Page MenuHomeFreeBSD
Differential D44864

net80211: add new ciphers and RSN flags
Needs ReviewPublic
Actions

Authored by adrian on Fri, Apr 19, 2:08 PM.
Tags
Referenced Files
Unknown Object (File)
Wed, May 1, 7:11 PM
Unknown Object (File)
Wed, May 1, 5:24 AM
Unknown Object (File)
Sat, Apr 27, 6:52 AM
Unknown Object (File)
Sat, Apr 27, 6:22 AM
Unknown Object (File)
Fri, Apr 26, 1:08 PM
Unknown Object (File)
Fri, Apr 26, 10:33 AM
Unknown Object (File)
Thu, Apr 25, 8:12 PM
Unknown Object (File)
Thu, Apr 25, 8:08 PM
View All 13 Files
Subscribers
bz
cc
emaste
glebius
imp
melifaro

Details

Reviewers
adrian
bz
cc
Group Reviewers
wireless
Summary

These are the rest of the ciphers and RSN flags from 802.11-2016.

  • add the rest of the ciphers from 802.11-2016
  • add the rest of the RSN flags from 802.11-2016

Of special interest here are the extended key ID field for supporting

1 unicast key (to support seamless rekeying w/out dropping frames)

and the MFP (management frame protection) config bits.

This is a no-op; no code is using these new fields.
(In particular, no code in net80211 uses the RSN capability bits;
but that will change when we start on MFP support.)

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 57482
Build 54370: arc lint + arc unit

Event Timeline

adrian created this revision.Fri, Apr 19, 2:08 PM
Herald added subscribers: glebius, melifaro, imp. · View Herald TranscriptFri, Apr 19, 2:08 PM
adrian requested review of this revision.Fri, Apr 19, 2:08 PM
Harbormaster completed remote builds in B57215: Diff 137385.Fri, Apr 19, 2:08 PM
adrian updated this revision to Diff 137386.Fri, Apr 19, 2:09 PM

add differential revision

Harbormaster completed remote builds in B57216: Diff 137386.Fri, Apr 19, 2:09 PM
adrian added a parent revision: D44827: net80211: add driver / crypto methods to set the hardware / software cipher suites.Fri, Apr 19, 2:10 PM
adrian added a reviewer: wireless.
bz requested changes to this revision.Fri, Apr 19, 4:47 PM
bz added a subscriber: bz.
bz added inline comments.
sys/net80211/ieee80211.h
1269

Comments are a tab further out here.

1283

Why a comment instead of _256 here for these two?

1284

This is /* Reserved */ for the standard you are citing.

1285

Compered to the plain CCMP which we could also defined double as CCMP_128 the comment here is not needed.

1286

Why not TDLS_256 in this case either? Either we are consistent with all or not?

1290

Above you are using "Table 9-131—Cipher suite selectors" here you are using 9-xx and then (). Why don't keep it as ", Table 9-133 - AKM suite selectors"?

1290

I think the world (other standards) generally call them "Suite B" and I think it would remove confusion if it were added here.

1291

The two comments are encoded in the name so what's the need for them?

1294

, Figure 9-257 - RSN Capabilities field format

1295

How much of this do you actually need in the kernel compared to just the supplicant?

This revision now requires changes to proceed.Fri, Apr 19, 4:47 PM
emaste added a subscriber: emaste.Fri, Apr 19, 4:49 PM
emaste added inline comments.
sys/net80211/ieee80211.h
1278

Thank you for putting the references in!

1281–1282

reserved?

1285–1288

These are decimal in the spec, any reason not to follow suit? The compiler doesn't care and it's easier for humans to match.

adrian added inline comments.Fri, Apr 19, 4:58 PM
sys/net80211/ieee80211.h
1295

Today? None of them. It's just to get them into the tree.

But soon? We're going to need to use them as part of IE parsing and in IBSS/hostap modes, as we drive a bunch of that initial MLME machinery here in net80211 before we hand it off to the hostapd side to handle key management.

(See how the WPA/WPA2 and cipher flags get used in net80211, we're going to need similar stuff here for MFP and EXT_KEYID_CAPABLE too.)

adrian added inline comments.Fri, Apr 19, 5:20 PM
sys/net80211/ieee80211.h
1281–1282

Yeah, it was used in an early draft for AES-OCB. It never landed in the spec, but we have AES-OCB placeholders still in the code.

(i went looking for the cipher code for this out of morbid curiousity, but couldn't find any!)

adrian updated this revision to Diff 137401.Fri, Apr 19, 5:21 PM

feedback from emaste / bz

Harbormaster completed remote builds in B57225: Diff 137401.Fri, Apr 19, 5:21 PM
adrian marked 6 inline comments as done.Fri, Apr 19, 5:23 PM

I'll review the AKM names a second time; stay tuned.

sys/net80211/ieee80211.h
1281–1282

oh /this/ one is reserved? lemme double check, sorry!

adrian marked an inline comment as done.Fri, Apr 19, 5:28 PM
adrian added inline comments.
sys/net80211/ieee80211.h
1290

I'm open to suggestions, esp if they align better with how nl80211 names them.

