?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
mdoc.7/MANUAL STRUCTURE: add HARDWARE
[freebsd/src.git] / sys / net80211 / ieee80211_crypto_tkip.c
blob4cfb7542f8ffcd84d0d2c5356f12b652d131a19d
1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include <sys/cdefs.h>
29 /*
30 * IEEE 802.11i TKIP crypto support.
31 *
32 * Part of this module is derived from similar code in the Host
33 * AP driver. The code is used with the consent of the author and
34 * it's license is included below.
35 */
36 #include "opt_wlan.h"
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/malloc.h>
42 #include <sys/kernel.h>
43 #include <sys/module.h>
44 #include <sys/endian.h>
45
46 #include <sys/socket.h>
47
48 #include <net/if.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51
52 #include <net80211/ieee80211_var.h>
53
54 static void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *);
55 static void tkip_detach(struct ieee80211_key *);
56 static int tkip_setkey(struct ieee80211_key *);
57 static void tkip_setiv(struct ieee80211_key *, uint8_t *);
58 static int tkip_encap(struct ieee80211_key *, struct mbuf *);
59 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
60 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
61 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
62
63 static const struct ieee80211_cipher tkip = {
64 .ic_name = "TKIP",
65 .ic_cipher = IEEE80211_CIPHER_TKIP,
66 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
67 IEEE80211_WEP_EXTIVLEN,
68 .ic_trailer = IEEE80211_WEP_CRCLEN,
69 .ic_miclen = IEEE80211_WEP_MICLEN,
70 .ic_attach = tkip_attach,
71 .ic_detach = tkip_detach,
72 .ic_setkey = tkip_setkey,
73 .ic_setiv = tkip_setiv,
74 .ic_encap = tkip_encap,
75 .ic_decap = tkip_decap,
76 .ic_enmic = tkip_enmic,
77 .ic_demic = tkip_demic,
78 };
79
80 typedef uint8_t u8;
81 typedef uint16_t u16;
82 typedef uint32_t __u32;
83 typedef uint32_t u32;
84
85 struct tkip_ctx {
86 struct ieee80211vap *tc_vap; /* for diagnostics+statistics */
87
88 u16 tx_ttak[5];
89 u8 tx_rc4key[16]; /* XXX for test module; make locals? */
90
91 u16 rx_ttak[5];
92 int rx_phase1_done;
93 u8 rx_rc4key[16]; /* XXX for test module; make locals? */
94 uint64_t rx_rsc; /* held until MIC verified */
95 };
96
97 static void michael_mic(struct tkip_ctx *, const u8 *key,
98 struct mbuf *m, u_int off, size_t data_len,
99 u8 mic[IEEE80211_WEP_MICLEN]);
100 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
101 struct mbuf *, int hdr_len);
102 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
103 struct mbuf *, int hdr_len);
104
105 /* number of references from net80211 layer */
106 static int nrefs = 0;
107
108 static void *
109 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k)
110 {
111 struct tkip_ctx *ctx;
112
113 ctx = (struct tkip_ctx *) IEEE80211_MALLOC(sizeof(struct tkip_ctx),
114 M_80211_CRYPTO, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
115 if (ctx == NULL) {
116 vap->iv_stats.is_crypto_nomem++;
117 return NULL;
118 }
119
120 ctx->tc_vap = vap;
121 nrefs++; /* NB: we assume caller locking */
122 return ctx;
123 }
124
125 static void
126 tkip_detach(struct ieee80211_key *k)
127 {
128 struct tkip_ctx *ctx = k->wk_private;
129
130 IEEE80211_FREE(ctx, M_80211_CRYPTO);
131 KASSERT(nrefs > 0, ("imbalanced attach/detach"));
132 nrefs--; /* NB: we assume caller locking */
133 }
134
135 static int
136 tkip_setkey(struct ieee80211_key *k)
137 {
138 struct tkip_ctx *ctx = k->wk_private;
139
140 if (k->wk_keylen != (128/NBBY)) {
141 (void) ctx; /* XXX */
142 IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO,
143 "%s: Invalid key length %u, expecting %u\n",
144 __func__, k->wk_keylen, 128/NBBY);
145 return 0;
146 }
147 ctx->rx_phase1_done = 0;
148 return 1;
149 }
150
151 static void
152 tkip_setiv(struct ieee80211_key *k, uint8_t *ivp)
153 {
154 struct tkip_ctx *ctx = k->wk_private;
155 struct ieee80211vap *vap = ctx->tc_vap;
156 uint8_t keyid;
157
158 keyid = ieee80211_crypto_get_keyid(vap, k) << 6;
159
160 k->wk_keytsc++;
161 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */
162 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */
163 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */
164 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */
165 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */
166 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */
167 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */
168 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */
169 }
170
171 /*
172 * Add privacy headers and do any s/w encryption required.
