2 * Copyright 2002-2004, Instant802 Networks, Inc.
3 * Copyright 2008, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/netdevice.h>
11 #include <linux/types.h>
12 #include <linux/skbuff.h>
13 #include <linux/compiler.h>
14 #include <linux/ieee80211.h>
15 #include <linux/gfp.h>
16 #include <asm/unaligned.h>
17 #include <net/mac80211.h>
19 #include "ieee80211_i.h"
27 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data
*tx
)
32 struct ieee80211_hdr
*hdr
;
33 struct sk_buff
*skb
= tx
->skb
;
34 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
37 hdr
= (struct ieee80211_hdr
*)skb
->data
;
38 if (!tx
->key
|| tx
->key
->conf
.cipher
!= WLAN_CIPHER_SUITE_TKIP
||
39 skb
->len
< 24 || !ieee80211_is_data_present(hdr
->frame_control
))
42 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
43 if (skb
->len
< hdrlen
)
46 data
= skb
->data
+ hdrlen
;
47 data_len
= skb
->len
- hdrlen
;
49 if (unlikely(info
->flags
& IEEE80211_TX_INTFL_TKIP_MIC_FAILURE
)) {
50 /* Need to use software crypto for the test */
51 info
->control
.hw_key
= NULL
;
54 if (info
->control
.hw_key
&&
55 !(tx
->flags
& IEEE80211_TX_FRAGMENTED
) &&
56 !(tx
->key
->conf
.flags
& IEEE80211_KEY_FLAG_GENERATE_MMIC
)) {
57 /* hwaccel - with no need for SW-generated MMIC */
61 tail
= MICHAEL_MIC_LEN
;
62 if (!info
->control
.hw_key
)
65 if (WARN_ON(skb_tailroom(skb
) < tail
||
66 skb_headroom(skb
) < TKIP_IV_LEN
))
69 key
= &tx
->key
->conf
.key
[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY
];
70 mic
= skb_put(skb
, MICHAEL_MIC_LEN
);
71 michael_mic(key
, hdr
, data
, data_len
, mic
);
72 if (unlikely(info
->flags
& IEEE80211_TX_INTFL_TKIP_MIC_FAILURE
))
80 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data
*rx
)
82 u8
*data
, *key
= NULL
;
85 u8 mic
[MICHAEL_MIC_LEN
];
86 struct sk_buff
*skb
= rx
->skb
;
87 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
88 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
91 * it makes no sense to check for MIC errors on anything other
94 if (!ieee80211_is_data_present(hdr
->frame_control
))
98 * No way to verify the MIC if the hardware stripped it or
99 * the IV with the key index. In this case we have solely rely
100 * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
101 * MIC failure report.
103 if (status
->flag
& (RX_FLAG_MMIC_STRIPPED
| RX_FLAG_IV_STRIPPED
)) {
104 if (status
->flag
& RX_FLAG_MMIC_ERROR
)
107 if (!(status
->flag
& RX_FLAG_IV_STRIPPED
))
114 * Some hardware seems to generate Michael MIC failure reports; even
115 * though, the frame was not encrypted with TKIP and therefore has no
116 * MIC. Ignore the flag them to avoid triggering countermeasures.
118 if (!rx
->key
|| rx
->key
->conf
.cipher
!= WLAN_CIPHER_SUITE_TKIP
||
119 !(status
->flag
& RX_FLAG_DECRYPTED
))
122 if (rx
->sdata
->vif
.type
== NL80211_IFTYPE_AP
&& rx
->key
->conf
.keyidx
) {
124 * APs with pairwise keys should never receive Michael MIC
125 * errors for non-zero keyidx because these are reserved for
126 * group keys and only the AP is sending real multicast
127 * frames in the BSS. (
129 return RX_DROP_UNUSABLE
;
132 if (status
->flag
& RX_FLAG_MMIC_ERROR
)
135 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
136 if (skb
->len
< hdrlen
+ MICHAEL_MIC_LEN
)
137 return RX_DROP_UNUSABLE
;
139 data
= skb
->data
+ hdrlen
;
140 data_len
= skb
->len
- hdrlen
- MICHAEL_MIC_LEN
;
141 key
= &rx
->key
->conf
.key
[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY
];
142 michael_mic(key
, hdr
, data
, data_len
, mic
);
143 if (memcmp(mic
