Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Arend Van Spriel]

On 31-3-2017 14:42, Johannes Berg wrote:
> On Fri, 2017-03-31 at 14:39 +0200, Arend Van Spriel wrote:
>>
>> Ok. Just wondering. I am ok with the proposal with the addition of
>> authorized flag in connect event. So do you expect these to come as
>> non-rfc patches any time soon?
>>
> 
> Hmm. I need to find time to look at it, but I'll be travelling next
> week for netconf/netdev.

ok.

> If you wanted to pick up anything here I won't stop you :)

I am tempted, but it is weekend so I will see how I feel on monday :-p

Regards,
Arend

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Johannes Berg]

On Fri, 2017-03-31 at 14:39 +0200, Arend Van Spriel wrote:
> 
> Ok. Just wondering. I am ok with the proposal with the addition of
> authorized flag in connect event. So do you expect these to come as
> non-rfc patches any time soon?
> 

Hmm. I need to find time to look at it, but I'll be travelling next
week for netconf/netdev.

If you wanted to pick up anything here I won't stop you :)

johannes

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Arend Van Spriel]

On 31-3-2017 13:50, Johannes Berg wrote:
> On Tue, 2017-03-28 at 12:50 +0200, Arend Van Spriel wrote:
>>
>> So looking at wpa_supplicant RFC patches I see that it now diverts
>> driver_nl80211_set_key() for ALG_PMK case to the new api. So why not
>> extending CMD_NEW_KEY to support ALG_PMK?
> 
> I don't really care what the supplicant does, but IMHO having
> completely different types of keys in the same API isn't a good idea.
> We'd have to invent (a) cipher suite(s), or new attributes, to even
> encapsulate that in netlink - and the usage is completely different
> etc.

Ok. Just wondering. I am ok with the proposal with the addition of
authorized flag in connect event. So do you expect these to come as
non-rfc patches any time soon?

Regards,
Arend

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Arend Van Spriel]

On 21-2-2017 13:37, Johannes Berg wrote:
> From: Avraham Stern 
> 
> Add API for setting the PMK to the driver. For FT support, allow
> setting also the PMK-R0 Name.
> 
> This can be used by drivers that support 4-Way handshake offload
> while IEEE802.1X authentication is managed by upper layers.

So looking at wpa_supplicant RFC patches I see that it now diverts
driver_nl80211_set_key() for ALG_PMK case to the new api. So why not
extending CMD_NEW_KEY to support ALG_PMK?

Regards,
Arend

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Arend Van Spriel]

On 2-3-2017 9:59, Johannes Berg wrote:
> 
>>> +   int (*del_pmk)(struct wiphy *wiphy, struct
>>> net_device *dev,
>>> +  const u8 *aa);
>>
>> Minor nit, but prefer clr_pmk to clear the pmk.
> 
> Why? You don't have "the PMK" that you can clear, you have "a PMK" (for
> the network) and after deleting it you don't have it anymore. You don't
> have a "cleared PMK" afterwards, you just don't have any. I think the
> delete makes more sense?

Ah. I just looked at set_pmk and felt its counter-part should therefor
be clr_pmk. Following your logic should it be add_pmk iso set_pmk?

>>> +   NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X,
>>
>> So do we need this flag. Is the fact that the driver implements the
>> set_pmk and del_pmk (or clr_pmk) callbacks not sufficient provided
>> they are listed in the "supported commands" message of wiphy dump
>> (not in this patch). Which reminds me, is "supported commands" no
>> longer preferred because that list does not seem complete?
> 
> It's complicated... We've kinda naturally gravitated towards extended
> feature flags because they're so easy to handle now (only need to
> define the bit) - and with mac80211 in the picture, relying on the
> handlers only often didn't work, so it requires extra code in the CMD()
> advertising - and anyway it already requires extra code there unlike
> the feature flags...
> 
> So overall - while this isn't stated policy (yet?) - I think we prefer
> the feature bits.

