wpa.c 32 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Copyright 2002-2004, Instant802 Networks, Inc.
  4. * Copyright 2008, Jouni Malinen <j@w1.fi>
  5. * Copyright (C) 2016-2017 Intel Deutschland GmbH
  6. * Copyright (C) 2020-2021 Intel Corporation
  7. */
  8. #include <linux/netdevice.h>
  9. #include <linux/types.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/compiler.h>
  12. #include <linux/ieee80211.h>
  13. #include <linux/gfp.h>
  14. #include <asm/unaligned.h>
  15. #include <net/mac80211.h>
  16. #include <crypto/aes.h>
  17. #include <crypto/algapi.h>
  18. #include "ieee80211_i.h"
  19. #include "michael.h"
  20. #include "tkip.h"
  21. #include "aes_ccm.h"
  22. #include "aes_cmac.h"
  23. #include "aes_gmac.h"
  24. #include "aes_gcm.h"
  25. #include "wpa.h"
  26. ieee80211_tx_result
  27. ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
  28. {
  29. u8 *data, *key, *mic;
  30. size_t data_len;
  31. unsigned int hdrlen;
  32. struct ieee80211_hdr *hdr;
  33. struct sk_buff *skb = tx->skb;
  34. struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  35. int tail;
  36. hdr = (struct ieee80211_hdr *)skb->data;
  37. if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
  38. skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
  39. return TX_CONTINUE;
  40. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  41. if (skb->len < hdrlen)
  42. return TX_DROP;
  43. data = skb->data + hdrlen;
  44. data_len = skb->len - hdrlen;
  45. if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
  46. /* Need to use software crypto for the test */
  47. info->control.hw_key = NULL;
  48. }
  49. if (info->control.hw_key &&
  50. (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
  51. ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
  52. !(tx->key->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC |
  53. IEEE80211_KEY_FLAG_PUT_MIC_SPACE))) {
  54. /* hwaccel - with no need for SW-generated MMIC or MIC space */
  55. return TX_CONTINUE;
  56. }
  57. tail = MICHAEL_MIC_LEN;
  58. if (!info->control.hw_key)
  59. tail += IEEE80211_TKIP_ICV_LEN;
  60. if (WARN(skb_tailroom(skb) < tail ||
  61. skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
  62. "mmic: not enough head/tail (%d/%d,%d/%d)\n",
  63. skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
  64. skb_tailroom(skb), tail))
  65. return TX_DROP;
  66. mic = skb_put(skb, MICHAEL_MIC_LEN);
  67. if (tx->key->conf.flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) {
  68. /* Zeroed MIC can help with debug */
  69. memset(mic, 0, MICHAEL_MIC_LEN);
  70. return TX_CONTINUE;
  71. }
  72. key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
  73. michael_mic(key, hdr, data, data_len, mic);
  74. if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
  75. mic[0]++;
  76. return TX_CONTINUE;
  77. }
  78. ieee80211_rx_result
  79. ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
  80. {
  81. u8 *data, *key = NULL;
  82. size_t data_len;
  83. unsigned int hdrlen;
  84. u8 mic[MICHAEL_MIC_LEN];
  85. struct sk_buff *skb = rx->skb;
  86. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  87. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  88. /*
  89. * it makes no sense to check for MIC errors on anything other
  90. * than data frames.
  91. */
  92. if (!ieee80211_is_data_present(hdr->frame_control))
  93. return RX_CONTINUE;
  94. /*
  95. * No way to verify the MIC if the hardware stripped it or
  96. * the IV with the key index. In this case we have solely rely
  97. * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
  98. * MIC failure report.
  99. */
  100. if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
  101. if (status->flag & RX_FLAG_MMIC_ERROR)
  102. goto mic_fail_no_key;
  103. if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
  104. rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
  105. goto update_iv;
  106. return RX_CONTINUE;
  107. }
  108. /*
  109. * Some hardware seems to generate Michael MIC failure reports; even
  110. * though, the frame was not encrypted with TKIP and therefore has no
  111. * MIC. Ignore the flag them to avoid triggering countermeasures.
  112. */
  113. if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
  114. !(status->flag & RX_FLAG_DECRYPTED))
  115. return RX_CONTINUE;
  116. if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
  117. /*
  118. * APs with pairwise keys should never receive Michael MIC
  119. * errors for non-zero keyidx because these are reserved for
  120. * group keys and only the AP is sending real multicast
  121. * frames in the BSS.
