aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211/wpa.c
diff options
context:
space:
mode:
Diffstat (limited to 'net/mac80211/wpa.c')
-rw-r--r--net/mac80211/wpa.c403
1 files changed, 152 insertions, 251 deletions
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 45709ada8fee..2f33df0dcccf 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -11,6 +11,8 @@
11#include <linux/slab.h> 11#include <linux/slab.h>
12#include <linux/skbuff.h> 12#include <linux/skbuff.h>
13#include <linux/compiler.h> 13#include <linux/compiler.h>
14#include <linux/ieee80211.h>
15#include <asm/unaligned.h>
14#include <net/mac80211.h> 16#include <net/mac80211.h>
15 17
16#include "ieee80211_i.h" 18#include "ieee80211_i.h"
@@ -19,76 +21,30 @@
19#include "aes_ccm.h" 21#include "aes_ccm.h"
20#include "wpa.h" 22#include "wpa.h"
21 23
22static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
23 u8 *qos_tid, u8 **data, size_t *data_len)
24{
25 struct ieee80211_hdr *hdr;
26 size_t hdrlen;
27 u16 fc;
28 int a4_included;
29 u8 *pos;
30
31 hdr = (struct ieee80211_hdr *) skb->data;
32 fc = le16_to_cpu(hdr->frame_control);
33
34 hdrlen = 24;
35 if ((fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) ==
36 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
37 hdrlen += ETH_ALEN;
38 *sa = hdr->addr4;
39 *da = hdr->addr3;
40 } else if (fc & IEEE80211_FCTL_FROMDS) {
41 *sa = hdr->addr3;
42 *da = hdr->addr1;
43 } else if (fc & IEEE80211_FCTL_TODS) {
44 *sa = hdr->addr2;
45 *da = hdr->addr3;
46 } else {
47 *sa = hdr->addr2;
48 *da = hdr->addr1;
49 }
50
51 if (fc & 0x80)
52 hdrlen += 2;
53
54 *data = skb->data + hdrlen;
55 *data_len = skb->len - hdrlen;
56
57 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
58 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
59 if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
60 fc & IEEE80211_STYPE_QOS_DATA) {
61 pos = (u8 *) &hdr->addr4;
62 if (a4_included)
63 pos += 6;
64 *qos_tid = pos[0] & 0x0f;
65 *qos_tid |= 0x80; /* qos_included flag */
66 } else
67 *qos_tid = 0;
68
69 return skb->len < hdrlen ? -1 : 0;
70}
71
72
73ieee80211_tx_result 24ieee80211_tx_result
74ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx) 25ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
75{ 26{
76 u8 *data, *sa, *da, *key, *mic, qos_tid; 27 u8 *data, *key, *mic, key_offset;
77 size_t data_len; 28 size_t data_len;
78 u16 fc; 29 unsigned int hdrlen;
30 struct ieee80211_hdr *hdr;
79 struct sk_buff *skb = tx->skb; 31 struct sk_buff *skb = tx->skb;
80 int authenticator; 32 int authenticator;
81 int wpa_test = 0; 33 int wpa_test = 0;
34 int tail;
82 35
83 fc = tx->fc; 36 hdr = (struct ieee80211_hdr *)skb->data;
84
85 if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 || 37 if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
86 !WLAN_FC_DATA_PRESENT(fc)) 38 !ieee80211_is_data_present(hdr->frame_control))
87 return TX_CONTINUE; 39 return TX_CONTINUE;
88 40
89 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)) 41 hdrlen = ieee80211_hdrlen(hdr->frame_control);
42 if (skb->len < hdrlen)
90 return TX_DROP; 43 return TX_DROP;
91 44
45 data = skb->data + hdrlen;
46 data_len = skb->len - hdrlen;
47
92 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 48 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
93 !(tx->flags & IEEE80211_TX_FRAGMENTED) && 49 !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
94 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) && 50 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
@@ -98,26 +54,27 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
98 return TX_CONTINUE; 54 return TX_CONTINUE;
99 } 55 }
100 56
101 if (skb_tailroom(skb) < MICHAEL_MIC_LEN) { 57 tail = MICHAEL_MIC_LEN;
102 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 58 if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
103 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, 59 tail += TKIP_ICV_LEN;
104 MICHAEL_MIC_LEN + TKIP_ICV_LEN, 60
105 GFP_ATOMIC))) { 61 if (WARN_ON(skb_tailroom(skb) < tail ||
106 printk(KERN_DEBUG "%s: failed to allocate more memory " 62 skb_headroom(skb) < TKIP_IV_LEN))
107 "for Michael MIC\n", tx->dev->name); 63 return TX_DROP;
108 return TX_DROP;
109 }
110 }
111 64
112#if 0 65#if 0
113 authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */ 66 authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
114#else 67#else
115 authenticator = 1; 68 authenticator = 1;
116#endif 69#endif
117 key = &tx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_TX_MIC_KEY : 70 /* At this point we know we're using ALG_TKIP. To get the MIC key
118 ALG_TKIP_TEMP_AUTH_RX_MIC_KEY]; 71 * we now will rely on the offset from the ieee80211_key_conf::key */
72 key_offset = authenticator ?
