net/wireless/lib80211_crypt_tkip.c

   1 /*
   2  * lib80211 crypt: host-based TKIP encryption implementation for lib80211
   3  *
   4  * Copyright (c) 2003-2004, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2008, John W. Linville <linville@tuxdriver.com>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation. See README and COPYING for
  10  * more details.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/err.h>
  16 #include <linux/module.h>
  17 #include <linux/init.h>
  18 #include <linux/slab.h>
  19 #include <linux/random.h>
  20 #include <linux/scatterlist.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/mm.h>
  24 #include <linux/if_ether.h>
  25 #include <linux/if_arp.h>
  26 #include <asm/string.h>
  27
  28 #include <linux/wireless.h>
  29 #include <linux/ieee80211.h>
  30 #include <net/iw_handler.h>
  31
  32 #include <crypto/hash.h>
  33 #include <linux/crypto.h>
  34 #include <linux/crc32.h>
  35
  36 #include <net/lib80211.h>
  37
  38 MODULE_AUTHOR("Jouni Malinen");
  39 MODULE_DESCRIPTION("lib80211 crypt: TKIP");
  40 MODULE_LICENSE("GPL");
  41
  42 #define TKIP_HDR_LEN 8
  43
  44 struct lib80211_tkip_data {
  45 #define TKIP_KEY_LEN 32
  46         u8 key[TKIP_KEY_LEN];
  47         int key_set;
  48
  49         u32 tx_iv32;
  50         u16 tx_iv16;
  51         u16 tx_ttak[5];
  52         int tx_phase1_done;
  53
  54         u32 rx_iv32;
  55         u16 rx_iv16;
  56         u16 rx_ttak[5];
  57         int rx_phase1_done;
  58         u32 rx_iv32_new;
  59         u16 rx_iv16_new;
  60
  61         u32 dot11RSNAStatsTKIPReplays;
  62         u32 dot11RSNAStatsTKIPICVErrors;
  63         u32 dot11RSNAStatsTKIPLocalMICFailures;
  64
  65         int key_idx;
  66
  67         struct crypto_cipher *rx_tfm_arc4;
  68         struct crypto_shash *rx_tfm_michael;
  69         struct crypto_cipher *tx_tfm_arc4;
  70         struct crypto_shash *tx_tfm_michael;
  71
  72         /* scratch buffers for virt_to_page() (crypto API) */
  73         u8 rx_hdr[16], tx_hdr[16];
  74
  75         unsigned long flags;
  76 };
  77
  78 static unsigned long lib80211_tkip_set_flags(unsigned long flags, void *priv)
  79 {
  80         struct lib80211_tkip_data *_priv = priv;
  81         unsigned long old_flags = _priv->flags;
  82         _priv->flags = flags;
  83         return old_flags;
  84 }
  85
  86 static unsigned long lib80211_tkip_get_flags(void *priv)
  87 {
  88         struct lib80211_tkip_data *_priv = priv;
  89         return _priv->flags;
  90 }
  91
  92 static void *lib80211_tkip_init(int key_idx)
  93 {
  94         struct lib80211_tkip_data *priv;
  95
  96         priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
  97         if (priv == NULL)
  98                 goto fail;
  99
 100         priv->key_idx = key_idx;
 101
 102         priv->tx_tfm_arc4 = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
 103         if (IS_ERR(priv->tx_tfm_arc4)) {
 104                 priv->tx_tfm_arc4 = NULL;
 105                 goto fail;
 106         }
 107
 108         priv->tx_tfm_michael = crypto_alloc_shash("michael_mic", 0, 0);
 109         if (IS_ERR(priv->tx_tfm_michael)) {
 110                 priv->tx_tfm_michael = NULL;
 111                 goto fail;
 112         }
 113
 114         priv->rx_tfm_arc4 = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
 115         if (IS_ERR(priv->rx_tfm_arc4)) {
 116                 priv->rx_tfm_arc4 = NULL;
 117                 goto fail;
 118         }
 119
 120         priv->rx_tfm_michael = crypto_alloc_shash("michael_mic", 0, 0);
 121         if (IS_ERR(priv->rx_tfm_michael)) {
 122                 priv->rx_tfm_michael = NULL;
 123                 goto fail;
 124         }
 125
 126         return priv;
 127
 128       fail:
 129         if (priv) {
 130                 crypto_free_shash(priv->tx_tfm_michael);
 131                 crypto_free_cipher(priv->tx_tfm_arc4);
 132                 crypto_free_shash(priv->rx_tfm_michael);
 133                 crypto_free_cipher(priv->rx_tfm_arc4);
 134                 kfree(priv);
 135         }
 136
 137         return NULL;
 138 }
 139
 140 static void lib80211_tkip_deinit(void *priv)
 141 {
 142         struct lib80211_tkip_data *_priv = priv;
 143         if (_priv) {
 144                 crypto_free_shash(_priv->tx_tfm_michael);
 145                 crypto_free_cipher(_priv->tx_tfm_arc4);
 146                 crypto_free_shash(_priv->rx_tfm_michael);
 147                 crypto_free_cipher(_priv->rx_tfm_arc4);
