xref: /freebsd/sys/net80211/ieee80211_crypto_tkip.c (revision 06c3fb2749bda94cb5201f81ffdb8fa6c3161b2e)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 /*
30  * IEEE 802.11i TKIP crypto support.
31  *
32  * Part of this module is derived from similar code in the Host
33  * AP driver. The code is used with the consent of the author and
34  * it's license is included below.
35  */
36 #include "opt_wlan.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/malloc.h>
42 #include <sys/kernel.h>
43 #include <sys/module.h>
44 #include <sys/endian.h>
45 
46 #include <sys/socket.h>
47 
48 #include <net/if.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 
52 #include <net80211/ieee80211_var.h>
53 
54 static	void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *);
55 static	void tkip_detach(struct ieee80211_key *);
56 static	int tkip_setkey(struct ieee80211_key *);
57 static	void tkip_setiv(struct ieee80211_key *, uint8_t *);
58 static	int tkip_encap(struct ieee80211_key *, struct mbuf *);
59 static	int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
60 static	int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
61 static	int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
62 
63 static const struct ieee80211_cipher tkip  = {
64 	.ic_name	= "TKIP",
65 	.ic_cipher	= IEEE80211_CIPHER_TKIP,
66 	.ic_header	= IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
67 			  IEEE80211_WEP_EXTIVLEN,
68 	.ic_trailer	= IEEE80211_WEP_CRCLEN,
69 	.ic_miclen	= IEEE80211_WEP_MICLEN,
70 	.ic_attach	= tkip_attach,
71 	.ic_detach	= tkip_detach,
72 	.ic_setkey	= tkip_setkey,
73 	.ic_setiv	= tkip_setiv,
74 	.ic_encap	= tkip_encap,
75 	.ic_decap	= tkip_decap,
76 	.ic_enmic	= tkip_enmic,
77 	.ic_demic	= tkip_demic,
78 };
79 
80 typedef	uint8_t u8;
81 typedef	uint16_t u16;
82 typedef	uint32_t __u32;
83 typedef	uint32_t u32;
84 
85 struct tkip_ctx {
86 	struct ieee80211vap *tc_vap;	/* for diagnostics+statistics */
87 
88 	u16	tx_ttak[5];
89 	u8	tx_rc4key[16];		/* XXX for test module; make locals? */
90 
91 	u16	rx_ttak[5];
92 	int	rx_phase1_done;
93 	u8	rx_rc4key[16];		/* XXX for test module; make locals? */
94 	uint64_t rx_rsc;		/* held until MIC verified */
95 };
96 
97 static	void michael_mic(struct tkip_ctx *, const u8 *key,
98 		struct mbuf *m, u_int off, size_t data_len,
99 		u8 mic[IEEE80211_WEP_MICLEN]);
100 static	int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
101 		struct mbuf *, int hdr_len);
102 static	int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
103 		struct mbuf *, int hdr_len);
104 
105 /* number of references from net80211 layer */
106 static	int nrefs = 0;
107 
108 static void *
109 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k)
110 {
111 	struct tkip_ctx *ctx;
112 
113 	ctx = (struct tkip_ctx *) IEEE80211_MALLOC(sizeof(struct tkip_ctx),
114 		M_80211_CRYPTO, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
115 	if (ctx == NULL) {
116 		vap->iv_stats.is_crypto_nomem++;
117 		return NULL;
118 	}
119 
120 	ctx->tc_vap = vap;
121 	nrefs++;			/* NB: we assume caller locking */
122 	return ctx;
123 }
124 
125 static void
126 tkip_detach(struct ieee80211_key *k)
127 {
128 	struct tkip_ctx *ctx = k->wk_private;
129 
130 	IEEE80211_FREE(ctx, M_80211_CRYPTO);
