Use separate PASN capabilities for AP and STA modes

Use separate capabilities for AP and STA modes for P802.11az security
parameters secure LTF support, secure RTT measurement exchange support,
and protection of range negotiation and measurement management frames
support.

P802.11az security parameters are considered to be supported for both
station and AP modes if the driver sets NL80211_EXT_FEATURE_SECURE_LTF,
NL80211_EXT_FEATURE_SECURE_RTT, and
NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE flags. The driver can
advertize capabilities specific to each mode using
QCA_WLAN_VENDOR_FEATURE_SECURE_LTF*,
QCA_WLAN_VENDOR_FEATURE_SECURE_RTT*, and
QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE* flags.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index e9288bed93bf214ac5cfef2a25a35670e484b7a6..86cb3965c9b17b90f6620720b8a7fe51be2fa445 100644 (file)
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -3167,7 +3167,7 @@ static void handle_auth_pasn_1(struct hostapd_data *hapd, struct sta_info *sta,
        sta->pasn->akmp = rsn_data.key_mgmt;
        sta->pasn->cipher = rsn_data.pairwise_cipher;
 
-       derive_kdk = (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) &&
+       derive_kdk = (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP) &&
                ieee802_11_rsnx_capab_len(elems.rsnxe, elems.rsnxe_len,
                                          WLAN_RSNX_CAPAB_SECURE_LTF);
 #ifdef CONFIG_TESTING_OPTIONS

diff --git a/src/ap/ieee802_11_shared.c b/src/ap/ieee802_11_shared.c
index 72f59113f7a7a1179497a8510b945d257379266a..d962cc0d5faa1fe1405bcb41953a0aaed873aa26 100644 (file)
--- a/src/ap/ieee802_11_shared.c
+++ b/src/ap/ieee802_11_shared.c
@@ -1074,11 +1074,11 @@ u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len)
 #endif /* CONFIG_SAE_PK */
        }
 
-       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF)
+       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP)
                capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
-       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT)
+       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP)
                capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
-       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG)
+       if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP)
                capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG);
 
        flen = (capab & 0xff00) ? 2 : 1;

diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
index 9d776db2dfaf11aa9a7e424948e5f5b90e090bdf..bef8fd26184e5a7d5db02810dbf348bdeb43fbd8 100644 (file)
--- a/src/ap/wpa_auth_glue.c
+++ b/src/ap/wpa_auth_glue.c
@@ -1551,11 +1551,12 @@ int hostapd_setup_wpa(struct hostapd_data *hapd)
 #endif /* CONFIG_OCV */
 
        _conf.secure_ltf =
-               !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF);
+               !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP);
        _conf.secure_rtt =
-               !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT);
+               !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP);
        _conf.prot_range_neg =
-               !!(hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG);
+               !!(hapd->iface->drv_flags2 &
+                  WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP);
 
        hapd->wpa_auth = wpa_init(hapd->own_addr, &_conf, &cb, hapd);
        if (hapd->wpa_auth == NULL) {

diff --git a/src/drivers/driver.h b/src/drivers/driver.h
index ccbae59a34d358b342875e8e5e9b262e66fab560..7daedfe2dd100cee1c45c64cf9af51f0524aec9f 100644 (file)
--- a/src/drivers/driver.h
+++ b/src/drivers/driver.h
@@ -2060,15 +2060,15 @@ struct wpa_driver_capa {
 #define WPA_DRIVER_FLAGS2_CONTROL_PORT_RX      0x0000000000000001ULL
 /** Driver supports TX status reports for EAPOL frames through control port */
 #define WPA_DRIVER_FLAGS2_CONTROL_PORT_TX_STATUS 0x0000000000000002ULL
-/** Driver supports secure LTF */
-#define WPA_DRIVER_FLAGS2_SEC_LTF              0x0000000000000004ULL
-/** Driver supports secure RTT measurement exchange */
-#define WPA_DRIVER_FLAGS2_SEC_RTT              0x0000000000000008ULL
+/** Driver supports secure LTF in AP mode */
+#define WPA_DRIVER_FLAGS2_SEC_LTF_AP           0x0000000000000004ULL
+/** Driver supports secure RTT measurement exchange in AP mode */
+#define WPA_DRIVER_FLAGS2_SEC_RTT_AP           0x0000000000000008ULL
 /**
  * Driver supports protection of range negotiation and measurement management
- * frames
+ * frames in AP mode
  */
-#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG       0x0000000000000010ULL
+#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP    0x0000000000000010ULL
 /** Driver supports Beacon frame TX rate configuration (HE rates) */
 #define WPA_DRIVER_FLAGS2_BEACON_RATE_HE       0x0000000000000020ULL
 /** Driver supports Beacon protection only in client mode */
@@ -2081,6 +2081,15 @@ struct wpa_driver_capa {
 #define WPA_DRIVER_FLAGS2_SA_QUERY_OFFLOAD_AP  0x0000000000000200ULL
 /** Driver supports background radar/CAC detection */
 #define WPA_DRIVER_RADAR_BACKGROUND            0x0000000000000400ULL
+/** Driver supports secure LTF in STA mode */
+#define WPA_DRIVER_FLAGS2_SEC_LTF_STA          0x0000000000000800ULL
+/** Driver supports secure RTT measurement exchange in STA mode */
+#define WPA_DRIVER_FLAGS2_SEC_RTT_STA          0x0000000000001000ULL
+/**
+ * Driver supports protection of range negotiation and measurement management
+ * frames in STA mode
+ */
+#define WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA   0x0000000000002000ULL
        u64 flags2;
 