  122. */
  123. return RX_DROP_UNUSABLE;
  124. }
  125. if (status->flag & RX_FLAG_MMIC_ERROR)
  126. goto mic_fail;
  127. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  128. if (skb->len < hdrlen + MICHAEL_MIC_LEN)
  129. return RX_DROP_UNUSABLE;
  130. if (skb_linearize(rx->skb))
  131. return RX_DROP_UNUSABLE;
  132. hdr = (void *)skb->data;
  133. data = skb->data + hdrlen;
  134. data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
  135. key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
  136. michael_mic(key, hdr, data, data_len, mic);
  137. if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
  138. goto mic_fail;
  139. /* remove Michael MIC from payload */
  140. skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
  141. update_iv:
  142. /* update IV in key information to be able to detect replays */
  143. rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32;
  144. rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16;
  145. return RX_CONTINUE;
  146. mic_fail:
  147. rx->key->u.tkip.mic_failures++;
  148. mic_fail_no_key:
  149. /*
  150. * In some cases the key can be unset - e.g. a multicast packet, in
  151. * a driver that supports HW encryption. Send up the key idx only if
  152. * the key is set.
  153. */
  154. cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
  155. is_multicast_ether_addr(hdr->addr1) ?
  156. NL80211_KEYTYPE_GROUP :
  157. NL80211_KEYTYPE_PAIRWISE,
  158. rx->key ? rx->key->conf.keyidx : -1,
  159. NULL, GFP_ATOMIC);
  160. return RX_DROP_UNUSABLE;
  161. }
  162. static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
  163. {
  164. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  165. struct ieee80211_key *key = tx->key;
  166. struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  167. unsigned int hdrlen;
  168. int len, tail;
  169. u64 pn;
  170. u8 *pos;
  171. if (info->control.hw_key &&
  172. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
  173. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
  174. /* hwaccel - with no need for software-generated IV */
  175. return 0;
  176. }
  177. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  178. len = skb->len - hdrlen;
  179. if (info->control.hw_key)
  180. tail = 0;
  181. else
  182. tail = IEEE80211_TKIP_ICV_LEN;
  183. if (WARN_ON(skb_tailroom(skb) < tail ||
  184. skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
  185. return -1;
  186. pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
  187. memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
  188. pos += hdrlen;
  189. /* the HW only needs room for the IV, but not the actual IV */
  190. if (info->control.hw_key &&
  191. (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
  192. return 0;
  193. /* Increase IV for the frame */
  194. pn = atomic64_inc_return(&key->conf.tx_pn);
  195. pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
  196. /* hwaccel - with software IV */
  197. if (info->control.hw_key)
  198. return 0;
  199. /* Add room for ICV */
  200. skb_put(skb, IEEE80211_TKIP_ICV_LEN);
  201. return ieee80211_tkip_encrypt_data(&tx->local->wep_tx_ctx,
  202. key, skb, pos, len);
  203. }
  204. ieee80211_tx_result
  205. ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
  206. {
  207. struct sk_buff *skb;
  208. ieee80211_tx_set_protected(tx);
  209. skb_queue_walk(&tx->skbs, skb) {
  210. if (tkip_encrypt_skb(tx, skb) < 0)
  211. return TX_DROP;
  212. }
  213. return TX_CONTINUE;
  214. }
  215. ieee80211_rx_result
  216. ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
  217. {
  218. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
  219. int hdrlen, res, hwaccel = 0;
  220. struct ieee80211_key *key = rx->key;
  221. struct sk_buff *skb = rx->skb;
  222. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  223. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  224. if (!ieee80211_is_data(hdr->frame_control))
  225. return RX_CONTINUE;
  226. if (!rx->sta || skb->len - hdrlen < 12)
  227. return RX_DROP_UNUSABLE;
  228. /* it may be possible to optimize this a bit more */
  229. if (skb_linearize(rx->skb))
  230. return RX_DROP_UNUSABLE;
  231. hdr = (void *)skb->data;
  232. /*
  233. * Let TKIP code verify IV, but skip decryption.
  234. * In the case where hardware checks the IV as well,
  235. * we don't even get here, see ieee80211_rx_h_decrypt()
  236. */
  237. if (status->flag & RX_FLAG_DECRYPTED)
  238. hwaccel = 1;
  239. res = ieee80211_tkip_decrypt_data(&rx->local->wep_rx_ctx,
  240. key, skb->data + hdrlen,
  241. skb->len - hdrlen, rx->sta->sta.addr,
  242. hdr->addr1, hwaccel, rx->security_idx,
  243. &rx->tkip.iv32,
  244. &rx->tkip.iv16);
  245. if (res != TKIP_DECRYPT_OK)
  246. return RX_DROP_UNUSABLE;
  247. /* Trim ICV */
  248. if (!(status->flag & RX_FLAG_ICV_STRIPPED))
  249. skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
  250. /* Remove IV */
  251. memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
  252. skb_pull(skb, IEEE80211_TKIP_IV_LEN);
  253. return RX_CONTINUE;
  254. }
  255. static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
  256. {
  257. __le16 mask_fc;
  258. int a4_included, mgmt;
  259. u8 qos_tid;
  260. u16 len_a;
  261. unsigned int hdrlen;
  262. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  263. /*
  264. * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
  265. * Retry, PwrMgt, MoreData; set Protected
  266. */
  267. mgmt = ieee80211_is_mgmt(hdr->frame_control);
  268. mask_fc = hdr->frame_control;
  269. mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
  270. IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
  271. if (!mgmt)
  272. mask_fc &= ~cpu_to_le16(0x0070);
  273. mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
  274. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  275. len_a = hdrlen - 2;
  276. a4_included = ieee80211_has_a4(hdr->frame_control);
  277. if (ieee80211_is_data_qos(hdr->frame_control))
  278. qos_tid = ieee80211_get_tid(hdr);
  279. else
  280. qos_tid = 0;
  281. /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
  282. * mode authentication are not allowed to collide, yet both are derived
  283. * from this vector b_0. We only set L := 1 here to indicate that the
  284. * data size can be represented in (L+1) bytes. The CCM layer will take
  285. * care of storing the data length in the top (L+1) bytes and setting
  286. * and clearing the other bits as is required to derive the two IVs.