131 	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
132 	nrefs--;			/* NB: we assume caller locking */
133 }
134 
135 static int
136 tkip_setkey(struct ieee80211_key *k)
137 {
138 	struct tkip_ctx *ctx = k->wk_private;
139 
140 	if (k->wk_keylen != (128/NBBY)) {
141 		(void) ctx;		/* XXX */
142 		IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO,
143 			"%s: Invalid key length %u, expecting %u\n",
144 			__func__, k->wk_keylen, 128/NBBY);
145 		return 0;
146 	}
147 	ctx->rx_phase1_done = 0;
148 	return 1;
149 }
150 
151 static void
152 tkip_setiv(struct ieee80211_key *k, uint8_t *ivp)
153 {
154 	struct tkip_ctx *ctx = k->wk_private;
155 	struct ieee80211vap *vap = ctx->tc_vap;
156 	uint8_t keyid;
157 
158 	keyid = ieee80211_crypto_get_keyid(vap, k) << 6;
159 
160 	k->wk_keytsc++;
161 	ivp[0] = k->wk_keytsc >> 8;		/* TSC1 */
162 	ivp[1] = (ivp[0] | 0x20) & 0x7f;	/* WEP seed */
163 	ivp[2] = k->wk_keytsc >> 0;		/* TSC0 */
164 	ivp[3] = keyid | IEEE80211_WEP_EXTIV;	/* KeyID | ExtID */
165 	ivp[4] = k->wk_keytsc >> 16;		/* TSC2 */
166 	ivp[5] = k->wk_keytsc >> 24;		/* TSC3 */
167 	ivp[6] = k->wk_keytsc >> 32;		/* TSC4 */
168 	ivp[7] = k->wk_keytsc >> 40;		/* TSC5 */
169 }
170 
171 /*
172  * Add privacy headers and do any s/w encryption required.
173  */
174 static int
175 tkip_encap(struct ieee80211_key *k, struct mbuf *m)
176 {
177 	struct tkip_ctx *ctx = k->wk_private;
178 	struct ieee80211vap *vap = ctx->tc_vap;
179 	struct ieee80211com *ic = vap->iv_ic;
180 	struct ieee80211_frame *wh;
181 	uint8_t *ivp;
182 	int hdrlen;
183 	int is_mgmt;
184 
185 	wh = mtod(m, struct ieee80211_frame *);
186 	is_mgmt = IEEE80211_IS_MGMT(wh);
187 
188 	/*
189 	 * Handle TKIP counter measures requirement.
190 	 */
191 	if (vap->iv_flags & IEEE80211_F_COUNTERM) {
192 #ifdef IEEE80211_DEBUG
193 		struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
194 #endif
195 
196 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
197 		    "discard frame due to countermeasures (%s)", __func__);
198 		vap->iv_stats.is_crypto_tkipcm++;
199 		return 0;
200 	}
201 
202 	/*
203 	 * Check to see whether IV needs to be included.
204 	 */
205 	if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOIVMGT))
206 		return 1;
207 	if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOIV))
208 		return 1;
209 
210 	hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
211 
212 	/*
213 	 * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
214 	 */
215 	M_PREPEND(m, tkip.ic_header, IEEE80211_M_NOWAIT);
216 	if (m == NULL)
217 		return 0;
218 	ivp = mtod(m, uint8_t *);
219 	memmove(ivp, ivp + tkip.ic_header, hdrlen);
220 	ivp += hdrlen;
221 
222 	tkip_setiv(k, ivp);
223 
224 	/*
225 	 * Finally, do software encrypt if needed.
226 	 */
227 	if ((k->wk_flags & IEEE80211_KEY_SWENCRYPT) &&
228 	    !tkip_encrypt(ctx, k, m, hdrlen))
229 		return 0;
230 
231 	return 1;
232 }
233 
234 /*
235  * Add MIC to the frame as needed.
236  */
237 static int
238 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
239 {
240 	struct tkip_ctx *ctx = k->wk_private;
241 	struct ieee80211_frame *wh;
242 	int is_mgmt;
243 
244 	wh = mtod(m, struct ieee80211_frame *);
245 	is_mgmt = IEEE80211_IS_MGMT(wh);
246 
247 	/*
248 	 * Check to see whether MIC needs to be included.