73 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
74 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
75 key = &tx->key->conf.key[key_offset];
119 mic = skb_put(skb, MICHAEL_MIC_LEN); 76 mic = skb_put(skb, MICHAEL_MIC_LEN);
120 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic); 77 michael_mic(key, hdr, data, data_len, mic);
121 78
122 return TX_CONTINUE; 79 return TX_CONTINUE;
123} 80}
@@ -126,47 +83,50 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
126ieee80211_rx_result 83ieee80211_rx_result
127ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) 84ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
128{ 85{
129 u8 *data, *sa, *da, *key = NULL, qos_tid; 86 u8 *data, *key = NULL, key_offset;
130 size_t data_len; 87 size_t data_len;
131 u16 fc; 88 unsigned int hdrlen;
89 struct ieee80211_hdr *hdr;
132 u8 mic[MICHAEL_MIC_LEN]; 90 u8 mic[MICHAEL_MIC_LEN];
133 struct sk_buff *skb = rx->skb; 91 struct sk_buff *skb = rx->skb;
134 int authenticator = 1, wpa_test = 0; 92 int authenticator = 1, wpa_test = 0;
135 DECLARE_MAC_BUF(mac); 93 DECLARE_MAC_BUF(mac);
136 94
137 fc = rx->fc;
138
139 /* 95 /*
140 * No way to verify the MIC if the hardware stripped it 96 * No way to verify the MIC if the hardware stripped it
141 */ 97 */
142 if (rx->status->flag & RX_FLAG_MMIC_STRIPPED) 98 if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
143 return RX_CONTINUE; 99 return RX_CONTINUE;
144 100
101 hdr = (struct ieee80211_hdr *)skb->data;
145 if (!rx->key || rx->key->conf.alg != ALG_TKIP || 102 if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
146 !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc)) 103 !ieee80211_has_protected(hdr->frame_control) ||
104 !ieee80211_is_data_present(hdr->frame_control))
147 return RX_CONTINUE; 105 return RX_CONTINUE;
148 106
149 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len) 107 hdrlen = ieee80211_hdrlen(hdr->frame_control);
150 || data_len < MICHAEL_MIC_LEN) 108 if (skb->len < hdrlen + MICHAEL_MIC_LEN)
151 return RX_DROP_UNUSABLE; 109 return RX_DROP_UNUSABLE;
152 110
153 data_len -= MICHAEL_MIC_LEN; 111 data = skb->data + hdrlen;
112 data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
154 113
155#if 0 114#if 0
156 authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */ 115 authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
157#else 116#else
158 authenticator = 1; 117 authenticator = 1;
159#endif 118#endif
160 key = &rx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_RX_MIC_KEY : 119 /* At this point we know we're using ALG_TKIP. To get the MIC key
161 ALG_TKIP_TEMP_AUTH_TX_MIC_KEY]; 120 * we now will rely on the offset from the ieee80211_key_conf::key */
162 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic); 121 key_offset = authenticator ?
