From 7dc9d473914b500f679acb301594ff4fc0095bd0 Mon Sep 17 00:00:00 2001 From: Srikanth Marepalli Date: Mon, 26 Feb 2024 19:46:31 +0530 Subject: [PATCH] qcacld-3.0: Update key management after bss create response Add support to update key management with higher security after BSS create response. Also, Currently if there are multiple AKM and ucast cipher. Host overwrites AKM and ucast cipher value with the new one. Instead of overwrite, add support to do ORing to keep all values. Change-Id: I7a489c7d90a609c28be69a9fe9deb0b9b9c328af CRs-Fixed: 3751018 --- core/sme/src/csr/csr_util.c | 126 +++++++++++++++++++++++++++++++++++- 1 file changed, 125 insertions(+), 1 deletion(-) diff --git a/core/sme/src/csr/csr_util.c b/core/sme/src/csr/csr_util.c index 8c08c6a19c57..3ecb634f3889 100644 --- a/core/sme/src/csr/csr_util.c +++ b/core/sme/src/csr/csr_util.c @@ -1,6 +1,6 @@ /* * Copyright (c) 2011-2021 The Linux Foundation. All rights reserved. - * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -35,6 +35,7 @@ #include "wlan_reg_services_api.h" #include "wlan_crypto_global_api.h" #include "wlan_cm_roam_api.h" +#include "wlan_crypto_def_i.h" uint8_t csr_wpa_oui[][CSR_WPA_OUI_SIZE] = { {0x00, 0x50, 0xf2, 0x00} @@ -2445,6 +2446,125 @@ static inline void csr_update_pmksa_to_profile(struct csr_roam_profile *profile, } #endif +static void csr_update_key_mgmt_crypto_param(struct wlan_objmgr_vdev *vdev, + tDot11fIERSN ap_rsn) +{ + int32_t key_mgmt = 0; + int32_t neg_akm; + + neg_akm = wlan_crypto_get_param(vdev, WLAN_CRYPTO_PARAM_KEY_MGMT); + if (neg_akm < 0) { + sme_err("Invalid AKM suite"); + return; + } + + SET_PARAM(neg_akm, + wlan_crypto_rsn_suite_to_keymgmt(ap_rsn.akm_suite[0])); + + /* + * As there can be multiple AKM present select the most secured AKM + * present + */ + if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_SAE)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_SAE); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_SAE)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_SAE); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SUITE_B)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SUITE_B); + else if (HAS_PARAM(neg_akm, + WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SUITE_B_192)) + SET_PARAM(key_mgmt, + WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SUITE_B_192); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FILS_SHA256)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FILS_SHA256); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FILS_SHA384)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FILS_SHA384); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_FILS_SHA256)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_FILS_SHA256); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_FILS_SHA384)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_FILS_SHA384); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_OWE)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_OWE); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_DPP)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_DPP); + else if (HAS_PARAM(neg_akm, + WLAN_CRYPTO_KEY_MGMT_FT_IEEE8021X_SHA384)) + SET_PARAM(key_mgmt, + WLAN_CRYPTO_KEY_MGMT_FT_IEEE8021X_SHA384); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_PSK)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_PSK); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_IEEE8021X)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_IEEE8021X); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_PSK)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_PSK); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SHA256)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_SHA256); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_PSK_SHA256)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_PSK_SHA256); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_FT_PSK_SHA384)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_FT_PSK_SHA384); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_PSK_SHA384)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_PSK_SHA384); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_WAPI_PSK)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_WAPI_PSK); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_WAPI_CERT)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_WAPI_CERT); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_CCKM)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_CCKM); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_OSEN)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_OSEN); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_WPS)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_WPS); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_IEEE8021X)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_IEEE8021X); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_NO_WPA)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_IEEE8021X_NO_WPA); + else if (HAS_PARAM(neg_akm, WLAN_CRYPTO_KEY_MGMT_WPA_NONE)) + SET_PARAM(key_mgmt, WLAN_CRYPTO_KEY_MGMT_WPA_NONE); + else /* use original if no akm match */ + key_mgmt = neg_akm; + + wlan_crypto_set_vdev_param(vdev, WLAN_CRYPTO_PARAM_KEY_MGMT, + key_mgmt); +} + +static void csr_update_ucast_cipher_crypto_param(struct wlan_objmgr_vdev *vdev, + tDot11fIERSN ap_rsn) +{ + int32_t ucastcipherset = 0; + int32_t neg_ucastcipher; + + neg_ucastcipher = wlan_crypto_get_param(vdev, + WLAN_CRYPTO_PARAM_UCAST_CIPHER); + if (neg_ucastcipher < 0) { + sme_err("Invalid unicast cipherset"); + return; + } + + SET_PARAM(neg_ucastcipher, + wlan_crypto_rsn_suite_to_cipher(ap_rsn.pwise_cipher_suites[0])); + + /* + * As there can be multiple ucastcipher present select the most secured + * ucastcipher present. + */ + if (HAS_PARAM(neg_ucastcipher, WLAN_CRYPTO_CIPHER_AES_GCM_256)) + SET_PARAM(ucastcipherset, WLAN_CRYPTO_CIPHER_AES_GCM_256); + else if (HAS_PARAM(neg_ucastcipher, WLAN_CRYPTO_CIPHER_AES_CCM_256)) + SET_PARAM(ucastcipherset, WLAN_CRYPTO_CIPHER_AES_CCM_256); + else if (HAS_PARAM(neg_ucastcipher, WLAN_CRYPTO_CIPHER_AES_GCM)) + SET_PARAM(ucastcipherset, WLAN_CRYPTO_CIPHER_AES_GCM); + else if (HAS_PARAM(neg_ucastcipher, WLAN_CRYPTO_CIPHER_AES_CCM)) + SET_PARAM(ucastcipherset, WLAN_CRYPTO_CIPHER_AES_CCM); + else if (HAS_PARAM(neg_ucastcipher, WLAN_CRYPTO_CIPHER_TKIP)) + SET_PARAM(ucastcipherset, WLAN_CRYPTO_CIPHER_TKIP); + else + ucastcipherset = neg_ucastcipher; + + wlan_crypto_set_vdev_param(vdev, WLAN_CRYPTO_PARAM_UCAST_CIPHER, + ucastcipherset); +} + uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId, struct csr_roam_profile *pProfile, struct bss_description *pSirBssDesc, @@ -2500,6 +2620,10 @@ uint8_t csr_construct_rsn_ie(struct mac_context *mac, uint32_t sessionId, } wlan_crypto_set_vdev_param(vdev, WLAN_CRYPTO_PARAM_RSN_CAP, self_rsn_cap); + + csr_update_key_mgmt_crypto_param(vdev, local_ap_ie->RSN); + csr_update_ucast_cipher_crypto_param(vdev, local_ap_ie->RSN); + qdf_mem_zero(&pmksa, sizeof(pmksa)); if (pSirBssDesc->fils_info_element.is_cache_id_present) { pmksa.ssid_len =