1 /*- 2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 __FBSDID("$FreeBSD$"); 28 29 /* 30 * IEEE 802.11i TKIP crypto support. 31 * 32 * Part of this module is derived from similar code in the Host 33 * AP driver. The code is used with the consent of the author and 34 * it's license is included below. 35 */ 36 #include "opt_wlan.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/malloc.h> 42 #include <sys/kernel.h> 43 #include <sys/module.h> 44 #include <sys/endian.h> 45 46 #include <sys/socket.h> 47 48 #include <net/if.h> 49 #include <net/if_media.h> 50 #include <net/ethernet.h> 51 52 #include <net80211/ieee80211_var.h> 53 54 static void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *); 55 static void tkip_detach(struct ieee80211_key *); 56 static int tkip_setkey(struct ieee80211_key *); 57 static int tkip_encap(struct ieee80211_key *, struct mbuf *m, uint8_t keyid); 58 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int); 59 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int); 60 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int); 61 62 static const struct ieee80211_cipher tkip = { 63 .ic_name = "TKIP", 64 .ic_cipher = IEEE80211_CIPHER_TKIP, 65 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + 66 IEEE80211_WEP_EXTIVLEN, 67 .ic_trailer = IEEE80211_WEP_CRCLEN, 68 .ic_miclen = IEEE80211_WEP_MICLEN, 69 .ic_attach = tkip_attach, 70 .ic_detach = tkip_detach, 71 .ic_setkey = tkip_setkey, 72 .ic_encap = tkip_encap, 73 .ic_decap = tkip_decap, 74 .ic_enmic = tkip_enmic, 75 .ic_demic = tkip_demic, 76 }; 77 78 typedef uint8_t u8; 79 typedef uint16_t u16; 80 typedef uint32_t __u32; 81 typedef uint32_t u32; 82 83 struct tkip_ctx { 84 struct ieee80211vap *tc_vap; /* for diagnostics+statistics */ 85 86 u16 tx_ttak[5]; 87 int tx_phase1_done; 88 u8 tx_rc4key[16]; /* XXX for test module; make locals? */ 89 90 u16 rx_ttak[5]; 91 int rx_phase1_done; 92 u8 rx_rc4key[16]; /* XXX for test module; make locals? */ 93 uint64_t rx_rsc; /* held until MIC verified */ 94 }; 95 96 static void michael_mic(struct tkip_ctx *, const u8 *key, 97 struct mbuf *m, u_int off, size_t data_len, 98 u8 mic[IEEE80211_WEP_MICLEN]); 99 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *, 100 struct mbuf *, int hdr_len); 101 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *, 102 struct mbuf *, int hdr_len); 103 104 /* number of references from net80211 layer */ 105 static int nrefs = 0; 106 107 static void * 108 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k) 109 { 110 struct tkip_ctx *ctx; 111 112 ctx = (struct tkip_ctx *) malloc(sizeof(struct tkip_ctx), 113 M_80211_CRYPTO, M_NOWAIT | M_ZERO); 114 if (ctx == NULL) { 115 vap->iv_stats.is_crypto_nomem++; 116 return NULL; 117 } 118 119 ctx->tc_vap = vap; 120 nrefs++; /* NB: we assume caller locking */ 121 return ctx; 122 } 123 124 static void 125 tkip_detach(struct ieee80211_key *k) 126 { 127 struct tkip_ctx *ctx = k->wk_private; 128 129 free(ctx, M_80211_CRYPTO); 130 KASSERT(nrefs > 0, ("imbalanced attach/detach")); 131 nrefs--; /* NB: we assume caller locking */ 132 } 133 134 static int 135 tkip_setkey(struct ieee80211_key *k) 136 { 137 struct tkip_ctx *ctx = k->wk_private; 138 139 if (k->wk_keylen != (128/NBBY)) { 140 (void) ctx; /* XXX */ 141 IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO, 142 "%s: Invalid key length %u, expecting %u\n", 143 __func__, k->wk_keylen, 128/NBBY); 144 return 0; 145 } 146 k->wk_keytsc = 1; /* TSC starts at 1 */ 147 ctx->rx_phase1_done = 0; 148 return 1; 149 } 150 151 /* 152 * Add privacy headers and do any s/w encryption required. 153 */ 154 static int 155 tkip_encap(struct ieee80211_key *k, struct mbuf *m, uint8_t keyid) 156 { 157 struct tkip_ctx *ctx = k->wk_private; 158 struct ieee80211vap *vap = ctx->tc_vap; 159 struct ieee80211com *ic = vap->iv_ic; 160 uint8_t *ivp; 161 int hdrlen; 162 163 /* 164 * Handle TKIP counter measures requirement. 165 */ 166 if (vap->iv_flags & IEEE80211_F_COUNTERM) { 167 #ifdef IEEE80211_DEBUG 168 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 169 #endif 170 171 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 172 "discard frame due to countermeasures (%s)", __func__); 173 vap->iv_stats.is_crypto_tkipcm++; 174 return 0; 175 } 176 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *)); 177 178 /* 179 * Copy down 802.11 header and add the IV, KeyID, and ExtIV. 