cfg80211/nl80211: add API for MAC address ACLs

Add API to enable drivers to implement MAC address based
access control in AP/P2P GO mode. Capable drivers advertise
this capability by setting the maximum number of MAC
addresses in such a list in wiphy->max_acl_mac_addrs.

An initial ACL may be given to the NL80211_CMD_START_AP
command and/or changed later with NL80211_CMD_SET_MAC_ACL.

Black- and whitelists are supported, but not simultaneously.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
[rewrite commit log, many cleanups]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

4 files changed, 151 insertions, 0 deletions

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 0e702cdc6043..ce827242f390 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -478,6 +478,11 @@ int wiphy_register(struct wiphy *wiphy)
                            ETH_ALEN)))
                 return -EINVAL;
 
+        if (WARN_ON(wiphy->max_acl_mac_addrs &&
+                    (!(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME) ||
+                     !rdev->ops->set_mac_acl)))
+                return -EINVAL;
+
         if (wiphy->addresses)
                 memcpy(wiphy->perm_addr, wiphy->addresses[0].addr, ETH_ALEN);
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 33de80364c5c..b5978ab4ad7a 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -365,6 +365,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
+        [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
+        [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 };
 
 /* policy for the key attributes */
@@ -1268,6 +1270,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                     dev->wiphy.ht_capa_mod_mask))
                 goto nla_put_failure;
 
+        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
+            dev->wiphy.max_acl_mac_addrs &&
+            nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
+                        dev->wiphy.max_acl_mac_addrs))
+                goto nla_put_failure;
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2491,6 +2499,97 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+/* This function returns an error or the number of nested attributes */
+static int validate_acl_mac_addrs(struct nlattr *nl_attr)
+{
+        struct nlattr *attr;
+        int n_entries = 0, tmp;
+
+        nla_for_each_nested(attr, nl_attr, tmp) {
+                if (nla_len(attr) != ETH_ALEN)
+                        return -EINVAL;
+
+                n_entries++;
+        }
+
+        return n_entries;
+}
+
+/*
+ * This function parses ACL information and allocates memory for ACL data.
+ * On successful return, the calling function is responsible to free the
+ * ACL buffer returned by this function.
+ */
+static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
+                                                struct genl_info *info)
+{
+        enum nl80211_acl_policy acl_policy;
+        struct nlattr *attr;
+        struct cfg80211_acl_data *acl;
+        int i = 0, n_entries, tmp;
+
+        if (!wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-EOPNOTSUPP);
+
+        if (!info->attrs[NL80211_ATTR_ACL_POLICY])
+                return ERR_PTR(-EINVAL);
+
+        acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
+        if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
+            acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
+                return ERR_PTR(-EINVAL);
+
+        if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
+                return ERR_PTR(-EINVAL);
+
+        n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
+        if (n_entries < 0)
+                return ERR_PTR(n_entries);
+
+        if (n_entries > wiphy->max_acl_mac_addrs)
+                return ERR_PTR(-ENOTSUPP);
+
+        acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
+                      GFP_KERNEL);
+        if (!acl)
+                return ERR_PTR(-ENOMEM);
+
+        nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
+                memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
+                i++;
+        }
+
+        acl->n_acl_entries = n_entries;
+        acl->acl_policy = acl_policy;
+
+        return acl;
+}
+
+static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct cfg80211_acl_data *acl;
+        int err;
+
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!dev->ieee80211_ptr->beacon_interval)
+                return -EINVAL;
+
+        acl = parse_acl_data(&rdev->wiphy, info);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+
+        err = rdev_set_mac_acl(rdev, dev, acl);
+
+        kfree(acl);
+
+        return err;
+}
+
 static int nl80211_parse_beacon(struct genl_info *info,
                                 struct cfg80211_beacon_data *bcn)
 {
@@ -2734,6 +2833,12 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 return err;
 
+        if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
+                params.acl = parse_acl_data(&rdev->wiphy, info);
+                if (IS_ERR(params.acl))
+                        return PTR_ERR(params.acl);
+        }
+
         err = rdev_start_ap(rdev, dev, &params);
         if (!err) {
                 wdev->preset_chandef = params.chandef;
@@ -2742,6 +2847,9 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 wdev->ssid_len = params.ssid_len;
                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
         }
+
+        kfree(params.acl);
+
         return err;
 }
 
@@ -7876,6 +7984,14 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_SET_MAC_ACL,
+                .doit = nl80211_set_mac_acl,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 6c0c8191f837..422d38291d66 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -875,4 +875,16 @@ static inline void rdev_stop_p2p_device(struct cfg80211_registered_device *rdev,
         rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
         trace_rdev_return_void(&rdev->wiphy);
 }                                       
+
+static inline int rdev_set_mac_acl(struct cfg80211_registered_device *rdev,
+                                   struct net_device *dev,
+                                   struct cfg80211_acl_data *params)
+{
+        int ret;
+
+        trace_rdev_set_mac_acl(&rdev->wiphy, dev, params);
+        ret = rdev->ops->set_mac_acl(&rdev->wiphy, dev, params);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 2134576f426e..8bc553199686 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1767,6 +1767,24 @@ DEFINE_EVENT(wiphy_wdev_evt, rdev_stop_p2p_device,
         TP_ARGS(wiphy, wdev)
 );
 
+TRACE_EVENT(rdev_set_mac_acl,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_acl_data *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                __field(u32, acl_policy)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WIPHY_ASSIGN;
+                __entry->acl_policy = params->acl_policy;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", acl policy: %d",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->acl_policy)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/