249 	 */
250 	if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOMICMGT))
251 		return 1;
252 	if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOMIC))
253 		return 1;
254 
255 	if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) {
256 		struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
257 		struct ieee80211vap *vap = ctx->tc_vap;
258 		struct ieee80211com *ic = vap->iv_ic;
259 		int hdrlen;
260 		uint8_t mic[IEEE80211_WEP_MICLEN];
261 
262 		vap->iv_stats.is_crypto_tkipenmic++;
263 
264 		hdrlen = ieee80211_hdrspace(ic, wh);
265 
266 		michael_mic(ctx, k->wk_txmic,
267 			m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
268 		return m_append(m, tkip.ic_miclen, mic);
269 	}
270 	return 1;
271 }
272 
273 static __inline uint64_t
274 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
275 {
276 	uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
277 	uint16_t iv16 = (b4 << 0) | (b5 << 8);
278 	return (((uint64_t)iv16) << 32) | iv32;
279 }
280 
281 /*
282  * Validate and strip privacy headers (and trailer) for a
283  * received frame.  If necessary, decrypt the frame using
284  * the specified key.
285  */
286 static int
287 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
288 {
289 	const struct ieee80211_rx_stats *rxs;
290 	struct tkip_ctx *ctx = k->wk_private;
291 	struct ieee80211vap *vap = ctx->tc_vap;
292 	struct ieee80211_frame *wh;
293 	uint8_t *ivp, tid;
294 
295 	rxs = ieee80211_get_rx_params_ptr(m);
296 
297 	/*
298 	 * If IV has been stripped, we skip most of the below.
299 	 */
300 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))
301 		goto finish;
302 
303 	/*
304 	 * Header should have extended IV and sequence number;
305 	 * verify the former and validate the latter.
306 	 */
307 	wh = mtod(m, struct ieee80211_frame *);
308 	ivp = mtod(m, uint8_t *) + hdrlen;
309 	if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
310 		/*
311 		 * No extended IV; discard frame.
312 		 */
313 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
314 		    "%s", "missing ExtIV for TKIP cipher");
315 		vap->iv_stats.is_rx_tkipformat++;
316 		return 0;
317 	}
318 	/*
319 	 * Handle TKIP counter measures requirement.
320 	 */
321 	if (vap->iv_flags & IEEE80211_F_COUNTERM) {
322 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
323 		    "discard frame due to countermeasures (%s)", __func__);
324 		vap->iv_stats.is_crypto_tkipcm++;
325 		return 0;
326 	}
327 
328 	tid = ieee80211_gettid(wh);
329 	ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
330 	if (ctx->rx_rsc <= k->wk_keyrsc[tid] &&
331 	    (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) {
332 		/*
333 		 * Replay violation; notify upper layer.
334 		 */
335 		ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid);
336 		vap->iv_stats.is_rx_tkipreplay++;
337 		return 0;
338 	}
339 	/*
340 	 * NB: We can't update the rsc in the key until MIC is verified.
341 	 *
342 	 * We assume we are not preempted between doing the check above
343 	 * and updating wk_keyrsc when stripping the MIC in tkip_demic.
344 	 * Otherwise we might process another packet and discard it as
345 	 * a replay.
346 	 */
347 
348 	/*
349 	 * Check if the device handled the decrypt in hardware.
350 	 * If so we just strip the header; otherwise we need to
351 	 * handle the decrypt in software.
352 	 */
353 	if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
354 	    !tkip_decrypt(ctx, k, m, hdrlen))
355 		return 0;
356 
357 finish:
358 
359 	/*
360 	 * Copy up 802.11 header and strip crypto bits - but only if we
361 	 * are required to.
362 	 */
363 	if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
364 		memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *),
365 		    hdrlen);
366 		m_adj(m, tkip.ic_header);
367 	}
368 
369 	/*
370 	 * XXX TODO: do we need an option to potentially not strip the
371 	 * WEP trailer?  Does "MMIC_STRIP" also mean this? Or?
372 	 */
373 	m_adj(m, -tkip.ic_trailer);
374 
375 	return 1;
376 }
377 
378 /*
379  * Verify and strip MIC from the frame.
