xref: /freebsd/sys/net80211/ieee80211_crypto_tkip.c (revision c7046f76c2c027b00c0e6ba57cfd28f1a78f5e23)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 /*
32  * IEEE 802.11i TKIP crypto support.
33  *
34  * Part of this module is derived from similar code in the Host
35  * AP driver. The code is used with the consent of the author and
36  * it's license is included below.
37  */
38 #include "opt_wlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/malloc.h>
44 #include <sys/kernel.h>
45 #include <sys/module.h>
46 #include <sys/endian.h>
47 
48 #include <sys/socket.h>
49 
50 #include <net/if.h>
51 #include <net/if_media.h>
52 #include <net/ethernet.h>
53 
54 #include <net80211/ieee80211_var.h>
55 
56 static	void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *);
57 static	void tkip_detach(struct ieee80211_key *);
58 static	int tkip_setkey(struct ieee80211_key *);
59 static	void tkip_setiv(struct ieee80211_key *, uint8_t *);
60 static	int tkip_encap(struct ieee80211_key *, struct mbuf *);
61 static	int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
62 static	int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
63 static	int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
64 
65 static const struct ieee80211_cipher tkip  = {
66 	.ic_name	= "TKIP",
67 	.ic_cipher	= IEEE80211_CIPHER_TKIP,
68 	.ic_header	= IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
69 			  IEEE80211_WEP_EXTIVLEN,
70 	.ic_trailer	= IEEE80211_WEP_CRCLEN,
71 	.ic_miclen	= IEEE80211_WEP_MICLEN,
72 	.ic_attach	= tkip_attach,
73 	.ic_detach	= tkip_detach,
74 	.ic_setkey	= tkip_setkey,
75 	.ic_setiv	= tkip_setiv,
76 	.ic_encap	= tkip_encap,
77 	.ic_decap	= tkip_decap,
78 	.ic_enmic	= tkip_enmic,
79 	.ic_demic	= tkip_demic,
80 };
81 
82 typedef	uint8_t u8;
83 typedef	uint16_t u16;
84 typedef	uint32_t __u32;
85 typedef	uint32_t u32;
86 
87 struct tkip_ctx {
88 	struct ieee80211vap *tc_vap;	/* for diagnostics+statistics */
89 
90 	u16	tx_ttak[5];
91 	u8	tx_rc4key[16];		/* XXX for test module; make locals? */
92 
93 	u16	rx_ttak[5];
94 	int	rx_phase1_done;
95 	u8	rx_rc4key[16];		/* XXX for test module; make locals? */
96 	uint64_t rx_rsc;		/* held until MIC verified */
97 };
98 
99 static	void michael_mic(struct tkip_ctx *, const u8 *key,
100 		struct mbuf *m, u_int off, size_t data_len,
101 		u8 mic[IEEE80211_WEP_MICLEN]);
102 static	int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
103 		struct mbuf *, int hdr_len);
104 static	int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
105 		struct mbuf *, int hdr_len);
106 
107 /* number of references from net80211 layer */
108 static	int nrefs = 0;
109 
110 static void *
111 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k)
112 {
113 	struct tkip_ctx *ctx;
114 
115 	ctx = (struct tkip_ctx *) IEEE80211_MALLOC(sizeof(struct tkip_ctx),
116 		M_80211_CRYPTO, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
117 	if (ctx == NULL) {
118 		vap->iv_stats.is_crypto_nomem++;
119 		return NULL;
120 	}
121 
122 	ctx->tc_vap = vap;
123 	nrefs++;			/* NB: we assume caller locking */
124 	return ctx;
125 }
126 
127 static void
128 tkip_detach(struct ieee80211_key *k)
129 {
130 	struct tkip_ctx *ctx = k->wk_private;
131 
132 	IEEE80211_FREE(ctx, M_80211_CRYPTO);
133 	KASSERT(nrefs > 0, ("imbalanced attach/detach"));
134 	nrefs--;			/* NB: we assume caller locking */
135 }
136 
137 static int
138 tkip_setkey(struct ieee80211_key *k)
139 {
140 	struct tkip_ctx *ctx = k->wk_private;
141 
142 	if (k->wk_keylen != (128/NBBY)) {
143 		(void) ctx;		/* XXX */
144 		IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO,
145 			"%s: Invalid key length %u, expecting %u\n",
146 			__func__, k->wk_keylen, 128/NBBY);
147 		return 0;
148 	}
149 	ctx->rx_phase1_done = 0;
150 	return 1;
151 }
152 
153 static void
154 tkip_setiv(struct ieee80211_key *k, uint8_t *ivp)
155 {
156 	struct tkip_ctx *ctx = k->wk_private;
157 	struct ieee80211vap *vap = ctx->tc_vap;
158 	uint8_t keyid;
159 
160 	keyid = ieee80211_crypto_get_keyid(vap, k) << 6;
161 
162 	k->wk_keytsc++;
163 	ivp[0] = k->wk_keytsc >> 8;		/* TSC1 */
164 	ivp[1] = (ivp[0] | 0x20) & 0x7f;	/* WEP seed */
165 	ivp[2] = k->wk_keytsc >> 0;		/* TSC0 */
166 	ivp[3] = keyid | IEEE80211_WEP_EXTIV;	/* KeyID | ExtID */
167 	ivp[4] = k->wk_keytsc >> 16;		/* TSC2 */
168 	ivp[5] = k->wk_keytsc >> 24;		/* TSC3 */
169 	ivp[6] = k->wk_keytsc >> 32;		/* TSC4 */
170 	ivp[7] = k->wk_keytsc >> 40;		/* TSC5 */
171 }
172 
173 /*
174  * Add privacy headers and do any s/w encryption required.
