[RFC 22/30] WPA: SMD: Support installing group keys
Ilan Peer
ilan.peer at intel.com
Wed Oct 21 06:43:40 PDT 2026
Add support for installing groups keys when ST execution
is done.
To support this, extended the group key install function
to also get the address for which the keys should be installed
for (and not the default broadcast address). This assumes that
if SMD is supported, per station group keys can be supported.
Signed-off-by: Ilan Peer <ilan.peer at intel.com>
---
src/rsn_supp/wpa.c | 62 +++++++++++++++++++++++++----------------
src/rsn_supp/wpa.h | 3 +-
wpa_supplicant/events.c | 2 +-
wpa_supplicant/smd.c | 2 +-
4 files changed, 42 insertions(+), 27 deletions(-)
diff --git a/src/rsn_supp/wpa.c b/src/rsn_supp/wpa.c
index b104869a404b..66f16ee82c54 100644
--- a/src/rsn_supp/wpa.c
+++ b/src/rsn_supp/wpa.c
@@ -1552,6 +1552,7 @@ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
static int wpa_supplicant_install_mlo_gtk(struct wpa_sm *sm, u8 link_id,
+ const u8 *addr,
const struct wpa_gtk_data *gd,
const u8 *key_rsc, int wnm_sleep)
{
@@ -1586,7 +1587,7 @@ static int wpa_supplicant_install_mlo_gtk(struct wpa_sm *sm, u8 link_id,
os_memcpy(gtk_buf + 24, gd->gtk + 16, 8);
gtk = gtk_buf;
}
- if (wpa_sm_set_key(sm, link_id, gd->alg, broadcast_ether_addr,
+ if (wpa_sm_set_key(sm, link_id, gd->alg, addr,
gd->keyidx, gd->tx, key_rsc, gd->key_rsc_len, gtk,
gd->gtk_len, KEY_FLAG_GROUP_RX) < 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
@@ -1659,7 +1660,8 @@ static int wpa_supplicant_rsc_relaxation(const struct wpa_sm *sm,
}
-static int wpa_supplicant_mlo_gtk(struct wpa_sm *sm, u8 link_id, const u8 *gtk,
+static int wpa_supplicant_mlo_gtk(struct wpa_sm *sm, u8 link_id,
+ const u8 *addr, const u8 *gtk,
size_t gtk_len, int key_info)
{
struct wpa_gtk_data gd;
@@ -1696,7 +1698,8 @@ static int wpa_supplicant_mlo_gtk(struct wpa_sm *sm, u8 link_id, const u8 *gtk,
if (wpa_supplicant_check_group_cipher(sm, sm->group_cipher, gtk_len,
gtk_len, &gd.key_rsc_len,
&gd.alg) ||
- wpa_supplicant_install_mlo_gtk(sm, link_id, &gd, key_rsc, 0)) {
+ wpa_supplicant_install_mlo_gtk(sm, link_id, addr, &gd, key_rsc,
+ 0)) {
wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
"RSN: Failed to install GTK for MLO Link ID %u",
link_id);
@@ -1724,8 +1727,9 @@ static int wpa_supplicant_pairwise_mlo_gtk(struct wpa_sm *sm,
return -1;
}
- if (wpa_supplicant_mlo_gtk(sm, i, ie->mlo_gtk[i],
- ie->mlo_gtk_len[i], key_info))
+ if (wpa_supplicant_mlo_gtk(sm, i, broadcast_ether_addr,
+ ie->mlo_gtk[i], ie->mlo_gtk_len[i],
+ key_info))
return -1;
}
@@ -1905,6 +1909,7 @@ static int wpa_supplicant_install_bigtk(struct wpa_sm *sm,
static int wpa_supplicant_install_mlo_igtk(struct wpa_sm *sm, u8 link_id,
+ const u8 *addr,
const struct rsn_mlo_igtk_kde *igtk,
int wnm_sleep)
{
@@ -1936,7 +1941,7 @@ static int wpa_supplicant_install_mlo_igtk(struct wpa_sm *sm, u8 link_id,
}
if (wpa_sm_set_key(sm, link_id,
wpa_cipher_to_alg(sm->mgmt_group_cipher),
- broadcast_ether_addr, keyidx, 0, igtk->pn,
+ addr, keyidx, 0, igtk->pn,