, data
+ data_len
, MICHAEL_MIC_LEN
) != 0)
146 /* remove Michael MIC from payload */
147 skb_trim(skb
, skb
->len
- MICHAEL_MIC_LEN
);
150 /* update IV in key information to be able to detect replays */
151 rx
->key
->u
.tkip
.rx
[rx
->queue
].iv32
= rx
->tkip_iv32
;
152 rx
->key
->u
.tkip
.rx
[rx
->queue
].iv16
= rx
->tkip_iv16
;
157 mac80211_ev_michael_mic_failure(rx
->sdata
, rx
->key
->conf
.keyidx
,
158 (void *) skb
->data
, NULL
, GFP_ATOMIC
);
159 return RX_DROP_UNUSABLE
;
163 static int tkip_encrypt_skb(struct ieee80211_tx_data
*tx
, struct sk_buff
*skb
)
165 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
166 struct ieee80211_key
*key
= tx
->key
;
167 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
172 if (info
->control
.hw_key
&&
173 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_GENERATE_IV
)) {
174 /* hwaccel - with no need for software-generated IV */
178 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
179 len
= skb
->len
- hdrlen
;
181 if (info
->control
.hw_key
)
186 if (WARN_ON(skb_tailroom(skb
) < tail
||
187 skb_headroom(skb
) < TKIP_IV_LEN
))
190 pos
= skb_push(skb
, TKIP_IV_LEN
);
191 memmove(pos
, pos
+ TKIP_IV_LEN
, hdrlen
);
194 /* Increase IV for the frame */
195 key
->u
.tkip
.tx
.iv16
++;
196 if (key
->u
.tkip
.tx
.iv16
== 0)
197 key
->u
.tkip
.tx
.iv32
++;
199 pos
= ieee80211_tkip_add_iv(pos
, key
, key
->u
.tkip
.tx
.iv16
);
201 /* hwaccel - with software IV */
202 if (info
->control
.hw_key
)
205 /* Add room for ICV */
206 skb_put(skb
, TKIP_ICV_LEN
);
208 hdr
= (struct ieee80211_hdr
*) skb
->data
;
209 return ieee80211_tkip_encrypt_data(tx
->local
->wep_tx_tfm
,
210 key
, pos
, len
, hdr
->addr2
);
215 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data
*tx
)
217 struct sk_buff
*skb
= tx
->skb
;
219 ieee80211_tx_set_protected(tx
);
222 if (tkip_encrypt_skb(tx
, skb
) < 0)
224 } while ((skb
= skb
->next
));
231 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data
*rx
)
233 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
234 int hdrlen
, res
, hwaccel
= 0;
235 struct ieee80211_key
*key
= rx
->key
;
236 struct sk_buff
*skb
= rx
->skb
;
237 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
239 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
241 if (!ieee80211_is_data(hdr
->frame_control
))
244 if (!rx
->sta
|| skb
->len
- hdrlen
< 12)
245 return RX_DROP_UNUSABLE
;
248 * Let TKIP code verify IV, but skip decryption.
249 * In the case where hardware checks the IV as well,
250 * we don't even get here, see ieee80211_rx_h_decrypt()
252 if (status
->flag
& RX_FLAG_DECRYPTED
)
255 res
= ieee80211_tkip_decrypt_data(rx
->local
->wep_rx_tfm
,
256 key
, skb
->data
+ hdrlen
,
257 skb
->len
- hdrlen
, rx
->sta
->sta
.addr
,
258 hdr
->addr1
, hwaccel
, rx
->queue
,
261 if (res
!= TKIP_DECRYPT_OK
)
262 return RX_DROP_UNUSABLE
;
265 skb_trim(skb
, skb
->len
- TKIP_ICV_LEN
);
268 memmove(skb
->data
+ TKIP_IV_LEN
, skb
->data
, hdrlen
);
269 skb_pull(skb
, TKIP_IV_LEN
);
275 static void ccmp_special_blocks(struct sk_buff
*skb
, u8
*pn
, u8
*scratch
,
279 int a4_included
, mgmt
;
284 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
286 b_0
= scratch
+ 3 * AES_BLOCK_LEN
;
287 aad
= scratch
+ 4 * AES_BLOCK_LEN
;
290 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
291 * Retry, PwrMgt, MoreData; set Protected
293 mgmt
= ieee80211_is_mgmt(hdr
->frame_control
);
294 mask_fc
= hdr
->frame_control
;
295 mask_fc
&= ~cpu_to_le16(IEEE80211_FCTL_RETRY
|
296 IEEE80211_FCTL_PM