175  */
176 static int
177 tkip_encap(struct ieee80211_key *k, struct mbuf *m)
178 {
179 	struct tkip_ctx *ctx = k->wk_private;
180 	struct ieee80211vap *vap = ctx->tc_vap;
181 	struct ieee80211com *ic = vap->iv_ic;
182 	struct ieee80211_frame *wh;
183 	uint8_t *ivp;
184 	int hdrlen;
185 	int is_mgmt;
186 
187 	wh = mtod(m, struct ieee80211_frame *);
188 	is_mgmt = IEEE80211_IS_MGMT(wh);
189 
190 	/*
191 	 * Handle TKIP counter measures requirement.
192 	 */
193 	if (vap->iv_flags & IEEE80211_F_COUNTERM) {
194 #ifdef IEEE80211_DEBUG
195 		struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
196 #endif
197 
198 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
199 		    "discard frame due to countermeasures (%s)", __func__);
200 		vap->iv_stats.is_crypto_tkipcm++;
201 		return 0;
202 	}
203 
204 	/*
205 	 * Check to see whether IV needs to be included.
206 	 */
207 	if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOIVMGT))
208 		return 1;
209 	if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOIV))
210 		return 1;
211 
212 	hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
213 
214 	/*
215 	 * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
216 	 */
217 	M_PREPEND(m, tkip.ic_header, IEEE80211_M_NOWAIT);
218 	if (m == NULL)
219 		return 0;
220 	ivp = mtod(m, uint8_t *);
221 	memmove(ivp, ivp + tkip.ic_header, hdrlen);
222 	ivp += hdrlen;
223 
224 	tkip_setiv(k, ivp);
225 
226 	/*
227 	 * Finally, do software encrypt if needed.
228 	 */
229 	if ((k->wk_flags & IEEE80211_KEY_SWENCRYPT) &&
230 	    !tkip_encrypt(ctx, k, m, hdrlen))
231 		return 0;
232 
233 	return 1;
234 }
235 
236 /*
237  * Add MIC to the frame as needed.
238  */
239 static int
240 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
241 {
242 	struct tkip_ctx *ctx = k->wk_private;
243 	struct ieee80211_frame *wh;
244 	int is_mgmt;
245 
246 	wh = mtod(m, struct ieee80211_frame *);
247 	is_mgmt = IEEE80211_IS_MGMT(wh);
248 
249 	/*
250 	 * Check to see whether MIC needs to be included.
251 	 */
252 	if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOMICMGT))
253 		return 1;
254 	if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOMIC))
255 		return 1;
256 
257 	if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) {
258 		struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
259 		struct ieee80211vap *vap = ctx->tc_vap;
260 		struct ieee80211com *ic = vap->iv_ic;
261 		int hdrlen;
262 		uint8_t mic[IEEE80211_WEP_MICLEN];
263 
264 		vap->iv_stats.is_crypto_tkipenmic++;
265 
266 		hdrlen = ieee80211_hdrspace(ic, wh);
267 
268 		michael_mic(ctx, k->wk_txmic,
269 			m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
270 		return m_append(m, tkip.ic_miclen, mic);
271 	}
272 	return 1;
273 }
274 
275 static __inline uint64_t
276 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
277 {
278 	uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
279 	uint16_t iv16 = (b4 << 0) | (b5 << 8);
280 	return (((uint64_t)iv16) << 32) | iv32;
281 }
282 
283 /*
284  * Validate and strip privacy headers (and trailer) for a
285  * received frame.  If necessary, decrypt the frame using
286  * the specified key.