 148         }
 149         kfree(priv);
 150 }
 151
 152 static inline u16 RotR1(u16 val)
 153 {
 154         return (val >> 1) | (val << 15);
 155 }
 156
 157 static inline u8 Lo8(u16 val)
 158 {
 159         return val & 0xff;
 160 }
 161
 162 static inline u8 Hi8(u16 val)
 163 {
 164         return val >> 8;
 165 }
 166
 167 static inline u16 Lo16(u32 val)
 168 {
 169         return val & 0xffff;
 170 }
 171
 172 static inline u16 Hi16(u32 val)
 173 {
 174         return val >> 16;
 175 }
 176
 177 static inline u16 Mk16(u8 hi, u8 lo)
 178 {
 179         return lo | (((u16) hi) << 8);
 180 }
 181
 182 static inline u16 Mk16_le(__le16 * v)
 183 {
 184         return le16_to_cpu(*v);
 185 }
 186
 187 static const u16 Sbox[256] = {
 188         0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
 189         0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
 190         0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
 191         0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
 192         0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
 193         0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
 194         0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
 195         0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
 196         0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
 197         0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
 198         0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
 199         0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
 200         0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
 201         0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
 202         0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
 203         0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
 204         0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
 205         0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
 206         0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
 207         0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
 208         0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
 209         0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
 210         0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
 211         0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
 212         0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
 213         0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
 214         0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
 215         0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
 216         0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
 217         0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
 218         0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
 219         0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
 220 };
 221
 222 static inline u16 _S_(u16 v)
 223 {
 224         u16 t = Sbox[Hi8(v)];
 225         return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
 226 }
 227
 228 #define PHASE1_LOOP_COUNT 8
 229
 230 static void tkip_mixing_phase1(u16 * TTAK, const u8 * TK, const u8 * TA,
 231                                u32 IV32)
 232 {
 233         int i, j;
 234
 235         /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
 236         TTAK[0] = Lo16(IV32);
 237         TTAK[1] = Hi16(IV32);
 238         TTAK[2] = Mk16(TA[1], TA[0]);
 239         TTAK[3] = Mk16(TA[3], TA[2]);
 240         TTAK[4] = Mk16(TA[5], TA[4]);
 241
 242         for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
 243                 j = 2 * (i & 1);
 244                 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
 245                 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
 246                 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
 247                 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
 248                 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
 249         }
 250 }
 251
 252 static void tkip_mixing_phase2(u8 * WEPSeed, const u8 * TK, const u16 * TTAK,
 253                                u16 IV16)
 254 {
 255         /* Make temporary area overlap WEP seed so that the final copy can be
 256          * avoided on little endian hosts. */
 257         u16 *PPK = (u16 *) & WEPSeed[4];
 258
 259         /* Step 1 - make copy of TTAK and bring in TSC */
 260         PPK[0] = TTAK[0];
