summaryrefslogtreecommitdiffstats
path: root/net/mac80211
AgeCommit message (Collapse)AuthorFilesLines
2011-08-24{nl,cfg,mac}80211: let userspace make meshif mesh gateJavier Cardona3-1/+11
Allow userspace to set NL80211_MESHCONF_GATE_ANNOUNCEMENTS attribute, which will advertise this mesh node as being a mesh gate. NL80211_HWMP_ROOTMODE must be set or this will do nothing. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24{nl,cfg,mac}80211: let userspace set RANN intervalJavier Cardona5-6/+13
Allow userspace to set Root Announcement Interval for our mesh interface. Also, RANN interval is now in proper units of TUs. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24{nl,mac}80211: add missing root mode meshconf entriesJavier Cardona1-1/+1
This fix allows userspace to mark a meshif as a root node. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24mac80211: mesh gate implementationJavier Cardona5-9/+331
In this implementation, a mesh gate is a root node with a certain bit set in its RANN flags. The mpath to this root node is marked as a path to a gate, and added to our list of known gates for this if_mesh. Once a path discovery process fails, we forward the unresolved frames to a known gate. Thanks to Luis Rodriguez for refactoring and bug fix help. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24mac80211: fix mesh path flushingJavier Cardona1-2/+1
Previously, mpaths were never flushed since the mpath is not active once we call this function. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24mac80211: mesh locking fixesJavier Cardona1-2/+2
mesh_queue_preq is invoked invoked from both user (work queue) and softirq (timer) context, so the _bh version of spinlock needs to be used. Also, the mpath->state_lock should be softirq safe as well. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24mac80211: fix mpath timer NULL functionJavier Cardona1-2/+4
If we have an mpath whose timer has not been initialized, don't try to delete it. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-24mac80211: improve mpath debuggingJavier Cardona3-11/+31
make hwmp_dbg print the relevant sdata->name by default and improve formatting. Also add mpath_dbg macro for debugging of mesh path operations. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22mac80211: update mesh path selection frame formatThomas Pedersen5-45/+61
Make mesh path selection frames Mesh Action category, remove outdated Mesh Path Selection category and defines, use updated reason codes, add mesh_action_is_path_sel for readability, and update/correct path selection IEs. Signed-off-by: Thomas Pedersen <thomas@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22mac80211: update mesh peering frame formatThomas Pedersen3-43/+74
This patch updates the mesh peering frames to the format specified in the recently ratified 802.11s standard. Several changes took place to make this happen: - Change RX path to handle new self-protected frames - Add new Peering management IE - Remove old Peer Link IE - Remove old plink_action field in ieee80211_mgmt header These changes by themselves would either break peering, or work by coincidence, so squash them all into this patch. Signed-off-by: Thomas Pedersen <thomas@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22mac80211: update mesh peering frame codesThomas Pedersen1-81/+76
Have the mesh peering frames use the self-protected action and reason codes specified in 802.11s and defined in ieee80211.h. Remove the local enums. Signed-off-by: Thomas Pedersen <thomas@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22mac80211: fix mesh beacon formatThomas Pedersen4-62/+196
Correct ordering of IEs in the mesh beacon while removing unneeded IEs from mesh peering frames. Set privacy bit in capability info if security is enabled. Add utility functions to aid in construction of IEs and reduce code duplication. Signed-off-by: Thomas Pedersen <thomas@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22mac80211: Tear down BA session on BAR tx failureHelmut Schaa1-0/+18