180 */ 181 M_PREPEND(m, tkip.ic_header, M_NOWAIT); 182 if (m == NULL) 183 return 0; 184 ivp = mtod(m, uint8_t *); 185 memmove(ivp, ivp + tkip.ic_header, hdrlen); 186 ivp += hdrlen; 187 188 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */ 189 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */ 190 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */ 191 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */ 192 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */ 193 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */ 194 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */ 195 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */ 196 197 /* 198 * Finally, do software encrypt if neeed. 199 */ 200 if (k->wk_flags & IEEE80211_KEY_SWENCRYPT) { 201 if (!tkip_encrypt(ctx, k, m, hdrlen)) 202 return 0; 203 /* NB: tkip_encrypt handles wk_keytsc */ 204 } else 205 k->wk_keytsc++; 206 207 return 1; 208 } 209 210 /* 211 * Add MIC to the frame as needed. 212 */ 213 static int 214 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force) 215 { 216 struct tkip_ctx *ctx = k->wk_private; 217 218 if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) { 219 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 220 struct ieee80211vap *vap = ctx->tc_vap; 221 struct ieee80211com *ic = vap->iv_ic; 222 int hdrlen; 223 uint8_t mic[IEEE80211_WEP_MICLEN]; 224 225 vap->iv_stats.is_crypto_tkipenmic++; 226 227 hdrlen = ieee80211_hdrspace(ic, wh); 228 229 michael_mic(ctx, k->wk_txmic, 230 m, hdrlen, m->m_pkthdr.len - hdrlen, mic); 231 return m_append(m, tkip.ic_miclen, mic); 232 } 233 return 1; 234 } 235 236 static __inline uint64_t 237 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5) 238 { 239 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24); 240 uint16_t iv16 = (b4 << 0) | (b5 << 8); 241 return (((uint64_t)iv16) << 32) | iv32; 242 } 243 244 /* 245 * Validate and strip privacy headers (and trailer) for a 246 * received frame. If necessary, decrypt the frame using 247 * the specified key. 248 */ 249 static int 250 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen) 251 { 252 struct tkip_ctx *ctx = k->wk_private; 253 struct ieee80211vap *vap = ctx->tc_vap; 254 struct ieee80211_frame *wh; 255 uint8_t *ivp, tid; 256 257 /* 258 * Header should have extended IV and sequence number; 259 * verify the former and validate the latter. 260 */ 261 wh = mtod(m, struct ieee80211_frame *); 262 ivp = mtod(m, uint8_t *) + hdrlen; 263 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) { 264 /* 265 * No extended IV; discard frame. 266 */ 267 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 268 "%s", "missing ExtIV for TKIP cipher"); 269 vap->iv_stats.is_rx_tkipformat++; 270 return 0; 271 } 272 /* 273 * Handle TKIP counter measures requirement. 274 */ 275 if (vap->iv_flags & IEEE80211_F_COUNTERM) { 276 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 277 "discard frame due to countermeasures (%s)", __func__); 278 vap->iv_stats.is_crypto_tkipcm++; 279 return 0; 280 } 281 282 tid = ieee80211_gettid(wh); 283 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]); 284 /* 285 * NB: Multiple stations are using the same key in 286 * IBSS mode, there is currently no way to sync keyrsc 287 * counters without discarding too many frames. 288 */ 289 if (vap->iv_opmode != IEEE80211_M_IBSS && 290 vap->iv_opmode != IEEE80211_M_AHDEMO && 291 ctx->rx_rsc <= k->wk_keyrsc[tid]) { 292 /* 293 * Replay violation; notify upper layer. 294 */ 295 ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid); 296 vap->iv_stats.is_rx_tkipreplay++; 297 return 0; 298 } 299 /* 300 * NB: We can't update the rsc in the key until MIC is verified. 301 * 302 * We assume we are not preempted between doing the check above 303 * and updating wk_keyrsc when stripping the MIC in tkip_demic. 304 * Otherwise we might process another packet and discard it as 305 * a replay. 306 */ 307 308 /* 309 * Check if the device handled the decrypt in hardware. 310 * If so we just strip the header; otherwise we need to 311 * handle the decrypt in software. 