Introduce NL80211_KEY_LTF_SEED attribute to enable secure FTM measurements with PHY-layer security. This allows drivers to generate secure LTF keys for ranging operations, protecting against eavesdropping and manipulation of ranging measurements. Support the keyseed with trigger-based and non-trigger-based FTM requests to enable secure peer measurement sessions. The keyseed must be configured before initiating the measurement session to ensure end-to-end security throughout the ranging operation. Signed-off-by: Peddolla Harshavardhan Reddy --- include/net/cfg80211.h | 4 ++++ include/uapi/linux/nl80211.h | 16 +++++++++++++--- net/wireless/nl80211.c | 10 ++++++++++ 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 6f7abb118a27..ac69cb200c0f 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -830,6 +830,8 @@ struct vif_params { * @seq_len: length of @seq. * @vlan_id: vlan_id for VLAN group key (if nonzero) * @mode: key install mode (RX_TX, NO_TX or SET_TX) + * @ltf_keyseed: LTF key seed material + * @ltf_keyseed_len: length of LTF key seed material */ struct key_params { const u8 *key; @@ -839,6 +841,8 @@ struct key_params { u16 vlan_id; u32 cipher; enum nl80211_key_mode mode; + const u8 *ltf_keyseed; + size_t ltf_keyseed_len; }; /** diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h index 9c647c184e7f..0ae56bd66e7e 100644 --- a/include/uapi/linux/nl80211.h +++ b/include/uapi/linux/nl80211.h @@ -395,9 +395,10 @@ * %NL80211_ATTR_MLO_LINK_ID. * @NL80211_CMD_NEW_KEY: add a key with given %NL80211_ATTR_KEY_DATA, * %NL80211_ATTR_KEY_IDX, %NL80211_ATTR_MAC, %NL80211_ATTR_KEY_CIPHER, - * and %NL80211_ATTR_KEY_SEQ attributes. %NL80211_ATTR_MAC represents - * peer's MLD address for MLO pairwise key. The link to add MLO - * group key is identified by %NL80211_ATTR_MLO_LINK_ID. + * %NL80211_ATTR_KEY_SEQ and %NL80211_KEY_LTF_SEED attributes. + * %NL80211_ATTR_MAC represents peer's MLD address for MLO pairwise key. + * The link to add MLO group key is identified by + * %NL80211_ATTR_MLO_LINK_ID. * @NL80211_CMD_DEL_KEY: delete a key identified by %NL80211_ATTR_KEY_IDX * or %NL80211_ATTR_MAC. %NL80211_ATTR_MAC represents peer's MLD address * for MLO pairwise key. The link to delete group key is identified by @@ -5602,6 +5603,14 @@ enum nl80211_key_default_types { * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode. * Defaults to @NL80211_KEY_RX_TX. * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key + * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate + * secure LTF keys used in case of peer measurement request with FTM + * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED + * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED, secure LTF key seeds will + * help enable PHY security in peer measurement session. The corresponding + * keys need to be configured before hand to ensure peer measurement + * session is secure. Only valid if %NL80211_EXT_FEATURE_SECURE_LTF + * is set. * * @__NL80211_KEY_AFTER_LAST: internal * @NL80211_KEY_MAX: highest key attribute @@ -5618,6 +5627,7 @@ enum nl80211_key_attributes { NL80211_KEY_DEFAULT_TYPES, NL80211_KEY_MODE, NL80211_KEY_DEFAULT_BEACON, + NL80211_KEY_LTF_SEED, /* keep last */ __NL80211_KEY_AFTER_LAST, diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 281a15226edb..68bf941122ae 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -983,6 +983,7 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), + [NL80211_KEY_LTF_SEED] = { .type = NLA_BINARY, .len = 48 }, }; /* policy for the key default flags */ @@ -1459,6 +1460,7 @@ struct key_parse { static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, struct key_parse *k) { + struct cfg80211_registered_device *rdev = info->user_ptr[0]; struct nlattr *tb[NL80211_KEY_MAX + 1]; int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key, nl80211_key_policy, @@ -1514,6 +1516,14 @@ static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, if (tb[NL80211_KEY_MODE]) k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); + if (tb[NL80211_KEY_LTF_SEED]) { + if (!wiphy_ext_feature_isset(&rdev->wiphy, + NL80211_EXT_FEATURE_SECURE_LTF)) + return -EOPNOTSUPP; + k->p.ltf_keyseed = nla_data(tb[NL80211_KEY_LTF_SEED]); + k->p.ltf_keyseed_len = nla_len(tb[NL80211_KEY_LTF_SEED]); + } + return 0; } -- 2.34.1