2 * Copyright 2002-2004, Instant802 Networks, Inc.
3 * Copyright 2008, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
10 #include <linux/netdevice.h>
11 #include <linux/types.h>
12 #include <linux/skbuff.h>
13 #include <linux/compiler.h>
14 #include <linux/ieee80211.h>
15 #include <linux/gfp.h>
16 #include <asm/unaligned.h>
17 #include <net/mac80211.h>
18 #include <crypto/aes.h>
20 #include "ieee80211_i.h"
28 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data
*tx
)
33 struct ieee80211_hdr
*hdr
;
34 struct sk_buff
*skb
= tx
->skb
;
35 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
38 hdr
= (struct ieee80211_hdr
*)skb
->data
;
39 if (!tx
->key
|| tx
->key
->conf
.cipher
!= WLAN_CIPHER_SUITE_TKIP
||
40 skb
->len
< 24 || !ieee80211_is_data_present(hdr
->frame_control
))
43 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
44 if (skb
->len
< hdrlen
)
47 data
= skb
->data
+ hdrlen
;
48 data_len
= skb
->len
- hdrlen
;
50 if (unlikely(info
->flags
& IEEE80211_TX_INTFL_TKIP_MIC_FAILURE
)) {
51 /* Need to use software crypto for the test */
52 info
->control
.hw_key
= NULL
;
55 if (info
->control
.hw_key
&&
56 (info
->flags
& IEEE80211_TX_CTL_DONTFRAG
||
57 tx
->local
->ops
->set_frag_threshold
) &&
58 !(tx
->key
->conf
.flags
& IEEE80211_KEY_FLAG_GENERATE_MMIC
)) {
59 /* hwaccel - with no need for SW-generated MMIC */
63 tail
= MICHAEL_MIC_LEN
;
64 if (!info
->control
.hw_key
)
65 tail
+= IEEE80211_TKIP_ICV_LEN
;
67 if (WARN_ON(skb_tailroom(skb
) < tail
||
68 skb_headroom(skb
) < IEEE80211_TKIP_IV_LEN
))
71 key
= &tx
->key
->conf
.key
[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY
];
72 mic
= skb_put(skb
, MICHAEL_MIC_LEN
);
73 michael_mic(key
, hdr
, data
, data_len
, mic
);
74 if (unlikely(info
->flags
& IEEE80211_TX_INTFL_TKIP_MIC_FAILURE
))
82 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data
*rx
)
84 u8
*data
, *key
= NULL
;
87 u8 mic
[MICHAEL_MIC_LEN
];
88 struct sk_buff
*skb
= rx
->skb
;
89 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
90 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
93 * it makes no sense to check for MIC errors on anything other
96 if (!ieee80211_is_data_present(hdr
->frame_control
))
100 * No way to verify the MIC if the hardware stripped it or
101 * the IV with the key index. In this case we have solely rely
102 * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
103 * MIC failure report.
105 if (status
->flag
& (RX_FLAG_MMIC_STRIPPED
| RX_FLAG_IV_STRIPPED
)) {
106 if (status
->flag
& RX_FLAG_MMIC_ERROR
)
107 goto mic_fail_no_key
;
109 if (!(status
->flag
& RX_FLAG_IV_STRIPPED
) && rx
->key
&&
110 rx
->key
->conf
.cipher
== WLAN_CIPHER_SUITE_TKIP
)
117 * Some hardware seems to generate Michael MIC failure reports; even
118 * though, the frame was not encrypted with TKIP and therefore has no
119 * MIC. Ignore the flag them to avoid triggering countermeasures.