 261         PPK[1] = TTAK[1];
 262         PPK[2] = TTAK[2];
 263         PPK[3] = TTAK[3];
 264         PPK[4] = TTAK[4];
 265         PPK[5] = TTAK[4] + IV16;
 266
 267         /* Step 2 - 96-bit bijective mixing using S-box */
 268         PPK[0] += _S_(PPK[5] ^ Mk16_le((__le16 *) & TK[0]));
 269         PPK[1] += _S_(PPK[0] ^ Mk16_le((__le16 *) & TK[2]));
 270         PPK[2] += _S_(PPK[1] ^ Mk16_le((__le16 *) & TK[4]));
 271         PPK[3] += _S_(PPK[2] ^ Mk16_le((__le16 *) & TK[6]));
 272         PPK[4] += _S_(PPK[3] ^ Mk16_le((__le16 *) & TK[8]));
 273         PPK[5] += _S_(PPK[4] ^ Mk16_le((__le16 *) & TK[10]));
 274
 275         PPK[0] += RotR1(PPK[5] ^ Mk16_le((__le16 *) & TK[12]));
 276         PPK[1] += RotR1(PPK[0] ^ Mk16_le((__le16 *) & TK[14]));
 277         PPK[2] += RotR1(PPK[1]);
 278         PPK[3] += RotR1(PPK[2]);
 279         PPK[4] += RotR1(PPK[3]);
 280         PPK[5] += RotR1(PPK[4]);
 281
 282         /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
 283          * WEPSeed[0..2] is transmitted as WEP IV */
 284         WEPSeed[0] = Hi8(IV16);
 285         WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
 286         WEPSeed[2] = Lo8(IV16);
 287         WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((__le16 *) & TK[0])) >> 1);
 288
 289 #ifdef __BIG_ENDIAN
 290         {
 291                 int i;
 292                 for (i = 0; i < 6; i++)
 293                         PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
 294         }
 295 #endif
 296 }
 297
 298 static int lib80211_tkip_hdr(struct sk_buff *skb, int hdr_len,
 299                               u8 * rc4key, int keylen, void *priv)
 300 {
 301         struct lib80211_tkip_data *tkey = priv;
 302         u8 *pos;
 303         struct ieee80211_hdr *hdr;
 304
 305         hdr = (struct ieee80211_hdr *)skb->data;
 306
 307         if (skb_headroom(skb) < TKIP_HDR_LEN || skb->len < hdr_len)
 308                 return -1;
 309
 310         if (rc4key == NULL || keylen < 16)
 311                 return -1;
 312
 313         if (!tkey->tx_phase1_done) {
 314                 tkip_mixing_phase1(tkey->tx_ttak, tkey->key, hdr->addr2,
 315                                    tkey->tx_iv32);
 316                 tkey->tx_phase1_done = 1;
 317         }
 318         tkip_mixing_phase2(rc4key, tkey->key, tkey->tx_ttak, tkey->tx_iv16);
 319
 320         pos = skb_push(skb, TKIP_HDR_LEN);
 321         memmove(pos, pos + TKIP_HDR_LEN, hdr_len);
 322         pos += hdr_len;
 323
 324         *pos++ = *rc4key;
 325         *pos++ = *(rc4key + 1);
 326         *pos++ = *(rc4key + 2);
 327         *pos++ = (tkey->key_idx << 6) | (1 << 5) /* Ext IV included */ ;
 328         *pos++ = tkey->tx_iv32 & 0xff;
 329         *pos++ = (tkey->tx_iv32 >> 8) & 0xff;
 330         *pos++ = (tkey->tx_iv32 >> 16) & 0xff;
 331         *pos++ = (tkey->tx_iv32 >> 24) & 0xff;
 332
 333         tkey->tx_iv16++;
 334         if (tkey->tx_iv16 == 0) {
 335                 tkey->tx_phase1_done = 0;
 336                 tkey->tx_iv32++;
 337         }
 338
 339         return TKIP_HDR_LEN;
 340 }
 341
 342 static int lib80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
 343 {
 344         struct lib80211_tkip_data *tkey = priv;
 345         int len;
 346         u8 rc4key[16], *pos, *icv;
 347         u32 crc;
 348         int i;
 349
 350         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
 351                 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 352                 net_dbg_ratelimited("TKIP countermeasures: dropped TX packet to %pM\n",
 353                                     hdr->addr1);
 354                 return -1;
 355         }
 356
 357         if (skb_tailroom(skb) < 4 || skb->len < hdr_len)
 358                 return -1;
 359
 360         len = skb->len - hdr_len;
 361         pos = skb->data + hdr_len;
 362
 363         if ((lib80211_tkip_hdr(skb, hdr_len, rc4key, 16, priv)) < 0)
 364                 return -1;
 365
 366         crc = ~crc32_le(~0, pos, len);
 367         icv = skb_put(skb, 4);
 368         icv[0] = crc;
 369         icv[1] = crc >> 8;
 370         icv[2] = crc >> 16;
 371         icv[3] = crc >> 24;
 372
 373         crypto_cipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
 374         for (i = 0; i < len + 4; i++)
 375                 crypto_cipher_encrypt_one(tkey->tx_tfm_arc4, pos + i, pos + i);
 376         return 0;
 377 }
 378
 379 /*
 380  * deal with seq counter wrapping correctly.