173 */
174 static int
175 tkip_encap(struct ieee80211_key *k, struct mbuf *m)
176 {
177 struct tkip_ctx *ctx = k->wk_private;
178 struct ieee80211vap *vap = ctx->tc_vap;
179 struct ieee80211com *ic = vap->iv_ic;
180 struct ieee80211_frame *wh;
181 uint8_t *ivp;
182 int hdrlen;
183 int is_mgmt;
184
185 wh = mtod(m, struct ieee80211_frame *);
186 is_mgmt = IEEE80211_IS_MGMT(wh);
187
188 /*
189 * Handle TKIP counter measures requirement.
190 */
191 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
192 #ifdef IEEE80211_DEBUG
193 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
194 #endif
195
196 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
197 "discard frame due to countermeasures (%s)", __func__);
198 vap->iv_stats.is_crypto_tkipcm++;
199 return 0;
200 }
201
202 /*
203 * Check to see whether IV needs to be included.
204 */
205 if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOIVMGT))
206 return 1;
207 if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOIV))
208 return 1;
209
210 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
211
212 /*
213 * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
214 */
215 M_PREPEND(m, tkip.ic_header, IEEE80211_M_NOWAIT);
216 if (m == NULL)
217 return 0;
218 ivp = mtod(m, uint8_t *);
219 memmove(ivp, ivp + tkip.ic_header, hdrlen);
220 ivp += hdrlen;
221
222 tkip_setiv(k, ivp);
223
224 /*
225 * Finally, do software encrypt if needed.
226 */
227 if ((k->wk_flags & IEEE80211_KEY_SWENCRYPT) &&
228 !tkip_encrypt(ctx, k, m, hdrlen))
229 return 0;
230
231 return 1;
232 }
233
234 /*
235 * Add MIC to the frame as needed.
236 */
237 static int
238 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
239 {
240 struct tkip_ctx *ctx = k->wk_private;
241 struct ieee80211_frame *wh;
242 int is_mgmt;
243
244 wh = mtod(m, struct ieee80211_frame *);
245 is_mgmt = IEEE80211_IS_MGMT(wh);
246
247 /*
248 * Check to see whether MIC needs to be included.
249 */
250 if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOMICMGT))
251 return 1;
252 if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOMIC))
253 return 1;
254
255 if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) {
256 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
257 struct ieee80211vap *vap = ctx->tc_vap;
258 struct ieee80211com *ic = vap->iv_ic;
259 int hdrlen;
260 uint8_t mic[IEEE80211_WEP_MICLEN];
261
262 vap->iv_stats.is_crypto_tkipenmic++;
263
264 hdrlen = ieee80211_hdrspace(ic, wh);
265
266 michael_mic(ctx, k->wk_txmic,
267 m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
268 return m_append(m, tkip.ic_miclen, mic);
269 }
270 return 1;
271 }
272
273 static __inline uint64_t
274 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
275 {
276 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
277 uint16_t iv16 = (b4 << 0) | (b5 << 8);
278 return (((uint64_t)iv16) << 32) | iv32;
279 }
280
281 /*
282 * Validate and strip privacy headers (and trailer) for a
283 * received frame. If necessary, decrypt the frame using
284 * the specified key.
285 */
286 static int
287 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
288 {
289 const struct ieee80211_rx_stats *rxs;
290 struct tkip_ctx *ctx = k->wk_private;
291 struct ieee80211vap *vap = ctx->tc_vap;
292 struct ieee80211_frame *wh;
293 uint8_t *ivp, tid;
294
295 rxs = ieee80211_get_rx_params_ptr(m);
296
297 /*
298 * If IV has been stripped, we skip most of the below.