121 if (!rx
->key
|| rx
->key
->conf
.cipher
!= WLAN_CIPHER_SUITE_TKIP
||
122 !(status
->flag
& RX_FLAG_DECRYPTED
))
125 if (rx
->sdata
->vif
.type
== NL80211_IFTYPE_AP
&& rx
->key
->conf
.keyidx
) {
127 * APs with pairwise keys should never receive Michael MIC
128 * errors for non-zero keyidx because these are reserved for
129 * group keys and only the AP is sending real multicast
130 * frames in the BSS. (
132 return RX_DROP_UNUSABLE
;
135 if (status
->flag
& RX_FLAG_MMIC_ERROR
)
138 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
139 if (skb
->len
< hdrlen
+ MICHAEL_MIC_LEN
)
140 return RX_DROP_UNUSABLE
;
142 if (skb_linearize(rx
->skb
))
143 return RX_DROP_UNUSABLE
;
144 hdr
= (void *)skb
->data
;
146 data
= skb
->data
+ hdrlen
;
147 data_len
= skb
->len
- hdrlen
- MICHAEL_MIC_LEN
;
148 key
= &rx
->key
->conf
.key
[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY
];
149 michael_mic(key
, hdr
, data
, data_len
, mic
);
150 if (memcmp(mic
, data
+ data_len
, MICHAEL_MIC_LEN
) != 0)
153 /* remove Michael MIC from payload */
154 skb_trim(skb
, skb
->len
- MICHAEL_MIC_LEN
);
157 /* update IV in key information to be able to detect replays */
158 rx
->key
->u
.tkip
.rx
[rx
->security_idx
].iv32
= rx
->tkip_iv32
;
159 rx
->key
->u
.tkip
.rx
[rx
->security_idx
].iv16
= rx
->tkip_iv16
;
164 rx
->key
->u
.tkip
.mic_failures
++;
168 * In some cases the key can be unset - e.g. a multicast packet, in
169 * a driver that supports HW encryption. Send up the key idx only if
172 mac80211_ev_michael_mic_failure(rx
->sdata
,
173 rx
->key
? rx
->key
->conf
.keyidx
: -1,
174 (void *) skb
->data
, NULL
, GFP_ATOMIC
);
175 return RX_DROP_UNUSABLE
;
179 static int tkip_encrypt_skb(struct ieee80211_tx_data
*tx
, struct sk_buff
*skb
)
181 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
182 struct ieee80211_key
*key
= tx
->key
;
183 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
188 if (info
->control
.hw_key
&&
189 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_GENERATE_IV
) &&
190 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_PUT_IV_SPACE
)) {
191 /* hwaccel - with no need for software-generated IV */
195 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
196 len
= skb
->len
- hdrlen
;
198 if (info
->control
.hw_key
)
201 tail
= IEEE80211_TKIP_ICV_LEN
;
203 if (WARN_ON(skb_tailroom(skb
) < tail
||
204 skb_headroom(skb
) < IEEE80211_TKIP_IV_LEN
))
207 pos
= skb_push(skb
, IEEE80211_TKIP_IV_LEN
);
208 memmove(pos
, pos
+ IEEE80211_TKIP_IV_LEN
, hdrlen
);
209 skb_set_network_header(skb
, skb_network_offset(skb
) +
210 IEEE80211_TKIP_IV_LEN
);
213 /* the HW only needs room for the IV, but not the actual IV */
214 if (info
->control
.hw_key
&&
215 (info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_PUT_IV_SPACE
))
218 /* Increase IV for the frame */
219 spin_lock(&key
->u
.tkip
.txlock
);
220 key
->u
.tkip
.tx
.iv16
++;
221 if (key
->u
.tkip
.tx
.iv16
== 0)
222 key
->u
.tkip
.tx
.iv32
++;
223 pos
= ieee80211_tkip_add_iv(pos
, key
);
224 spin_unlock(&key
->u
.tkip
.txlock
);
226 /* hwaccel - with software IV */
227 if (info
->control
.hw_key
)
230 /* Add room for ICV */
231 skb_put(skb
, IEEE80211_TKIP_ICV_LEN
);
233 return ieee80211_tkip_encrypt_data(tx
->local
->wep_tx_tfm
,
239 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data
*tx
)
243 ieee80211_tx_set_protected(tx
);
245 skb_queue_walk(&tx
->skbs
, skb
) {
246 if (tkip_encrypt_skb(tx
, skb
) < 0)
255 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data
*rx
)
257 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
258 int hdrlen
, res
, hwaccel
= 0;
259 struct ieee80211_key
*key
= rx
->key
;
260 struct sk_buff
*skb
= rx
->skb
;
261 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
263 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
265 if (!ieee80211_is_data(hdr
->frame_control
))
268 if (!rx
->sta
|| skb
->len
- hdrlen
< 12)
269 return RX_DROP_UNUSABLE
;
271 /* it may be possible to optimize this a bit more */
272 if (skb_linearize(rx
->skb
))
273 return RX_DROP_UNUSABLE
;
274 hdr
= (void *)skb
->data
;
277 * Let TKIP code verify IV, but skip decryption.
