Correct handling of keys that already have a hardware/device key index:

this was broken in r183248 when the check of wk_keyix was replaced by
a check of IEEE80211_KEY_DEVKEY (because the flag was clobbered).  Define
IEEE80211_KEY_DEVICE to specify flags that are owned by net80211/driver
and use this to preserve IEEE80211_KEY_DEVKEY so we don't ask the driver
for another key index when we already have one.

Testing by:	Daniel Thiele, Wes Morgan
Reviewed by:	rpaulo
Approved by:	re (kib)

2 files changed, 8 insertions, 6 deletions

diff --git a/sys/net80211/ieee80211_crypto.c b/sys/net80211/ieee80211_crypto.c
index 1eb6f0b..d338506 100644
--- a/sys/net80211/ieee80211_crypto.c
+++ b/sys/net80211/ieee80211_crypto.c
@@ -244,11 +244,13 @@ static const char *cipher_modnames[IEEE80211_CIPHER_MAX] = {
 	[IEEE80211_CIPHER_NONE]	   = "wlan_none",
 };
 
+/* NB: there must be no overlap between user-supplied and device-owned flags */
+CTASSERT((IEEE80211_KEY_COMMON & IEEE80211_KEY_DEVICE) == 0);
+
 /*
  * Establish a relationship between the specified key and cipher
  * and, if necessary, allocate a hardware index from the driver.
- * Note that when a fixed key index is required it must be specified
- * and we blindly assign it w/o consulting the driver (XXX).
+ * Note that when a fixed key index is required it must be specified.
  *
  * This must be the first call applied to a key; all the other key
  * routines assume wk_cipher is setup.
@@ -309,6 +311,8 @@ ieee80211_crypto_newkey(struct ieee80211vap *vap,
 
 	oflags = key->wk_flags;
 	flags &= IEEE80211_KEY_COMMON;
+	/* NB: preserve device attributes */
+	flags |= (oflags & IEEE80211_KEY_DEVICE);
 	/*
 	 * If the hardware does not support the cipher then
 	 * fallback to a host-based implementation.
@@ -359,10 +363,6 @@ ieee80211_crypto_newkey(struct ieee80211vap *vap,
 		key->wk_cipher = cip;		/* XXX refcnt? */
 		key->wk_private = keyctx;
 	}
-	/*
-	 * Commit to requested usage so driver can see the flags.
-	 */
-	key->wk_flags = flags;
 
 	/*
 	 * Ask the driver for a key index if we don't have one.
diff --git a/sys/net80211/ieee80211_crypto.h b/sys/net80211/ieee80211_crypto.h
index dde2c46..57d05ad 100644
--- a/sys/net80211/ieee80211_crypto.h
+++ b/sys/net80211/ieee80211_crypto.h
@@ -99,6 +99,8 @@ struct ieee80211_key {
 };
 #define	IEEE80211_KEY_COMMON 		/* common flags passed in by apps */\
 	(IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV | IEEE80211_KEY_GROUP)
+#define	IEEE80211_KEY_DEVICE		/* flags owned by device driver */\
+	(IEEE80211_KEY_DEVKEY|IEEE80211_KEY_CIPHER0|IEEE80211_KEY_CIPHER1)
 
 #define	IEEE80211_KEY_SWCRYPT \
 	(IEEE80211_KEY_SWENCRYPT | IEEE80211_KEY_SWDECRYPT)