 381  * refer to timer_after() for jiffies wrapping handling
 382  */
 383 static inline int tkip_replay_check(u32 iv32_n, u16 iv16_n,
 384                                     u32 iv32_o, u16 iv16_o)
 385 {
 386         if ((s32)iv32_n - (s32)iv32_o < 0 ||
 387             (iv32_n == iv32_o && iv16_n <= iv16_o))
 388                 return 1;
 389         return 0;
 390 }
 391
 392 static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
 393 {
 394         struct lib80211_tkip_data *tkey = priv;
 395         u8 rc4key[16];
 396         u8 keyidx, *pos;
 397         u32 iv32;
 398         u16 iv16;
 399         struct ieee80211_hdr *hdr;
 400         u8 icv[4];
 401         u32 crc;
 402         int plen;
 403         int i;
 404
 405         hdr = (struct ieee80211_hdr *)skb->data;
 406
 407         if (tkey->flags & IEEE80211_CRYPTO_TKIP_COUNTERMEASURES) {
 408                 net_dbg_ratelimited("TKIP countermeasures: dropped received packet from %pM\n",
 409                                     hdr->addr2);
 410                 return -1;
 411         }
 412
 413         if (skb->len < hdr_len + TKIP_HDR_LEN + 4)
 414                 return -1;
 415
 416         pos = skb->data + hdr_len;
 417         keyidx = pos[3];
 418         if (!(keyidx & (1 << 5))) {
 419                 net_dbg_ratelimited("TKIP: received packet without ExtIV flag from %pM\n",
 420                                     hdr->addr2);
 421                 return -2;
 422         }
 423         keyidx >>= 6;
 424         if (tkey->key_idx != keyidx) {
 425                 net_dbg_ratelimited("TKIP: RX tkey->key_idx=%d frame keyidx=%d\n",
 426                                     tkey->key_idx, keyidx);
 427                 return -6;
 428         }
 429         if (!tkey->key_set) {
 430                 net_dbg_ratelimited("TKIP: received packet from %pM with keyid=%d that does not have a configured key\n",
 431                                     hdr->addr2, keyidx);
 432                 return -3;
 433         }
 434         iv16 = (pos[0] << 8) | pos[2];
 435         iv32 = pos[4] | (pos[5] << 8) | (pos[6] << 16) | (pos[7] << 24);
 436         pos += TKIP_HDR_LEN;
 437
 438         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
 439 #ifdef CONFIG_LIB80211_DEBUG
 440                 net_dbg_ratelimited("TKIP: replay detected: STA=%pM previous TSC %08x%04x received TSC %08x%04x\n",
 441                                     hdr->addr2, tkey->rx_iv32, tkey->rx_iv16,
 442                                     iv32, iv16);
 443 #endif
 444                 tkey->dot11RSNAStatsTKIPReplays++;
 445                 return -4;
 446         }
 447
 448         if (iv32 != tkey->rx_iv32 || !tkey->rx_phase1_done) {
 449                 tkip_mixing_phase1(tkey->rx_ttak, tkey->key, hdr->addr2, iv32);
 450                 tkey->rx_phase1_done = 1;
 451         }
 452         tkip_mixing_phase2(rc4key, tkey->key, tkey->rx_ttak, iv16);
 453
 454         plen = skb->len - hdr_len - 12;
 455
 456         crypto_cipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
 457         for (i = 0; i < plen + 4; i++)
 458                 crypto_cipher_decrypt_one(tkey->rx_tfm_arc4, pos + i, pos + i);
 459
 460         crc = ~crc32_le(~0, pos, plen);
 461         icv[0] = crc;
 462         icv[1] = crc >> 8;
 463         icv[2] = crc >> 16;
 464         icv[3] = crc >> 24;
 465         if (memcmp(icv, pos + plen, 4) != 0) {
 466                 if (iv32 != tkey->rx_iv32) {
 467                         /* Previously cached Phase1 result was already lost, so
 468                          * it needs to be recalculated for the next packet. */
 469                         tkey->rx_phase1_done = 0;
 470                 }
 471 #ifdef CONFIG_LIB80211_DEBUG