380  */
381 static int
382 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
383 {
384 	const struct ieee80211_rx_stats *rxs;
385 	struct tkip_ctx *ctx = k->wk_private;
386 	struct ieee80211_frame *wh;
387 	uint8_t tid;
388 
389 	wh = mtod(m, struct ieee80211_frame *);
390 	rxs = ieee80211_get_rx_params_ptr(m);
391 
392 	/*
393 	 * If we are told about a MIC failure from the driver,
394 	 * directly notify as a michael failure to the upper
395 	 * layers.
396 	 */
397 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_FAIL_MIC)) {
398 		struct ieee80211vap *vap = ctx->tc_vap;
399 		ieee80211_notify_michael_failure(vap, wh,
400 		    k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
401 		    k->wk_rxkeyix : k->wk_keyix);
402 		return 0;
403 	}
404 
405 	/*
406 	 * If IV has been stripped, we skip most of the below.
407 	 */
408 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_MMIC_STRIP))
409 		goto finish;
410 
411 	if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) {
412 		struct ieee80211vap *vap = ctx->tc_vap;
413 		int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh);
414 		u8 mic[IEEE80211_WEP_MICLEN];
415 		u8 mic0[IEEE80211_WEP_MICLEN];
416 
417 		vap->iv_stats.is_crypto_tkipdemic++;
418 
419 		michael_mic(ctx, k->wk_rxmic,
420 			m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
421 			mic);
422 		m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
423 			tkip.ic_miclen, mic0);
424 		if (memcmp(mic, mic0, tkip.ic_miclen)) {
425 			/* NB: 802.11 layer handles statistic and debug msg */
426 			ieee80211_notify_michael_failure(vap, wh,
427 				k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
428 					k->wk_rxkeyix : k->wk_keyix);
429 			return 0;
430 		}
431 	}
432 	/*
433 	 * Strip MIC from the tail.
434 	 */
435 	m_adj(m, -tkip.ic_miclen);
436 
437 	/*
438 	 * Ok to update rsc now that MIC has been verified.
439 	 */
440 	tid = ieee80211_gettid(wh);
441 	k->wk_keyrsc[tid] = ctx->rx_rsc;
442 
443 finish:
444 	return 1;
445 }
446 
447 /*
448  * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
449  *
450  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
451  *
452  * This program is free software; you can redistribute it and/or modify
453  * it under the terms of the GNU General Public License version 2 as
454  * published by the Free Software Foundation. See README and COPYING for
455  * more details.
456  *
457  * Alternatively, this software may be distributed under the terms of BSD
458  * license.
459  */
460 
461 static const __u32 crc32_table[256] = {
462 	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
463 	0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
464 	0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
465 	0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
466 	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
467 	0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
468 	0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
469 	0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
470 	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
471 	0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
472 	0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
473 	0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
474 	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
475 	0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
476 	0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
477 	0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
478 	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
479 	0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
480 	0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
481 	0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
482 	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
483 	0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
484 	0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
485 	0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
486 	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
487 	0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
488 	0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
489 	0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
490 	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
491 	0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
492 	0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
493 	0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
494 	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
495 	0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
496 	0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
497 	0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
498 	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
499 	0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
500 	0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
501 	0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
