Skip to content

Commit

Permalink
cfg80211: Validate cipher suite against supported ciphers
Browse files Browse the repository at this point in the history
Instead of using a hardcoded list of cipher suites in nl80211.c, use a
shared function in util.c to verify that the driver advertises support
for the specified cipher. This provides more accurate validation of the
values and allows vendor-specific cipher suites to be added in drivers.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Jouni Malinen authored and John W. Linville committed Sep 27, 2011
1 parent 6d30240 commit 38ba3c5
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 18 deletions.
1 change: 1 addition & 0 deletions net/wireless/core.h
Original file line number Diff line number Diff line change
Expand Up @@ -406,6 +406,7 @@ void cfg80211_sme_failed_assoc(struct wireless_dev *wdev);
bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);

/* internal helpers */
bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
struct key_params *params, int key_idx,
bool pairwise, const u8 *mac_addr);
Expand Down
16 changes: 4 additions & 12 deletions net/wireless/nl80211.c
Original file line number Diff line number Diff line change
Expand Up @@ -4126,16 +4126,6 @@ static bool nl80211_valid_wpa_versions(u32 wpa_versions)
NL80211_WPA_VERSION_2));
}

static bool nl80211_valid_cipher_suite(u32 cipher)
{
return cipher == WLAN_CIPHER_SUITE_WEP40 ||
cipher == WLAN_CIPHER_SUITE_WEP104 ||
cipher == WLAN_CIPHER_SUITE_TKIP ||
cipher == WLAN_CIPHER_SUITE_CCMP ||
cipher == WLAN_CIPHER_SUITE_AES_CMAC;
}


static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
{
struct cfg80211_registered_device *rdev = info->user_ptr[0];
Expand Down Expand Up @@ -4268,15 +4258,17 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
memcpy(settings->ciphers_pairwise, data, len);

for (i = 0; i < settings->n_ciphers_pairwise; i++)
if (!nl80211_valid_cipher_suite(
if (!cfg80211_supported_cipher_suite(
&rdev->wiphy,
settings->ciphers_pairwise[i]))
return -EINVAL;
}

if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
settings->cipher_group =
nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
if (!nl80211_valid_cipher_suite(settings->cipher_group))
if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
settings->cipher_group))
return -EINVAL;
}

Expand Down
16 changes: 10 additions & 6 deletions net/wireless/util.c
Original file line number Diff line number Diff line change
Expand Up @@ -151,12 +151,19 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
set_mandatory_flags_band(wiphy->bands[band], band);
}

bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
{
int i;
for (i = 0; i < wiphy->n_cipher_suites; i++)
if (cipher == wiphy->cipher_suites[i])
return true;
return false;
}

int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
struct key_params *params, int key_idx,
bool pairwise, const u8 *mac_addr)
{
int i;

if (key_idx > 5)
return -EINVAL;

Expand Down Expand Up @@ -226,10 +233,7 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
}
}

for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
if (params->cipher == rdev->wiphy.cipher_suites[i])
break;
if (i == rdev->wiphy.n_cipher_suites)
if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
return -EINVAL;

return 0;
Expand Down

0 comments on commit 38ba3c5

Please sign in to comment.