278 * In the case where hardware checks the IV as well,
279 * we don't even get here, see ieee80211_rx_h_decrypt()
281 if (status
->flag
& RX_FLAG_DECRYPTED
)
284 res
= ieee80211_tkip_decrypt_data(rx
->local
->wep_rx_tfm
,
285 key
, skb
->data
+ hdrlen
,
286 skb
->len
- hdrlen
, rx
->sta
->sta
.addr
,
287 hdr
->addr1
, hwaccel
, rx
->security_idx
,
290 if (res
!= TKIP_DECRYPT_OK
)
291 return RX_DROP_UNUSABLE
;
294 skb_trim(skb
, skb
->len
- IEEE80211_TKIP_ICV_LEN
);
297 memmove(skb
->data
+ IEEE80211_TKIP_IV_LEN
, skb
->data
, hdrlen
);
298 skb_pull(skb
, IEEE80211_TKIP_IV_LEN
);
304 static void ccmp_special_blocks(struct sk_buff
*skb
, u8
*pn
, u8
*scratch
,
308 int a4_included
, mgmt
;
313 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
315 memset(scratch
, 0, 6 * AES_BLOCK_SIZE
);
317 b_0
= scratch
+ 3 * AES_BLOCK_SIZE
;
318 aad
= scratch
+ 4 * AES_BLOCK_SIZE
;
321 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
322 * Retry, PwrMgt, MoreData; set Protected
324 mgmt
= ieee80211_is_mgmt(hdr
->frame_control
);
325 mask_fc
= hdr
->frame_control
;
326 mask_fc
&= ~cpu_to_le16(IEEE80211_FCTL_RETRY
|
327 IEEE80211_FCTL_PM
| IEEE80211_FCTL_MOREDATA
);
329 mask_fc
&= ~cpu_to_le16(0x0070);
330 mask_fc
|= cpu_to_le16(IEEE80211_FCTL_PROTECTED
);
332 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
334 a4_included
= ieee80211_has_a4(hdr
->frame_control
);
336 if (ieee80211_is_data_qos(hdr
->frame_control
))
337 qos_tid
= *ieee80211_get_qos_ctl(hdr
) & IEEE80211_QOS_CTL_TID_MASK
;
341 data_len
= skb
->len
- hdrlen
- IEEE80211_CCMP_HDR_LEN
;
343 data_len
-= IEEE80211_CCMP_MIC_LEN
;
345 /* First block, b_0 */
346 b_0
[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
347 /* Nonce: Nonce Flags | A2 | PN
348 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
350 b_0
[1] = qos_tid
| (mgmt
<< 4);
351 memcpy(&b_0
[2], hdr
->addr2
, ETH_ALEN
);
352 memcpy(&b_0
[8], pn
, IEEE80211_CCMP_PN_LEN
);
354 put_unaligned_be16(data_len
, &b_0
[14]);
356 /* AAD (extra authenticate-only data) / masked 802.11 header
357 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
358 put_unaligned_be16(len_a
, &aad
[0]);
359 put_unaligned(mask_fc
, (__le16
*)&aad
[2]);
360 memcpy(&aad
[4], &hdr
->addr1
, 3 * ETH_ALEN
);
362 /* Mask Seq#, leave Frag# */
363 aad
[22] = *((u8
*) &hdr
->seq_ctrl
) & 0x0f;
367 memcpy(&aad
[24], hdr
->addr4
, ETH_ALEN
);
371 memset(&aad
[24], 0, ETH_ALEN
+ IEEE80211_QOS_CTL_LEN
);
377 static inline void ccmp_pn2hdr(u8
*hdr
, u8
*pn
, int key_id
)
382 hdr
[3] = 0x20 | (key_id
<< 6);
390 static inline void ccmp_hdr2pn(u8
*pn
, u8
*hdr
)
401 static int ccmp_encrypt_skb(struct ieee80211_tx_data
*tx
, struct sk_buff
*skb
)
403 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
404 struct ieee80211_key
*key
= tx
->key
;
405 struct ieee80211_tx_info
*info
= IEEE80211_SKB_CB(skb
);
406 int hdrlen
, len
, tail
;
410 u8 scratch
[6 * AES_BLOCK_SIZE
];
412 if (info
->control
.hw_key
&&
413 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_GENERATE_IV
) &&
414 !(info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_PUT_IV_SPACE
)) {