  287. */
  288. b_0[0] = 0x1;
  289. /* Nonce: Nonce Flags | A2 | PN
  290. * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
  291. */
  292. b_0[1] = qos_tid | (mgmt << 4);
  293. memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
  294. memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
  295. /* AAD (extra authenticate-only data) / masked 802.11 header
  296. * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
  297. put_unaligned_be16(len_a, &aad[0]);
  298. put_unaligned(mask_fc, (__le16 *)&aad[2]);
  299. memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
  300. /* Mask Seq#, leave Frag# */
  301. aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
  302. aad[23] = 0;
  303. if (a4_included) {
  304. memcpy(&aad[24], hdr->addr4, ETH_ALEN);
  305. aad[30] = qos_tid;
  306. aad[31] = 0;
  307. } else {
  308. memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
  309. aad[24] = qos_tid;
  310. }
  311. }
  312. static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
  313. {
  314. hdr[0] = pn[5];
  315. hdr[1] = pn[4];
  316. hdr[2] = 0;
  317. hdr[3] = 0x20 | (key_id << 6);
  318. hdr[4] = pn[3];
  319. hdr[5] = pn[2];
  320. hdr[6] = pn[1];
  321. hdr[7] = pn[0];
  322. }
  323. static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
  324. {
  325. pn[0] = hdr[7];
  326. pn[1] = hdr[6];
  327. pn[2] = hdr[5];
  328. pn[3] = hdr[4];
  329. pn[4] = hdr[1];
  330. pn[5] = hdr[0];
  331. }
  332. static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
  333. unsigned int mic_len)
  334. {
  335. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  336. struct ieee80211_key *key = tx->key;
  337. struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  338. int hdrlen, len, tail;
  339. u8 *pos;
  340. u8 pn[6];
  341. u64 pn64;
  342. u8 aad[CCM_AAD_LEN];
  343. u8 b_0[AES_BLOCK_SIZE];
  344. if (info->control.hw_key &&
  345. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
  346. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
  347. !((info->control.hw_key->flags &
  348. IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
  349. ieee80211_is_mgmt(hdr->frame_control))) {
  350. /*
  351. * hwaccel has no need for preallocated room for CCMP
  352. * header or MIC fields
  353. */
  354. return 0;
  355. }
  356. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  357. len = skb->len - hdrlen;
  358. if (info->control.hw_key)
  359. tail = 0;
  360. else
  361. tail = mic_len;
  362. if (WARN_ON(skb_tailroom(skb) < tail ||
  363. skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
  364. return -1;
  365. pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
  366. memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
  367. /* the HW only needs room for the IV, but not the actual IV */
  368. if (info->control.hw_key &&
  369. (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
  370. return 0;
  371. hdr = (struct ieee80211_hdr *) pos;
  372. pos += hdrlen;
  373. pn64 = atomic64_inc_return(&key->conf.tx_pn);
  374. pn[5] = pn64;
  375. pn[4] = pn64 >> 8;
  376. pn[3] = pn64 >> 16;
  377. pn[2] = pn64 >> 24;
  378. pn[1] = pn64 >> 32;
  379. pn[0] = pn64 >> 40;
  380. ccmp_pn2hdr(pos, pn, key->conf.keyidx);
  381. /* hwaccel - with software CCMP header */
  382. if (info->control.hw_key)
  383. return 0;
  384. pos += IEEE80211_CCMP_HDR_LEN;
  385. ccmp_special_blocks(skb, pn, b_0, aad);
  386. return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
  387. skb_put(skb, mic_len));
  388. }
  389. ieee80211_tx_result
  390. ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
  391. unsigned int mic_len)
  392. {
  393. struct sk_buff *skb;
  394. ieee80211_tx_set_protected(tx);
  395. skb_queue_walk(&tx->skbs, skb) {
  396. if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
  397. return TX_DROP;
  398. }
  399. return TX_CONTINUE;
  400. }
  401. ieee80211_rx_result
  402. ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
  403. unsigned int mic_len)
  404. {
  405. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  406. int hdrlen;
  407. struct ieee80211_key *key = rx->key;
  408. struct sk_buff *skb = rx->skb;
  409. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  410. u8 pn[IEEE80211_CCMP_PN_LEN];
  411. int data_len;
  412. int queue;
  413. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  414. if (!ieee80211_is_data(hdr->frame_control) &&