299 */
300 if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))
301 goto finish;
302
303 /*
304 * Header should have extended IV and sequence number;
305 * verify the former and validate the latter.
306 */
307 wh = mtod(m, struct ieee80211_frame *);
308 ivp = mtod(m, uint8_t *) + hdrlen;
309 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
310 /*
311 * No extended IV; discard frame.
312 */
313 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
314 "%s", "missing ExtIV for TKIP cipher");
315 vap->iv_stats.is_rx_tkipformat++;
316 return 0;
317 }
318 /*
319 * Handle TKIP counter measures requirement.
320 */
321 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
322 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
323 "discard frame due to countermeasures (%s)", __func__);
324 vap->iv_stats.is_crypto_tkipcm++;
325 return 0;
326 }
327
328 tid = ieee80211_gettid(wh);
329 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
330 if (ctx->rx_rsc <= k->wk_keyrsc[tid] &&
331 (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) {
332 /*
333 * Replay violation; notify upper layer.
334 */
335 ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid);
336 vap->iv_stats.is_rx_tkipreplay++;
337 return 0;
338 }
339 /*
340 * NB: We can't update the rsc in the key until MIC is verified.
341 *
342 * We assume we are not preempted between doing the check above
343 * and updating wk_keyrsc when stripping the MIC in tkip_demic.
344 * Otherwise we might process another packet and discard it as
345 * a replay.
346 */
347
348 /*
349 * Check if the device handled the decrypt in hardware.
350 * If so we just strip the header; otherwise we need to
351 * handle the decrypt in software.
352 */
353 if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
354 !tkip_decrypt(ctx, k, m, hdrlen))
355 return 0;
356
357 finish:
358
359 /*
360 * Copy up 802.11 header and strip crypto bits - but only if we
361 * are required to.
362 */
363 if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
364 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *),
365 hdrlen);
366 m_adj(m, tkip.ic_header);
367 }
368
369 /*
370 * XXX TODO: do we need an option to potentially not strip the
371 * WEP trailer? Does "MMIC_STRIP" also mean this? Or?
372 */
373 m_adj(m, -tkip.ic_trailer);
374
375 return 1;
376 }
377
378 /*
379 * Verify and strip MIC from the frame.
380 */
381 static int
382 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
383 {
384 const struct ieee80211_rx_stats *rxs;
385 struct tkip_ctx *ctx = k->wk_private;
386 struct ieee80211_frame *wh;
387 uint8_t tid;
388
389 wh = mtod(m, struct ieee80211_frame *);
390 rxs = ieee80211_get_rx_params_ptr(m);
391
392 /*
393 * If we are told about a MIC failure from the driver,
394 * directly notify as a michael failure to the upper
395 * layers.
396 */
397 if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_FAIL_MIC)) {
398 struct ieee80211vap *vap = ctx->tc_vap;
399 ieee80211_notify_michael_failure(vap, wh,
400 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
401 k->wk_rxkeyix : k->wk_keyix);
402 return 0;
403 }
404
405 /*
406 * If IV has been stripped, we skip most of the below.
407 */
408 if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_MMIC_STRIP))
409 goto finish;
410
411 if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) {
412 struct ieee80211vap *vap = ctx->tc_vap;
413 int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh);
414 u8 mic[IEEE80211_WEP_MICLEN];
415 u8 mic0[IEEE80211_WEP_MICLEN];
416
417 vap->iv_stats.is_crypto_tkipdemic++;
418
419 michael_mic(ctx, k->wk_rxmic,
420 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
421 mic);
422 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
423 tkip.ic_miclen, mic0);
424 if (memcmp(mic, mic0, tkip.ic_miclen)) {
425 /* NB: 802.11 layer handles statistic and debug msg */
426 ieee80211_notify_michael_failure(vap, wh,
427 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
428 k->wk_rxkeyix : k->wk_keyix);
429 return 0;
430 }
431 }
432 /*
433 * Strip MIC from the tail.
434 */
435 m_adj(m, -tkip.ic_miclen);
436
437 /*
438 * Ok to update rsc now that MIC has been verified.