I based these on the 802.11-2016 names, and it doesn't mention suite-b here ;-)

bz added inline comments.Fri, Apr 19, 6:05 PM
sys/net80211/ieee80211.h
1290

Not sure where you are looking but the table you referenced actually says does.

".. using a Suite B compliant EAP method .."

I don't know about nl80211, I know from some RFCs in a different world.

adrian updated this revision to Diff 137417.Fri, Apr 19, 8:54 PM
adrian marked an inline comment as done.

rename fields

Harbormaster completed remote builds in B57234: Diff 137417.Fri, Apr 19, 8:54 PM
adrian added inline comments.Fri, Apr 19, 8:54 PM
sys/net80211/ieee80211.h
1290

oh lord, yes you're right. I was just looking at the name of the thing, not what was using it. :-) Oops!

adrian marked an inline comment as done.Fri, Apr 19, 8:56 PM

updated after looking at wpa's definition of it in the 802.11 spec headers in it:

#define RSN_AUTH_KEY_MGMT_802_1X_SUITE_B RSN_SELECTOR(0x00, 0x0f, 0xac, 11)
#define RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192 RSN_SELECTOR(0x00, 0x0f, 0xac, 12)

adrian marked 2 inline comments as done.Fri, Apr 19, 8:56 PM
adrian added a project: wireless.Sat, Apr 20, 8:46 PM
adrian added a child revision: D44899: net80211: add the 802.11-2016 cipher list to the crypto array set..Mon, Apr 22, 3:46 AM
cc requested changes to this revision.Wed, Apr 24, 8:11 PM
cc added a subscriber: cc.
cc added inline comments.
sys/net80211/ieee80211.h
1282–1333

I can find the definition of RSN, OUI, WPA, AKM, etc.

Let me guess the "CSE" inside RSN_CSE_NULL. Is it Cipher Shift Element or Cipher Suite Element? Please help add the comment of this acronyms as I guess it is challenging to read so many acronyms, not even say find these acronyms.

1289

Instead of 0x07, use 7 to keep consistency.

1298

Let me guess the "ASE" inside the RSN_ASE_NONE means "Authentication Suite Element"?

1309

Shall be RSN_ASE_8021X_SUITE_B_256?

1310

I can find the same *_8021X_SUITE_B_192 in Linux, but actually the table says using SHA-384. Confusing? Shall be RSN_ASE_8021X_SUITE_B_384?

1319

I think use CAPABLE as RSN_CAP_MFP_CAPABLE is consistent with it in the Figure 9-257.

This revision now requires changes to proceed.Wed, Apr 24, 8:11 PM
adrian updated this revision to Diff 137741.Sat, Apr 27, 1:57 AM

comments!

Harbormaster completed remote builds in B57410: Diff 137741.Sat, Apr 27, 1:57 AM
adrian marked 4 inline comments as done.Sat, Apr 27, 1:58 AM
cc requested changes to this revision.Mon, Apr 29, 2:56 PM
cc added inline comments.
sys/net80211/ieee80211.h
1333

The table shows 16 replay counters per PTKSA/GTKSA/STKSA for "Replay counter value 3".

This revision now requires changes to proceed.Mon, Apr 29, 2:56 PM
adrian marked an inline comment as done.Wed, May 1, 1:33 AM
adrian updated this revision to Diff 137922.Wed, May 1, 2:19 AM

address comments from cc@

Harbormaster completed remote builds in B57482: Diff 137922.Wed, May 1, 2:19 AM
adrian added inline comments.Wed, May 1, 10:16 PM
sys/net80211/ieee80211.h
1333

oh good catch!

cc accepted this revision as: cc.Thu, May 2, 5:54 PM

Individual accept.

bz added a comment.Thu, May 2, 7:34 PM

Most of the comments were marked "done" and changed some since the original comments but the "RSN AKM suite element" table still has a mix of #define suffixes and comments for the "256" cases? Is this on purpose for some reason beyond this file? At least the TDLS case I had originally asked for _256? I just wonder why not? Can you explain?

sys/net80211/ieee80211.h
1286

This was marked done but never addressed?

adrian marked an inline comment as done.Fri, May 3, 4:43 PM
adrian added inline comments.
sys/net80211/ieee80211.h
1286

I thought I had made them all internally consistent now?

Revision Contents
Changeset List

PathSize
sys/
net80211/
67 lines

Diff 137922

View Options

sys/net80211/ieee80211.h

Loading...