sizeof(igtk->pn), igtk->igtk, len,
KEY_FLAG_GROUP_RX) < 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
@@ -1962,6 +1967,7 @@ static int wpa_supplicant_install_mlo_igtk(struct wpa_sm *sm, u8 link_id,
static int
wpa_supplicant_install_mlo_bigtk(struct wpa_sm *sm, u8 link_id,
+ const u8 *addr,
const struct rsn_mlo_bigtk_kde *bigtk,
int wnm_sleep)
{
@@ -1996,7 +2002,7 @@ wpa_supplicant_install_mlo_bigtk(struct wpa_sm *sm, u8 link_id,
}
if (wpa_sm_set_key(sm, link_id,
wpa_cipher_to_alg(sm->mgmt_group_cipher),
- broadcast_ether_addr, keyidx, 0, bigtk->pn,
+ addr, keyidx, 0, bigtk->pn,
sizeof(bigtk->pn), bigtk->bigtk, len,
KEY_FLAG_GROUP_RX) < 0) {
wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
@@ -2021,6 +2027,7 @@ wpa_supplicant_install_mlo_bigtk(struct wpa_sm *sm, u8 link_id,
static int _mlo_ieee80211w_set_keys(struct wpa_sm *sm, u8 link_id,
+ const u8 *addr,
struct wpa_eapol_ie_parse *ie)
{
size_t len;
@@ -2032,7 +2039,7 @@ static int _mlo_ieee80211w_set_keys(struct wpa_sm *sm, u8 link_id,
return -1;
if (wpa_supplicant_install_mlo_igtk(
- sm, link_id,
+ sm, link_id, addr,
(const struct rsn_mlo_igtk_kde *)
ie->mlo_igtk[link_id],
0) < 0)
@@ -2046,7 +2053,7 @@ static int _mlo_ieee80211w_set_keys(struct wpa_sm *sm, u8 link_id,
return -1;
if (wpa_supplicant_install_mlo_bigtk(
- sm, link_id,
+ sm, link_id, addr,
(const struct rsn_mlo_bigtk_kde *)
ie->mlo_bigtk[link_id],
0) < 0)
@@ -2067,7 +2074,7 @@ static int mlo_ieee80211w_set_keys(struct wpa_sm *sm,
return 0;
for_each_link(sm->mlo.valid_links, i) {
- if (_mlo_ieee80211w_set_keys(sm, i, ie))
+ if (_mlo_ieee80211w_set_keys(sm, i, broadcast_ether_addr, ie))
return -1;
}
@@ -3383,8 +3390,9 @@ static void wpa_supplicant_process_mlo_1_of_2(struct wpa_sm *sm,
if (!ie.mlo_gtk[i])
continue;
- if (wpa_supplicant_mlo_gtk(sm, i, ie.mlo_gtk[i],
- ie.mlo_gtk_len[i], key_info))
+ if (wpa_supplicant_mlo_gtk(sm, i, broadcast_ether_addr,
+ ie.mlo_gtk[i], ie.mlo_gtk_len[i],
+ key_info))
goto failed;
}
@@ -7878,7 +7886,8 @@ struct wpabuf * wpa_sm_known_sta_identification(struct wpa_sm *sm, const u8 *aa,
static int mlo_ieee80211w_set_keys_for_new_links(struct wpa_sm *sm,
struct wpa_eapol_ie_parse *ie,
- u16 added_links_bitmap)
+ u16 added_links_bitmap,
+ const u8 *addr)
{
int i;
@@ -7887,7 +7896,7 @@ static int mlo_ieee80211w_set_keys_for_new_links(struct wpa_sm *sm,
return 0;
for_each_link(added_links_bitmap, i) {
- if (_mlo_ieee80211w_set_keys(sm, i, ie))
+ if (_mlo_ieee80211w_set_keys(sm, i, addr, ie))
return -1;
}
@@ -7897,7 +7906,8 @@ static int mlo_ieee80211w_set_keys_for_new_links(struct wpa_sm *sm,
static int wpa_supplicant_install_mlo_gtk_keys(struct wpa_sm *sm,
struct wpa_eapol_ie_parse *ie,
- u16 added_links_bitmap)
+ u16 added_links_bitmap,
+ const u8 *addr)
{
int i;
@@ -7908,7 +7918,7 @@ static int wpa_supplicant_install_mlo_gtk_keys(struct wpa_sm *sm,
return -1;
}
- if (wpa_supplicant_mlo_gtk(sm, i, ie->mlo_gtk[i],
+ if (wpa_supplicant_mlo_gtk(sm, i, addr, ie->mlo_gtk[i],
ie->mlo_gtk_len[i], 0))
return -1;
}