  415. !ieee80211_is_robust_mgmt_frame(skb))
  416. return RX_CONTINUE;
  417. if (status->flag & RX_FLAG_DECRYPTED) {
  418. if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
  419. return RX_DROP_UNUSABLE;
  420. if (status->flag & RX_FLAG_MIC_STRIPPED)
  421. mic_len = 0;
  422. } else {
  423. if (skb_linearize(rx->skb))
  424. return RX_DROP_UNUSABLE;
  425. }
  426. /* reload hdr - skb might have been reallocated */
  427. hdr = (void *)rx->skb->data;
  428. data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
  429. if (!rx->sta || data_len < 0)
  430. return RX_DROP_UNUSABLE;
  431. if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
  432. int res;
  433. ccmp_hdr2pn(pn, skb->data + hdrlen);
  434. queue = rx->security_idx;
  435. res = memcmp(pn, key->u.ccmp.rx_pn[queue],
  436. IEEE80211_CCMP_PN_LEN);
  437. if (res < 0 ||
  438. (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
  439. key->u.ccmp.replays++;
  440. return RX_DROP_UNUSABLE;
  441. }
  442. if (!(status->flag & RX_FLAG_DECRYPTED)) {
  443. u8 aad[2 * AES_BLOCK_SIZE];
  444. u8 b_0[AES_BLOCK_SIZE];
  445. /* hardware didn't decrypt/verify MIC */
  446. ccmp_special_blocks(skb, pn, b_0, aad);
  447. if (ieee80211_aes_ccm_decrypt(
  448. key->u.ccmp.tfm, b_0, aad,
  449. skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
  450. data_len,
  451. skb->data + skb->len - mic_len))
  452. return RX_DROP_UNUSABLE;
  453. }
  454. memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
  455. if (unlikely(ieee80211_is_frag(hdr)))
  456. memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
  457. }
  458. /* Remove CCMP header and MIC */
  459. if (pskb_trim(skb, skb->len - mic_len))
  460. return RX_DROP_UNUSABLE;
  461. memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
  462. skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
  463. return RX_CONTINUE;
  464. }
  465. static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
  466. {
  467. __le16 mask_fc;
  468. u8 qos_tid;
  469. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  470. memcpy(j_0, hdr->addr2, ETH_ALEN);
  471. memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
  472. j_0[13] = 0;
  473. j_0[14] = 0;
  474. j_0[AES_BLOCK_SIZE - 1] = 0x01;
  475. /* AAD (extra authenticate-only data) / masked 802.11 header
  476. * FC | A1 | A2 | A3 | SC | [A4] | [QC]
  477. */
  478. put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
  479. /* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
  480. * Retry, PwrMgt, MoreData; set Protected
  481. */
  482. mask_fc = hdr->frame_control;
  483. mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
  484. IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
  485. if (!ieee80211_is_mgmt(hdr->frame_control))
  486. mask_fc &= ~cpu_to_le16(0x0070);
  487. mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
  488. put_unaligned(mask_fc, (__le16 *)&aad[2]);
  489. memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
  490. /* Mask Seq#, leave Frag# */
  491. aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
  492. aad[23] = 0;
  493. if (ieee80211_is_data_qos(hdr->frame_control))
  494. qos_tid = ieee80211_get_tid(hdr);
  495. else
  496. qos_tid = 0;
  497. if (ieee80211_has_a4(hdr->frame_control)) {
  498. memcpy(&aad[24], hdr->addr4, ETH_ALEN);
  499. aad[30] = qos_tid;
  500. aad[31] = 0;
  501. } else {
  502. memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
  503. aad[24] = qos_tid;
  504. }
  505. }
  506. static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
  507. {
  508. hdr[0] = pn[5];
  509. hdr[1] = pn[4];
  510. hdr[2] = 0;
  511. hdr[3] = 0x20 | (key_id << 6);
  512. hdr[4] = pn[3];
  513. hdr[5] = pn[2];
  514. hdr[6] = pn[1];
  515. hdr[7] = pn[0];
  516. }
  517. static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
  518. {
  519. pn[0] = hdr[7];
  520. pn[1] = hdr[6];
  521. pn[2] = hdr[5];
  522. pn[3] = hdr[4];
  523. pn[4] = hdr[1];
  524. pn[5] = hdr[0];
  525. }
  526. static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
  527. {
  528. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  529. struct ieee80211_key *key = tx->key;
  530. struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  531. int hdrlen, len, tail;
  532. u8 *pos;
  533. u8 pn[6];
  534. u64 pn64;
  535. u8 aad[GCM_AAD_LEN];
  536. u8 j_0[AES_BLOCK_SIZE];
  537. if (info->control.hw_key &&