439 */
440 tid = ieee80211_gettid(wh);
441 k->wk_keyrsc[tid] = ctx->rx_rsc;
442
443 finish:
444 return 1;
445 }
446
447 /*
448 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
449 *
450 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
451 *
452 * This program is free software; you can redistribute it and/or modify
453 * it under the terms of the GNU General Public License version 2 as
454 * published by the Free Software Foundation. See README and COPYING for
455 * more details.
456 *
457 * Alternatively, this software may be distributed under the terms of BSD
458 * license.
459 */
460
461 static const __u32 crc32_table[256] = {
462 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
463 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
464 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
465 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
466 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
467 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
468 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
469 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
470 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
471 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
472 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
473 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
474 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
475 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
476 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
477 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
478 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
479 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
480 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
481 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
482 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
483 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
484 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
485 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
486 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
487 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
488 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
489 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
490 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
491 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
492 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
493 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
494 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
495 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
496 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
497 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
498 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
499 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
500 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
501 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
502 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
503 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
504 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
505 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
506 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
507 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
508 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
509 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
510 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
511 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
512 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
513 0x2d02ef8dL
514 };
515
516 static __inline u16 RotR1(u16 val)
517 {
518 return (val >> 1) | (val << 15);
519 }
520
521 static __inline u8 Lo8(u16 val)
522 {
523 return val & 0xff;
524 }
525
526 static __inline u8 Hi8(u16 val)
527 {
528 return val >> 8;
529 }
530
531 static __inline u16 Lo16(u32 val)
532 {
533 return val & 0xffff;
534 }
535
536 static __inline u16 Hi16(u32 val)
537 {
538 return val >> 16;
539 }
540
541 static __inline u16 Mk16(u8 hi, u8 lo)
542 {
543 return lo | (((u16) hi) << 8);
544 }
545
546 static __inline u16 Mk16_le(const u16 *v)
547 {
548 return le16toh(*v);
549 }
550
551 static const u16 Sbox[256] = {
552 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
553 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
554 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
555 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
556 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
557 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
558 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
559 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
560 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
561 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
562 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
563 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
564 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
565 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
566 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
567 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
568 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
569 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
570 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
571 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
572 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
573 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
574 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
575 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
576 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
577 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
578 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
579 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
580 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
581 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
582 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
583 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
584 };
585
586 static __inline u16 _S_(u16 v)
587 {
588 u16 t = Sbox[Hi8(v)];
589 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
590 }
591