122 NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
123 NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
124 key = &rx->key->conf.key[key_offset];
125 michael_mic(key, hdr, data, data_len, mic);
163 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) { 126 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
164 if (!(rx->flags & IEEE80211_RX_RA_MATCH)) 127 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
165 return RX_DROP_UNUSABLE; 128 return RX_DROP_UNUSABLE;
166 129
167 printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from "
168 "%s\n", rx->dev->name, print_mac(mac, sa));
169
170 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx, 130 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
171 (void *) skb->data); 131 (void *) skb->data);
172 return RX_DROP_UNUSABLE; 132 return RX_DROP_UNUSABLE;
@@ -176,59 +136,58 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
176 skb_trim(skb, skb->len - MICHAEL_MIC_LEN); 136 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
177 137
178 /* update IV in key information to be able to detect replays */ 138 /* update IV in key information to be able to detect replays */
179 rx->key->u.tkip.iv32_rx[rx->queue] = rx->tkip_iv32; 139 rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
180 rx->key->u.tkip.iv16_rx[rx->queue] = rx->tkip_iv16; 140 rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
181 141
182 return RX_CONTINUE; 142 return RX_CONTINUE;
183} 143}
184 144
185 145
186static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, 146static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
187 struct sk_buff *skb, int test)
188{ 147{
189 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 148 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
190 struct ieee80211_key *key = tx->key; 149 struct ieee80211_key *key = tx->key;
191 int hdrlen, len, tailneed; 150 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
192 u16 fc; 151 unsigned int hdrlen;
152 int len, tail;
193 u8 *pos; 153 u8 *pos;
194 154
195 fc = le16_to_cpu(hdr->frame_control); 155 info->control.icv_len = TKIP_ICV_LEN;
196 hdrlen = ieee80211_get_hdrlen(fc); 156 info->control.iv_len = TKIP_IV_LEN;
157
158 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
159 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
160 /* hwaccel - with no need for preallocated room for IV/ICV */
161 info->control.hw_key = &tx->key->conf;
162 return 0;
163 }
164
165 hdrlen = ieee80211_hdrlen(hdr->frame_control);
197 len = skb->len - hdrlen; 166 len = skb->len - hdrlen;
198 167
199 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) 168 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
200 tailneed = 0; 169 tail = 0;
201 else 170 else
202 tailneed = TKIP_ICV_LEN; 171 tail = TKIP_ICV_LEN;
203 172
204 if ((skb_headroom(skb) < TKIP_IV_LEN || 173 if (WARN_ON(skb_tailroom(skb) < tail ||
205 skb_tailroom(skb) < tailneed)) { 174 skb_headroom(skb) < TKIP_IV_LEN))
206 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 175 return -1;
207 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, tailneed,
208 GFP_ATOMIC)))
209 return -1;
210 }
211 176
212 pos = skb_push(skb, TKIP_IV_LEN); 177 pos = skb_push(skb, TKIP_IV_LEN);
213 memmove(pos, pos + TKIP_IV_LEN, hdrlen); 178 memmove(pos, pos + TKIP_IV_LEN, hdrlen);
214 pos += hdrlen; 179 pos += hdrlen;
215 180
216 /* Increase IV for the frame */ 181 /* Increase IV for the frame */
217 key->u.tkip.iv16++; 182 key->u.tkip.tx.iv16++;
218 if (key->u.tkip.iv16 == 0) 183 if (key->u.tkip.tx.iv16 == 0)
219 key->u.tkip.iv32++; 184 key->u.tkip.tx.iv32++;
220 185
221 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { 186 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
222 hdr = (struct ieee80211_hdr *)skb->data;