  538. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
  539. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
  540. !((info->control.hw_key->flags &
  541. IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
  542. ieee80211_is_mgmt(hdr->frame_control))) {
  543. /* hwaccel has no need for preallocated room for GCMP
  544. * header or MIC fields
  545. */
  546. return 0;
  547. }
  548. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  549. len = skb->len - hdrlen;
  550. if (info->control.hw_key)
  551. tail = 0;
  552. else
  553. tail = IEEE80211_GCMP_MIC_LEN;
  554. if (WARN_ON(skb_tailroom(skb) < tail ||
  555. skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
  556. return -1;
  557. pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
  558. memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
  559. skb_set_network_header(skb, skb_network_offset(skb) +
  560. IEEE80211_GCMP_HDR_LEN);
  561. /* the HW only needs room for the IV, but not the actual IV */
  562. if (info->control.hw_key &&
  563. (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
  564. return 0;
  565. hdr = (struct ieee80211_hdr *)pos;
  566. pos += hdrlen;
  567. pn64 = atomic64_inc_return(&key->conf.tx_pn);
  568. pn[5] = pn64;
  569. pn[4] = pn64 >> 8;
  570. pn[3] = pn64 >> 16;
  571. pn[2] = pn64 >> 24;
  572. pn[1] = pn64 >> 32;
  573. pn[0] = pn64 >> 40;
  574. gcmp_pn2hdr(pos, pn, key->conf.keyidx);
  575. /* hwaccel - with software GCMP header */
  576. if (info->control.hw_key)
  577. return 0;
  578. pos += IEEE80211_GCMP_HDR_LEN;
  579. gcmp_special_blocks(skb, pn, j_0, aad);
  580. return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
  581. skb_put(skb, IEEE80211_GCMP_MIC_LEN));
  582. }
  583. ieee80211_tx_result
  584. ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
  585. {
  586. struct sk_buff *skb;
  587. ieee80211_tx_set_protected(tx);
  588. skb_queue_walk(&tx->skbs, skb) {
  589. if (gcmp_encrypt_skb(tx, skb) < 0)
  590. return TX_DROP;
  591. }
  592. return TX_CONTINUE;
  593. }
  594. ieee80211_rx_result
  595. ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
  596. {
  597. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  598. int hdrlen;
  599. struct ieee80211_key *key = rx->key;
  600. struct sk_buff *skb = rx->skb;
  601. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  602. u8 pn[IEEE80211_GCMP_PN_LEN];
  603. int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
  604. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  605. if (!ieee80211_is_data(hdr->frame_control) &&
  606. !ieee80211_is_robust_mgmt_frame(skb))
  607. return RX_CONTINUE;
  608. if (status->flag & RX_FLAG_DECRYPTED) {
  609. if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
  610. return RX_DROP_UNUSABLE;
  611. if (status->flag & RX_FLAG_MIC_STRIPPED)
  612. mic_len = 0;
  613. } else {
  614. if (skb_linearize(rx->skb))
  615. return RX_DROP_UNUSABLE;
  616. }
  617. /* reload hdr - skb might have been reallocated */
  618. hdr = (void *)rx->skb->data;
  619. data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
  620. if (!rx->sta || data_len < 0)
  621. return RX_DROP_UNUSABLE;
  622. if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
  623. int res;
  624. gcmp_hdr2pn(pn, skb->data + hdrlen);
  625. queue = rx->security_idx;
  626. res = memcmp(pn, key->u.gcmp.rx_pn[queue],
  627. IEEE80211_GCMP_PN_LEN);
  628. if (res < 0 ||
  629. (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
  630. key->u.gcmp.replays++;
  631. return RX_DROP_UNUSABLE;
  632. }
  633. if (!(status->flag & RX_FLAG_DECRYPTED)) {
  634. u8 aad[2 * AES_BLOCK_SIZE];
  635. u8 j_0[AES_BLOCK_SIZE];
  636. /* hardware didn't decrypt/verify MIC */
  637. gcmp_special_blocks(skb, pn, j_0, aad);
  638. if (ieee80211_aes_gcm_decrypt(
  639. key->u.gcmp.tfm, j_0, aad,
  640. skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
  641. data_len,
  642. skb->data + skb->len -
  643. IEEE80211_GCMP_MIC_LEN))
  644. return RX_DROP_UNUSABLE;
  645. }
  646. memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
  647. if (unlikely(ieee80211_is_frag(hdr)))
  648. memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
  649. }
  650. /* Remove GCMP header and MIC */
  651. if (pskb_trim(skb, skb->len - mic_len))
  652. return RX_DROP_UNUSABLE;
  653. memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
  654. skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