As described at [1] some STAs (i.e. Intel 5100 Windows) can end up correctly BlockAcking incoming frames without delivering them to user space if a AMPDU subframe got lost and we don't flush the receipients reorder buffer with a BlockAckReq. This in turn results in stuck connections. According to 802.11n-2009 it is not necessary to send a BAR to flush the recepients RX reorder buffer but we still do that to be polite. However, assume the following frame exchange: AP -> STA, AMPDU (failed) AP -> STA, BAR (failed) The client in question then ends up in the same situation and won't deliver frames to userspace anymore since we weren't able to flush its reorder buffer. This is not a hypothetical situation but I was able to observe this exact behavior during a stress test between a rt2800pci AP and a Intel 5100 Windows client. In order to work around this issue just tear down the BA session as soon as a BAR failed to be TX'ed. [1] http://comments.gmane.org/gmane.linux.kernel.wireless.general/66867 Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-22wireless: Introduce defines for BAR TID_INFO & MULTI_TID fieldsHelmut Schaa1-1/+1
While at it also fix the indention of the other IEEE80211_BAR_CTRL_ defines. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-12cfg80211/mac80211: move information element parsing logic to cfg80211Yogesh Ashok Powar2-230/+0
Moving the parsing logic for retrieving the information elements stored in management frames, e.g. beacons or probe responses, and making it available to other cfg80211 drivers. Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-11nl80211/cfg80211: Make addition of new sinfo fields saferJouni Malinen1-0/+1
Add a comment pointing out the use of enum station_info_flags for all new struct station_info fields. In addition, memset the sinfo buffer to zero before use on all paths in the current tree to avoid leaving uninitialized pointers in the data. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-10mac80211: fix erroneous clearing of MESH_PATH_SN_VALID flagJavier Cardona1-1/+0
When a PREQ or PREP is received from an intermediate node, it contains useful information for path selection but it doesn't include the originator's sequence number. Therefore, when updating the mesh path to that intermediate node, we should not set the MESH_PATH_SN_VALID flag. BUT, if the flag is set, it should not be unset as we might have received a valid sequence number for that intermediate node in the past. This issue was reported, fixed and tested by Ya Bo (游波) and Pedro Larbig (ASPj). Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-10mac80211: clear sta.drv_priv on reconfigurationEliad Peller1-0/+1
drivers might assume sta.drv_priv is clear while the sta is added, so clear it on reconfinguration. Signed-off-by: Eliad Peller <eliad@wizery.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-09mac80211: Don't use EAPOL frames for rate samplingHelmut Schaa1-1/+7
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Acked-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-09mac80211: Fill in skb->protocol information for injected framesHelmut Schaa1-0/+20
Some drivers (ath9k for example) are using skb->protocol to treat EAPOL frames somehow special (disallow aggregation for example). When running in AP mode hostapd injects the EAPOL frames through a monitor interface and thus skb->protocol isn't set at all. Hence, if the injected frame is a data frame and carries a rfc1042 headaer update the skb->protocol field accordingly. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-08mac80211/mesh: make the preq queue lock consistentBaruch Siach1-3/+3
Make mesh_preq_queue_lock locking consistent with mesh_queue_preq() using spin_lock_bh(). Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-08mac80211: Don't use a buf_size=0 in ADDBA requestsHelmut Schaa1-0/+1
According to 802.11-2007, 7.3.1.14 it is compliant to use a buf_size of 0 in ADDBA requests. But some devices (AVM Fritz Stick N) arn't able to handle that correctly and will reply with an ADDBA reponse with a buf_size of 0 which in turn will disallow BA sessions for these devices. To work around this problem, initialize hw.max_tx_aggregation_subframes to the maximum AMPDU buffer size 0x40. Using 0 as default for the bufsize was introduced in commit 5dd36bc933e8be84f8369ac64505a2938f9ce036 (mac80211: allow advertising correct maximum aggregate size). Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-08mac80211: Stop TX BA session if buf_size is zeroHelmut Schaa1-11/+7
If we receive an ADDBA response with status code 0 and a buf_size of 0 we should stop the TX BA session as otherwise we'll end up queuing frames in ieee80211_tx_prep_agg forever instead of sending them out as non AMPDUs. This fixes a problem with AVM Fritz Stick N wireless devices where frames to this device are not transmitted anymore by mac80211. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-08-08mac80211: remove offchannel_tx APIJohannes Berg4-74/+0