223
224 /* hwaccel - with preallocated room for IV */ 187 /* hwaccel - with preallocated room for IV */
225 ieee80211_tkip_add_iv(pos, key, 188 ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
226 (u8) (key->u.tkip.iv16 >> 8),
227 (u8) (((key->u.tkip.iv16 >> 8) | 0x20) &
228 0x7f),
229 (u8) key->u.tkip.iv16);
230 189
231 tx->control->key_idx = tx->key->conf.hw_key_idx; 190 info->control.hw_key = &tx->key->conf;
232 return 0; 191 return 0;
233 } 192 }
234 193
@@ -246,28 +205,16 @@ ieee80211_tx_result
246ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx) 205ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
247{ 206{
248 struct sk_buff *skb = tx->skb; 207 struct sk_buff *skb = tx->skb;
249 int wpa_test = 0, test = 0;
250 208
251 tx->control->icv_len = TKIP_ICV_LEN;
252 tx->control->iv_len = TKIP_IV_LEN;
253 ieee80211_tx_set_protected(tx); 209 ieee80211_tx_set_protected(tx);
254 210
255 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 211 if (tkip_encrypt_skb(tx, skb) < 0)
256 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
257 !wpa_test) {
258 /* hwaccel - with no need for preallocated room for IV/ICV */
259 tx->control->key_idx = tx->key->conf.hw_key_idx;
260 return TX_CONTINUE;
261 }
262
263 if (tkip_encrypt_skb(tx, skb, test) < 0)
264 return TX_DROP; 212 return TX_DROP;
265 213
266 if (tx->extra_frag) { 214 if (tx->extra_frag) {
267 int i; 215 int i;
268 for (i = 0; i < tx->num_extra_frag; i++) { 216 for (i = 0; i < tx->num_extra_frag; i++) {
269 if (tkip_encrypt_skb(tx, tx->extra_frag[i], test) 217 if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
270 < 0)
271 return TX_DROP; 218 return TX_DROP;
272 } 219 }
273 } 220 }
@@ -280,16 +227,14 @@ ieee80211_rx_result
280ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx) 227ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
281{ 228{
282 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 229 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
283 u16 fc;
284 int hdrlen, res, hwaccel = 0, wpa_test = 0; 230 int hdrlen, res, hwaccel = 0, wpa_test = 0;
285 struct ieee80211_key *key = rx->key; 231 struct ieee80211_key *key = rx->key;
286 struct sk_buff *skb = rx->skb; 232 struct sk_buff *skb = rx->skb;
287 DECLARE_MAC_BUF(mac); 233 DECLARE_MAC_BUF(mac);
288 234
289 fc = le16_to_cpu(hdr->frame_control); 235 hdrlen = ieee80211_hdrlen(hdr->frame_control);
290 hdrlen = ieee80211_get_hdrlen(fc);
291 236
292 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) 237 if (!ieee80211_is_data(hdr->frame_control))
293 return RX_CONTINUE; 238 return RX_CONTINUE;
294 239
295 if (!rx->sta || skb->len - hdrlen < 12) 240 if (!rx->sta || skb->len - hdrlen < 12)
@@ -315,15 +260,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
315 hdr->addr1, hwaccel, rx->queue, 260 hdr->addr1, hwaccel, rx->queue,
316 &rx->tkip_iv32, 261 &rx->tkip_iv32,
317 &rx->tkip_iv16); 262 &rx->tkip_iv16);
318 if (res != TKIP_DECRYPT_OK || wpa_test) { 263 if (res != TKIP_DECRYPT_OK || wpa_test)
319#ifdef CONFIG_MAC80211_DEBUG
320 if (net_ratelimit())
321 printk(KERN_DEBUG "%s: TKIP decrypt failed for RX "
322 "frame from %s (res=%d)\n", rx->dev->name,
323 print_mac(mac, rx->sta->addr), res);
324#endif /* CONFIG_MAC80211_DEBUG */
325 return RX_DROP_UNUSABLE; 264 return RX_DROP_UNUSABLE;
326 }
327 265
328 /* Trim ICV */ 266 /* Trim ICV */
329 skb_trim(skb, skb->len - TKIP_ICV_LEN); 267 skb_trim(skb, skb->len - TKIP_ICV_LEN);
@@ -336,70 +274,68 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
336} 274}
337 275
338 276
339static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad, 277static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
340 int encrypted) 278 int encrypted)
341{ 279{
342 u16 fc; 280 __le16 mask_fc;
