From nobody Wed Apr 23 16:25:17 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ZjPbL4LNLz5tbM4; Wed, 23 Apr 2025 16:25:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ZjPbL1K0Pz49Tm; Wed, 23 Apr 2025 16:25:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745425518; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/QpC9Bo8wAhGuXh9CJmckX/Np2RWTSgNoZRH82evcdg=; b=kydVKL+tc431SC1gkSBE3Hq45xaVC8JlMz62Kurg0zC37uDBeQxgBh3vDP53WcU+QUIQ3w axGC6WXuV+y9hQRo7t1zFkWYoO6KC7MCzPwjPpigtlsRn1tq4wif7D5uVoH1XEoemRAC2m 7sACo9BM8GJfVYHgJCIHXC3jADQ/uYwOlmkIvyF3Fi2foMH5DvJJAPNBIptoXh/E6ynjFn U2o1neZMW8at2XjW3rfRrbiWc/EskkBrjMHG9cOxiEIlRhVReqQ66/Vk8sFZ8dETJ/zlYl R8ODx1r9zN3xTeP3Z5H7dvlLMeYyAirO/2XgPGI4Npf/ghtt/i5NXok5qD7QuQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1745425518; a=rsa-sha256; cv=none; b=YXJ/cFlKaEYYnhFjdlcsdDBQrqJfentfMJa4rL3cKeJ7gaCC96yG/YY+V+NWyNJt45c6lh NccaZP4NxotBxC2D7/40UeTsQcmgCojSN+yF6naV3q7rex4hC7nNp5r2ZrAo9u5kwKaHfz JhSvgNBMkfN7PMpfmY6uCkxSnmweoDmjUlX2HZmKLttYl1B1zi4lsJqM5GxD6RFMd+ELyo PY+iaFXPxFzkeVpgbz7xK1mpthUQrlnj5cgNkMUJLncH7f9NNGdwT+ibbkTFEJroELBK+Q 0l4/KZzHMwpyXjeDvn/bqRFMpV/0RWIbnDFOWlHBWYJTe1GH/MGW6Ww/R6XTnw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1745425518; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/QpC9Bo8wAhGuXh9CJmckX/Np2RWTSgNoZRH82evcdg=; b=A2uTT6k6OxWYrROxD0DbDptd7DdkshCVZAYLXvfhxOTLnS1re3L6VCTVWykrq58fGevVe1 No5clDTfGtnR62pmOpxhR4ZPd65syyIMV2QI98GsRffSAP/vPHdFrur65PzQYnQo9MJRTc k0xlo4q7X+i7O+tsTgrfjIACsG0+k3qqGo/4zUeslFDFiq9IAlXhLgXmMDYpWD0lspj+4P Eo+0y5ciOGRJKzkQjNVUesJe67AvcOpKGLhjzzYfu+jb5tUZ7ftRM71no0rr+9wKqqx8EI Nvwu+yN1R7LasOdiFMSksZUn2x3KE1am4gVqYO4SqpWmrrBfEetGxpUruy2XTg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ZjPbL0MD9z19kr; Wed, 23 Apr 2025 16:25:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53NGPHtC081844; Wed, 23 Apr 2025 16:25:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53NGPHrN081841; Wed, 23 Apr 2025 16:25:17 GMT (envelope-from git) Date: Wed, 23 Apr 2025 16:25:17 GMT Message-Id: <202504231625.53NGPHrN081841@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: "Bjoern A. Zeeb" Subject: git: bf8c25f16165 - main - LinuxKPI: 802.11: sort cipher lists and filter net80211 unsupported ones List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: bf8c25f16165440cb75199c2ae405e75d2540e93 Auto-Submitted: auto-generated The branch main has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=bf8c25f16165440cb75199c2ae405e75d2540e93 commit bf8c25f16165440cb75199c2ae405e75d2540e93 Author: Bjoern A. Zeeb AuthorDate: 2025-04-15 20:34:41 +0000 Commit: Bjoern A. Zeeb CommitDate: 2025-04-23 16:24:20 +0000 LinuxKPI: 802.11: sort cipher lists and filter net80211 unsupported ones Sort the ciphers in lkpi_cipher_suite_to_name() to match other places (e.g., in mac80211.h). Do the same for lkpi_l80211_to_net80211_cyphers() and return