For iwlwifi, I decided not to use this API since it just increased the complexity for little gain. Since nobody else intends to use it, let's kill it again. If anybody later needs to have it, we can always revive it then. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-27net: Audit drivers to identify those needing IFF_TX_SKB_SHARING clearedNeil Horman1-0/+1
After the last patch, We are left in a state in which only drivers calling ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real hardware call ether_setup for their net_devices and don't hold any state in their skbs. There are a handful of drivers that violate this assumption of course, and need to be fixed up. This patch identifies those drivers, and marks them as not being able to support the safe transmission of skbs by clearning the IFF_TX_SKB_SHARING flag in priv_flags Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Karsten Keil <isdn@linux-pingi.de> CC: "David S. Miller" <davem@davemloft.net> CC: Jay Vosburgh <fubar@us.ibm.com> CC: Andy Gospodarek <andy@greyhouse.net> CC: Patrick McHardy <kaber@trash.net> CC: Krzysztof Halasa <khc@pm.waw.pl> CC: "John W. Linville" <linville@tuxdriver.com> CC: Greg Kroah-Hartman <gregkh@suse.de> CC: Marcel Holtmann <marcel@holtmann.org> CC: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-25Merge branch 'for-linus' of ↵Linus Torvalds2-14/+10
git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (43 commits) fs: Merge split strings treewide: fix potentially dangerous trailing ';' in #defined values/expressions uwb: Fix misspelling of neighbourhood in comment net, netfilter: Remove redundant goto in ebt_ulog_packet trivial: don't touch files that are removed in the staging tree lib/vsprintf: replace link to Draft by final RFC number doc: Kconfig: `to be' -> `be' doc: Kconfig: Typo: square -> squared doc: Konfig: Documentation/power/{pm => apm-acpi}.txt drivers/net: static should be at beginning of declaration drivers/media: static should be at beginning of declaration drivers/i2c: static should be at beginning of declaration XTENSA: static should be at beginning of declaration SH: static should be at beginning of declaration MIPS: static should be at beginning of declaration ARM: static should be at beginning of declaration rcu: treewide: Do not use rcu_read_lock_held when calling rcu_dereference_check Update my e-mail address PCIe ASPM: forcedly -> forcibly gma500: push through device driver tree ... Fix up trivial conflicts: - arch/arm/mach-ep93xx/dma-m2p.c (deleted) - drivers/gpio/gpio-ep93xx.c (renamed and context nearby) - drivers/net/r8169.c (just context changes)
2011-07-21treewide: fix potentially dangerous trailing ';' in #defined values/expressionsPhil Carmody1-10/+10
All these are instances of #define NAME value; or #define NAME(params_opt) value; These of course fail to build when used in contexts like if(foo $OP NAME) while(bar $OP NAME) and may silently generate the wrong code in contexts such as foo = NAME + 1; /* foo = value; + 1; */ bar = NAME - 1; /* bar = value; - 1; */ baz = NAME & quux; /* baz = value; & quux; */ Reported on comp.lang.c, Message-ID: <ab0d55fe-25e5-482b-811e-c475aa6065c3@c29g2000yqd.googlegroups.com> Initial analysis of the dangers provided by Keith Thompson in that thread. There are many more instances of more complicated macros having unnecessary trailing semicolons, but this pile seems to be all of the cases of simple values suffering from the problem. (Thus things that are likely to be found in one of the contexts above, more complicated ones aren't.) Signed-off-by: Phil Carmody <ext-phil.2.carmody@nokia.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-07-20mac80211: check sta_info_get() return valueEliad Peller1-1/+9
ieee80211_stop_rx_ba_session() was calling sta_info_get() without rcu locking, and the return value was not checked. This resulted in the following panic: [<bf05726c>] (ieee80211_stop_rx_ba_session+0x0/0x60 [mac80211]) [<bf0abd94>] (wl1271_event_handle+0x0/0xdc8 [wl12xx]) [<bf0a7308>] (wl1271_irq+0x0/0x4a0 [wl12xx]) [<c00c40a8>] (irq_thread+0x0/0x254) [<c00a7398>] (kthread+0x0/0x8c) Signed-off-by: Eliad Peller <eliad@wizery.com> Reviewed-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-20mac80211: sync driver before TXJohannes Berg5-3/+122
