mac80211: support scan features for improved scan privacy

Support the new random SN and minimal probe request contents
scan flags for the case of software scan - for hardware scan
the drivers need to opt in, but may need to do only that,
depending on their implementation.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index bdf6fa78d0d2b101a448fe10e925f5e381486224..c4e2f7d2bcb8b385a4b70d5569033ba096e146a5 100644 (file)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3486,7 +3486,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
        }
 
        local_bh_disable();
-       ieee80211_xmit(sdata, sta, skb);
+       ieee80211_xmit(sdata, sta, skb, 0);
        local_bh_enable();
 
        ret = 0;

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 2851245c569ab445dc2a77d128a9cce30ad975ca..a6c12c104c38ff7873fca2d1933c2bb842c337a0 100644 (file)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -165,6 +165,7 @@ typedef unsigned __bitwise ieee80211_tx_result;
 #define TX_DROP                ((__force ieee80211_tx_result) 1u)
 #define TX_QUEUED      ((__force ieee80211_tx_result) 2u)
 
+#define IEEE80211_TX_NO_SEQNO          BIT(0)
 #define IEEE80211_TX_UNICAST           BIT(1)
 #define IEEE80211_TX_PS_BUFFERED       BIT(2)
 
@@ -1880,19 +1881,20 @@ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,
 void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
                               bool bss_notify, bool enable_qos);
 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
-                   struct sta_info *sta, struct sk_buff *skb);
+                   struct sta_info *sta, struct sk_buff *skb,
+                   u32 txdata_flags);
 
 void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb, int tid,
-                                enum nl80211_band band);
+                                enum nl80211_band band, u32 txdata_flags);
 
 static inline void
 ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
                          struct sk_buff *skb, int tid,
-                         enum nl80211_band band)
+                         enum nl80211_band band, u32 txdata_flags)
 {
        rcu_read_lock();
-       __ieee80211_tx_skb_tid_band(sdata, skb, tid, band);
+       __ieee80211_tx_skb_tid_band(sdata, skb, tid, band, txdata_flags);
        rcu_read_unlock();
 }
 
@@ -1910,7 +1912,7 @@ static inline void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
        }
 
        __ieee80211_tx_skb_tid_band(sdata, skb, tid,
-                                   chanctx_conf->def.chan->band);
+                                   chanctx_conf->def.chan->band, 0);
        rcu_read_unlock();
 }
 
@@ -2034,6 +2036,8 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 
 enum {
        IEEE80211_PROBE_FLAG_DIRECTED           = BIT(0),
+       IEEE80211_PROBE_FLAG_MIN_CONTENT        = BIT(1),
+       IEEE80211_PROBE_FLAG_RANDOM_SN          = BIT(2),
 };
 
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4d2e797e3f168bdf784268b16de15799220e0146..a6f8e3a646d4275503589c5f6da7c2a196501434 100644 (file)
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -557,10 +557,19 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
        wiphy_ext_feature_set(wiphy,
                              NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211);
 
-       if (!ops->hw_scan)
+       if (!ops->hw_scan) {
                wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                   NL80211_FEATURE_AP_SCAN;
-
+               /*
+                * if the driver behaves correctly using the probe request
+                * (template) from mac80211, then both of these should be
+                * supported even with hw scan - but let drivers opt in.
+                */
+               wiphy_ext_feature_set(wiphy,
+                                     NL80211_EXT_FEATURE_SCAN_RANDOM_SN);
+               wiphy_ext_feature_set(wiphy,
+                                     NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT);
+       }
 
        if (!ops->set_key)
                wiphy->flags |= WIPHY_FLAG_IBSS_RSN;

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f1d40b6645ff2777713885bef12936860f5ec9c8..8ef4153cd2994a73b4be5733a1dc12e9fa329640 100644 (file)
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -262,7 +262,7 @@ static void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc,
        if (roc->mgmt_tx_cookie) {
                if (!WARN_ON(!roc->frame)) {
                        ieee80211_tx_skb_tid_band(roc->sdata, roc->frame, 7,
-                                                 roc->chan->band);
+                                                 roc->chan->band, 0);
                        roc->frame = NULL;
                }
        } else {

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 0a38cc1cbebcee97ed7e8779ab487e2e0943e84c..756ba176db1e65813900989b160962b904d557cc 100644 (file)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3241,7 +3241,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
                }
 