  655. return RX_CONTINUE;
  656. }
  657. static ieee80211_tx_result
  658. ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
  659. struct sk_buff *skb)
  660. {
  661. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  662. struct ieee80211_key *key = tx->key;
  663. struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  664. int hdrlen;
  665. u8 *pos, iv_len = key->conf.iv_len;
  666. if (info->control.hw_key &&
  667. !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
  668. /* hwaccel has no need for preallocated head room */
  669. return TX_CONTINUE;
  670. }
  671. if (unlikely(skb_headroom(skb) < iv_len &&
  672. pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
  673. return TX_DROP;
  674. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  675. pos = skb_push(skb, iv_len);
  676. memmove(pos, pos + iv_len, hdrlen);
  677. return TX_CONTINUE;
  678. }
  679. static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
  680. {
  681. int i;
  682. /* pn is little endian */
  683. for (i = len - 1; i >= 0; i--) {
  684. if (pn1[i] < pn2[i])
  685. return -1;
  686. else if (pn1[i] > pn2[i])
  687. return 1;
  688. }
  689. return 0;
  690. }
  691. static ieee80211_rx_result
  692. ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
  693. {
  694. struct ieee80211_key *key = rx->key;
  695. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  696. const struct ieee80211_cipher_scheme *cs = NULL;
  697. int hdrlen = ieee80211_hdrlen(hdr->frame_control);
  698. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  699. int data_len;
  700. u8 *rx_pn;
  701. u8 *skb_pn;
  702. u8 qos_tid;
  703. if (!rx->sta || !rx->sta->cipher_scheme ||
  704. !(status->flag & RX_FLAG_DECRYPTED))
  705. return RX_DROP_UNUSABLE;
  706. if (!ieee80211_is_data(hdr->frame_control))
  707. return RX_CONTINUE;
  708. cs = rx->sta->cipher_scheme;
  709. data_len = rx->skb->len - hdrlen - cs->hdr_len;
  710. if (data_len < 0)
  711. return RX_DROP_UNUSABLE;
  712. if (ieee80211_is_data_qos(hdr->frame_control))
  713. qos_tid = ieee80211_get_tid(hdr);
  714. else
  715. qos_tid = 0;
  716. if (skb_linearize(rx->skb))
  717. return RX_DROP_UNUSABLE;
  718. hdr = (struct ieee80211_hdr *)rx->skb->data;
  719. rx_pn = key->u.gen.rx_pn[qos_tid];
  720. skb_pn = rx->skb->data + hdrlen + cs->pn_off;
  721. if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
  722. return RX_DROP_UNUSABLE;
  723. memcpy(rx_pn, skb_pn, cs->pn_len);
  724. /* remove security header and MIC */
  725. if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
  726. return RX_DROP_UNUSABLE;
  727. memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
  728. skb_pull(rx->skb, cs->hdr_len);
  729. return RX_CONTINUE;
  730. }
  731. static void bip_aad(struct sk_buff *skb, u8 *aad)
  732. {
  733. __le16 mask_fc;
  734. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  735. /* BIP AAD: FC(masked) || A1 || A2 || A3 */
  736. /* FC type/subtype */
  737. /* Mask FC Retry, PwrMgt, MoreData flags to zero */
  738. mask_fc = hdr->frame_control;
  739. mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
  740. IEEE80211_FCTL_MOREDATA);
  741. put_unaligned(mask_fc, (__le16 *) &aad[0]);
  742. /* A1 || A2 || A3 */
  743. memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
  744. }
  745. static inline void bip_ipn_set64(u8 *d, u64 pn)
  746. {
  747. *d++ = pn;
  748. *d++ = pn >> 8;
  749. *d++ = pn >> 16;
  750. *d++ = pn >> 24;
  751. *d++ = pn >> 32;
  752. *d = pn >> 40;
  753. }
  754. static inline void bip_ipn_swap(u8 *d, const u8 *s)
  755. {
  756. *d++ = s[5];
  757. *d++ = s[4];
  758. *d++ = s[3];
  759. *d++ = s[2];
  760. *d++ = s[1];
  761. *d = s[0];
  762. }
  763. ieee80211_tx_result
  764. ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
  765. {
  766. struct sk_buff *skb;
  767. struct ieee80211_tx_info *info;
  768. struct ieee80211_key *key = tx->key;
  769. struct ieee80211_mmie *mmie;
  770. u8 aad[20];
  771. u64 pn64;
  772. if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  773. return TX_DROP;
  774. skb = skb_peek(&tx->skbs);
  775. info = IEEE80211_SKB_CB(skb);
  776. if (info->control.hw_key &&
  777. !(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIE))
  778. return TX_CONTINUE;
  779. if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
  780. return TX_DROP;
  781. mmie = skb_put(skb, sizeof(*mmie));