502 	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
503 	0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
504 	0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
505 	0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
506 	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
507 	0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
508 	0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
509 	0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
510 	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
511 	0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
512 	0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
513 	0x2d02ef8dL
514 };
515 
516 static __inline u16 RotR1(u16 val)
517 {
518 	return (val >> 1) | (val << 15);
519 }
520 
521 static __inline u8 Lo8(u16 val)
522 {
523 	return val & 0xff;
524 }
525 
526 static __inline u8 Hi8(u16 val)
527 {
528 	return val >> 8;
529 }
530 
531 static __inline u16 Lo16(u32 val)
532 {
533 	return val & 0xffff;
534 }
535 
536 static __inline u16 Hi16(u32 val)
537 {
538 	return val >> 16;
539 }
540 
541 static __inline u16 Mk16(u8 hi, u8 lo)
542 {
543 	return lo | (((u16) hi) << 8);
544 }
545 
546 static __inline u16 Mk16_le(const u16 *v)
547 {
548 	return le16toh(*v);
549 }
550 
551 static const u16 Sbox[256] = {
552 	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
553 	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
554 	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
555 	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
556 	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
557 	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
558 	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
559 	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
560 	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
561 	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
562 	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
563 	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
564 	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
565 	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
566 	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
567 	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
568 	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
569 	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
570 	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
571 	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
572 	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
573 	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
574 	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
575 	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
576 	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
577 	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
578 	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
579 	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
580 	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
581 	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
582 	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
583 	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
584 };
585 
586 static __inline u16 _S_(u16 v)
587 {
588 	u16 t = Sbox[Hi8(v)];
589 	return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
590 }
591 
592 #define PHASE1_LOOP_COUNT 8
593 
594 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
595 {
596 	int i, j;
597 
598 	/* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
599 	TTAK[0] = Lo16(IV32);
600 	TTAK[1] = Hi16(IV32);
601 	TTAK[2] = Mk16(TA[1], TA[0]);
602 	TTAK[3] = Mk16(TA[3], TA[2]);
603 	TTAK[4] = Mk16(TA[5], TA[4]);
604 
605 	for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
606 		j = 2 * (i & 1);
607 		TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
608 		TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
609 		TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
610 		TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
611 		TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
612 	}
613 }
614 
615 #ifndef _BYTE_ORDER
616 #error "Don't know native byte order"
617 #endif
618 
619 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
620 			       u16 IV16)
621 {
622 	/* Make temporary area overlap WEP seed so that the final copy can be
623 	 * avoided on little endian hosts. */
624 	u16 *PPK = (u16 *) &WEPSeed[4];
625 
626 	/* Step 1 - make copy of TTAK and bring in TSC */
627 	PPK[0] = TTAK[0];
628 	PPK[1] = TTAK[1];
629 	PPK[2] = TTAK[2];
630 	PPK[3] = TTAK[3];
631 	PPK[4] = TTAK[4];
632 	PPK[5] = TTAK[4] + IV16;
633 
634 	/* Step 2 - 96-bit bijective mixing using S-box */
635 	PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
636 	PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
637 	PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
638 	PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
639 	PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