416 * hwaccel has no need for preallocated room for CCMP
417 * header or MIC fields
422 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
423 len
= skb
->len
- hdrlen
;
425 if (info
->control
.hw_key
)
428 tail
= IEEE80211_CCMP_MIC_LEN
;
430 if (WARN_ON(skb_tailroom(skb
) < tail
||
431 skb_headroom(skb
) < IEEE80211_CCMP_HDR_LEN
))
434 pos
= skb_push(skb
, IEEE80211_CCMP_HDR_LEN
);
435 memmove(pos
, pos
+ IEEE80211_CCMP_HDR_LEN
, hdrlen
);
436 skb_set_network_header(skb
, skb_network_offset(skb
) +
437 IEEE80211_CCMP_HDR_LEN
);
439 /* the HW only needs room for the IV, but not the actual IV */
440 if (info
->control
.hw_key
&&
441 (info
->control
.hw_key
->flags
& IEEE80211_KEY_FLAG_PUT_IV_SPACE
))
444 hdr
= (struct ieee80211_hdr
*) pos
;
447 pn64
= atomic64_inc_return(&key
->u
.ccmp
.tx_pn
);
456 ccmp_pn2hdr(pos
, pn
, key
->conf
.keyidx
);
458 /* hwaccel - with software CCMP header */
459 if (info
->control
.hw_key
)
462 pos
+= IEEE80211_CCMP_HDR_LEN
;
463 ccmp_special_blocks(skb
, pn
, scratch
, 0);
464 ieee80211_aes_ccm_encrypt(key
->u
.ccmp
.tfm
, scratch
, pos
, len
,
465 pos
, skb_put(skb
, IEEE80211_CCMP_MIC_LEN
));
472 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data
*tx
)
476 ieee80211_tx_set_protected(tx
);
478 skb_queue_walk(&tx
->skbs
, skb
) {
479 if (ccmp_encrypt_skb(tx
, skb
) < 0)
488 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data
*rx
)
490 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)rx
->skb
->data
;
492 struct ieee80211_key
*key
= rx
->key
;
493 struct sk_buff
*skb
= rx
->skb
;
494 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
495 u8 pn
[IEEE80211_CCMP_PN_LEN
];
499 hdrlen
= ieee80211_hdrlen(hdr
->frame_control
);
501 if (!ieee80211_is_data(hdr
->frame_control
) &&
502 !ieee80211_is_robust_mgmt_frame(hdr
))
505 data_len
= skb
->len
- hdrlen
- IEEE80211_CCMP_HDR_LEN
-
506 IEEE80211_CCMP_MIC_LEN
;
507 if (!rx
->sta
|| data_len
< 0)
508 return RX_DROP_UNUSABLE
;
510 if (status
->flag
& RX_FLAG_DECRYPTED
) {
511 if (!pskb_may_pull(rx
->skb
, hdrlen
+ IEEE80211_CCMP_HDR_LEN
))
512 return RX_DROP_UNUSABLE
;
514 if (skb_linearize(rx
->skb
))
515 return RX_DROP_UNUSABLE
;
518 ccmp_hdr2pn(pn
, skb
->data
+ hdrlen
);
520 queue
= rx
->security_idx
;
522 if (memcmp(pn
, key
->u
.ccmp
.rx_pn
[queue
], IEEE80211_CCMP_PN_LEN
) <= 0) {
523 key
->u
.ccmp
.replays
++;
524 return RX_DROP_UNUSABLE
;
527 if (!(status
->flag
& RX_FLAG_DECRYPTED
)) {
528 u8 scratch
[6 * AES_BLOCK_SIZE
];
529 /* hardware didn't decrypt/verify MIC */
530 ccmp_special_blocks(skb
, pn
, scratch
, 1);
532 if (ieee80211_aes_ccm_decrypt(
533 key
->u
.ccmp
.tfm
, scratch
,
534 skb
->data
+ hdrlen
+ IEEE80211_CCMP_HDR_LEN
,
536 skb
->data
+ skb
->len
- IEEE80211_CCMP_MIC_LEN
,
537 skb
->data
+ hdrlen
+ IEEE80211_CCMP_HDR_LEN
))
538 return RX_DROP_UNUSABLE
;
541 memcpy(key
->u
.ccmp
.rx_pn
[queue
], pn
, IEEE80211_CCMP_PN_LEN
);
543 /* Remove CCMP header and MIC */
544 if (pskb_trim(skb
, skb
->len
- IEEE80211_CCMP_MIC_LEN
))
545 return RX_DROP_UNUSABLE
;
546 memmove(skb
->data
+ IEEE80211_CCMP_HDR_LEN
, skb
->data
, hdrlen
);
547 skb_pull(skb