@@ -7918,25 +7928,29 @@ static int wpa_supplicant_install_mlo_gtk_keys(struct wpa_sm *sm,
int wpa_sm_install_mlo_group_keys(struct wpa_sm *sm, const u8 *key_data,
- size_t key_data_len, u16 added_links_bitmap)
+ size_t key_data_len, u16 added_links_bitmap,
+ const u8 *addr)
{
struct wpa_eapol_ie_parse ie;
if (!sm)
return -1;
+ if (!addr)
+ addr = broadcast_ether_addr;
+
wpa_hexdump_key(MSG_DEBUG, "RSN: IE KeyData for MLO link reconfig",
key_data, key_data_len);
if (wpa_supplicant_parse_ies(key_data, key_data_len, &ie) < 0)
return -1;
- if (wpa_supplicant_install_mlo_gtk_keys(
- sm, &ie, added_links_bitmap) < 0)
+ if (wpa_supplicant_install_mlo_gtk_keys(sm, &ie, added_links_bitmap,
+ addr) < 0)
return -1;
- if (mlo_ieee80211w_set_keys_for_new_links(sm, &ie,
- added_links_bitmap) < 0)
+ if (mlo_ieee80211w_set_keys_for_new_links(sm, &ie, added_links_bitmap,
+ addr) < 0)
return -1;
return 0;
@@ -7948,11 +7962,11 @@ int wpa_sm_install_mlo_group_keys(struct wpa_sm *sm, const u8 *key_data,
static int process_key_delivery_link(struct wpa_sm *sm, u8 i,
struct wpa_eapol_ie_parse *kde)
{
- if (wpa_supplicant_mlo_gtk(sm, i, kde->mlo_gtk[i],
- kde->mlo_gtk_len[i], 0))
+ if (wpa_supplicant_mlo_gtk(sm, i, broadcast_ether_addr,
+ kde->mlo_gtk[i], kde->mlo_gtk_len[i], 0))
return -1;
- if (_mlo_ieee80211w_set_keys(sm, i, kde) < 0) {
+ if (_mlo_ieee80211w_set_keys(sm, i, broadcast_ether_addr, kde) < 0) {
wpa_printf(MSG_DEBUG,
"ENC_ASSOC: Failed to set MLO IGTK/BIGTK (link=%u)",
i);
diff --git a/src/rsn_supp/wpa.h b/src/rsn_supp/wpa.h
index 80d6b1814360..6bbde7ad26cc 100644
--- a/src/rsn_supp/wpa.h
+++ b/src/rsn_supp/wpa.h
@@ -748,7 +748,8 @@ const u8 * wpa_sm_get_auth_addr(struct wpa_sm *sm);
struct wpabuf * wpa_sm_known_sta_identification(struct wpa_sm *sm, const u8 *aa,
u64 timestamp);
int wpa_sm_install_mlo_group_keys(struct wpa_sm *sm, const u8 *key_data,
- size_t key_data_len, u16 added_links_bitmap);
+ size_t key_data_len, u16 added_links_bitmap,
+ const u8 *addr);
bool wpa_sm_pmksa_privacy_supported(struct wpa_sm *sm);
void wpa_sm_set_802_1x_auth_caps(struct wpa_sm *sm, u64 flags2);
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 16b35744c55d..5b289f00525a 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -6932,7 +6932,7 @@ static void wpas_setup_link_reconfig(struct wpa_supplicant *wpa_s,
if (wpa_sm_install_mlo_group_keys(wpa_s->wpa, key_data,
key_data_len,
- info->added_links)) {
+ info->added_links, NULL)) {
wpa_printf(MSG_ERROR,
"SETUP_LINK_RECONFIG: Failed to install group keys for added links");
return;
diff --git a/wpa_supplicant/smd.c b/wpa_supplicant/smd.c
index f80b5ff94cc8..53a115934ddc 100644
--- a/wpa_supplicant/smd.c
+++ b/wpa_supplicant/smd.c
@@ -539,7 +539,7 @@ void wpas_smd_st_exec_status(struct wpa_supplicant *wpa_s,
elems.key_delivery + WPA_KEY_RSC_LEN,
elems.key_delivery_len -
WPA_KEY_RSC_LEN,
- info->links) < 0) {
+ info->links, info->ap_mld_addr) < 0) {
wpa_printf(MSG_DEBUG,
"SMD: Failed to install group keys from Key Delivery");
goto fail;
--
2.55.0
More information about the Hostap
mailing list