I see. Glad they worked out that way ;-)

Regards,
Arend

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Johannes Berg]

> > +   int (*del_pmk)(struct wiphy *wiphy, struct
> > net_device *dev,
> > +      const u8 *aa);
> 
> Minor nit, but prefer clr_pmk to clear the pmk.

Why? You don't have "the PMK" that you can clear, you have "a PMK" (for
the network) and after deleting it you don't have it anymore. You don't
have a "cleared PMK" afterwards, you just don't have any. I think the
delete makes more sense?

> > + * @NL80211_CMD_DEL_PMK: For offloaded 4-Way handshake, delete the
> > previously
> > + * configured PMK for the authenticator address identified
> > by
> > + * _ATTR_MAC.
> 
> Maybe better to indicate it is for 802.1X.

I guess that makes sense.

> > +   NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X,
> 
> So do we need this flag. Is the fact that the driver implements the
> set_pmk and del_pmk (or clr_pmk) callbacks not sufficient provided
> they are listed in the "supported commands" message of wiphy dump
> (not in this patch). Which reminds me, is "supported commands" no
> longer preferred because that list does not seem complete?

It's complicated... We've kinda naturally gravitated towards extended
feature flags because they're so easy to handle now (only need to
define the bit) - and with mac80211 in the picture, relying on the
handlers only often didn't work, so it requires extra code in the CMD()
advertising - and anyway it already requires extra code there unlike
the feature flags...

So overall - while this isn't stated policy (yet?) - I think we prefer
the feature bits.

johannes

Re: [RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Arend Van Spriel]

On 21-2-2017 13:37, Johannes Berg wrote:
> From: Avraham Stern 
> 
> Add API for setting the PMK to the driver. For FT support, allow
> setting also the PMK-R0 Name.
> 
> This can be used by drivers that support 4-Way handshake offload
> while IEEE802.1X authentication is managed by upper layers.
> 
> Signed-off-by: Avraham Stern 
> Signed-off-by: Johannes Berg 
> ---
>  include/linux/ieee80211.h|  3 ++
>  include/net/cfg80211.h   | 27 
>  include/uapi/linux/nl80211.h | 24 ++-
>  net/wireless/core.c  |  5 +++
>  net/wireless/nl80211.c   | 99 
> 
>  net/wireless/rdev-ops.h  | 25 +++
>  net/wireless/trace.h | 60 +++
>  7 files changed, 241 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
> index 2049e983a994..fb1f533e75b3 100644
> --- a/include/linux/ieee80211.h
> +++ b/include/linux/ieee80211.h
> @@ -2356,8 +2356,11 @@ enum ieee80211_sa_query_action {
>  
>  #define WLAN_MAX_KEY_LEN 32
>  
> +#define WLAN_PMK_NAME_LEN16
>  #define WLAN_PMKID_LEN   16
> +#define WLAN_PMK_LEN_EAP_LEAP16
>  #define WLAN_PMK_LEN 32
> +#define WLAN_PMK_LEN_SUITE_B_192 48
>  
>  #define WLAN_OUI_WFA 0x506f9a
>  #define WLAN_OUI_TYPE_WFA_P2P9
> diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
> index 4ca968927d60..a68c6db6ac55 100644
> --- a/include/net/cfg80211.h
> +++ b/include/net/cfg80211.h
> @@ -2507,6 +2507,23 @@ struct cfg80211_nan_func {
>  };
>  
>  /**
> + * struct cfg80211_pmk_conf - PMK configuration
> + *
> + * @aa: authenticator address
> + * @pmk_len: PMK length in bytes.
> + * @pmk: the PMK material
> + * @pmk_r0_name: PMK-R0 Name. NULL if not applicable (i.e., the PMK
> + *   is not PMK-R0). When pmk_r0_name is not NULL, the pmk field
> + *   holds PMK-R0.
> + */
> +struct cfg80211_pmk_conf {
> + const u8 *aa;
> + u8 pmk_len;
> + const u8 *pmk;
> + const u8 *pmk_r0_name;
> +};
> +
> +/**
>   * struct cfg80211_ops - backend description for wireless configuration
>   *
>   * This struct is registered by fullmac card drivers and/or wireless stacks
> @@ -2823,6 +2840,11 @@ struct cfg80211_nan_func {
>   *   All other parameters must be ignored.
>   *
>   * @set_multicast_to_unicast: configure multicast to unicast conversion for 
> BSS
> + *
> + * @set_pmk: configure the PMK to be used for offloaded 4-Way handshake.
> + *   (invoked with the wireless_dev mutex held)
> + * @del_pmk: delete the previously configured PMK for the given 
> authenticator.
> + *   (invoked with the wireless_dev mutex held)
>   */
>  struct cfg80211_ops {
>   int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
> @@ -3111,6 +3133,11 @@ struct cfg80211_ops {
>   int (*set_multicast_to_unicast)(struct wiphy *wiphy,
>   struct net_device *dev,
>   const bool enabled);
> +
> + int (*set_pmk)(struct wiphy *wiphy, struct net_device *dev,
> +const struct cfg80211_pmk_conf *conf);
> + int (*del_pmk)(struct wiphy *wiphy, struct net_device *dev,
> +const u8 *aa);