                __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
-                                           status->band);
+                                           status->band, 0);
        }
        dev_kfree_skb(rx->skb);
        return RX_QUEUED;

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 03f66f31c5b4952d4880ba8460fe4483a97f19ef..ae77d1c1285623ed7a595223dfb9bf0a1a0b5ce9 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -20,6 +20,7 @@
 #include <net/sch_generic.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/random.h>
 #include <net/mac80211.h>
 
 #include "ieee80211_i.h"
@@ -293,6 +294,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        struct cfg80211_chan_def chandef;
        u8 bands_used = 0;
        int i, ielen, n_chans;
+       u32 flags = 0;
 
        req = rcu_dereference_protected(local->scan_req,
                                        lockdep_is_held(&local->mtx));
@@ -331,12 +333,16 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
        local->hw_scan_req->req.n_channels = n_chans;
        ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
 
+       if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
+               flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
+
        ielen = ieee80211_build_preq_ies(local,
                                         (u8 *)local->hw_scan_req->req.ie,
                                         local->hw_scan_ies_bufsize,
                                         &local->hw_scan_req->ies,
                                         req->ie, req->ie_len,
-                                        bands_used, req->rates, &chandef, 0);
+                                        bands_used, req->rates, &chandef,
+                                        flags);
        local->hw_scan_req->req.ie_len = ielen;
        local->hw_scan_req->req.no_cck = req->no_cck;
        ether_addr_copy(local->hw_scan_req->req.mac_addr, req->mac_addr);
@@ -536,13 +542,24 @@ static void ieee80211_send_scan_probe_req(struct ieee80211_sub_if_data *sdata,
                                          struct ieee80211_channel *channel)
 {
        struct sk_buff *skb;
+       u32 txdata_flags = 0;
 
        skb = ieee80211_build_probe_req(sdata, src, dst, ratemask, channel,
                                        ssid, ssid_len,
                                        ie, ie_len, flags);
+
        if (skb) {
+               if (flags & IEEE80211_PROBE_FLAG_RANDOM_SN) {
+                       struct ieee80211_hdr *hdr = (void *)skb->data;
+                       u16 sn = get_random_u32();
+
+                       txdata_flags |= IEEE80211_TX_NO_SEQNO;
+                       hdr->seq_ctrl =
+                               cpu_to_le16(IEEE80211_SN_TO_SEQ(sn));
+               }
                IEEE80211_SKB_CB(skb)->flags |= tx_flags;
-               ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
+               ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band,
+                                         txdata_flags);
        }
 }
 
@@ -553,7 +570,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
        struct ieee80211_sub_if_data *sdata;
        struct cfg80211_scan_request *scan_req;
        enum nl80211_band band = local->hw.conf.chandef.chan->band;
-       u32 tx_flags;
+       u32 flags = 0, tx_flags;
 
        scan_req = rcu_dereference_protected(local->scan_req,
                                             lockdep_is_held(&local->mtx));
@@ -561,6 +578,10 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
        tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
        if (scan_req->no_cck)
                tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
+       if (scan_req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
+               flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
+       if (scan_req->flags & NL80211_SCAN_FLAG_RANDOM_SN)
+               flags |= IEEE80211_PROBE_FLAG_RANDOM_SN;
 
        sdata = rcu_dereference_protected(local->scan_sdata,
                                          lockdep_is_held(&local->mtx));
@@ -570,7 +591,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                        sdata, local->scan_addr, scan_req->bssid,
                        scan_req->ssids[i].ssid, scan_req->ssids[i].ssid_len,
                        scan_req->ie, scan_req->ie_len,
-                       scan_req->rates[band], 0,
+                       scan_req->rates[band], flags,
                        tx_flags, local->hw.conf.chandef.chan);
 
        /*
@@ -1159,6 +1180,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        u32 rate_masks[NUM_NL80211_BANDS] = {};
        u8 bands_used = 0;
        u8 *ie;
+       u32 flags = 0;
 
        iebufsz = local->scan_ies_len + req->ie_len;
 
@@ -1175,6 +1197,9 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                }
        }
 
+       if (req->flags & NL80211_SCAN_FLAG_MIN_PREQ_CONTENT)
+               flags |= IEEE80211_PROBE_FLAG_MIN_CONTENT;
+
        ie = kzalloc(num_bands * iebufsz, GFP_KERNEL);
        if (!ie) {
                ret = -ENOMEM;
@@ -1186,7 +1211,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        ieee80211_build_preq_ies(local, ie, num_bands * iebufsz,
                                 &sched_scan_ies, req->ie,
                                 req->ie_len, bands_used, rate_masks, &chandef,
-                                0);
+                                flags);
 
        ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
        if (ret == 0) {

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 6428f1ac37b67afda55d7335bee59b2d140813a8..aa96fddfbfc2c66fd42513976aeba8813b45ddf6 100644 (file)
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1391,7 +1391,7 @@ static void ieee80211_send_null_response(struct sta_info *sta, int tid,
        }
 
        info->band = chanctx_conf->def.chan->band;
-       ieee80211_xmit(sdata, sta, skb);
+       ieee80211_xmit(sdata, sta, skb, 0);
        rcu_read_unlock();
 }
 

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 44b5dfe8727d936d39338006bc89b125c848d12b..5b93bde248fd687c1a9826403b23d6027de22d07 100644 (file)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -825,6 +825,8 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         */
        if (!ieee80211_is_data_qos(hdr->frame_control) ||
            is_multicast_ether_addr(hdr->addr1)) {
+               if (tx->flags & IEEE80211_TX_NO_SEQNO)
+                       return TX_CONTINUE;
                /* driver should assign sequence number */
                info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
                /* for pure STA mode without beacons, we can do it */
@@ -1854,7 +1856,7 @@ EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
  */
 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
                         struct sta_info *sta, struct sk_buff *skb,
-                        bool txpending)
+                        bool txpending, u32 txdata_flags)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_tx_data tx;
@@ -1872,6 +1874,8 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
        led_len = skb->len;
        res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
 
+       tx.flags |= txdata_flags;
+
        if (unlikely(res_prepare == TX_DROP)) {
                ieee80211_free_txskb(&local->hw, skb);
                return true;
@@ -1933,7 +1937,8 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
 }
 
 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
-                   struct sta_info *sta, struct sk_buff *skb)
+                   struct sta_info *sta, struct sk_buff *skb,
+                   u32 txdata_flags)
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1968,7 +1973,7 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
        }
 
        ieee80211_set_qos_hdr(sdata, skb);
-       ieee80211_tx(sdata, sta, skb, false);
+       ieee80211_tx(sdata, sta, skb, false, txdata_flags);
 }
 
 static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
@@ -2289,7 +2294,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
        if (!ieee80211_parse_tx_radiotap(local, skb))
                goto fail_rcu;
 
-       ieee80211_xmit(sdata, NULL, skb);
+       ieee80211_xmit(sdata, NULL, skb, 0);
        rcu_read_unlock();
 
        return NETDEV_TX_OK;
@@ -3648,7 +3653,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
 
                ieee80211_tx_stats(dev, skb->len);
 
-               ieee80211_xmit(sdata, sta, skb);
+               ieee80211_xmit(sdata, sta, skb, 0);
        }
        goto out;
  out_free:
@@ -3867,7 +3872,7 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                        return true;
                }
                info->band = chanctx_conf->def.chan->band;
-               result = ieee80211_tx(sdata, NULL, skb, true);
+               result = ieee80211_tx(sdata, NULL, skb, true, 0);
        } else {
                struct sk_buff_head skbs;
 
@@ -4783,7 +4788,7 @@ EXPORT_SYMBOL(ieee80211_unreserve_tid);
 
 void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb, int tid,
-                                enum nl80211_band band)
+                                enum nl80211_band band, u32 txdata_flags)
 {
        int ac = ieee80211_ac_from_tid(tid);
 
@@ -4800,7 +4805,7 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
         */
        local_bh_disable();
        IEEE80211_SKB_CB(skb)->band = band;
-       ieee80211_xmit(sdata, NULL, skb);
+       ieee80211_xmit(sdata, NULL, skb, txdata_flags);
        local_bh_enable();
 }
 

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0325133552adc28e148cfa9be1297a90286e18f0..b744b10465c34fe7b089c7fa8dfa4ca610ea5550 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1433,6 +1433,9 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
                                chandef->chan->center_freq);
        }
 
+       if (flags & IEEE80211_PROBE_FLAG_MIN_CONTENT)
+               goto done;
+
        /* insert custom IEs that go before HT */
        if (ie && ie_len) {
                static const u8 before_ht[] = {
@@ -1510,6 +1513,7 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
        return pos - buffer;
  out_err:
        WARN_ONCE(1, "not enough space for preq IEs\n");
+ done:
        return pos - buffer;
 }