  782. mmie->element_id = WLAN_EID_MMIE;
  783. mmie->length = sizeof(*mmie) - 2;
  784. mmie->key_id = cpu_to_le16(key->conf.keyidx);
  785. /* PN = PN + 1 */
  786. pn64 = atomic64_inc_return(&key->conf.tx_pn);
  787. bip_ipn_set64(mmie->sequence_number, pn64);
  788. if (info->control.hw_key)
  789. return TX_CONTINUE;
  790. bip_aad(skb, aad);
  791. /*
  792. * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
  793. */
  794. ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
  795. skb->data + 24, skb->len - 24, mmie->mic);
  796. return TX_CONTINUE;
  797. }
  798. ieee80211_tx_result
  799. ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
  800. {
  801. struct sk_buff *skb;
  802. struct ieee80211_tx_info *info;
  803. struct ieee80211_key *key = tx->key;
  804. struct ieee80211_mmie_16 *mmie;
  805. u8 aad[20];
  806. u64 pn64;
  807. if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  808. return TX_DROP;
  809. skb = skb_peek(&tx->skbs);
  810. info = IEEE80211_SKB_CB(skb);
  811. if (info->control.hw_key)
  812. return TX_CONTINUE;
  813. if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
  814. return TX_DROP;
  815. mmie = skb_put(skb, sizeof(*mmie));
  816. mmie->element_id = WLAN_EID_MMIE;
  817. mmie->length = sizeof(*mmie) - 2;
  818. mmie->key_id = cpu_to_le16(key->conf.keyidx);
  819. /* PN = PN + 1 */
  820. pn64 = atomic64_inc_return(&key->conf.tx_pn);
  821. bip_ipn_set64(mmie->sequence_number, pn64);
  822. bip_aad(skb, aad);
  823. /* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
  824. */
  825. ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
  826. skb->data + 24, skb->len - 24, mmie->mic);
  827. return TX_CONTINUE;
  828. }
  829. ieee80211_rx_result
  830. ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
  831. {
  832. struct sk_buff *skb = rx->skb;
  833. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  834. struct ieee80211_key *key = rx->key;
  835. struct ieee80211_mmie *mmie;
  836. u8 aad[20], mic[8], ipn[6];
  837. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  838. if (!ieee80211_is_mgmt(hdr->frame_control))
  839. return RX_CONTINUE;
  840. /* management frames are already linear */
  841. if (skb->len < 24 + sizeof(*mmie))
  842. return RX_DROP_UNUSABLE;
  843. mmie = (struct ieee80211_mmie *)
  844. (skb->data + skb->len - sizeof(*mmie));
  845. if (mmie->element_id != WLAN_EID_MMIE ||
  846. mmie->length != sizeof(*mmie) - 2)
  847. return RX_DROP_UNUSABLE; /* Invalid MMIE */
  848. bip_ipn_swap(ipn, mmie->sequence_number);
  849. if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
  850. key->u.aes_cmac.replays++;
  851. return RX_DROP_UNUSABLE;
  852. }
  853. if (!(status->flag & RX_FLAG_DECRYPTED)) {
  854. /* hardware didn't decrypt/verify MIC */
  855. bip_aad(skb, aad);
  856. ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
  857. skb->data + 24, skb->len - 24, mic);
  858. if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
  859. key->u.aes_cmac.icverrors++;
  860. return RX_DROP_UNUSABLE;
  861. }
  862. }
  863. memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
  864. /* Remove MMIE */
  865. skb_trim(skb, skb->len - sizeof(*mmie));
  866. return RX_CONTINUE;
  867. }
  868. ieee80211_rx_result
  869. ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
  870. {
  871. struct sk_buff *skb = rx->skb;
  872. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  873. struct ieee80211_key *key = rx->key;
  874. struct ieee80211_mmie_16 *mmie;
  875. u8 aad[20], mic[16], ipn[6];
  876. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  877. if (!ieee80211_is_mgmt(hdr->frame_control))
  878. return RX_CONTINUE;
  879. /* management frames are already linear */
  880. if (skb->len < 24 + sizeof(*mmie))
  881. return RX_DROP_UNUSABLE;
  882. mmie = (struct ieee80211_mmie_16 *)
  883. (skb->data + skb->len - sizeof(*mmie));
  884. if (mmie->element_id != WLAN_EID_MMIE ||
  885. mmie->length != sizeof(*mmie) - 2)
  886. return RX_DROP_UNUSABLE; /* Invalid MMIE */
  887. bip_ipn_swap(ipn, mmie->sequence_number);
  888. if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
  889. key->u.aes_cmac.replays++;
  890. return RX_DROP_UNUSABLE;
  891. }
  892. if (!(status->flag & RX_FLAG_DECRYPTED)) {
  893. /* hardware didn't decrypt/verify MIC */
  894. bip_aad(skb, aad);
  895. ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