Minor nit, but prefer clr_pmk to clear the pmk.

>  };
>  
>  /*
> diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
> index bb5e1904a107..89295fc2336b 100644
> --- a/include/uapi/linux/nl80211.h
> +++ b/include/uapi/linux/nl80211.h
> @@ -901,6 +901,14 @@
>   *   does not result in a change for the current association. Currently,
>   *   only the %NL80211_ATTR_IE data is used and updated with this command.
>   *
> + * @NL80211_CMD_SET_PMK: For offloaded 4-Way handshake, set the PMK or PMK-R0
> + *   for the given authenticator address (specified with _ATTR_MAC).
> + *   When _ATTR_PMKR0_NAME is set, _ATTR_PMK specifies the
> + *   PMK-R0, otherwise it specifies the PMK.
> + * @NL80211_CMD_DEL_PMK: For offloaded 4-Way handshake, delete the previously
> + *   configured PMK for the authenticator address identified by
> + *   _ATTR_MAC.

Maybe better to indicate it is for 802.1X. Here also preference for
NL80211_CMD_CLR_PMK.

> + *
>   * @NL80211_CMD_MAX: highest used command number
>   * @__NL80211_CMD_AFTER_LAST: internal use
>   */
> @@ -1100,6 +1108,9 @@ enum nl80211_commands {
>  
>   NL80211_CMD_UPDATE_CONNECT_PARAMS,
>  
> + NL80211_CMD_SET_PMK,
> + NL80211_CMD_DEL_PMK,
> +
>   /* add new commands above here */
>  
>   /* used to define NL80211_CMD_MAX below */
> @@ -2012,8 +2023,12 @@ enum nl80211_commands {
>   *   u32 attribute with an  nl80211_timeout_reason value. This is used,
>   *   e.g., with %NL80211_CMD_CONNECT event.
>   *
> - * @NL80211_ATTR_PMK: PSK for offloaded 4-Way 

[RFC v2 2/2] cfg80211: support 4-way handshake offloading for 802.1X

[Johannes Berg]

From: Avraham Stern 

Add API for setting the PMK to the driver. For FT support, allow
setting also the PMK-R0 Name.

This can be used by drivers that support 4-Way handshake offload
while IEEE802.1X authentication is managed by upper layers.

Signed-off-by: Avraham Stern 
Signed-off-by: Johannes Berg 
---
 include/linux/ieee80211.h|  3 ++
 include/net/cfg80211.h   | 27 
 include/uapi/linux/nl80211.h | 24 ++-
 net/wireless/core.c  |  5 +++
 net/wireless/nl80211.c   | 99 
 net/wireless/rdev-ops.h  | 25 +++
 net/wireless/trace.h | 60 +++
 7 files changed, 241 insertions(+), 2 deletions(-)

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 2049e983a994..fb1f533e75b3 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -2356,8 +2356,11 @@ enum ieee80211_sa_query_action {
 