, IEEE80211_CCMP_HDR_LEN
);
553 static void bip_aad(struct sk_buff
*skb
, u8
*aad
)
556 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
558 /* BIP AAD: FC(masked) || A1 || A2 || A3 */
560 /* FC type/subtype */
561 /* Mask FC Retry, PwrMgt, MoreData flags to zero */
562 mask_fc
= hdr
->frame_control
;
563 mask_fc
&= ~cpu_to_le16(IEEE80211_FCTL_RETRY
| IEEE80211_FCTL_PM
|
564 IEEE80211_FCTL_MOREDATA
);
565 put_unaligned(mask_fc
, (__le16
*) &aad
[0]);
567 memcpy(aad
+ 2, &hdr
->addr1
, 3 * ETH_ALEN
);
571 static inline void bip_ipn_set64(u8
*d
, u64 pn
)
581 static inline void bip_ipn_swap(u8
*d
, const u8
*s
)
593 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data
*tx
)
596 struct ieee80211_tx_info
*info
;
597 struct ieee80211_key
*key
= tx
->key
;
598 struct ieee80211_mmie
*mmie
;
602 if (WARN_ON(skb_queue_len(&tx
->skbs
) != 1))
605 skb
= skb_peek(&tx
->skbs
);
607 info
= IEEE80211_SKB_CB(skb
);
609 if (info
->control
.hw_key
)
612 if (WARN_ON(skb_tailroom(skb
) < sizeof(*mmie
)))
615 mmie
= (struct ieee80211_mmie
*) skb_put(skb
, sizeof(*mmie
));
616 mmie
->element_id
= WLAN_EID_MMIE
;
617 mmie
->length
= sizeof(*mmie
) - 2;
618 mmie
->key_id
= cpu_to_le16(key
->conf
.keyidx
);
621 pn64
= atomic64_inc_return(&key
->u
.aes_cmac
.tx_pn
);
623 bip_ipn_set64(mmie
->sequence_number
, pn64
);
628 * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
630 ieee80211_aes_cmac(key
->u
.aes_cmac
.tfm
, aad
,
631 skb
->data
+ 24, skb
->len
- 24, mmie
->mic
);
638 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data
*rx
)
640 struct sk_buff
*skb
= rx
->skb
;
641 struct ieee80211_rx_status
*status
= IEEE80211_SKB_RXCB(skb
);
642 struct ieee80211_key
*key
= rx
->key
;
643 struct ieee80211_mmie
*mmie
;
644 u8 aad
[20], mic
[8], ipn
[6];
645 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
647 if (!ieee80211_is_mgmt(hdr
->frame_control
))
650 /* management frames are already linear */
652 if (skb
->len
< 24 + sizeof(*mmie
))
653 return RX_DROP_UNUSABLE
;
655 mmie
= (struct ieee80211_mmie
*)
656 (skb
->data
+ skb
->len
- sizeof(*mmie
));
657 if (mmie
->element_id
!= WLAN_EID_MMIE
||
658 mmie
->length
!= sizeof(*mmie
) - 2)
659 return RX_DROP_UNUSABLE
; /* Invalid MMIE */
661 bip_ipn_swap(ipn
, mmie
->sequence_number
);
663 if (memcmp(ipn
, key
->u
.aes_cmac
.rx_pn
, 6) <= 0) {
664 key
->u
.aes_cmac
.replays
++;
665 return RX_DROP_UNUSABLE
;
668 if (!(status
->flag
& RX_FLAG_DECRYPTED
)) {
669 /* hardware didn't decrypt/verify MIC */
671 ieee80211_aes_cmac(key
->u
.aes_cmac
.tfm
, aad
,
672 skb
->data
+ 24, skb
->len
- 24, mic
);
673 if (memcmp(mic
, mmie
->mic
, sizeof(mmie
->mic
)) != 0) {
674 key
->u
.aes_cmac
.icverrors
++;
675 return RX_DROP_UNUSABLE
;
679 memcpy(key
->u
.aes_cmac
.rx_pn
, ipn
, 6);
682 skb_trim(skb
, skb
->len
- sizeof(*mmie
));
688 ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data
*tx
)
691 struct ieee80211_tx_info
*info
= NULL
;
693 skb_queue_walk(&tx
->skbs
, skb
) {
694 info
= IEEE80211_SKB_CB(skb
);
696 /* handle hw-only algorithm */
697 if (!info
->control
.hw_key
)
701 ieee80211_tx_set_protected(tx
);