 #define FULL_AP_CLIENT_STATE_SUPP(drv_flags) \

diff --git a/src/drivers/driver_nl80211_capa.c b/src/drivers/driver_nl80211_capa.c
index f5b62705aa36eb5741c70e908d8513938f1a57e1..03ac9345bee084004aa63e24c6c5178bf627a79a 100644 (file)
--- a/src/drivers/driver_nl80211_capa.c
+++ b/src/drivers/driver_nl80211_capa.c
@@ -675,6 +675,25 @@ static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info,
        if (ext_feature_isset(ext_features, len,
                              NL80211_EXT_FEATURE_RADAR_BACKGROUND))
                capa->flags2 |= WPA_DRIVER_RADAR_BACKGROUND;
+
+       if (ext_feature_isset(ext_features, len,
+                             NL80211_EXT_FEATURE_SECURE_LTF)) {
+               capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_STA;
+               capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_AP;
+       }
+
+       if (ext_feature_isset(ext_features, len,
+                             NL80211_EXT_FEATURE_SECURE_RTT)) {
+               capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_STA;
+               capa->flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_AP;
+       }
+
+       if (ext_feature_isset(
+                   ext_features, len,
+                   NL80211_EXT_FEATURE_PROT_RANGE_NEGO_AND_MEASURE)) {
+               capa->flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA;
+               capa->flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP;
+       }
 }
 
 
@@ -1334,6 +1353,22 @@ static void qca_nl80211_get_features(struct wpa_driver_nl80211_data *drv)
                drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_AP;
        if (check_feature(QCA_WLAN_VENDOR_FEATURE_OCE_STA_CFON, &info))
                drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_STA_CFON;
+       if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_LTF_STA, &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_STA;
+       if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_LTF_AP, &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_LTF_AP;
+       if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_RTT_STA, &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_STA;
+       if (check_feature(QCA_WLAN_VENDOR_FEATURE_SECURE_RTT_AP, &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_SEC_RTT_AP;
+       if (check_feature(
+                   QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE_STA,
+                   &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA;
+       if (check_feature(
+                   QCA_WLAN_VENDOR_FEATURE_PROT_RANGE_NEGO_AND_MEASURE_AP,
+                   &info))
+               drv->capa.flags2 |= WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP;
        os_free(info.flags);
 }
 

diff --git a/wpa_supplicant/pasn_supplicant.c b/wpa_supplicant/pasn_supplicant.c
index dc21b6a3c32959a53e201a08982e4f81858f66a6..aa5fc087bf1f3e9b21e09dc3b201947b2d3bd04c 100644 (file)
--- a/wpa_supplicant/pasn_supplicant.c
+++ b/wpa_supplicant/pasn_supplicant.c
@@ -732,11 +732,11 @@ static struct wpabuf * wpas_pasn_build_auth_1(struct wpa_supplicant *wpa_s,
        /* Add own RNSXE */
        capab = 0;
        capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
-       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF)
+       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA)
                capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
-       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT)
+       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_STA)
                capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
-       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG)
+       if (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_STA)
                capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG);
        wpa_pasn_add_rsnxe(buf, capab);
 
@@ -1080,7 +1080,7 @@ static int wpas_pasn_start(struct wpa_supplicant *wpa_s, const u8 *bssid,
        pasn->group = group;
        pasn->freq = freq;
 
-       derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF) &&
+       derive_kdk = (wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_STA) &&
                ieee802_11_rsnx_capab(beacon_rsnxe,
                                      WLAN_RSNX_CAPAB_SECURE_LTF);
 #ifdef CONFIG_TESTING_OPTIONS