 #define WLAN_MAX_KEY_LEN   32
 
+#define WLAN_PMK_NAME_LEN  16
 #define WLAN_PMKID_LEN 16
+#define WLAN_PMK_LEN_EAP_LEAP  16
 #define WLAN_PMK_LEN   32
+#define WLAN_PMK_LEN_SUITE_B_192   48
 
 #define WLAN_OUI_WFA   0x506f9a
 #define WLAN_OUI_TYPE_WFA_P2P  9
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 4ca968927d60..a68c6db6ac55 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2507,6 +2507,23 @@ struct cfg80211_nan_func {
 };
 
 /**
+ * struct cfg80211_pmk_conf - PMK configuration
+ *
+ * @aa: authenticator address
+ * @pmk_len: PMK length in bytes.
+ * @pmk: the PMK material
+ * @pmk_r0_name: PMK-R0 Name. NULL if not applicable (i.e., the PMK
+ * is not PMK-R0). When pmk_r0_name is not NULL, the pmk field
+ * holds PMK-R0.
+ */
+struct cfg80211_pmk_conf {
+   const u8 *aa;
+   u8 pmk_len;
+   const u8 *pmk;
+   const u8 *pmk_r0_name;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -2823,6 +2840,11 @@ struct cfg80211_nan_func {
  * All other parameters must be ignored.
  *
  * @set_multicast_to_unicast: configure multicast to unicast conversion for BSS
+ *
+ * @set_pmk: configure the PMK to be used for offloaded 4-Way handshake.
+ * (invoked with the wireless_dev mutex held)
+ * @del_pmk: delete the previously configured PMK for the given authenticator.
+ * (invoked with the wireless_dev mutex held)
  */
 struct cfg80211_ops {
int (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -3111,6 +3133,11 @@ struct cfg80211_ops {
int (*set_multicast_to_unicast)(struct wiphy *wiphy,
struct net_device *dev,
const bool enabled);
+
+   int (*set_pmk)(struct wiphy *wiphy, struct net_device *dev,
+  const struct cfg80211_pmk_conf *conf);
+   int (*del_pmk)(struct wiphy *wiphy, struct net_device *dev,
+  const u8 *aa);
 };
 
 /*
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index bb5e1904a107..89295fc2336b 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -901,6 +901,14 @@
  * does not result in a change for the current association. Currently,
  * only the %NL80211_ATTR_IE data is used and updated with this command.
  *
+ * @NL80211_CMD_SET_PMK: For offloaded 4-Way handshake, set the PMK or PMK-R0
+ * for the given authenticator address (specified with _ATTR_MAC).
+ * When _ATTR_PMKR0_NAME is set, _ATTR_PMK specifies the
+ * PMK-R0, otherwise it specifies the PMK.
+ * @NL80211_CMD_DEL_PMK: For offloaded 4-Way handshake, delete the previously
+ * configured PMK for the authenticator address identified by
+ * _ATTR_MAC.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -1100,6 +1108,9 @@ enum nl80211_commands {
 
NL80211_CMD_UPDATE_CONNECT_PARAMS,
 
+   NL80211_CMD_SET_PMK,
+   NL80211_CMD_DEL_PMK,
+
/* add new commands above here */
 
/* used to define NL80211_CMD_MAX below */
@@ -2012,8 +2023,12 @@ enum nl80211_commands {
  * u32 attribute with an  nl80211_timeout_reason value. This is used,
  * e.g., with %NL80211_CMD_CONNECT event.
  *
- * @NL80211_ATTR_PMK: PSK for offloaded 4-Way Handshake. Relevant only
- * with %NL80211_CMD_CONNECT (for WPA/WPA2-PSK networks).
+ * @NL80211_ATTR_PMK: PMK for offloaded 4-Way Handshake. Relevant with
+ * %NL80211_CMD_CONNECT (for WPA/WPA2-PSK networks) when PSK is used, or
+ * with %NL80211_CMD_SET_PMK when 802.1X authentication is used.
+ * When _ATTR_PMKR0_NAME is specified, this attribute specifies
+ *