the net80211 for all of them. This in theory automatically enables them for net80211 and user space which can lead to other odd problems. Filter out everything net80211 does not currently support in ieee80211_ifattach(). Then also disable all we have not sucessfully implemented in LinuxKPI yet. It is assumed that the later will go away any day again but keep the commit sequence usable. Lastly also fill them all in lkpi_net80211_to_l80211_cipher_suite(). Sponsored by: The FreeBSD Foundation MFC after: 3 days --- sys/compat/linuxkpi/common/src/linux_80211.c | 93 +++++++++++++++++++--------- 1 file changed, 63 insertions(+), 30 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index cbf1db5e17de..28c04c9b7a99 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -961,68 +961,68 @@ lkpi_opmode_to_vif_type(enum ieee80211_opmode opmode) static const char * lkpi_cipher_suite_to_name(uint32_t wlan_cipher_suite) { - switch (wlan_cipher_suite) { case WLAN_CIPHER_SUITE_WEP40: return ("WEP40"); + case WLAN_CIPHER_SUITE_WEP104: + return ("WEP104"); case WLAN_CIPHER_SUITE_TKIP: return ("TKIP"); case WLAN_CIPHER_SUITE_CCMP: return ("CCMP"); - case WLAN_CIPHER_SUITE_WEP104: - return ("WEP104"); - case WLAN_CIPHER_SUITE_AES_CMAC: - return ("AES_CMAC"); + case WLAN_CIPHER_SUITE_CCMP_256: + return ("CCMP_256"); case WLAN_CIPHER_SUITE_GCMP: return ("GCMP"); case WLAN_CIPHER_SUITE_GCMP_256: return ("GCMP_256"); - case WLAN_CIPHER_SUITE_CCMP_256: - return ("CCMP_256"); + case WLAN_CIPHER_SUITE_AES_CMAC: + return ("AES_CMAC"); + case WLAN_CIPHER_SUITE_BIP_CMAC_256: + return ("BIP_CMAC_256"); case WLAN_CIPHER_SUITE_BIP_GMAC_128: return ("BIP_GMAC_128"); case WLAN_CIPHER_SUITE_BIP_GMAC_256: return ("BIP_GMAC_256"); - case WLAN_CIPHER_SUITE_BIP_CMAC_256: - return ("BIP_CMAC_256"); default: return ("??"); } } static uint32_t -lkpi_l80211_to_net80211_cyphers(uint32_t wlan_cipher_suite) +lkpi_l80211_to_net80211_cyphers(struct ieee80211com *ic, + uint32_t wlan_cipher_suite) { - switch (wlan_cipher_suite) { case WLAN_CIPHER_SUITE_WEP40: return (IEEE80211_CRYPTO_WEP); + case WLAN_CIPHER_SUITE_WEP104: + return (IEEE80211_CRYPTO_WEP); case WLAN_CIPHER_SUITE_TKIP: return (IEEE80211_CRYPTO_TKIP); case WLAN_CIPHER_SUITE_CCMP: return (IEEE80211_CRYPTO_AES_CCM); - case WLAN_CIPHER_SUITE_WEP104: - return (IEEE80211_CRYPTO_WEP); - case WLAN_CIPHER_SUITE_AES_CMAC: + case WLAN_CIPHER_SUITE_CCMP_256: + return (IEEE80211_CRYPTO_AES_CCM_256); case WLAN_CIPHER_SUITE_GCMP: + return (IEEE80211_CRYPTO_AES_GCM_128); case WLAN_CIPHER_SUITE_GCMP_256: - case WLAN_CIPHER_SUITE_CCMP_256: + return (IEEE80211_CRYPTO_AES_GCM_256); + case WLAN_CIPHER_SUITE_AES_CMAC: + return (IEEE80211_CRYPTO_BIP_CMAC_128); + case WLAN_CIPHER_SUITE_BIP_CMAC_256: + return (IEEE80211_CRYPTO_BIP_CMAC_256); case WLAN_CIPHER_SUITE_BIP_GMAC_128: + return (IEEE80211_CRYPTO_BIP_GMAC_128); case