  896. skb->data + 24, skb->len - 24, mic);
  897. if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
  898. key->u.aes_cmac.icverrors++;
  899. return RX_DROP_UNUSABLE;
  900. }
  901. }
  902. memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
  903. /* Remove MMIE */
  904. skb_trim(skb, skb->len - sizeof(*mmie));
  905. return RX_CONTINUE;
  906. }
  907. ieee80211_tx_result
  908. ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
  909. {
  910. struct sk_buff *skb;
  911. struct ieee80211_tx_info *info;
  912. struct ieee80211_key *key = tx->key;
  913. struct ieee80211_mmie_16 *mmie;
  914. struct ieee80211_hdr *hdr;
  915. u8 aad[GMAC_AAD_LEN];
  916. u64 pn64;
  917. u8 nonce[GMAC_NONCE_LEN];
  918. if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
  919. return TX_DROP;
  920. skb = skb_peek(&tx->skbs);
  921. info = IEEE80211_SKB_CB(skb);
  922. if (info->control.hw_key)
  923. return TX_CONTINUE;
  924. if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
  925. return TX_DROP;
  926. mmie = skb_put(skb, sizeof(*mmie));
  927. mmie->element_id = WLAN_EID_MMIE;
  928. mmie->length = sizeof(*mmie) - 2;
  929. mmie->key_id = cpu_to_le16(key->conf.keyidx);
  930. /* PN = PN + 1 */
  931. pn64 = atomic64_inc_return(&key->conf.tx_pn);
  932. bip_ipn_set64(mmie->sequence_number, pn64);
  933. bip_aad(skb, aad);
  934. hdr = (struct ieee80211_hdr *)skb->data;
  935. memcpy(nonce, hdr->addr2, ETH_ALEN);
  936. bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
  937. /* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
  938. if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
  939. skb->data + 24, skb->len - 24, mmie->mic) < 0)
  940. return TX_DROP;
  941. return TX_CONTINUE;
  942. }
  943. ieee80211_rx_result
  944. ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
  945. {
  946. struct sk_buff *skb = rx->skb;
  947. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  948. struct ieee80211_key *key = rx->key;
  949. struct ieee80211_mmie_16 *mmie;
  950. u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
  951. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  952. if (!ieee80211_is_mgmt(hdr->frame_control))
  953. return RX_CONTINUE;
  954. /* management frames are already linear */
  955. if (skb->len < 24 + sizeof(*mmie))
  956. return RX_DROP_UNUSABLE;
  957. mmie = (struct ieee80211_mmie_16 *)
  958. (skb->data + skb->len - sizeof(*mmie));
  959. if (mmie->element_id != WLAN_EID_MMIE ||
  960. mmie->length != sizeof(*mmie) - 2)
  961. return RX_DROP_UNUSABLE; /* Invalid MMIE */
  962. bip_ipn_swap(ipn, mmie->sequence_number);
  963. if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
  964. key->u.aes_gmac.replays++;
  965. return RX_DROP_UNUSABLE;
  966. }
  967. if (!(status->flag & RX_FLAG_DECRYPTED)) {
  968. /* hardware didn't decrypt/verify MIC */
  969. bip_aad(skb, aad);
  970. memcpy(nonce, hdr->addr2, ETH_ALEN);
  971. memcpy(nonce + ETH_ALEN, ipn, 6);
  972. mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC);
  973. if (!mic)
  974. return RX_DROP_UNUSABLE;
  975. if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
  976. skb->data + 24, skb->len - 24,
  977. mic) < 0 ||
  978. crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
  979. key->u.aes_gmac.icverrors++;
  980. kfree(mic);
  981. return RX_DROP_UNUSABLE;
  982. }
  983. kfree(mic);
  984. }
  985. memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
  986. /* Remove MMIE */
  987. skb_trim(skb, skb->len - sizeof(*mmie));
  988. return RX_CONTINUE;
  989. }
  990. ieee80211_tx_result
  991. ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
  992. {
  993. struct sk_buff *skb;
  994. struct ieee80211_tx_info *info = NULL;
  995. ieee80211_tx_result res;
  996. skb_queue_walk(&tx->skbs, skb) {
  997. info = IEEE80211_SKB_CB(skb);
  998. /* handle hw-only algorithm */
  999. if (!info->control.hw_key)
  1000. return TX_DROP;
  1001. if (tx->key->flags & KEY_FLAG_CIPHER_SCHEME) {
  1002. res = ieee80211_crypto_cs_encrypt(tx, skb);
  1003. if (res != TX_CONTINUE)
  1004. return res;
  1005. }
  1006. }
  1007. ieee80211_tx_set_protected(tx);
  1008. return TX_CONTINUE;
  1009. }
  1010. ieee80211_rx_result
  1011. ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
  1012. {
  1013. if (rx->sta && rx->sta->cipher_scheme)
  1014. return ieee80211_crypto_cs_decrypt(rx);
  1015. return RX_DROP_UNUSABLE;
  1016. }