 472                 net_dbg_ratelimited("TKIP: ICV error detected: STA=%pM\n",
 473                                     hdr->addr2);
 474 #endif
 475                 tkey->dot11RSNAStatsTKIPICVErrors++;
 476                 return -5;
 477         }
 478
 479         /* Update real counters only after Michael MIC verification has
 480          * completed */
 481         tkey->rx_iv32_new = iv32;
 482         tkey->rx_iv16_new = iv16;
 483
 484         /* Remove IV and ICV */
 485         memmove(skb->data + TKIP_HDR_LEN, skb->data, hdr_len);
 486         skb_pull(skb, TKIP_HDR_LEN);
 487         skb_trim(skb, skb->len - 4);
 488
 489         return keyidx;
 490 }
 491
 492 static int michael_mic(struct crypto_shash *tfm_michael, u8 *key, u8 *hdr,
 493                        u8 *data, size_t data_len, u8 *mic)
 494 {
 495         SHASH_DESC_ON_STACK(desc, tfm_michael);
 496         int err;
 497
 498         if (tfm_michael == NULL) {
 499                 pr_warn("%s(): tfm_michael == NULL\n", __func__);
 500                 return -1;
 501         }
 502
 503         desc->tfm = tfm_michael;
 504         desc->flags = 0;
 505
 506         if (crypto_shash_setkey(tfm_michael, key, 8))
 507                 return -1;
 508
 509         err = crypto_shash_init(desc);
 510         if (err)
 511                 goto out;
 512         err = crypto_shash_update(desc, hdr, 16);
 513         if (err)
 514                 goto out;
 515         err = crypto_shash_update(desc, data, data_len);
 516         if (err)
 517                 goto out;
 518         err = crypto_shash_final(desc, mic);
 519
 520 out:
 521         shash_desc_zero(desc);
 522         return err;
 523 }
 524
 525 static void michael_mic_hdr(struct sk_buff *skb, u8 * hdr)
 526 {
 527         struct ieee80211_hdr *hdr11;
 528
 529         hdr11 = (struct ieee80211_hdr *)skb->data;
 530
 531         switch (le16_to_cpu(hdr11->frame_control) &
 532                 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
 533         case IEEE80211_FCTL_TODS:
 534                 memcpy(hdr, hdr11->addr3, ETH_ALEN);    /* DA */
 535                 memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
 536                 break;
 537         case IEEE80211_FCTL_FROMDS:
 538                 memcpy(hdr, hdr11->addr1, ETH_ALEN);    /* DA */
 539                 memcpy(hdr + ETH_ALEN, hdr11->addr3, ETH_ALEN); /* SA */
 540                 break;
 541         case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
 542                 memcpy(hdr, hdr11->addr3, ETH_ALEN);    /* DA */
 543                 memcpy(hdr + ETH_ALEN, hdr11->addr4, ETH_ALEN); /* SA */
 544                 break;
 545         default:
 546                 memcpy(hdr, hdr11->addr1, ETH_ALEN);    /* DA */
 547                 memcpy(hdr + ETH_ALEN, hdr11->addr2, ETH_ALEN); /* SA */
 548                 break;
 549         }
 550
 551         if (ieee80211_is_data_qos(hdr11->frame_control)) {
 552                 hdr[12] = le16_to_cpu(*((__le16 *)ieee80211_get_qos_ctl(hdr11)))
 553                         & IEEE80211_QOS_CTL_TID_MASK;
 554         } else
 555                 hdr[12] = 0;            /* priority */
 556
 557         hdr[13] = hdr[14] = hdr[15] = 0;        /* reserved */
 558 }
 559
 560 static int lib80211_michael_mic_add(struct sk_buff *skb, int hdr_len,
 561                                      void *priv)
 562 {
 563         struct lib80211_tkip_data *tkey = priv;
 564         u8 *pos;
 565
 566         if (skb_tailroom(skb) < 8 || skb->len < hdr_len) {
 567                 printk(KERN_DEBUG "Invalid packet for Michael MIC add "
 568                        "(tailroom=%d hdr_len=%d skb->len=%d)\n",
 569                        skb_tailroom(skb), hdr_len, skb->len);
 570                 return -1;
 571         }
 572
