 +4836,8 @@ enum nl80211_feature_flags { · 2330 unmodified lines
47594836 * @NL80211_EXT_FEATURE_CQM_RSSI_LIST: With this driver the
47604837 * %NL80211_ATTR_CQM_RSSI_THOLD attribute accepts a list of zero or more
47614838 * RSSI threshold values to monitor rather than exactly one threshold.
4839+ * @NL80211_EXT_FEATURE_FILS_SK_OFFLOAD: Driver SME supports FILS shared key
4840+ * authentication with %NL80211_CMD_CONNECT.
47624841 *
47634842 * @NUM_NL80211_EXT_FEATURES: number of extended features.
47644843 * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
@@ -4778,6 +4857,7 @@ enum nl80211_ext_feature_index { · 13 unmodified lines
47784857 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED,
47794858 NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI,
47804859 NL80211_EXT_FEATURE_CQM_RSSI_LIST,
4860+ NL80211_EXT_FEATURE_FILS_SK_OFFLOAD,
47814861
47824862 /* add new features before the definition below */
47834863 NUM_NL80211_EXT_FEATURES,