640 	PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
641 
642 	PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
643 	PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
644 	PPK[2] += RotR1(PPK[1]);
645 	PPK[3] += RotR1(PPK[2]);
646 	PPK[4] += RotR1(PPK[3]);
647 	PPK[5] += RotR1(PPK[4]);
648 
649 	/* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
650 	 * WEPSeed[0..2] is transmitted as WEP IV */
651 	WEPSeed[0] = Hi8(IV16);
652 	WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
653 	WEPSeed[2] = Lo8(IV16);
654 	WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
655 
656 #if _BYTE_ORDER == _BIG_ENDIAN
657 	{
658 		int i;
659 		for (i = 0; i < 6; i++)
660 			PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
661 	}
662 #endif
663 }
664 
665 static void
666 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
667 	uint8_t icv[IEEE80211_WEP_CRCLEN])
668 {
669 	u32 i, j, k, crc;
670 	size_t buflen;
671 	u8 S[256];
672 	u8 *pos;
673 	struct mbuf *m;
674 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
675 
676 	/* Setup RC4 state */
677 	for (i = 0; i < 256; i++)
678 		S[i] = i;
679 	j = 0;
680 	for (i = 0; i < 256; i++) {
681 		j = (j + S[i] + key[i & 0x0f]) & 0xff;
682 		S_SWAP(i, j);
683 	}
684 
685 	/* Compute CRC32 over unencrypted data and apply RC4 to data */
686 	crc = ~0;
687 	i = j = 0;
688 	m = m0;
689 	pos = mtod(m, uint8_t *) + off;
690 	buflen = m->m_len - off;
691 	for (;;) {
692 		if (buflen > data_len)
693 			buflen = data_len;
694 		data_len -= buflen;
695 		for (k = 0; k < buflen; k++) {
696 			crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
697 			i = (i + 1) & 0xff;
698 			j = (j + S[i]) & 0xff;
699 			S_SWAP(i, j);
700 			*pos++ ^= S[(S[i] + S[j]) & 0xff];
701 		}
702 		m = m->m_next;
703 		if (m == NULL) {
704 			KASSERT(data_len == 0,
705 			    ("out of buffers with data_len %zu\n", data_len));
706 			break;
707 		}
708 		pos = mtod(m, uint8_t *);
709 		buflen = m->m_len;
710 	}
711 	crc = ~crc;
712 
713 	/* Append little-endian CRC32 and encrypt it to produce ICV */
714 	icv[0] = crc;
715 	icv[1] = crc >> 8;
716 	icv[2] = crc >> 16;
717 	icv[3] = crc >> 24;
718 	for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
719 		i = (i + 1) & 0xff;
720 		j = (j + S[i]) & 0xff;
721 		S_SWAP(i, j);
722 		icv[k] ^= S[(S[i] + S[j]) & 0xff];
723 	}
724 }
725 
726 static int
727 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
728 {
729 	u32 i, j, k, crc;
730 	u8 S[256];
731 	u8 *pos, icv[4];
732 	size_t buflen;
733 
734 	/* Setup RC4 state */
735 	for (i = 0; i < 256; i++)
736 		S[i] = i;
737 	j = 0;
738 	for (i = 0; i < 256; i++) {
739 		j = (j + S[i] + key[i & 0x0f]) & 0xff;
740 		S_SWAP(i, j);
741 	}
742 
743 	/* Apply RC4 to data and compute CRC32 over decrypted data */
744 	crc = ~0;
745 	i = j = 0;
746 	pos = mtod(m, uint8_t *) + off;
747 	buflen = m->m_len - off;
748 	for (;;) {
749 		if (buflen > data_len)
750 			buflen = data_len;
751 		data_len -= buflen;
752 		for (k = 0; k < buflen; k++) {
753 			i = (i + 1) & 0xff;
754 			j = (j + S[i]) & 0xff;
755 			S_SWAP(i, j);
756 			*pos ^= S[(S[i] + S[j]) & 0xff];
757 			crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
758 			pos++;
759 		}
760 		m = m->m_next;
761 		if (m == NULL) {
762 			KASSERT(data_len == 0,
763 			    ("out of buffers with data_len %zu\n", data_len));
764 			break;
765 		}
766 		pos = mtod(m, uint8_t *);
767 		buflen = m->m_len;
768 	}
769 	crc = ~crc;
770 
771 	/* Encrypt little-endian CRC32 and verify that it matches with the
772 	 * received ICV */
773 	icv[0] = crc;
774 	icv[1] = crc >> 8;
775 	icv[2] = crc >> 16;
776 	icv[3] = crc >> 24;
777 	for (k = 0; k < 4; k++) {
778 		i = (i + 1) & 0xff;
779 		j = (j + S[i]) & 0xff;
780 		S_SWAP(i, j);
781 		if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
782 			/* ICV mismatch - drop frame */
783 			return -1;
784 		}
785 	}
786 
787 	return 0;
788 }
789 
790 static __inline u32 rotl(u32 val, int bits)
791 {
792 	return (val << bits) | (val >> (32 - bits));
793 }
794 
795 static __inline u32 rotr(u32 val, int bits)
796 {
797 	return (val >> bits) | (val << (32 - bits));
798 }
799 
800 static __inline u32 xswap(u32 val)
801 {
802 	return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
803 }
804 
805 #define michael_block(l, r)	\
806 do {				\
807 	r ^= rotl(l, 17);	\
808 	l += r;			\
809 	r ^= xswap(l);		\
810 	l += r;			\
811 	r ^= rotl(l, 3);	\
812 	l += r;			\
813 	r ^= rotr(l, 2);	\
814 	l += r;			\
815 } while (0)
816 
817 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
818 {
819 	return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
820 }
821 
822 static __inline u32 get_le32(const u8 *p)
823 {
824 	return get_le32_split(p[0], p[1], p[2], p[3]);
825 }
826 
827 static __inline void put_le32(u8 *p, u32 v)
828 {
829 	p[0] = v;
830 	p[1] = v >> 8;
831 	p[2] = v >> 16;
832 	p[3] = v >> 24;
833 }
834 
835 /*
836  * Craft pseudo header used to calculate the MIC.