287  */
288 static int
289 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
290 {
291 	const struct ieee80211_rx_stats *rxs;
292 	struct tkip_ctx *ctx = k->wk_private;
293 	struct ieee80211vap *vap = ctx->tc_vap;
294 	struct ieee80211_frame *wh;
295 	uint8_t *ivp, tid;
296 
297 	rxs = ieee80211_get_rx_params_ptr(m);
298 
299 	/*
300 	 * If IV has been stripped, we skip most of the below.
301 	 */
302 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))
303 		goto finish;
304 
305 	/*
306 	 * Header should have extended IV and sequence number;
307 	 * verify the former and validate the latter.
308 	 */
309 	wh = mtod(m, struct ieee80211_frame *);
310 	ivp = mtod(m, uint8_t *) + hdrlen;
311 	if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
312 		/*
313 		 * No extended IV; discard frame.
314 		 */
315 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
316 		    "%s", "missing ExtIV for TKIP cipher");
317 		vap->iv_stats.is_rx_tkipformat++;
318 		return 0;
319 	}
320 	/*
321 	 * Handle TKIP counter measures requirement.
322 	 */
323 	if (vap->iv_flags & IEEE80211_F_COUNTERM) {
324 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
325 		    "discard frame due to countermeasures (%s)", __func__);
326 		vap->iv_stats.is_crypto_tkipcm++;
327 		return 0;
328 	}
329 
330 	tid = ieee80211_gettid(wh);
331 	ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
332 	if (ctx->rx_rsc <= k->wk_keyrsc[tid] &&
333 	    (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) {
334 		/*
335 		 * Replay violation; notify upper layer.
336 		 */
337 		ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid);
338 		vap->iv_stats.is_rx_tkipreplay++;
339 		return 0;
340 	}
341 	/*
342 	 * NB: We can't update the rsc in the key until MIC is verified.
343 	 *
344 	 * We assume we are not preempted between doing the check above
345 	 * and updating wk_keyrsc when stripping the MIC in tkip_demic.
346 	 * Otherwise we might process another packet and discard it as
347 	 * a replay.
348 	 */
349 
350 	/*
351 	 * Check if the device handled the decrypt in hardware.
352 	 * If so we just strip the header; otherwise we need to
353 	 * handle the decrypt in software.
354 	 */
355 	if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
356 	    !tkip_decrypt(ctx, k, m, hdrlen))
357 		return 0;
358 
359 finish:
360 
361 	/*
362 	 * Copy up 802.11 header and strip crypto bits - but only if we
363 	 * are required to.
364 	 */
365 	if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
366 		memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *),
367 		    hdrlen);
368 		m_adj(m, tkip.ic_header);
369 	}
370 
371 	/*
372 	 * XXX TODO: do we need an option to potentially not strip the
373 	 * WEP trailer?  Does "MMIC_STRIP" also mean this? Or?
374 	 */
375 	m_adj(m, -tkip.ic_trailer);
376 
377 	return 1;
378 }
379 
380 /*
381  * Verify and strip MIC from the frame.
382  */
383 static int
384 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
385 {
386 	const struct ieee80211_rx_stats *rxs;
387 	struct tkip_ctx *ctx = k->wk_private;
388 	struct ieee80211_frame *wh;
389 	uint8_t tid;
390 
391 	wh = mtod(m, struct ieee80211_frame *);
392 	rxs = ieee80211_get_rx_params_ptr(m);
393 
394 	/*
395 	 * If we are told about a MIC failure from the driver,
396 	 * directly notify as a michael failure to the upper
397 	 * layers.
398 	 */
399 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_FAIL_MIC)) {
400 		struct ieee80211vap *vap = ctx->tc_vap;
401 		ieee80211_notify_michael_failure(vap, wh,
402 		    k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
403 		    k->wk_rxkeyix : k->wk_keyix);
404 		return 0;
405 	}
406 
407 	/*
408 	 * If IV has been stripped, we skip most of the below.