In P2P client mode, the GO (AP) to connect to might have periods of time where it is not available due to powersave. To allow the driver to sync with it and send frames to the GO only when it is available add a new callback tx_sync (and the corresponding finish_tx_sync). These callbacks can sleep unlike the actual TX. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-19mac80211: implement scan supported ratesJohannes Berg5-15/+15
Scanning currently uses the TX rate mask to restrict the rate set, which is bogus. Make it use the new set of rates from userspace. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-18mac80211: reconfigure tx on device reconfigurationEliad Peller4-1/+12
Add tx_conf array to save the current tx queues configuration, and reconfig it on resume (ieee80211_reconfig). On resume, the driver is being reconfigured. Without reconfiguring the tx queues as well, the driver might configure the device to use wrong ac params (e.g. ps-poll instead of uapsd). Signed-off-by: Eliad Peller <eliad@wizery.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-15mac80211: be more careful in suspend/resumeJohannes Berg2-26/+31
When suspending with all netdevs down, the device is stopped but we still call a number of driver callbacks that the driver might not expect. The same happens during resume, we might call a few callbacks without starting the driver. Fix this by checking open_count around more things and exiting quickly if it is 0. Also, while at this I noticed that the coverage class isn't reprogrammed after resume, so add that. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-15mac80211: let key iteration get keys in install orderJohannes Berg1-1/+1
ieee80211_iter_keys() currently returns keys in the backward order they were installed in, which is a bit confusing. Add them to the tail of the key list to make sure iterations go in the same order that keys were originally installed in. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-15mac80211: allow driver access to TKIP RX P1KJohannes Berg1-0/+11
When the driver wants to pre-program the TKIP RX phase 1 key, it needs to be able to obtain it for the peer's TA. Add API to allow it to generate it. The generation uses a dummy on-stack context since it doesn't know the RX queue. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-13mac80211: allow driver to disconnect after resumeJohannes Berg6-6/+63
In WoWLAN, devices may use crypto keys for TX/RX and could also implement GTK rekeying. If the driver isn't able to retrieve replay counters and similar information from the device upon resume, or if the device isn't responsive due to platform issues, it isn't safe to keep the connection up as GTK rekey messages from during the sleep time could be replayed against it. The only protection against that is disconnecting from the AP. Modifying mac80211 to do that while it is resuming would be very complex and invasive in the case that the driver requires a reconfig, so do it after it has resumed completely. In that case, however, packets might be replayed since it can then only happen after TX/RX are up again, so mark keys for interfaces that need to disconnect as "tainted" and drop all packets that are sent or received with those keys. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-13mac80211: remove a redundant checkMohammed Shafi Shajakhan1-2/+1
is_valid_ether_addr itself checks for is_zero_ether_addr Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-11mac80211: allocate only one RX queueJohannes Berg1-2/+2
We don't have multiple RX queues, so there's no use in allocating multiple, use alloc_netdev_mqs() to allocate multiple TX but only one RX queue. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-11mac80211: add driver RSSI threshold eventsMeenakshi Venkataraman5-0/+125
mac80211 maintains a running average of the RSSI when a STA is associated to an AP. Report threshold events to any driver that has registered callbacks for getting RSSI measurements. Implement callbacks in mac80211 so that driver can set thresholds. Add callbacks in mac80211 which is invoked when an RSSI threshold event occurs. mac80211: add tracing to rssi_reports api and remove extraneous fn argument mac80211: scale up rssi thresholds from driver by 16 before storing Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-11Merge branch 'master' of ↵John W. Linville1-1/+2
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 Conflicts: drivers/net/wireless/ath/ath5k/sysfs.c net/bluetooth/l2cap_core.c net/mac80211/wpa.c
2011-07-11Merge branch 'master' into for-nextJiri Kosina7-32/+23
Sync with Linus' tree to be able to apply pending patches that are based on newer code already present upstream.