837  */
838 static void
839 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
840 {
841 	const struct ieee80211_frame_addr4 *wh =
842 		(const struct ieee80211_frame_addr4 *) wh0;
843 
844 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
845 	case IEEE80211_FC1_DIR_NODS:
846 		IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
847 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
848 		break;
849 	case IEEE80211_FC1_DIR_TODS:
850 		IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
851 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
852 		break;
853 	case IEEE80211_FC1_DIR_FROMDS:
854 		IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
855 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
856 		break;
857 	case IEEE80211_FC1_DIR_DSTODS:
858 		IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
859 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
860 		break;
861 	}
862 
863 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_DATA) {
864 		const struct ieee80211_qosframe *qwh =
865 			(const struct ieee80211_qosframe *) wh;
866 		hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
867 	} else
868 		hdr[12] = 0;
869 	hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
870 }
871 
872 static void
873 michael_mic(struct tkip_ctx *ctx, const u8 *key,
874 	struct mbuf *m, u_int off, size_t data_len,
875 	u8 mic[IEEE80211_WEP_MICLEN])
876 {
877 	uint8_t hdr[16];
878 	u32 l, r;
879 	const uint8_t *data;
880 	u_int space;
881 
882 	michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
883 
884 	l = get_le32(key);
885 	r = get_le32(key + 4);
886 
887 	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
888 	l ^= get_le32(hdr);
889 	michael_block(l, r);
890 	l ^= get_le32(&hdr[4]);
891 	michael_block(l, r);
892 	l ^= get_le32(&hdr[8]);
893 	michael_block(l, r);
894 	l ^= get_le32(&hdr[12]);
895 	michael_block(l, r);
896 
897 	/* first buffer has special handling */
898 	data = mtod(m, const uint8_t *) + off;
899 	space = m->m_len - off;
900 	for (;;) {
901 		if (space > data_len)
902 			space = data_len;
903 		/* collect 32-bit blocks from current buffer */
904 		while (space >= sizeof(uint32_t)) {
905 			l ^= get_le32(data);
906 			michael_block(l, r);
907 			data += sizeof(uint32_t), space -= sizeof(uint32_t);
908 			data_len -= sizeof(uint32_t);
909 		}
910 		/*
911 		 * NB: when space is zero we make one more trip around
912 		 * the loop to advance to the next mbuf where there is
913 		 * data.  This handles the case where there are 4*n
914 		 * bytes in an mbuf followed by <4 bytes in a later mbuf.
915 		 * By making an extra trip we'll drop out of the loop
916 		 * with m pointing at the mbuf with 3 bytes and space
917 		 * set as required by the remainder handling below.
918 		 */
919 		if (data_len == 0 ||
920 		    (data_len < sizeof(uint32_t) && space != 0))
921 			break;
922 		m = m->m_next;
923 		if (m == NULL) {
924 			KASSERT(0, ("out of data, data_len %zu\n", data_len));
925 			break;
926 		}
927 		if (space != 0) {
928 			const uint8_t *data_next;
929 			/*
930 			 * Block straddles buffers, split references.
931 			 */
932 			data_next = mtod(m, const uint8_t *);
933 			KASSERT(m->m_len >= sizeof(uint32_t) - space,
934 				("not enough data in following buffer, "
935 				"m_len %u need %zu\n", m->m_len,
936 				sizeof(uint32_t) - space));
937 			switch (space) {
938 			case 1:
939 				l ^= get_le32_split(data[0], data_next[0],
940 					data_next[1], data_next[2]);
941 				data = data_next + 3;
942 				space = m->m_len - 3;
943 				break;
944 			case 2:
945 				l ^= get_le32_split(data[0], data[1],
946 					data_next[0], data_next[1]);
947 				data = data_next + 2;
948 				space = m->m_len - 2;
949 				break;
950 			case 3:
951 				l ^= get_le32_split(data[0], data[1],
952 					data[2], data_next[0]);
953 				data = data_next + 1;
954 				space = m->m_len - 1;
955 				break;
956 			}
957 			michael_block(l, r);
958 			data_len -= sizeof(uint32_t);
959 		} else {
960 			/*
961 			 * Setup for next buffer.