409 	 */
410 	if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_MMIC_STRIP))
411 		goto finish;
412 
413 	if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) {
414 		struct ieee80211vap *vap = ctx->tc_vap;
415 		int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh);
416 		u8 mic[IEEE80211_WEP_MICLEN];
417 		u8 mic0[IEEE80211_WEP_MICLEN];
418 
419 		vap->iv_stats.is_crypto_tkipdemic++;
420 
421 		michael_mic(ctx, k->wk_rxmic,
422 			m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
423 			mic);
424 		m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
425 			tkip.ic_miclen, mic0);
426 		if (memcmp(mic, mic0, tkip.ic_miclen)) {
427 			/* NB: 802.11 layer handles statistic and debug msg */
428 			ieee80211_notify_michael_failure(vap, wh,
429 				k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
430 					k->wk_rxkeyix : k->wk_keyix);
431 			return 0;
432 		}
433 	}
434 	/*
435 	 * Strip MIC from the tail.
436 	 */
437 	m_adj(m, -tkip.ic_miclen);
438 
439 	/*
440 	 * Ok to update rsc now that MIC has been verified.
441 	 */
442 	tid = ieee80211_gettid(wh);
443 	k->wk_keyrsc[tid] = ctx->rx_rsc;
444 
445 finish:
446 	return 1;
447 }
448 
449 /*
450  * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
451  *
452  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
453  *
454  * This program is free software; you can redistribute it and/or modify
455  * it under the terms of the GNU General Public License version 2 as
456  * published by the Free Software Foundation. See README and COPYING for
457  * more details.
458  *
459  * Alternatively, this software may be distributed under the terms of BSD
460  * license.
461  */
462 
463 static const __u32 crc32_table[256] = {
464 	0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
465 	0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
466 	0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
467 	0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
468 	0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
469 	0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
470 	0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
471 	0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
472 	0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
473 	0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
474 	0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
475 	0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
476 	0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
477 	0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
478 	0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
479 	0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
480 	0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
481 	0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
482 	0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
483 	0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
484 	0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
485 	0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
486 	0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
487 	0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
488 	0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
489 	0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
490 	0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
491 	0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
492 	0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
493 	0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
494 	0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
495 	0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
496 	0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
497 	0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
498 	0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
499 	0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
500 	0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
501 	0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
502 	0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
503 	0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
504 	0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
505 	0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
506 	0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
507 	0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
508 	0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
509 	0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
510 	0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
511 	0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
512 	0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
513 	0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
514 	0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
515 	0x2d02ef8dL
516 };
517 
518 static __inline u16 RotR1(u16 val)
519 {
520 	return (val >> 1) | (val << 15);
521 }
522 
523 static __inline u8 Lo8(u16 val)
524 {
525 	return val & 0xff;
526 }
527 
528 static __inline u8 Hi8(u16 val)
529 {
530 	return val >> 8;
531 }
532 
533 static __inline u16 Lo16(u32 val)
534 {
535 	return val & 0xffff;
536 }
537 
538 static __inline u16 Hi16(u32 val)
539 {
540 	return val >> 16;
541 }
542 
543 static __inline u16 Mk16(u8 hi, u8 lo)
544 {
545 	return lo | (((u16) hi) << 8);
546 }
547 
548 static __inline u16 Mk16_le(const u16 *v)
549 {
550 	return le16toh(*v);
551 }
552 
553 static const u16 Sbox[256] = {
554 	0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
555 	0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
556 	0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
557 	0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
558 	0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
559 	0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
560 	0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
561 	0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
562 	0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
563 	0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
564 	0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