 573         michael_mic_hdr(skb, tkey->tx_hdr);
 574         pos = skb_put(skb, 8);
 575         if (michael_mic(tkey->tx_tfm_michael, &tkey->key[16], tkey->tx_hdr,
 576                         skb->data + hdr_len, skb->len - 8 - hdr_len, pos))
 577                 return -1;
 578
 579         return 0;
 580 }
 581
 582 static void lib80211_michael_mic_failure(struct net_device *dev,
 583                                           struct ieee80211_hdr *hdr,
 584                                           int keyidx)
 585 {
 586         union iwreq_data wrqu;
 587         struct iw_michaelmicfailure ev;
 588
 589         /* TODO: needed parameters: count, keyid, key type, TSC */
 590         memset(&ev, 0, sizeof(ev));
 591         ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
 592         if (hdr->addr1[0] & 0x01)
 593                 ev.flags |= IW_MICFAILURE_GROUP;
 594         else
 595                 ev.flags |= IW_MICFAILURE_PAIRWISE;
 596         ev.src_addr.sa_family = ARPHRD_ETHER;
 597         memcpy(ev.src_addr.sa_data, hdr->addr2, ETH_ALEN);
 598         memset(&wrqu, 0, sizeof(wrqu));
 599         wrqu.data.length = sizeof(ev);
 600         wireless_send_event(dev, IWEVMICHAELMICFAILURE, &wrqu, (char *)&ev);
 601 }
 602
 603 static int lib80211_michael_mic_verify(struct sk_buff *skb, int keyidx,
 604                                         int hdr_len, void *priv)
 605 {
 606         struct lib80211_tkip_data *tkey = priv;
 607         u8 mic[8];
 608
 609         if (!tkey->key_set)
 610                 return -1;
 611
 612         michael_mic_hdr(skb, tkey->rx_hdr);
 613         if (michael_mic(tkey->rx_tfm_michael, &tkey->key[24], tkey->rx_hdr,
 614                         skb->data + hdr_len, skb->len - 8 - hdr_len, mic))
 615                 return -1;
 616         if (memcmp(mic, skb->data + skb->len - 8, 8) != 0) {
 617                 struct ieee80211_hdr *hdr;
 618                 hdr = (struct ieee80211_hdr *)skb->data;
 619                 printk(KERN_DEBUG "%s: Michael MIC verification failed for "
 620                        "MSDU from %pM keyidx=%d\n",
 621                        skb->dev ? skb->dev->name : "N/A", hdr->addr2,
 622                        keyidx);
 623                 if (skb->dev)
 624                         lib80211_michael_mic_failure(skb->dev, hdr, keyidx);
 625                 tkey->dot11RSNAStatsTKIPLocalMICFailures++;
 626                 return -1;
 627         }
 628
 629         /* Update TSC counters for RX now that the packet verification has
 630          * completed. */
 631         tkey->rx_iv32 = tkey->rx_iv32_new;
 632         tkey->rx_iv16 = tkey->rx_iv16_new;
 633
 634         skb_trim(skb, skb->len - 8);
 635
 636         return 0;
 637 }
 638
 639 static int lib80211_tkip_set_key(void *key, int len, u8 * seq, void *priv)
 640 {
 641         struct lib80211_tkip_data *tkey = priv;
 642         int keyidx;
 643         struct crypto_shash *tfm = tkey->tx_tfm_michael;
 644         struct crypto_cipher *tfm2 = tkey->tx_tfm_arc4;
 645         struct crypto_shash *tfm3 = tkey->rx_tfm_michael;
 646         struct crypto_cipher *tfm4 = tkey->rx_tfm_arc4;
 647
 648         keyidx = tkey->key_idx;
 649         memset(tkey, 0, sizeof(*tkey));
 650         tkey->key_idx = keyidx;
 651         tkey->tx_tfm_michael = tfm;
 652         tkey->tx_tfm_arc4 = tfm2;
 653         tkey->rx_tfm_michael = tfm3;
 654         tkey->rx_tfm_arc4 = tfm4;
 655         if (len == TKIP_KEY_LEN) {
 656                 memcpy(tkey->key, key, TKIP_KEY_LEN);
 657                 tkey->key_set = 1;
 658                 tkey->tx_iv16 = 1;      /* TSC is initialized to 1 */
 659                 if (seq) {
 660                         tkey->rx_iv32 = (seq[5] << 24) | (seq[4] << 16) |