592 #define PHASE1_LOOP_COUNT 8
593
594 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
595 {
596 int i, j;
597
598 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
599 TTAK[0] = Lo16(IV32);
600 TTAK[1] = Hi16(IV32);
601 TTAK[2] = Mk16(TA[1], TA[0]);
602 TTAK[3] = Mk16(TA[3], TA[2]);
603 TTAK[4] = Mk16(TA[5], TA[4]);
604
605 for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
606 j = 2 * (i & 1);
607 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
608 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
609 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
610 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
611 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
612 }
613 }
614
615 #ifndef _BYTE_ORDER
616 #error "Don't know native byte order"
617 #endif
618
619 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
620 u16 IV16)
621 {
622 /* Make temporary area overlap WEP seed so that the final copy can be
623 * avoided on little endian hosts. */
624 u16 *PPK = (u16 *) &WEPSeed[4];
625
626 /* Step 1 - make copy of TTAK and bring in TSC */
627 PPK[0] = TTAK[0];
628 PPK[1] = TTAK[1];
629 PPK[2] = TTAK[2];
630 PPK[3] = TTAK[3];
631 PPK[4] = TTAK[4];
632 PPK[5] = TTAK[4] + IV16;
633
634 /* Step 2 - 96-bit bijective mixing using S-box */
635 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
636 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
637 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
638 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
639 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
640 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
641
642 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
643 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
644 PPK[2] += RotR1(PPK[1]);
645 PPK[3] += RotR1(PPK[2]);
646 PPK[4] += RotR1(PPK[3]);
647 PPK[5] += RotR1(PPK[4]);
648
649 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
650 * WEPSeed[0..2] is transmitted as WEP IV */
651 WEPSeed[0] = Hi8(IV16);
652 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
653 WEPSeed[2] = Lo8(IV16);
654 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
655
656 #if _BYTE_ORDER == _BIG_ENDIAN
657 {
658 int i;
659 for (i = 0; i < 6; i++)
660 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
661 }
662 #endif
663 }
664
665 static void
666 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
667 uint8_t icv[IEEE80211_WEP_CRCLEN])
668 {
669 u32 i, j, k, crc;
670 size_t buflen;
671 u8 S[256];
672 u8 *pos;
673 struct mbuf *m;
674 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
675
676 /* Setup RC4 state */
677 for (i = 0; i < 256; i++)
678 S[i] = i;
679 j = 0;
680 for (i = 0; i < 256; i++) {
681 j = (j + S[i] + key[i & 0x0f]) & 0xff;
682 S_SWAP(i, j);
683 }
684
685 /* Compute CRC32 over unencrypted data and apply RC4 to data */
686 crc = ~0;
687 i = j = 0;
688 m = m0;
689 pos = mtod(m, uint8_t *) + off;
690 buflen = m->m_len - off;
691 for (;;) {
692 if (buflen > data_len)
693 buflen = data_len;
694 data_len -= buflen;
695 for (k = 0; k < buflen; k++) {
696 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
697 i = (i + 1) & 0xff;
698 j = (j + S[i]) & 0xff;
699 S_SWAP(i, j);
700 *pos++ ^= S[(S[i] + S[j]) & 0xff];
701 }
702 m = m->m_next;
703 if (m == NULL) {
704 KASSERT(data_len == 0,
705 ("out of buffers with data_len %zu\n", data_len));
706 break;
707 }
708 pos = mtod(m, uint8_t *);
709 buflen = m->m_len;
710 }
711 crc = ~crc;
712
713 /* Append little-endian CRC32 and encrypt it to produce ICV */
714 icv[0] = crc;
715 icv[1] = crc >> 8;
716 icv[2] = crc >> 16;
717 icv[3] = crc >> 24;
718 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
719 i = (i + 1) & 0xff;
720 j = (j + S[i]) & 0xff;
721 S_SWAP(i, j);
722 icv[k] ^= S[(S[i] + S[j]) & 0xff];
723 }
724 }
725
726 static int
727 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
728 {
729 u32 i, j, k, crc;
730 u8 S[256];
731 u8 *pos, icv[4];
732 size_t buflen;
733
734 /* Setup RC4 state */
735 for (i = 0; i < 256; i++)
736 S[i] = i;
737 j = 0;
738 for (i = 0; i < 256; i++) {
739 j = (j + S[i] + key[i & 0x0f]) & 0xff;
740 S_SWAP(i, j);
741 }
742
743 /* Apply RC4 to data and compute CRC32 over decrypted data */
744 crc = ~0;
745 i = j = 0;
746 pos = mtod(m, uint8_t *) + off;
747 buflen = m->m_len - off;
748 for (;;) {
749 if (buflen > data_len)
750 buflen = data_len;
751 data_len -= buflen;
752 for (k = 0; k < buflen; k++) {
753 i = (i + 1) & 0xff;
754 j = (j + S[i]) & 0xff;
755 S_SWAP(i, j);
756 *pos ^= S[(S[i] + S[j]) & 0xff];
757 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
758 pos++;
759 }
760 m = m->m_next;
761 if (m == NULL) {
762 KASSERT(data_len == 0,
763 ("out of buffers with data_len %zu\n", data_len));
764 break;
765 }
766 pos = mtod(m, uint8_t *);
767 buflen = m->m_len;
768 }
769 crc = ~crc;
770
771 /* Encrypt little-endian CRC32 and verify that it matches with the
772 * received ICV */
773 icv[0] = crc;
774 icv[1] = crc >> 8;
775 icv[2] = crc >> 16;
776 icv[3] = crc >> 24;
777 for (k = 0; k < 4; k++) {
778 i = (i + 1) & 0xff;
779 j = (j + S[i]) & 0xff;
780 S_SWAP(i, j);
781 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
782 /* ICV mismatch - drop frame */
783 return -1;
784 }
785 }
786
787 return 0;
788 }
789
790 static __inline u32 rotl(u32 val, int bits)
791 {
792 return (val << bits) | (val >> (32 - bits));
793 }
794
795 static __inline u32 rotr(u32 val, int bits)
796 {
797 return (val >> bits) | (val << (32 - bits));
798 }
799
800 static __inline u32 xswap(u32 val)
801 {
802 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
803 }
804
805 #define michael_block(l, r) \
806 do { \
807 r ^= rotl(l, 17); \
808 l += r; \
809 r ^= xswap(l); \
810 l += r; \
811 r ^= rotl(l, 3); \
812 l += r; \
813 r ^= rotr(l, 2); \
814 l += r; \
815 } while (0)
816
817 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
818 {
819 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
820 }
821
822 static __inline u32 get_le32(const u8 *p)
823 {
824 return get_le32_split(p[0], p[1], p[2], p[3]);
825 }
826
827 static __inline void put_le32(u8 *p, u32 v)
828 {
829 p[0] = v;
830 p[1] = v >> 8;
831 p[2] = v >> 16;
832 p[3] = v >> 24;
833 }
834
835 /*
836 * Craft pseudo header used to calculate the MIC.