WLAN_CIPHER_SUITE_BIP_GMAC_256: - case WLAN_CIPHER_SUITE_BIP_CMAC_256: - printf("%s: unsupported WLAN Cipher Suite %#08x | %u (%s)\n", - __func__, - wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff, - lkpi_cipher_suite_to_name(wlan_cipher_suite)); - break; + return (IEEE80211_CRYPTO_BIP_GMAC_256); default: - printf("%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n", + ic_printf(ic, "%s: unknown WLAN Cipher Suite %#08x | %u (%s)\n", __func__, wlan_cipher_suite >> 8, wlan_cipher_suite & 0xff, lkpi_cipher_suite_to_name(wlan_cipher_suite)); + return (0); } - - return (0); } static uint32_t @@ -1030,18 +1030,37 @@ lkpi_net80211_to_l80211_cipher_suite(uint32_t cipher, uint8_t keylen) { switch (cipher) { - case IEEE80211_CIPHER_TKIP: - return (WLAN_CIPHER_SUITE_TKIP); - case IEEE80211_CIPHER_AES_CCM: - return (WLAN_CIPHER_SUITE_CCMP); case IEEE80211_CIPHER_WEP: if (keylen < 8) return (WLAN_CIPHER_SUITE_WEP40); else return (WLAN_CIPHER_SUITE_WEP104); break; + case IEEE80211_CIPHER_TKIP: + return (WLAN_CIPHER_SUITE_TKIP); + case IEEE80211_CIPHER_AES_CCM: + return (WLAN_CIPHER_SUITE_CCMP); + case IEEE80211_CIPHER_AES_CCM_256: + return (WLAN_CIPHER_SUITE_CCMP_256); + case IEEE80211_CIPHER_AES_GCM_128: + return (WLAN_CIPHER_SUITE_GCMP); + case IEEE80211_CIPHER_AES_GCM_256: + return (WLAN_CIPHER_SUITE_GCMP_256); + case IEEE80211_CIPHER_BIP_CMAC_128: + return (WLAN_CIPHER_SUITE_AES_CMAC); + case IEEE80211_CIPHER_BIP_CMAC_256: + return (WLAN_CIPHER_SUITE_BIP_CMAC_256); + case IEEE80211_CIPHER_BIP_GMAC_128: + return (WLAN_CIPHER_SUITE_BIP_GMAC_128); + case IEEE80211_CIPHER_BIP_GMAC_256: + return (WLAN_CIPHER_SUITE_BIP_GMAC_256); + case IEEE80211_CIPHER_AES_OCB: case IEEE80211_CIPHER_TKIPMIC: + /* + * TKIP w/ hw MIC support + * (gone wrong; should really be a crypto flag in net80211). + */ case IEEE80211_CIPHER_CKIP: case IEEE80211_CIPHER_NONE: printf("%s: unsupported cipher %#010x\n", __func__, cipher); @@ -5823,9 +5842,23 @@ linuxkpi_ieee80211_ifattach(struct ieee80211_hw *hw) ic->ic_cryptocaps = 0; #ifdef LKPI_80211_HW_CRYPTO if (lkpi_hwcrypto && hw->wiphy->n_cipher_suites > 0) { + uint32_t hwciphers; + + hwciphers = 0; for (i = 0; i < hw->wiphy->n_cipher_suites; i++) - ic->ic_cryptocaps |= lkpi_l80211_to_net80211_cyphers( - hw->wiphy->cipher_suites[i]); + hwciphers |= lkpi_l80211_to_net80211_cyphers( + ic, hw->wiphy->cipher_suites[i]); + /* + * (20250415) nothing anywhere in the path checks we actually + * support all these in net80211. + * net80211 supports _256 variants but the ioctl does not. + */ + IMPROVE("as net80211 grows more support, enable them"); + hwciphers &= (IEEE80211_CRYPTO_WEP | IEEE80211_CRYPTO_TKIP | + IEEE80211_CRYPTO_AES_CCM | IEEE80211_CRYPTO_AES_GCM_128); + /* We only support CCMP here, so further filter. */ + hwciphers &= IEEE80211_CRYPTO_AES_CCM; + ieee80211_set_hardware_ciphers(ic, hwciphers); } #endif