| IEEE80211_FCTL_MOREDATA
);
298 mask_fc
&= ~cpu_to_le16(0x0070);
299 mask_fc
|= cpu_to_le16(IEEE80211_FCTL_PROTECTED
);
301 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
303 a4_included
= ieee80211_has_a4(hdr
->frame_control
);
305 if (ieee80211_is_data_qos(hdr
->frame_control
))
306 qos_tid
= *ieee80211_get_qos_ctl(hdr
) & IEEE80211_QOS_CTL_TID_MASK
;
310 data_len
= skb
->len
- hdrlen
- CCMP_HDR_LEN
;
312 data_len
-= CCMP_MIC_LEN
;
314 /* First block, b_0 */
315 b_0
[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
316 /* Nonce: Nonce Flags | A2 | PN
317 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
319 b_0
[1] = qos_tid
| (mgmt
<< 4);
320 memcpy(&b_0
[2], hdr
->addr2
, ETH_ALEN
);
321 memcpy(&b_0
[8], pn
, CCMP_PN_LEN
);
323 put_unaligned_be16(data_len
, &b_0
[14]);
325 /* AAD (extra authenticate-only data) / masked 802.11 header
326 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
327 put_unaligned_be16(len_a
, &aad
[0]);
328 put_unaligned(mask_fc
, (__le16
*)&aad
[2]);
329 memcpy(&aad
[4], &hdr
->addr1
, 3 * ETH_ALEN
);
331 /* Mask Seq#, leave Frag# */
332 aad
[22] = *((u8
*) &hdr
->seq_ctrl
) & 0x0f;
336 memcpy(&aad
[24], hdr
->addr4
, ETH_ALEN
);
340 memset(&aad
[24], 0, ETH_ALEN
+ IEEE80211_QOS_CTL_LEN
);
346 static inline void ccmp_pn2hdr(u8
*hdr
, u8
*pn
, int key_id
)
351 hdr
[3] = 0x20 | (key_id
<< 6);
359 static inline void ccmp_hdr2pn(u8
*pn
, u8
*hdr
)
370 static int ccmp_encrypt_skb(struct ieee80211_tx_data
*tx
, struct sk_buff
*skb
)
372 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
373 struct ieee80211_key
*key
= tx
->key
;
374 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
375 int hdrlen
, len
, tail
;
379 if (info
->control
.hw_key
&&
380 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_GENERATE_IV
)) {
382 * hwaccel has no need for preallocated room for CCMP
383 * header or MIC fields
388 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
389 len
= skb
->len
- hdrlen
;
391 if (info
->control
.hw_key
)
396 if (WARN_ON(skb_tailroom(skb
) < tail
||
397 skb_headroom(skb
) < CCMP_HDR_LEN
))
400 pos
= skb_push(skb
, CCMP_HDR_LEN
);
401 memmove(pos
, pos
+ CCMP_HDR_LEN
, hdrlen
);
402 hdr
= (struct ieee80211_hdr
*) pos
;
406 pn
= key
->u
.ccmp
.tx_pn
;
408 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
414 ccmp_pn2hdr(pos
, pn
, key
->conf
.keyidx
);
416 /* hwaccel - with software CCMP header */
417 if (info
->control
.hw_key
)
421 ccmp_special_blocks(skb
, pn
, key
->u
.ccmp
.tx_crypto_buf
, 0);
422 ieee80211_aes_ccm_encrypt(key
->u
.ccmp
.tfm
, key
->u
.ccmp
.tx_crypto_buf
, pos
, len
,
423 pos
, skb_put(skb
, CCMP_MIC_LEN
));
430 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data
*tx
)
432 struct sk_buff
*skb
= tx
->skb
;
434 ieee80211_tx_set_protected(tx
);
437 if (ccmp_encrypt_skb(tx
, skb
) < 0)
439 } while ((skb
= skb
->next
));
446 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data
*rx
)
448 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)rx
->skb
->data
;
450 struct ieee80211_key
*key
= rx
->key
;
451 struct sk_buff
*skb
= rx
->skb
;
452 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
457 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
459 if (!ieee80211_is_data(hdr
->frame_control
) &&
460 !ieee80211_is_robust_mgmt_frame(hdr
))
463 data_len
= skb
->len
- hdrlen
- CCMP_HDR_LEN
- CCMP_MIC_LEN
;
464 if (!rx
->sta
|| data_len
< 0)
465 return RX_DROP_UNUSABLE
;
467 ccmp_hdr2pn(pn
, skb
->data
+ hdrlen
);
469 queue
= ieee80211_is_mgmt(hdr
->frame_control
) ?
