github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: allow cipher change on NAN_DATA interfaces

Browse Source 
ieee80211_key_link() rejects pairwise key installation when the
cipher differs from the existing PTK. Per Wi-Fi Aware version 4.0
section 7.4, the ND-TKSA between the same NDI pair shall be updated
when a new NDP requires a stronger cipher suite.

Exempt NL80211_IFTYPE_NAN_DATA from the same-cipher enforcement so
the PTK can be replaced with a different cipher.

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260515142736.3188a47a23bf.I5fba3a111ffe054b46928aefa5c2d763fef51d4d@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Daniel Gabay 2026-05-15 14:28:06 +03:00 committed by Johannes Berg
parent 11a0111ea1
commit 0980560283
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
net/mac80211/key.c
View File

@ -870,11 +870,16 @@ int ieee80211_key_link(struct ieee80211_key *key,
alt_key = wiphy_dereference(sdata->local->hw.wiphy,
sta->ptk[idx ^ 1]);
/* The rekey code assumes that the old and new key are using
/*
* The rekey code assumes that the old and new key are using
* the same cipher. Enforce the assumption for pairwise keys.
* NAN Data interfaces are exempt: Wi-Fi Aware v4.0 section 7.4
* requires upgrading the ND-TKSA when a new NDP negotiates a
* stronger cipher suite.
*/
if ((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
(old_key && old_key->conf.cipher != key->conf.cipher)) {
if (sdata->vif.type != NL80211_IFTYPE_NAN_DATA &&
((alt_key && alt_key->conf.cipher != key->conf.cipher) ||
(old_key && old_key->conf.cipher != key->conf.cipher))) {
ret = -EOPNOTSUPP;
goto out;
}