312 */ 313 if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) && 314 !tkip_decrypt(ctx, k, m, hdrlen)) 315 return 0; 316 317 /* 318 * Copy up 802.11 header and strip crypto bits. 319 */ 320 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen); 321 m_adj(m, tkip.ic_header); 322 m_adj(m, -tkip.ic_trailer); 323 324 return 1; 325 } 326 327 /* 328 * Verify and strip MIC from the frame. 329 */ 330 static int 331 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force) 332 { 333 struct tkip_ctx *ctx = k->wk_private; 334 struct ieee80211_frame *wh; 335 uint8_t tid; 336 337 wh = mtod(m, struct ieee80211_frame *); 338 if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) { 339 struct ieee80211vap *vap = ctx->tc_vap; 340 int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh); 341 u8 mic[IEEE80211_WEP_MICLEN]; 342 u8 mic0[IEEE80211_WEP_MICLEN]; 343 344 vap->iv_stats.is_crypto_tkipdemic++; 345 346 michael_mic(ctx, k->wk_rxmic, 347 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen), 348 mic); 349 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen, 350 tkip.ic_miclen, mic0); 351 if (memcmp(mic, mic0, tkip.ic_miclen)) { 352 /* NB: 802.11 layer handles statistic and debug msg */ 353 ieee80211_notify_michael_failure(vap, wh, 354 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ? 355 k->wk_rxkeyix : k->wk_keyix); 356 return 0; 357 } 358 } 359 /* 360 * Strip MIC from the tail. 361 */ 362 m_adj(m, -tkip.ic_miclen); 363 364 /* 365 * Ok to update rsc now that MIC has been verified. 366 */ 367 tid = ieee80211_gettid(wh); 368 k->wk_keyrsc[tid] = ctx->rx_rsc; 369 370 return 1; 371 } 372 373 /* 374 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver 375 * 376 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 377 * 378 * This program is free software; you can redistribute it and/or modify 379 * it under the terms of the GNU General Public License version 2 as 380 * published by the Free Software Foundation. See README and COPYING for 381 * more details. 382 * 383 * Alternatively, this software may be distributed under the terms of BSD 384 * license. 385 */ 386 387 static const __u32 crc32_table[256] = { 388 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, 389 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, 390 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 391 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, 392 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, 393 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, 394 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 395 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, 396 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, 397 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, 398 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 399 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, 400 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, 401 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, 402 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 403 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, 404 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, 405 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, 406 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 407 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, 408 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, 409 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, 410 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, 411 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, 412 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, 413 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, 414 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, 415 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, 416 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, 417 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, 418 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 419 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, 420 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, 421 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, 422 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 