diff options
| author | Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com> | 2026-04-20 14:38:55 +0530 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-05-05 13:52:23 +0200 |
| commit | 4bb6e58bc29ab772c26c5eb471ab255fe2e044d8 (patch) | |
| tree | 74aa570fe40f5037e069aefda2cf5ef15df02325 /net/wireless | |
| parent | 410aa47fd9d308029f3520e97eec71a8eb508622 (diff) | |
wifi: cfg80211: add LTF keyseed support for secure ranging
Currently there is no way to install an LTF key seed that can be
used in non-trigger-based (NTB) and trigger-based (TB) FTM ranging
to protect NDP frames. Without this, drivers cannot enable PHY-layer
security for peer measurement sessions, leaving ranging measurements
vulnerable to eavesdropping and manipulation.
Introduce NL80211_KEY_LTF_SEED attribute and the dedicated extended
feature flag NL80211_EXT_FEATURE_SET_KEY_LTF_SEED to allow drivers
to advertise and install LTF key seeds via nl80211. The key seed
must be configured beforehand to ensure the peer measurement session
is secure. The driver must advertise both NL80211_EXT_FEATURE_SECURE_LTF
and NL80211_EXT_FEATURE_SET_KEY_LTF_SEED for the key seed installation
to be permitted.
The LTF key seed is pairwise key material and must only be used with
pairwise key type. Reject attempts to use it with other key types.
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy@oss.qualcomm.com>
Link: https://patch.msgid.link/20260420090856.2152905-13-peddolla.reddy@oss.qualcomm.com
[fix policy coding style]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 9 | ||||
| -rw-r--r-- | net/wireless/util.c | 15 |
2 files changed, 24 insertions, 0 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index b33f688b983a..61b1716daf1e 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -1103,6 +1103,10 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX), + [NL80211_KEY_LTF_SEED] = { + .type = NLA_BINARY, + .len = WLAN_MAX_SECURE_LTF_KEYSEED_LEN, + }, }; /* policy for the key default flags */ @@ -1634,6 +1638,11 @@ static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, if (tb[NL80211_KEY_MODE]) k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]); + if (tb[NL80211_KEY_LTF_SEED]) { + k->p.ltf_keyseed = nla_data(tb[NL80211_KEY_LTF_SEED]); + k->p.ltf_keyseed_len = nla_len(tb[NL80211_KEY_LTF_SEED]); + } + return 0; } diff --git a/net/wireless/util.c b/net/wireless/util.c index b638e205c71e..8dd7545b9097 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -434,6 +434,21 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher)) return -EINVAL; + if (params->ltf_keyseed) { + if (!wiphy_ext_feature_isset(&rdev->wiphy, + NL80211_EXT_FEATURE_SECURE_LTF) || + !wiphy_ext_feature_isset(&rdev->wiphy, + NL80211_EXT_FEATURE_SET_KEY_LTF_SEED)) + return -EOPNOTSUPP; + + /* + * LTF key seed is pairwise key material and must only be + * used with a pairwise key + */ + if (!pairwise) + return -EINVAL; + } + return 0; } |