470 NUM_RX_DATA_QUEUES
: rx
->queue
;
472 if (memcmp(pn
, key
->u
.ccmp
.rx_pn
[queue
], CCMP_PN_LEN
) <= 0) {
473 key
->u
.ccmp
.replays
++;
474 return RX_DROP_UNUSABLE
;
477 if (!(status
->flag
& RX_FLAG_DECRYPTED
)) {
478 /* hardware didn't decrypt/verify MIC */
479 ccmp_special_blocks(skb
, pn
, key
->u
.ccmp
.rx_crypto_buf
, 1);
481 if (ieee80211_aes_ccm_decrypt(
482 key
->u
.ccmp
.tfm
, key
->u
.ccmp
.rx_crypto_buf
,
483 skb
->data
+ hdrlen
+ CCMP_HDR_LEN
, data_len
,
484 skb
->data
+ skb
->len
- CCMP_MIC_LEN
,
485 skb
->data
+ hdrlen
+ CCMP_HDR_LEN
))
486 return RX_DROP_UNUSABLE
;
489 memcpy(key
->u
.ccmp
.rx_pn
[queue
], pn
, CCMP_PN_LEN
);
491 /* Remove CCMP header and MIC */
492 skb_trim(skb
, skb
->len
- CCMP_MIC_LEN
);
493 memmove(skb
->data
+ CCMP_HDR_LEN
, skb
->data
, hdrlen
);
494 skb_pull(skb
, CCMP_HDR_LEN
);
500 static void bip_aad(struct sk_buff
*skb
, u8
*aad
)
502 /* BIP AAD: FC(masked) || A1 || A2 || A3 */
504 /* FC type/subtype */
505 aad
[0] = skb
->data
[0];
506 /* Mask FC Retry, PwrMgt, MoreData flags to zero */
507 aad
[1] = skb
->data
[1] & ~(BIT(4) | BIT(5) | BIT(6));
509 memcpy(aad
+ 2, skb
->data
+ 4, 3 * ETH_ALEN
);
513 static inline void bip_ipn_swap(u8
*d
, const u8
*s
)
525 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data
*tx
)
527 struct sk_buff
*skb
= tx
->skb
;
528 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
529 struct ieee80211_key
*key
= tx
->key
;
530 struct ieee80211_mmie
*mmie
;
534 if (info
->control
.hw_key
)
537 if (WARN_ON(skb_tailroom(skb
) < sizeof(*mmie
)))
540 mmie
= (struct ieee80211_mmie
*) skb_put(skb
, sizeof(*mmie
));
541 mmie
->element_id
= WLAN_EID_MMIE
;
542 mmie
->length
= sizeof(*mmie
) - 2;
543 mmie
->key_id
= cpu_to_le16(key
->conf
.keyidx
);
546 pn
= key
->u
.aes_cmac
.tx_pn
;
548 for (i
= sizeof(key
->u
.aes_cmac
.tx_pn
) - 1; i
>= 0; i
--) {
553 bip_ipn_swap(mmie
->sequence_number
, pn
);
558 * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
560 ieee80211_aes_cmac(key
->u
.aes_cmac
.tfm
, key
->u
.aes_cmac
.tx_crypto_buf
,
561 aad
, skb
->data
+ 24, skb
->len
- 24, mmie
->mic
);
568 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data
*rx
)
570 struct sk_buff
*skb
= rx
->skb
;
571 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
572 struct ieee80211_key
*key
= rx
->key
;
573 struct ieee80211_mmie
*mmie
;
574 u8 aad
[20], mic
[8], ipn
[6];
575 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
577 if (!ieee80211_is_mgmt(hdr
->frame_control
))
580 if (skb
->len
< 24 + sizeof(*mmie
))
581 return RX_DROP_UNUSABLE
;
583 mmie
= (struct ieee80211_mmie
*)
584 (skb
->data
+ skb
->len
- sizeof(*mmie
));
585 if (mmie
->element_id
!= WLAN_EID_MMIE
||
586 mmie
->length
!= sizeof(*mmie
) - 2)
587 return RX_DROP_UNUSABLE
; /* Invalid MMIE */
589 bip_ipn_swap(ipn
, mmie
->sequence_number
);
591 if (memcmp(ipn
, key
->u
.aes_cmac
.rx_pn
, 6) <= 0) {
592 key
->u
.aes_cmac
.replays
++;
593 return RX_DROP_UNUSABLE
;
596 if (!(status
->flag
& RX_FLAG_DECRYPTED
)) {
597 /* hardware didn't decrypt/verify MIC */
599 ieee80211_aes_cmac(key
->u
.aes_cmac
.tfm
,
600 key
->u
.aes_cmac
.rx_crypto_buf
, aad
,
601 skb
->data
+ 24, skb
->len
- 24, mic
);
602 if (memcmp(mic
, mmie
->mic
, sizeof(mmie
->mic
)) != 0) {
603 key
->u
.aes_cmac
.icverrors
++;
604 return RX_DROP_UNUSABLE
;
608 memcpy(key
->u
.aes_cmac
.rx_pn
, ipn
, 6);
611 skb_trim(skb
, skb
->len
- sizeof(*mmie
));