837 */
838 static void
839 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
840 {
841 const struct ieee80211_frame_addr4 *wh =
842 (const struct ieee80211_frame_addr4 *) wh0;
843
844 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
845 case IEEE80211_FC1_DIR_NODS:
846 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
847 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
848 break;
849 case IEEE80211_FC1_DIR_TODS:
850 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
851 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
852 break;
853 case IEEE80211_FC1_DIR_FROMDS:
854 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
855 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
856 break;
857 case IEEE80211_FC1_DIR_DSTODS:
858 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
859 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
860 break;
861 }
862
863 /* Match on any QOS frame, not just data */
864 if (IEEE80211_IS_QOS_ANY(wh)) {
865 const struct ieee80211_qosframe *qwh =
866 (const struct ieee80211_qosframe *) wh;
867 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
868 } else
869 hdr[12] = 0;
870 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
871 }
872
873 static void
874 michael_mic(struct tkip_ctx *ctx, const u8 *key,
875 struct mbuf *m, u_int off, size_t data_len,
876 u8 mic[IEEE80211_WEP_MICLEN])
877 {
878 uint8_t hdr[16];
879 u32 l, r;
880 const uint8_t *data;
881 u_int space;
882
883 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
884
885 l = get_le32(key);
886 r = get_le32(key + 4);
887
888 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
889 l ^= get_le32(hdr);
890 michael_block(l, r);
891 l ^= get_le32(&hdr[4]);
892 michael_block(l, r);
893 l ^= get_le32(&hdr[8]);
894 michael_block(l, r);
895 l ^= get_le32(&hdr[12]);
896 michael_block(l, r);
897
898 /* first buffer has special handling */
899 data = mtod(m, const uint8_t *) + off;
900 space = m->m_len - off;
901 for (;;) {
902 if (space > data_len)
903 space = data_len;
904 /* collect 32-bit blocks from current buffer */
905 while (space >= sizeof(uint32_t)) {
906 l ^= get_le32(data);
907 michael_block(l, r);
908 data += sizeof(uint32_t), space -= sizeof(uint32_t);
909 data_len -= sizeof(uint32_t);
910 }
911 /*
912 * NB: when space is zero we make one more trip around
913 * the loop to advance to the next mbuf where there is
914 * data. This handles the case where there are 4*n
915 * bytes in an mbuf followed by <4 bytes in a later mbuf.
916 * By making an extra trip we'll drop out of the loop
917 * with m pointing at the mbuf with 3 bytes and space
918 * set as required by the remainder handling below.
919 */
920 if (data_len == 0 ||
921 (data_len < sizeof(uint32_t) && space != 0))
922 break;
923 m = m->m_next;
924 if (m == NULL) {
925 KASSERT(0, ("out of data, data_len %zu\n", data_len));
926 break;
927 }
928 if (space != 0) {
929 const uint8_t *data_next;
930 /*
931 * Block straddles buffers, split references.