343 int a4_included, qos_included; 281 int a4_included;
344 u8 qos_tid, *fc_pos, *data, *sa, *da; 282 u8 qos_tid;
345 int len_a; 283 u8 *b_0, *aad;
346 size_t data_len; 284 u16 data_len, len_a;
347 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 285 unsigned int hdrlen;
286 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
348 287
349 fc_pos = (u8 *) &hdr->frame_control; 288 b_0 = scratch + 3 * AES_BLOCK_LEN;
350 fc = fc_pos[0] ^ (fc_pos[1] << 8); 289 aad = scratch + 4 * AES_BLOCK_LEN;
351 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 290
352 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS); 291 /*
353 292 * Mask FC: zero subtype b4 b5 b6
354 ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len); 293 * Retry, PwrMgt, MoreData; set Protected
355 data_len -= CCMP_HDR_LEN + (encrypted ? CCMP_MIC_LEN : 0); 294 */
356 if (qos_tid & 0x80) { 295 mask_fc = hdr->frame_control;
357 qos_included = 1; 296 mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
358 qos_tid &= 0x0f; 297 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
359 } else 298 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
360 qos_included = 0; 299
361 /* First block, b_0 */ 300 hdrlen = ieee80211_hdrlen(hdr->frame_control);
301 len_a = hdrlen - 2;
302 a4_included = ieee80211_has_a4(hdr->frame_control);
303
304 if (ieee80211_is_data_qos(hdr->frame_control))
305 qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
306 else
307 qos_tid = 0;
308
309 data_len = skb->len - hdrlen - CCMP_HDR_LEN;
310 if (encrypted)
311 data_len -= CCMP_MIC_LEN;
362 312
313 /* First block, b_0 */
363 b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */ 314 b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
364 /* Nonce: QoS Priority | A2 | PN */ 315 /* Nonce: QoS Priority | A2 | PN */
365 b_0[1] = qos_tid; 316 b_0[1] = qos_tid;
366 memcpy(&b_0[2], hdr->addr2, 6); 317 memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
367 memcpy(&b_0[8], pn, CCMP_PN_LEN); 318 memcpy(&b_0[8], pn, CCMP_PN_LEN);
368 /* l(m) */ 319 /* l(m) */
369 b_0[14] = (data_len >> 8) & 0xff; 320 put_unaligned_be16(data_len, &b_0[14]);
370 b_0[15] = data_len & 0xff;
371
372 321
373 /* AAD (extra authenticate-only data) / masked 802.11 header 322 /* AAD (extra authenticate-only data) / masked 802.11 header
374 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */ 323 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
375 324 put_unaligned_be16(len_a, &aad[0]);
376 len_a = a4_included ? 28 : 22; 325 put_unaligned(mask_fc, (__le16 *)&aad[2]);
377 if (qos_included) 326 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
378 len_a += 2;
379
380 aad[0] = 0; /* (len_a >> 8) & 0xff; */
381 aad[1] = len_a & 0xff;
382 /* Mask FC: zero subtype b4 b5 b6 */
383 aad[2] = fc_pos[0] & ~(BIT(4) | BIT(5) | BIT(6));
384 /* Retry, PwrMgt, MoreData; set Protected */
385 aad[3] = (fc_pos[1] & ~(BIT(3) | BIT(4) | BIT(5))) | BIT(6);
386 memcpy(&aad[4], &hdr->addr1, 18);
387 327
388 /* Mask Seq#, leave Frag# */ 328 /* Mask Seq#, leave Frag# */
389 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f; 329 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
390 aad[23] = 0; 330 aad[23] = 0;
331
391 if (a4_included) { 332 if (a4_included) {
392 memcpy(&aad[24], hdr->addr4, 6); 333 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
393 aad[30] = 0; 334 aad[30] = qos_tid;
394 aad[31] = 0; 335 aad[31] = 0;
395 } else 336 } else {
396 memset(&aad[24], 0, 8); 337 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
397 if (qos_included) { 338 aad[24] = qos_tid;
398 u8 *dpos = &aad[a4_included ? 30 : 24];
399
400 /* Mask QoS Control field */
401 dpos[0] = qos_tid;
402 dpos[1] = 0;
403 } 339 }
404} 340}
405 341
@@ -429,36 +365,37 @@ static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