2011-07-08rcu: treewide: Do not use rcu_read_lock_held when calling rcu_dereference_checkMichal Hocko1-4/+0
Since ca5ecddf (rcu: define __rcu address space modifier for sparse) rcu_dereference_check use rcu_read_lock_held as a part of condition automatically so callers do not have to do that as well. Signed-off-by: Michal Hocko <mhocko@suse.cz> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2011-07-08mac80211: Restart STA timers only on associated stateRajkumar Manoharan1-0/+3
A panic was observed when the device is failed to resume properly, and there are no running interfaces. ieee80211_reconfig tries to restart STA timers on unassociated state. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: allow driver to generate P1K for IV32Johannes Berg1-6/+3
In order to support pre-populating the P1K cache in iwlwifi hardware for WoWLAN, we need to calculate the P1K for the current IV32. Allow drivers to get the P1K for any given IV32 instead of for a given packet, but keep the packet-based version around as an inline. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: allow drivers to access key sequence counterJohannes Berg2-2/+77
In order to implement GTK rekeying, the device needs to be able to encrypt frames with the right PN/IV and check the PN/IV in RX frames. To be able to tell it about all those counters, we need to be able to get them from mac80211, this adds the required API. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: simplify RX PN/IV handlingJohannes Berg5-20/+44
The current rx->queue value is slightly confusing. It is set to 16 on non-QoS frames, including data, and then used for sequence number and PN/IV checks. Until recently, we had a TKIP IV checking bug that had been introduced in 2008 to fix a seqno issue. Before that, we always used TID 0 for checking the PN or IV on non-QoS packets. Go back to the old status for PN/IV checks using the TID 0 counter for non-QoS by splitting up the rx->queue value into "seqno_idx" and "security_idx" in order to avoid confusion in the future. They each have special rules on the value used for non- QoS data frames. Since the handling is now unified, also revert the special TKIP handling from my patch "mac80211: fix TKIP replay vulnerability". Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: use AES_BLOCK_SIZEJohannes Berg5-29/+25
mac80211 has a defnition of AES_BLOCK_SIZE and multiple definitions of AES_BLOCK_LEN. Remove them all and use crypto/aes.h. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: fix CMAC racesJohannes Berg6-32/+33
Just like TKIP and CCMP, CMAC has the PN race. It might not actually be possible to hit it now since there aren't multiple ACs for management frames, but fix it anyway. Also move scratch buffers onto the stack. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: fix CCMP racesJohannes Berg4-25/+32
Since we can process multiple packets at the same time for different ACs, but the PN is allocated from a single counter, we need to use an atomic value there. Use atomic64_t to make this cheaper on 64-bit platforms, other platforms will support this through software emulation, see lib/atomic64.c. We also need to use an on-stack scratch buf so that multiple packets won't corrupt each others scratch buffers. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-08mac80211: fix TKIP races, make API easier to useJohannes Berg5-61/+78
Our current TKIP code races against itself on TX since we can process multiple packets at the same time on different ACs, but they all share the TX context for TKIP. This can lead to bad IVs etc. Also, the crypto offload helper code just obtains the P1K/P2K from the cache, and can update it as well, but there's no guarantee that packets are really processed in order. To fix these issues, first introduce a spinlock that will protect the IV16/IV32 values in the TX context. This first step makes sure that we don't assign the same IV multiple times or get confused in other ways. Secondly, change the way the P1K cache works. I add a field "p1k_iv32" that stores the value of the IV32 when the P1K was last recomputed, and if different from the last time, then a new P1K is recomputed. This can cause the P1K computation to flip back and forth if packets are processed out of order. All this also happens under the new spinlock. Finally, because there are argument differences, split up the ieee80211_get_tkip_key() API into ieee80211_get_tkip_p1k() and ieee80211_get_tkip_p2k() and give them the correct arguments. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-07-07mac80211: fix TKIP replay vulnerabilityJohannes Berg1-3/+13
Unlike CCMP, the presence or absence of the QoS field doesn't change the encryption, only the TID is used. When no QoS field is present, zero is used as the TID value. This means that it is possible for an attacker to take a QoS packet with TID 0 and replay it as a non-QoS packet. Unfortunately, mac80211 uses different IVs for checking the validity of the packet's TKIP IV when it checks TID 0 and when it checks non-QoS packets. This means it is vulnerable to this replay attack. To fix this, use the same replay counter for TID 0 and non-QoS packets by overriding the rx->queue value to 0 if it is 16 (non-QoS). This is a minimal fix for now. I caused this issue in commit 1411f9b531f0a910cd1c85a337737c1e6ffbae6a Author: Johannes Berg <johannes@sipsolutions.net> Date: Thu Jul 10 10:11:02 2008 +0200 mac80211: fix RX sequence number check while fixing a sequence number issue (there, a separate counter needs to be used). Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-31 04:22:46 +0000