962 			 */
963 			data = mtod(m, const uint8_t *);
964 			space = m->m_len;
965 		}
966 	}
967 	/*
968 	 * Catch degenerate cases like mbuf[4*n+1 bytes] followed by
969 	 * mbuf[2 bytes].  I don't believe these should happen; if they
970 	 * do then we'll need more involved logic.
971 	 */
972 	KASSERT(data_len <= space,
973 	    ("not enough data, data_len %zu space %u\n", data_len, space));
974 
975 	/* Last block and padding (0x5a, 4..7 x 0) */
976 	switch (data_len) {
977 	case 0:
978 		l ^= get_le32_split(0x5a, 0, 0, 0);
979 		break;
980 	case 1:
981 		l ^= get_le32_split(data[0], 0x5a, 0, 0);
982 		break;
983 	case 2:
984 		l ^= get_le32_split(data[0], data[1], 0x5a, 0);
985 		break;
986 	case 3:
987 		l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
988 		break;
989 	}
990 	michael_block(l, r);
991 	/* l ^= 0; */
992 	michael_block(l, r);
993 
994 	put_le32(mic, l);
995 	put_le32(mic + 4, r);
996 }
997 
998 static int
999 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1000 	struct mbuf *m, int hdrlen)
1001 {
1002 	struct ieee80211_frame *wh;
1003 	uint8_t icv[IEEE80211_WEP_CRCLEN];
1004 
1005 	ctx->tc_vap->iv_stats.is_crypto_tkip++;
1006 
1007 	wh = mtod(m, struct ieee80211_frame *);
1008 	if ((u16)(key->wk_keytsc) == 0 || key->wk_keytsc == 1) {
1009 		tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
1010 				   (u32)(key->wk_keytsc >> 16));
1011 	}
1012 	tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
1013 		(u16) key->wk_keytsc);
1014 
1015 	wep_encrypt(ctx->tx_rc4key,
1016 		m, hdrlen + tkip.ic_header,
1017 		m->m_pkthdr.len - (hdrlen + tkip.ic_header),
1018 		icv);
1019 	(void) m_append(m, IEEE80211_WEP_CRCLEN, icv);	/* XXX check return */
1020 
1021 	return 1;
1022 }
1023 
1024 static int
1025 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1026 	struct mbuf *m, int hdrlen)
1027 {
1028 	struct ieee80211_frame *wh;
1029 	struct ieee80211vap *vap = ctx->tc_vap;
1030 	u32 iv32;
1031 	u16 iv16;
1032 	u8 tid;
1033 
1034 	vap->iv_stats.is_crypto_tkip++;
1035 
1036 	wh = mtod(m, struct ieee80211_frame *);
1037 	/* NB: tkip_decap already verified header and left seq in rx_rsc */
1038 	iv16 = (u16) ctx->rx_rsc;
1039 	iv32 = (u32) (ctx->rx_rsc >> 16);
1040 
1041 	tid = ieee80211_gettid(wh);
1042 	if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) {
1043 		tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
1044 			wh->i_addr2, iv32);
1045 		ctx->rx_phase1_done = 1;
1046 	}
1047 	tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
1048 
1049 	/* NB: m is unstripped; deduct headers + ICV to get payload */
1050 	if (wep_decrypt(ctx->rx_rc4key,
1051 		m, hdrlen + tkip.ic_header,
1052 	        m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
1053 		if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) {
1054 			/* Previously cached Phase1 result was already lost, so
1055 			 * it needs to be recalculated for the next packet. */
1056 			ctx->rx_phase1_done = 0;
1057 		}
1058 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
1059 		    "%s", "TKIP ICV mismatch on decrypt");
1060 		vap->iv_stats.is_rx_tkipicv++;
1061 		return 0;
1062 	}
1063 	return 1;
1064 }
1065 
1066 /*
1067  * Module glue.
1068  */
1069 IEEE80211_CRYPTO_MODULE(tkip, 1);
1070