diff options
-rw-r--r-- | net/wireless/lib80211_crypt_tkip.c | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c index c6a3cae1f85e..8cbdb32ff316 100644 --- a/net/wireless/lib80211_crypt_tkip.c +++ b/net/wireless/lib80211_crypt_tkip.c | |||
@@ -36,6 +36,8 @@ MODULE_AUTHOR("Jouni Malinen"); | |||
36 | MODULE_DESCRIPTION("lib80211 crypt: TKIP"); | 36 | MODULE_DESCRIPTION("lib80211 crypt: TKIP"); |
37 | MODULE_LICENSE("GPL"); | 37 | MODULE_LICENSE("GPL"); |
38 | 38 | ||
39 | #define TKIP_HDR_LEN 8 | ||
40 | |||
39 | struct lib80211_tkip_data { | 41 | struct lib80211_tkip_data { |
40 | #define TKIP_KEY_LEN 32 | 42 | #define TKIP_KEY_LEN 32 |
41 | u8 key[TKIP_KEY_LEN]; | 43 | u8 key[TKIP_KEY_LEN]; |
@@ -314,13 +316,12 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len, | |||
314 | u8 * rc4key, int keylen, void *priv) | 316 | u8 * rc4key, int keylen, void *priv) |
315 | { | 317 | { |
316 | struct lib80211_tkip_data *tkey = priv; | 318 | struct lib80211_tkip_data *tkey = priv; |
317 | int len; | ||
318 | u8 *pos; | 319 | u8 *pos; |
319 | struct ieee80211_hdr *hdr; | 320 | struct ieee80211_hdr *hdr; |
320 | 321 | ||
321 | hdr = (struct ieee80211_hdr *)skb->data; | 322 | hdr = (struct ieee80211_hdr *)skb->data; |
322 | 323 | ||
323 | if (skb_headroom(skb) < 8 || skb->len < hdr_len) | 324 | if (skb_headroom(skb) < TKIP_HDR_LEN || skb->len < hdr_len) |
324 | return -1; | 325 | return -1; |
325 | 326 | ||
326 | if (rc4key == NULL || keylen < 16) | 327 | if (rc4key == NULL || keylen < 16) |
@@ -333,9 +334,8 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len, | |||
333 | } | 334 | } |
334 | tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16); | 335 | tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16); |
335 | 336 | ||
336 | len = skb->len - hdr_len; | 337 | pos = skb_push(skb, TKIP_HDR_LEN); |
337 | pos = skb_push(skb, 8); | 338 | memmove(pos, pos + TKIP_HDR_LEN, hdr_len); |
338 | memmove(pos, pos + 8, hdr_len); | ||
339 | pos += hdr_len; | 339 | pos += hdr_len; |
340 | 340 | ||
341 | *pos++ = *rc4key; | 341 | *pos++ = *rc4key; |
@@ -353,7 +353,7 @@ static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len, | |||
353 | tkey->tx_iv32++; | 353 | tkey->tx_iv32++; |
354 | } | 354 | } |
355 | 355 | ||
356 | return 8; | 356 | return TKIP_HDR_LEN; |
357 | } | 357 | } |
358 | 358 | ||
359 | static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv) | 359 | static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv) |
@@ -433,7 +433,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv) | |||
433 | return -1; | 433 | return -1; |
434 | } | 434 | } |
435 | 435 | ||
436 | if (skb->len < hdr_len + 8 + 4) | 436 | if (skb->len < hdr_len + TKIP_HDR_LEN + 4) |
437 | return -1; | 437 | return -1; |
438 | 438 | ||
439 | pos = skb->data + hdr_len; | 439 | pos = skb->data + hdr_len; |
@@ -461,7 +461,7 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv) | |||
461 | } | 461 | } |
462 | iv16 = (pos[0] << 8) | pos[2]; | 462 | iv16 = (pos[0] << 8) | pos[2]; |
463 | iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24); | 463 | iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24); |
464 | pos += 8; | 464 | pos += TKIP_HDR_LEN; |
465 | 465 | ||
466 | if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) { | 466 | if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) { |
467 | #ifdef CONFIG_LIB80211_DEBUG | 467 | #ifdef CONFIG_LIB80211_DEBUG |
@@ -522,8 +522,8 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv) | |||
522 | tkey->rx_iv16_new = iv16; | 522 | tkey->rx_iv16_new = iv16; |
523 | 523 | ||
524 | /* Remove IV and ICV */ | 524 | /* Remove IV and ICV */ |
525 | memmove(skb->data + 8, skb->data, hdr_len); | 525 | memmove(skb->data + TKIP_HDR_LEN, skb->data, hdr_len); |
526 | skb_pull(skb, 8); | 526 | skb_pull(skb, TKIP_HDR_LEN); |
527 | skb_trim(skb, skb->len - 4); | 527 | skb_trim(skb, skb->len - 4); |
528 | 528 | ||
529 | return keyidx; | 529 | return keyidx; |