429} 365}
430 366
431 367
432static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, 368static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
433 struct sk_buff *skb, int test)
434{ 369{
435 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 370 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
436 struct ieee80211_key *key = tx->key; 371 struct ieee80211_key *key = tx->key;
437 int hdrlen, len, tailneed; 372 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
438 u16 fc; 373 int hdrlen, len, tail;
439 u8 *pos, *pn, *b_0, *aad, *scratch; 374 u8 *pos, *pn;
440 int i; 375 int i;
441 376
442 scratch = key->u.ccmp.tx_crypto_buf; 377 info->control.icv_len = CCMP_MIC_LEN;
443 b_0 = scratch + 3 * AES_BLOCK_LEN; 378 info->control.iv_len = CCMP_HDR_LEN;
444 aad = scratch + 4 * AES_BLOCK_LEN;
445 379
446 fc = le16_to_cpu(hdr->frame_control); 380 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
447 hdrlen = ieee80211_get_hdrlen(fc); 381 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
382 /* hwaccel - with no need for preallocated room for CCMP "
383 * header or MIC fields */
384 info->control.hw_key = &tx->key->conf;
385 return 0;
386 }
387
388 hdrlen = ieee80211_hdrlen(hdr->frame_control);
448 len = skb->len - hdrlen; 389 len = skb->len - hdrlen;
449 390
450 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) 391 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
451 tailneed = 0; 392 tail = 0;
452 else 393 else
453 tailneed = CCMP_MIC_LEN; 394 tail = CCMP_MIC_LEN;
454 395
455 if ((skb_headroom(skb) < CCMP_HDR_LEN || 396 if (WARN_ON(skb_tailroom(skb) < tail ||
456 skb_tailroom(skb) < tailneed)) { 397 skb_headroom(skb) < CCMP_HDR_LEN))
457 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 398 return -1;
458 if (unlikely(pskb_expand_head(skb, CCMP_HDR_LEN, tailneed,
459 GFP_ATOMIC)))
460 return -1;
461 }
462 399
463 pos = skb_push(skb, CCMP_HDR_LEN); 400 pos = skb_push(skb, CCMP_HDR_LEN);
464 memmove(pos, pos + CCMP_HDR_LEN, hdrlen); 401 memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
@@ -478,13 +415,13 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx,
478 415
479 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { 416 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
480 /* hwaccel - with preallocated room for CCMP header */ 417 /* hwaccel - with preallocated room for CCMP header */
481 tx->control->key_idx = key->conf.hw_key_idx; 418 info->control.hw_key = &tx->key->conf;
482 return 0; 419 return 0;
483 } 420 }
484 421
485 pos += CCMP_HDR_LEN; 422 pos += CCMP_HDR_LEN;
486 ccmp_special_blocks(skb, pn, b_0, aad, 0); 423 ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0);
487 ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, b_0, aad, pos, len, 424 ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, key->u.ccmp.tx_crypto_buf, pos, len,
488 pos, skb_put(skb, CCMP_MIC_LEN)); 425 pos, skb_put(skb, CCMP_MIC_LEN));
489 426
490 return 0; 427 return 0;
@@ -495,28 +432,16 @@ ieee80211_tx_result
495ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx) 432ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
496{ 433{
497 struct sk_buff *skb = tx->skb; 434 struct sk_buff *skb = tx->skb;
498 int test = 0;
499 435
500 tx->control->icv_len = CCMP_MIC_LEN;
501 tx->control->iv_len = CCMP_HDR_LEN;
502 ieee80211_tx_set_protected(tx); 436 ieee80211_tx_set_protected(tx);
503 437
504 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 438 if (ccmp_encrypt_skb(tx, skb) < 0)
505 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
506 /* hwaccel - with no need for preallocated room for CCMP "
507 * header or MIC fields */
508 tx->control->key_idx = tx->key->conf.hw_key_idx;
509 return TX_CONTINUE;
510 }
511