423 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, 424 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, 425 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, 426 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 427 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, 428 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, 429 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, 430 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 431 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, 432 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, 433 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, 434 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 435 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, 436 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, 437 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, 438 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 439 0x2d02ef8dL 440 }; 441 442 static __inline u16 RotR1(u16 val) 443 { 444 return (val >> 1) | (val << 15); 445 } 446 447 static __inline u8 Lo8(u16 val) 448 { 449 return val & 0xff; 450 } 451 452 static __inline u8 Hi8(u16 val) 453 { 454 return val >> 8; 455 } 456 457 static __inline u16 Lo16(u32 val) 458 { 459 return val & 0xffff; 460 } 461 462 static __inline u16 Hi16(u32 val) 463 { 464 return val >> 16; 465 } 466 467 static __inline u16 Mk16(u8 hi, u8 lo) 468 { 469 return lo | (((u16) hi) << 8); 470 } 471 472 static __inline u16 Mk16_le(const u16 *v) 473 { 474 return le16toh(*v); 475 } 476 477 static const u16 Sbox[256] = { 478 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 479 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 480 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 481 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 482 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, 483 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, 484 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, 485 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, 486 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, 487 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 488 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 489 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 490 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 491 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, 492 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, 493 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, 494 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, 495 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, 496 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 497 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 498 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 499 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 500 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, 501 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, 502 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, 503 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, 504 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, 505 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 506 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 507 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 508 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 509 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, 510 }; 511 512 static __inline u16 _S_(u16 v) 513 { 514 u16 t = Sbox[Hi8(v)]; 515 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8)); 516 } 517 518 #define PHASE1_LOOP_COUNT 8 519 520 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32) 521 { 522 int i, j; 523 524 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */ 525 TTAK[0] = Lo16(IV32); 526 TTAK[1] = Hi16(IV32); 527 TTAK[2] = Mk16(TA[1], TA[0]); 528 TTAK[3] = Mk16(TA[3], TA[2]); 529 TTAK[4] = Mk16(TA[5], TA[4]); 530 531 for (i = 0; i < PHASE1_LOOP_COUNT; i++) { 532 j = 2 * (i & 1); 533 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j])); 534 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j])); 535 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j])); 536 