932 */
933 data_next = mtod(m, const uint8_t *);
934 KASSERT(m->m_len >= sizeof(uint32_t) - space,
935 ("not enough data in following buffer, "
936 "m_len %u need %zu\n", m->m_len,
937 sizeof(uint32_t) - space));
938 switch (space) {
939 case 1:
940 l ^= get_le32_split(data[0], data_next[0],
941 data_next[1], data_next[2]);
942 data = data_next + 3;
943 space = m->m_len - 3;
944 break;
945 case 2:
946 l ^= get_le32_split(data[0], data[1],
947 data_next[0], data_next[1]);
948 data = data_next + 2;
949 space = m->m_len - 2;
950 break;
951 case 3:
952 l ^= get_le32_split(data[0], data[1],
953 data[2], data_next[0]);
954 data = data_next + 1;
955 space = m->m_len - 1;
956 break;
957 }
958 michael_block(l, r);
959 data_len -= sizeof(uint32_t);
960 } else {
961 /*
962 * Setup for next buffer.
963 */
964 data = mtod(m, const uint8_t *);
965 space = m->m_len;
966 }
967 }
968 /*
969 * Catch degenerate cases like mbuf[4*n+1 bytes] followed by
970 * mbuf[2 bytes]. I don't believe these should happen; if they
971 * do then we'll need more involved logic.
972 */
973 KASSERT(data_len <= space,
974 ("not enough data, data_len %zu space %u\n", data_len, space));
975
976 /* Last block and padding (0x5a, 4..7 x 0) */
977 switch (data_len) {
978 case 0:
979 l ^= get_le32_split(0x5a, 0, 0, 0);
980 break;
981 case 1:
982 l ^= get_le32_split(data[0], 0x5a, 0, 0);
983 break;
984 case 2:
985 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
986 break;
987 case 3:
988 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
989 break;
990 }
991 michael_block(l, r);
992 /* l ^= 0; */
993 michael_block(l, r);
994
995 put_le32(mic, l);
996 put_le32(mic + 4, r);
997 }
998
999 static int
1000 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1001 struct mbuf *m, int hdrlen)
1002 {
1003 struct ieee80211_frame *wh;
1004 uint8_t icv[IEEE80211_WEP_CRCLEN];
1005
1006 ctx->tc_vap->iv_stats.is_crypto_tkip++;
1007
1008 wh = mtod(m, struct ieee80211_frame *);
1009 if ((u16)(key->wk_keytsc) == 0 || key->wk_keytsc == 1) {
1010 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
1011 (u32)(key->wk_keytsc >> 16));
1012 }
1013 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
1014 (u16) key->wk_keytsc);
1015
1016 wep_encrypt(ctx->tx_rc4key,
1017 m, hdrlen + tkip.ic_header,
1018 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
1019 icv);
1020 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */
1021
1022 return 1;
1023 }
1024
1025 static int
1026 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1027 struct mbuf *m, int hdrlen)
1028 {
1029 struct ieee80211_frame *wh;
1030 struct ieee80211vap *vap = ctx->tc_vap;
1031 u32 iv32;
1032 u16 iv16;
1033 u8 tid;
1034
1035 vap->iv_stats.is_crypto_tkip++;
1036
1037 wh = mtod(m, struct ieee80211_frame *);
1038 /* NB: tkip_decap already verified header and left seq in rx_rsc */
1039 iv16 = (u16) ctx->rx_rsc;
1040 iv32 = (u32) (ctx->rx_rsc >> 16);
1041
1042 tid = ieee80211_gettid(wh);
1043 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) {
1044 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
1045 wh->i_addr2, iv32);
1046 ctx->rx_phase1_done = 1;
1047 }
1048 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
1049
1050 /* NB: m is unstripped; deduct headers + ICV to get payload */
1051 if (wep_decrypt(ctx->rx_rc4key,
1052 m, hdrlen + tkip.ic_header,
1053 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
1054 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) {
1055 /* Previously cached Phase1 result was already lost, so
1056 * it needs to be recalculated for the next packet. */
1057 ctx->rx_phase1_done = 0;
1058 }
1059 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
1060 "%s", "TKIP ICV mismatch on decrypt");
1061 vap->iv_stats.is_rx_tkipicv++;
1062 return 0;
1063 }
1064 return 1;
1065 }
1066
1067 /*
1068 * Module glue.
1069 */
1070 IEEE80211_CRYPTO_MODULE(tkip, 1);
The FreeBSD Project