 661                             (seq[3] << 8) | seq[2];
 662                         tkey->rx_iv16 = (seq[1] << 8) | seq[0];
 663                 }
 664         } else if (len == 0)
 665                 tkey->key_set = 0;
 666         else
 667                 return -1;
 668
 669         return 0;
 670 }
 671
 672 static int lib80211_tkip_get_key(void *key, int len, u8 * seq, void *priv)
 673 {
 674         struct lib80211_tkip_data *tkey = priv;
 675
 676         if (len < TKIP_KEY_LEN)
 677                 return -1;
 678
 679         if (!tkey->key_set)
 680                 return 0;
 681         memcpy(key, tkey->key, TKIP_KEY_LEN);
 682
 683         if (seq) {
 684                 /* Return the sequence number of the last transmitted frame. */
 685                 u16 iv16 = tkey->tx_iv16;
 686                 u32 iv32 = tkey->tx_iv32;
 687                 if (iv16 == 0)
 688                         iv32--;
 689                 iv16--;
 690                 seq[0] = tkey->tx_iv16;
 691                 seq[1] = tkey->tx_iv16 >> 8;
 692                 seq[2] = tkey->tx_iv32;
 693                 seq[3] = tkey->tx_iv32 >> 8;
 694                 seq[4] = tkey->tx_iv32 >> 16;
 695                 seq[5] = tkey->tx_iv32 >> 24;
 696         }
 697
 698         return TKIP_KEY_LEN;
 699 }
 700
 701 static void lib80211_tkip_print_stats(struct seq_file *m, void *priv)
 702 {
 703         struct lib80211_tkip_data *tkip = priv;
 704         seq_printf(m,
 705                    "key[%d] alg=TKIP key_set=%d "
 706                    "tx_pn=%02x%02x%02x%02x%02x%02x "
 707                    "rx_pn=%02x%02x%02x%02x%02x%02x "
 708                    "replays=%d icv_errors=%d local_mic_failures=%d\n",
 709                    tkip->key_idx, tkip->key_set,
 710                    (tkip->tx_iv32 >> 24) & 0xff,
 711                    (tkip->tx_iv32 >> 16) & 0xff,
 712                    (tkip->tx_iv32 >> 8) & 0xff,
 713                    tkip->tx_iv32 & 0xff,
 714                    (tkip->tx_iv16 >> 8) & 0xff,
 715                    tkip->tx_iv16 & 0xff,
 716                    (tkip->rx_iv32 >> 24) & 0xff,
 717                    (tkip->rx_iv32 >> 16) & 0xff,
 718                    (tkip->rx_iv32 >> 8) & 0xff,
 719                    tkip->rx_iv32 & 0xff,
 720                    (tkip->rx_iv16 >> 8) & 0xff,
 721                    tkip->rx_iv16 & 0xff,
 722                    tkip->dot11RSNAStatsTKIPReplays,
 723                    tkip->dot11RSNAStatsTKIPICVErrors,
 724                    tkip->dot11RSNAStatsTKIPLocalMICFailures);
 725 }
 726
 727 static struct lib80211_crypto_ops lib80211_crypt_tkip = {
 728         .name = "TKIP",
 729         .init = lib80211_tkip_init,
 730         .deinit = lib80211_tkip_deinit,
 731         .encrypt_mpdu = lib80211_tkip_encrypt,
 732         .decrypt_mpdu = lib80211_tkip_decrypt,
 733         .encrypt_msdu = lib80211_michael_mic_add,
 734         .decrypt_msdu = lib80211_michael_mic_verify,
 735         .set_key = lib80211_tkip_set_key,
 736         .get_key = lib80211_tkip_get_key,
 737         .print_stats = lib80211_tkip_print_stats,
 738         .extra_mpdu_prefix_len = 4 + 4, /* IV + ExtIV */
 739         .extra_mpdu_postfix_len = 4,    /* ICV */
 740         .extra_msdu_postfix_len = 8,    /* MIC */
 741         .get_flags = lib80211_tkip_get_flags,
 742         .set_flags = lib80211_tkip_set_flags,
 743         .owner = THIS_MODULE,
 744 };
 745
 746 static int __init lib80211_crypto_tkip_init(void)
 747 {
 748         return lib80211_register_crypto_ops(&lib80211_crypt_tkip);
 749 }
 750
 751 static void __exit lib80211_crypto_tkip_exit(void)
 752 {
 753         lib80211_unregister_crypto_ops(&lib80211_crypt_tkip);
 754 }
 755
 756 module_init(lib80211_crypto_tkip_init);
 757 module_exit(lib80211_crypto_tkip_exit);