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j])); 537 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i; 538 } 539 } 540 541 #ifndef _BYTE_ORDER 542 #error "Don't know native byte order" 543 #endif 544 545 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK, 546 u16 IV16) 547 { 548 /* Make temporary area overlap WEP seed so that the final copy can be 549 * avoided on little endian hosts. */ 550 u16 *PPK = (u16 *) &WEPSeed[4]; 551 552 /* Step 1 - make copy of TTAK and bring in TSC */ 553 PPK[0] = TTAK[0]; 554 PPK[1] = TTAK[1]; 555 PPK[2] = TTAK[2]; 556 PPK[3] = TTAK[3]; 557 PPK[4] = TTAK[4]; 558 PPK[5] = TTAK[4] + IV16; 559 560 /* Step 2 - 96-bit bijective mixing using S-box */ 561 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0])); 562 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2])); 563 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4])); 564 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6])); 565 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8])); 566 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10])); 567 568 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12])); 569 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14])); 570 PPK[2] += RotR1(PPK[1]); 571 PPK[3] += RotR1(PPK[2]); 572 PPK[4] += RotR1(PPK[3]); 573 PPK[5] += RotR1(PPK[4]); 574 575 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value 576 * WEPSeed[0..2] is transmitted as WEP IV */ 577 WEPSeed[0] = Hi8(IV16); 578 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F; 579 WEPSeed[2] = Lo8(IV16); 580 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1); 581 582 #if _BYTE_ORDER == _BIG_ENDIAN 583 { 584 int i; 585 for (i = 0; i < 6; i++) 586 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8); 587 } 588 #endif 589 } 590 591 static void 592 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len, 593 uint8_t icv[IEEE80211_WEP_CRCLEN]) 594 { 595 u32 i, j, k, crc; 596 size_t buflen; 597 u8 S[256]; 598 u8 *pos; 599 struct mbuf *m; 600 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0) 601 602 /* Setup RC4 state */ 603 for (i = 0; i < 256; i++) 604 S[i] = i; 605 j = 0; 606 for (i = 0; i < 256; i++) { 607 j = (j + S[i] + key[i & 0x0f]) & 0xff; 608 S_SWAP(i, j); 609 } 610 611 /* Compute CRC32 over unencrypted data and apply RC4 to data */ 612 crc = ~0; 613 i = j = 0; 614 m = m0; 615 pos = mtod(m, uint8_t *) + off; 616 buflen = m->m_len - off; 617 for (;;) { 618 if (buflen > data_len) 619 buflen = data_len; 620 data_len -= buflen; 621 for (k = 0; k < buflen; k++) { 622 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 623 i = (i + 1) & 0xff; 624 j = (j + S[i]) & 0xff; 625 S_SWAP(i, j); 626 *pos++ ^= S[(S[i] + S[j]) & 0xff]; 627 } 628 m = m->m_next; 629 if (m == NULL) { 630 KASSERT(data_len == 0, 631 ("out of buffers with data_len %zu\n", data_len)); 632 break; 633 } 634 pos = mtod(m, uint8_t *); 635 buflen = m->m_len; 636 } 637 crc = ~crc; 638 639 /* Append little-endian CRC32 and encrypt it to produce ICV */ 640 icv[0] = crc; 641 icv[1] = crc >> 8; 642 icv[2] = crc >> 16; 643 icv[3] = crc >> 24; 644 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) { 645 i = (i + 1) & 0xff; 646 j = (j + S[i]) & 0xff; 647 S_SWAP(i, j); 648 icv[k] ^= S[(S[i] + S[j]) & 0xff]; 649 } 650 } 651 652 static int 653 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len) 654 { 655 u32 i, j, k, crc; 656 u8 S[256]; 657 u8 *pos, icv[4]; 658 size_t buflen; 659 660 /* Setup RC4 state */ 661 for (i = 0; i < 256; i++) 662 S[i] = i; 663 j = 0; 664 for (i = 0; i < 256; i++) { 665 j = (j + S[i] + key[i & 0x0f]) & 0xff; 666 S_SWAP(i, j); 667 } 668 669 /* Apply RC4 to data and compute CRC32 over decrypted data */ 670 crc = ~0; 671 i = j = 0; 672 pos = mtod(m, uint8_t *) + off; 673 buflen = m->m_len - off; 674 for (;;) { 675 if (buflen > data_len) 676 buflen = data_len; 677 data_len -= buflen; 678 for (k = 0; k < buflen; k++) { 679 i = (i + 1) & 0xff; 680 j = (j + S[i]) & 0xff; 681 S_SWAP(i, j); 682 *pos ^= S[(S[i] + S[j]) & 0xff]; 683 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 684 pos++; 685 } 686 m = m->m_next; 687 if (m == NULL) { 688 KASSERT(data_len == 0, 689 ("out of buffers with data_len %zu\n", data_len)); 