Add a driver FILS crypto offload extended capability flag to indicate that the driver running in AP mode is capable of handling encryption and decryption of (Re)Association request and response frames. Add a command to set FILS AAD data to driver. This feature is supported on drivers running in AP mode only. This extended capability is exchanged with hostapd during cfg80211 init. If the driver indicates this capability, then before sending the Authentication response frame, hostapd sets FILS AAD data to the driver. This allows the driver to decrypt (Re)Association Request frame and encrypt (Re)Association Response frame. FILS Key derivation will still be done in hostapd.
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -300,6 +300,29 @@ · 299 unmodified lines | ||
| 300 | 300 | * the interface goes down. |
| 301 | 301 | */ |
| 302 | 302 | |
| 303 | +/** | |
| 304 | + * DOC: FILS shared key crypto offload | |
| 305 | + * | |
| 306 | + * This feature is applicable to drivers running in AP mode. | |
| 307 | + * | |
| 308 | + * FILS shared key crypto offload can be advertised by drivers by setting | |
| 309 | + * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD flag. The drivers that support | |
| 310 | + * FILS shared key crypto offload should be able to encrypt and decrypt | |
| 311 | + * association frames for FILS shared key authentication as per IEEE 802.11ai. | |
| 312 | + * With this capability, for FILS key derivation, drivers depend on userspace. | |
| 313 | + * | |
| 314 | + * After FILS key derivation, userspace shares the FILS AAD details with the | |
| 315 | + * driver and the driver stores the same to use in decryption of association | |
| 316 | + * request and in encryption of association response. The below parameters | |
| 317 | + * should be given to the driver in %NL80211_CMD_SET_FILS_AAD. | |
| 318 | + * %NL80211_ATTR_MAC - STA MAC address, used for storing FILS AAD per STA | |
| 319 | + * %NL80211_ATTR_FILS_KEK - Used for encryption or decryption | |
| 320 | + * %NL80211_ATTR_FILS_NONCES - Used for encryption or decryption | |
| 321 | + * (STA Nonce 16 bytes followed by AP Nonce 16 bytes) | |
| 322 | + * | |
| 323 | + * Once the association is done, the driver cleans the FILS AAD data. | |
| 324 | + */ | |
| 325 | + | |
| 303 | 326 | /** |
| 304 | 327 | * enum nl80211_commands - supported nl80211 commands |
| 305 | 328 | * |
| @@ -1200,6 +1223,12 @@ · 894 unmodified lines | ||
| 1200 | 1223 | * @NL80211_CMD_COLOR_CHANGE_COMPLETED: Notify userland that the color change |
| 1201 | 1224 | * has completed |
| 1202 | 1225 | * |
| 1226 | + * @NL80211_CMD_SET_FILS_AAD: Set FILS AAD data to the driver using - | |
| 1227 | + * &NL80211_ATTR_MAC - for STA MAC address | |
| 1228 | + * &NL80211_ATTR_FILS_KEK - for KEK | |
| 1229 | + * &NL80211_ATTR_FILS_NONCES - for FILS Nonces | |
| 1230 | + * (STA Nonce 16 bytes followed by AP Nonce 16 bytes) | |
| 1231 | + * | |
| 1203 | 1232 | * @NL80211_CMD_MAX: highest used command number |
| 1204 | 1233 | * @__NL80211_CMD_AFTER_LAST: internal use |
| 1205 | 1234 | */ |
| @@ -1440,6 +1469,8 @@ enum nl80211_commands { · 234 unmodified lines | ||
| 1440 | 1469 | NL80211_CMD_COLOR_CHANGE_ABORTED, |
| 1441 | 1470 | NL80211_CMD_COLOR_CHANGE_COMPLETED, |
| 1442 | 1471 | |
| 1472 | + NL80211_CMD_SET_FILS_AAD, | |
| 1473 | + | |
| 1443 | 1474 | /* add new commands above here */ |
| 1444 | 1475 | |
| 1445 | 1476 | /* used to define NL80211_CMD_MAX below */ |
| @@ -5995,6 +6026,11 @@ enum nl80211_feature_flags { · 4549 unmodified lines | ||
| 5995 | 6026 | * @NL80211_EXT_FEATURE_BSS_COLOR: The driver supports BSS color collision |
| 5996 | 6027 | * detection and change announcemnts. |
| 5997 | 6028 | * |
| 6029 | + * @NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD: Driver running in AP mode supports | |
| 6030 | + * FILS encryption and decryption for (Re)Association Request and Response | |
| 6031 | + * frames. Userspace has to share FILS AAD details to the driver by using | |
| 6032 | + * @NL80211_CMD_SET_FILS_AAD. | |
| 6033 | + * | |
| 5998 | 6034 | * @NUM_NL80211_EXT_FEATURES: number of extended features. |
| 5999 | 6035 | * @MAX_NL80211_EXT_FEATURES: highest extended feature index. |
| 6000 | 6036 | */ |
| @@ -6060,6 +6096,7 @@ enum nl80211_ext_feature_index { · 59 unmodified lines | ||
| 6060 | 6096 | NL80211_EXT_FEATURE_SECURE_RTT, |
| 6061 | 6097 | NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE, |
| 6062 | 6098 | NL80211_EXT_FEATURE_BSS_COLOR, |
| 6099 | + NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD, | |
| 6063 | 6100 | |
| 6064 | 6101 | /* add new features before the definition below */ |
| 6065 | 6102 | NUM_NL80211_EXT_FEATURES, |