512 if (ccmp_encrypt_skb(tx, skb, test) < 0)
513 return TX_DROP; 439 return TX_DROP;
514 440
515 if (tx->extra_frag) { 441 if (tx->extra_frag) {
516 int i; 442 int i;
517 for (i = 0; i < tx->num_extra_frag; i++) { 443 for (i = 0; i < tx->num_extra_frag; i++) {
518 if (ccmp_encrypt_skb(tx, tx->extra_frag[i], test) 444 if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
519 < 0)
520 return TX_DROP; 445 return TX_DROP;
521 } 446 }
522 } 447 }
@@ -528,8 +453,7 @@ ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
528ieee80211_rx_result 453ieee80211_rx_result
529ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx) 454ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
530{ 455{
531 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 456 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
532 u16 fc;
533 int hdrlen; 457 int hdrlen;
534 struct ieee80211_key *key = rx->key; 458 struct ieee80211_key *key = rx->key;
535 struct sk_buff *skb = rx->skb; 459 struct sk_buff *skb = rx->skb;
@@ -537,10 +461,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
537 int data_len; 461 int data_len;
538 DECLARE_MAC_BUF(mac); 462 DECLARE_MAC_BUF(mac);
539 463
540 fc = le16_to_cpu(hdr->frame_control); 464 hdrlen = ieee80211_hdrlen(hdr->frame_control);
541 hdrlen = ieee80211_get_hdrlen(fc);
542 465
543 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) 466 if (!ieee80211_is_data(hdr->frame_control))
544 return RX_CONTINUE; 467 return RX_CONTINUE;
545 468
546 data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN; 469 data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
@@ -554,41 +477,19 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
554 (void) ccmp_hdr2pn(pn, skb->data + hdrlen); 477 (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
555 478
556 if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) { 479 if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
557#ifdef CONFIG_MAC80211_DEBUG
558 u8 *ppn = key->u.ccmp.rx_pn[rx->queue];
559
560 printk(KERN_DEBUG "%s: CCMP replay detected for RX frame from "
561 "%s (RX PN %02x%02x%02x%02x%02x%02x <= prev. PN "
562 "%02x%02x%02x%02x%02x%02x)\n", rx->dev->name,
563 print_mac(mac, rx->sta->addr),
564 pn[0], pn[1], pn[2], pn[3], pn[4], pn[5],
565 ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]);
566#endif /* CONFIG_MAC80211_DEBUG */
567 key->u.ccmp.replays++; 480 key->u.ccmp.replays++;
568 return RX_DROP_UNUSABLE; 481 return RX_DROP_UNUSABLE;
569 } 482 }
570 483
571 if (!(rx->status->flag & RX_FLAG_DECRYPTED)) { 484 if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
572 /* hardware didn't decrypt/verify MIC */ 485 /* hardware didn't decrypt/verify MIC */
573 u8 *scratch, *b_0, *aad; 486 ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1);
574
575 scratch = key->u.ccmp.rx_crypto_buf;
576 b_0 = scratch + 3 * AES_BLOCK_LEN;
577 aad = scratch + 4 * AES_BLOCK_LEN;
578
579 ccmp_special_blocks(skb, pn, b_0, aad, 1);
580 487
581 if (ieee80211_aes_ccm_decrypt( 488 if (ieee80211_aes_ccm_decrypt(
582 key->u.ccmp.tfm, scratch, b_0, aad, 489 key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
583 skb->data + hdrlen + CCMP_HDR_LEN, data_len, 490 skb->data + hdrlen + CCMP_HDR_LEN, data_len,
584 skb->data + skb->len - CCMP_MIC_LEN, 491 skb->data + skb->len - CCMP_MIC_LEN,
585 skb->data + hdrlen + CCMP_HDR_LEN)) { 492 skb->data + hdrlen + CCMP_HDR_LEN)) {
586#ifdef CONFIG_MAC80211_DEBUG
587 if (net_ratelimit())
588 printk(KERN_DEBUG "%s: CCMP decrypt failed "
589 "for RX frame from %s\n", rx->dev->name,
590 print_mac(mac, rx->sta->addr));
591#endif /* CONFIG_MAC80211_DEBUG */
592 return RX_DROP_UNUSABLE; 493 return RX_DROP_UNUSABLE;
593 } 494 }
594 } 495 }
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-12 10:22:12 -0500