690 break; 691 } 692 pos = mtod(m, uint8_t *); 693 buflen = m->m_len; 694 } 695 crc = ~crc; 696 697 /* Encrypt little-endian CRC32 and verify that it matches with the 698 * received ICV */ 699 icv[0] = crc; 700 icv[1] = crc >> 8; 701 icv[2] = crc >> 16; 702 icv[3] = crc >> 24; 703 for (k = 0; k < 4; k++) { 704 i = (i + 1) & 0xff; 705 j = (j + S[i]) & 0xff; 706 S_SWAP(i, j); 707 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) { 708 /* ICV mismatch - drop frame */ 709 return -1; 710 } 711 } 712 713 return 0; 714 } 715 716 717 static __inline u32 rotl(u32 val, int bits) 718 { 719 return (val << bits) | (val >> (32 - bits)); 720 } 721 722 723 static __inline u32 rotr(u32 val, int bits) 724 { 725 return (val >> bits) | (val << (32 - bits)); 726 } 727 728 729 static __inline u32 xswap(u32 val) 730 { 731 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8); 732 } 733 734 735 #define michael_block(l, r) \ 736 do { \ 737 r ^= rotl(l, 17); \ 738 l += r; \ 739 r ^= xswap(l); \ 740 l += r; \ 741 r ^= rotl(l, 3); \ 742 l += r; \ 743 r ^= rotr(l, 2); \ 744 l += r; \ 745 } while (0) 746 747 748 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3) 749 { 750 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24); 751 } 752 753 static __inline u32 get_le32(const u8 *p) 754 { 755 return get_le32_split(p[0], p[1], p[2], p[3]); 756 } 757 758 759 static __inline void put_le32(u8 *p, u32 v) 760 { 761 p[0] = v; 762 p[1] = v >> 8; 763 p[2] = v >> 16; 764 p[3] = v >> 24; 765 } 766 767 /* 768 * Craft pseudo header used to calculate the MIC. 769 */ 770 static void 771 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16]) 772 { 773 const struct ieee80211_frame_addr4 *wh = 774 (const struct ieee80211_frame_addr4 *) wh0; 775 776 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 777 case IEEE80211_FC1_DIR_NODS: 778 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 779 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 780 break; 781 case IEEE80211_FC1_DIR_TODS: 782 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 783 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 784 break; 785 case IEEE80211_FC1_DIR_FROMDS: 786 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 787 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3); 788 break; 789 case IEEE80211_FC1_DIR_DSTODS: 790 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 791 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4); 792 break; 793 } 794 795 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) { 796 const struct ieee80211_qosframe *qwh = 797 (const struct ieee80211_qosframe *) wh; 798 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID; 799 } else 800 hdr[12] = 0; 801 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */ 802 } 803 804 static void 805 michael_mic(struct tkip_ctx *ctx, const u8 *key, 806 struct mbuf *m, u_int off, size_t data_len, 807 u8 mic[IEEE80211_WEP_MICLEN]) 808 { 809 uint8_t hdr[16]; 810 u32 l, r; 811 const uint8_t *data; 812 u_int space; 813 814 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr); 815 816 l = get_le32(key); 817 r = get_le32(key + 4); 818 819 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ 820 l ^= get_le32(hdr); 821 michael_block(l, r); 822 l ^= get_le32(&hdr[4]); 823 michael_block(l, r); 824 l ^= get_le32(&hdr[8]); 825 michael_block(l, r); 826 l ^= get_le32(&hdr[12]); 827 michael_block(l, r); 828 829 /* first buffer has special handling */ 830 data = mtod(m, const uint8_t *) + off; 831 space = m->m_len - off; 832 for (;;) { 833 if (space > data_len) 834 space = data_len; 835 /* collect 32-bit blocks from current buffer */ 836 while (space >= sizeof(uint32_t)) { 837 l ^= get_le32(data); 838 michael_block(l, r); 839 data += sizeof(uint32_t), space -= sizeof(uint32_t); 840 data_len -= sizeof(uint32_t); 841 } 842 /* 843 * NB: when space is zero we make one more trip around 844 * the loop to advance to the next mbuf where there is 845 * data. This handles the case where there are 4*n 846 * bytes in an mbuf followed by <4 bytes in a later mbuf. 847 * By making an extra trip we'll drop out of the loop 848 * with m pointing at the mbuf with 3 bytes and space 849 * set as required by the remainder handling below. 