cfg80211/nl80211: add API for MAC address ACLs
Add API to enable drivers to implement MAC address based access control in AP/P2P GO mode. Capable drivers advertise this capability by setting the maximum number of MAC addresses in such a list in wiphy->max_acl_mac_addrs. An initial ACL may be given to the NL80211_CMD_START_AP command and/or changed later with NL80211_CMD_SET_MAC_ACL. Black- and whitelists are supported, but not simultaneously. Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> [rewrite commit log, many cleanups] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Vasanthakumar Thiagarajan
committed by
Johannes Berg
Johannes Berg
parent
6d45a74b1f
commit
77765eaf5c
@@ -365,6 +365,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
|
||||
[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
|
||||
[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
|
||||
[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
|
||||
[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
|
||||
[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
|
||||
};
|
||||
|
||||
/* policy for the key attributes */
|
||||
@@ -1268,6 +1270,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
|
||||
dev->wiphy.ht_capa_mod_mask))
|
||||
goto nla_put_failure;
|
||||
|
||||
if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
|
||||
dev->wiphy.max_acl_mac_addrs &&
|
||||
nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
|
||||
dev->wiphy.max_acl_mac_addrs))
|
||||
goto nla_put_failure;
|
||||
|
||||
return genlmsg_end(msg, hdr);
|
||||
|
||||
nla_put_failure:
|
||||
@@ -2491,6 +2499,97 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
|
||||
return err;
|
||||
}
|
||||
|
||||
/* This function returns an error or the number of nested attributes */
|
||||
static int validate_acl_mac_addrs(struct nlattr *nl_attr)
|
||||
{
|
||||
struct nlattr *attr;
|
||||
int n_entries = 0, tmp;
|
||||
|
||||
nla_for_each_nested(attr, nl_attr, tmp) {
|
||||
if (nla_len(attr) != ETH_ALEN)
|
||||
return -EINVAL;
|
||||
|
||||
n_entries++;
|
||||
}
|
||||
|
||||
return n_entries;
|
||||
}
|
||||
|
||||
/*
|
||||
* This function parses ACL information and allocates memory for ACL data.
|
||||
* On successful return, the calling function is responsible to free the
|
||||
* ACL buffer returned by this function.
|
||||
*/
|
||||
static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
|
||||
struct genl_info *info)
|
||||
{
|
||||
enum nl80211_acl_policy acl_policy;
|
||||
struct nlattr *attr;
|
||||
struct cfg80211_acl_data *acl;
|
||||
int i = 0, n_entries, tmp;
|
||||
|
||||
if (!wiphy->max_acl_mac_addrs)
|
||||
return ERR_PTR(-EOPNOTSUPP);
|
||||
|
||||
if (!info->attrs[NL80211_ATTR_ACL_POLICY])
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
|
||||
if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
|
||||
acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
|
||||
if (n_entries < 0)
|
||||
return ERR_PTR(n_entries);
|
||||
|
||||
if (n_entries > wiphy->max_acl_mac_addrs)
|
||||
return ERR_PTR(-ENOTSUPP);
|
||||
|
||||
acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
|
||||
GFP_KERNEL);
|
||||
if (!acl)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
|
||||
nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
|
||||
memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
|
||||
i++;
|
||||
}
|
||||
|
||||
acl->n_acl_entries = n_entries;
|
||||
acl->acl_policy = acl_policy;
|
||||
|
||||
return acl;
|
||||
}
|
||||
|
||||
static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
|
||||
{
|
||||
struct cfg80211_registered_device *rdev = info->user_ptr[0];
|
||||
struct net_device *dev = info->user_ptr[1];
|
||||
struct cfg80211_acl_data *acl;
|
||||
int err;
|
||||
|
||||
if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
|
||||
dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
if (!dev->ieee80211_ptr->beacon_interval)
|
||||
return -EINVAL;
|
||||
|
||||
acl = parse_acl_data(&rdev->wiphy, info);
|
||||
if (IS_ERR(acl))
|
||||
return PTR_ERR(acl);
|
||||
|
||||
err = rdev_set_mac_acl(rdev, dev, acl);
|
||||
|
||||
kfree(acl);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
static int nl80211_parse_beacon(struct genl_info *info,
|
||||
struct cfg80211_beacon_data *bcn)
|
||||
{
|
||||
@@ -2734,6 +2833,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
|
||||
params.acl = parse_acl_data(&rdev->wiphy, info);
|
||||
if (IS_ERR(params.acl))
|
||||
return PTR_ERR(params.acl);
|
||||
}
|
||||
|
||||
err = rdev_start_ap(rdev, dev, ¶ms);
|
||||
if (!err) {
|
||||
wdev->preset_chandef = params.chandef;
|
||||
@@ -2742,6 +2847,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
|
||||
wdev->ssid_len = params.ssid_len;
|
||||
memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
|
||||
}
|
||||
|
||||
kfree(params.acl);
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
@@ -7876,6 +7984,14 @@ static struct genl_ops nl80211_ops[] = {
|
||||
.internal_flags = NL80211_FLAG_NEED_NETDEV |
|
||||
NL80211_FLAG_NEED_RTNL,
|
||||
},
|
||||
{
|
||||
.cmd = NL80211_CMD_SET_MAC_ACL,
|
||||
.doit = nl80211_set_mac_acl,
|
||||
.policy = nl80211_policy,
|
||||
.flags = GENL_ADMIN_PERM,
|
||||
.internal_flags = NL80211_FLAG_NEED_NETDEV |
|
||||
NL80211_FLAG_NEED_RTNL,
|
||||
},
|
||||
};
|
||||
|
||||
static struct genl_multicast_group nl80211_mlme_mcgrp = {
|
||||
|
||||
Reference in New Issue
Block a user