850 */ 851 if (data_len == 0 || 852 (data_len < sizeof(uint32_t) && space != 0)) 853 break; 854 m = m->m_next; 855 if (m == NULL) { 856 KASSERT(0, ("out of data, data_len %zu\n", data_len)); 857 break; 858 } 859 if (space != 0) { 860 const uint8_t *data_next; 861 /* 862 * Block straddles buffers, split references. 863 */ 864 data_next = mtod(m, const uint8_t *); 865 KASSERT(m->m_len >= sizeof(uint32_t) - space, 866 ("not enough data in following buffer, " 867 "m_len %u need %zu\n", m->m_len, 868 sizeof(uint32_t) - space)); 869 switch (space) { 870 case 1: 871 l ^= get_le32_split(data[0], data_next[0], 872 data_next[1], data_next[2]); 873 data = data_next + 3; 874 space = m->m_len - 3; 875 break; 876 case 2: 877 l ^= get_le32_split(data[0], data[1], 878 data_next[0], data_next[1]); 879 data = data_next + 2; 880 space = m->m_len - 2; 881 break; 882 case 3: 883 l ^= get_le32_split(data[0], data[1], 884 data[2], data_next[0]); 885 data = data_next + 1; 886 space = m->m_len - 1; 887 break; 888 } 889 michael_block(l, r); 890 data_len -= sizeof(uint32_t); 891 } else { 892 /* 893 * Setup for next buffer. 894 */ 895 data = mtod(m, const uint8_t *); 896 space = m->m_len; 897 } 898 } 899 /* 900 * Catch degenerate cases like mbuf[4*n+1 bytes] followed by 901 * mbuf[2 bytes]. I don't believe these should happen; if they 902 * do then we'll need more involved logic. 903 */ 904 KASSERT(data_len <= space, 905 ("not enough data, data_len %zu space %u\n", data_len, space)); 906 907 /* Last block and padding (0x5a, 4..7 x 0) */ 908 switch (data_len) { 909 case 0: 910 l ^= get_le32_split(0x5a, 0, 0, 0); 911 break; 912 case 1: 913 l ^= get_le32_split(data[0], 0x5a, 0, 0); 914 break; 915 case 2: 916 l ^= get_le32_split(data[0], data[1], 0x5a, 0); 917 break; 918 case 3: 919 l ^= get_le32_split(data[0], data[1], data[2], 0x5a); 920 break; 921 } 922 michael_block(l, r); 923 /* l ^= 0; */ 924 michael_block(l, r); 925 926 put_le32(mic, l); 927 put_le32(mic + 4, r); 928 } 929 930 static int 931 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 932 struct mbuf *m, int hdrlen) 933 { 934 struct ieee80211_frame *wh; 935 uint8_t icv[IEEE80211_WEP_CRCLEN]; 936 937 ctx->tc_vap->iv_stats.is_crypto_tkip++; 938 939 wh = mtod(m, struct ieee80211_frame *); 940 if (!ctx->tx_phase1_done) { 941 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2, 942 (u32)(key->wk_keytsc >> 16)); 943 ctx->tx_phase1_done = 1; 944 } 945 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak, 946 (u16) key->wk_keytsc); 947 948 wep_encrypt(ctx->tx_rc4key, 949 m, hdrlen + tkip.ic_header, 950 m->m_pkthdr.len - (hdrlen + tkip.ic_header), 951 icv); 952 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */ 953 954 key->wk_keytsc++; 955 if ((u16)(key->wk_keytsc) == 0) 956 ctx->tx_phase1_done = 0; 957 return 1; 958 } 959 960 static int 961 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 962 struct mbuf *m, int hdrlen) 963 { 964 struct ieee80211_frame *wh; 965 struct ieee80211vap *vap = ctx->tc_vap; 966 u32 iv32; 967 u16 iv16; 968 u8 tid; 969 970 vap->iv_stats.is_crypto_tkip++; 971 972 wh = mtod(m, struct ieee80211_frame *); 973 /* NB: tkip_decap already verified header and left seq in rx_rsc */ 974 iv16 = (u16) ctx->rx_rsc; 975 iv32 = (u32) (ctx->rx_rsc >> 16); 976 977 tid = ieee80211_gettid(wh); 978 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) { 979 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key, 980 wh->i_addr2, iv32); 981 ctx->rx_phase1_done = 1; 982 } 983 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16); 984 985 /* NB: m is unstripped; deduct headers + ICV to get payload */ 986 if (wep_decrypt(ctx->rx_rc4key, 987 m, hdrlen + tkip.ic_header, 988 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) { 989 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) { 990 /* Previously cached Phase1 result was already lost, so 991 * it needs to be recalculated for the next packet. */ 992 ctx->rx_phase1_done = 0; 993 } 994 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 995 "%s", "TKIP ICV mismatch on decrypt"); 996 vap->iv_stats.is_rx_tkipicv++; 997 return 0; 998 } 999 return 1; 1000 } 1001 1002 /* 1003 * Module glue. 1004 */ 1005 IEEE80211_CRYPTO_MODULE(tkip, 1); 1006