565 	0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
566 	0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
567 	0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
568 	0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
569 	0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
570 	0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
571 	0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
572 	0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
573 	0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
574 	0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
575 	0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
576 	0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
577 	0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
578 	0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
579 	0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
580 	0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
581 	0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
582 	0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
583 	0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
584 	0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
585 	0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
586 };
587 
588 static __inline u16 _S_(u16 v)
589 {
590 	u16 t = Sbox[Hi8(v)];
591 	return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
592 }
593 
594 #define PHASE1_LOOP_COUNT 8
595 
596 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
597 {
598 	int i, j;
599 
600 	/* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
601 	TTAK[0] = Lo16(IV32);
602 	TTAK[1] = Hi16(IV32);
603 	TTAK[2] = Mk16(TA[1], TA[0]);
604 	TTAK[3] = Mk16(TA[3], TA[2]);
605 	TTAK[4] = Mk16(TA[5], TA[4]);
606 
607 	for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
608 		j = 2 * (i & 1);
609 		TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
610 		TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
611 		TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
612 		TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
613 		TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
614 	}
615 }
616 
617 #ifndef _BYTE_ORDER
618 #error "Don't know native byte order"
619 #endif
620 
621 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
622 			       u16 IV16)
623 {
624 	/* Make temporary area overlap WEP seed so that the final copy can be
625 	 * avoided on little endian hosts. */
626 	u16 *PPK = (u16 *) &WEPSeed[4];
627 
628 	/* Step 1 - make copy of TTAK and bring in TSC */
629 	PPK[0] = TTAK[0];
630 	PPK[1] = TTAK[1];
631 	PPK[2] = TTAK[2];
632 	PPK[3] = TTAK[3];
633 	PPK[4] = TTAK[4];
634 	PPK[5] = TTAK[4] + IV16;
635 
636 	/* Step 2 - 96-bit bijective mixing using S-box */
637 	PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
638 	PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
639 	PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
640 	PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
641 	PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
642 	PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
643 
644 	PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
645 	PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
646 	PPK[2] += RotR1(PPK[1]);
647 	PPK[3] += RotR1(PPK[2]);
648 	PPK[4] += RotR1(PPK[3]);
649 	PPK[5] += RotR1(PPK[4]);
650 
651 	/* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
652 	 * WEPSeed[0..2] is transmitted as WEP IV */
653 	WEPSeed[0] = Hi8(IV16);
654 	WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
655 	WEPSeed[2] = Lo8(IV16);
656 	WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
657 
658 #if _BYTE_ORDER == _BIG_ENDIAN
659 	{
660 		int i;
661 		for (i = 0; i < 6; i++)
662 			PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
663 	}
664 #endif
665 }
666 
667 static void
668 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
669 	uint8_t icv[IEEE80211_WEP_CRCLEN])
670 {
671 	u32 i, j, k, crc;
672 	size_t buflen;
673 	u8 S[256];
674 	u8 *pos;
675 	struct mbuf *m;
676 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
677 
678 	/* Setup RC4 state */
679 	for (i = 0; i < 256; i++)
680 		S[i] = i;
681 	j = 0;
682 	for (i = 0; i < 256; i++) {
683 		j = (j + S[i] + key[i & 0x0f]) & 0xff;
684 		S_SWAP(i, j);
685 	}
686 
687 	/* Compute CRC32 over unencrypted data and apply RC4 to data */
688 	crc = ~0;
689 	i = j = 0;
690 	m = m0;
691 	pos = mtod(m, uint8_t *) + off;
692 	buflen = m->m_len - off;
693 	for (;;) {
694 		if (buflen > data_len)
695 			buflen = data_len;
696 		data_len -= buflen;
697 		for (k = 0; k < buflen; k++) {
698 			crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
699 			i = (i + 1) & 0xff;
700 			j = (j + S[i]) & 0xff;
701 			S_SWAP(i, j);
702 			*pos++ ^= S[(S[i] + S[j]) & 0xff];
703 		}
704 		m = m->m_next;
705 		if (m == NULL) {
706 			KASSERT(data_len == 0,
707 			    ("out of buffers with data_len %zu\n", data_len));
708 			break;
709 		}
710 		pos = mtod(m, uint8_t *);
711 		buflen = m->m_len;
712 	}
713 	crc = ~crc;
714 
715 	/* Append little-endian CRC32 and encrypt it to produce ICV */
716 	icv[0] = crc;
717 	icv[1] = crc >> 8;
718 	icv[2] = crc >> 16;
719 	icv[3] = crc >> 24;
720 	for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
721 		i = (i + 1) & 0xff;
722 		j = (j + S[i]) & 0xff;
723 		S_SWAP(i, j);
724 		icv[k] ^= S[(S[i] + S[j]) & 0xff];
725 	}
726 }
727 
728 static int
729 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
730 {
731 	u32 i, j, k, crc;
732 	u8 S[256];
733 	u8 *pos, icv[4];
734 	size_t buflen;
735 
736 	/* Setup RC4 state */
737 	for (i = 0; i < 256; i++)
738 		S[i] = i;
739 	j = 0;
740 	for (i = 0; i < 256; i++) {
741 		j = (j + S[i] + key[i & 0x0f]) & 0xff;
742 		S_SWAP(i, j);
743 	}
744 
745 	/* Apply RC4 to data and compute CRC32 over decrypted data */
746 	crc = ~0;
747 	i = j = 0;
748 	pos = mtod(m, uint8_t *) + off;
749 	buflen = m->m_len - off;
750 	for (;;) {
751 		if (buflen > data_len)
752 			buflen = data_len;
753 		data_len -= buflen;
754 		for (k = 0; k < buflen; k++) {
755 			i = (i + 1) & 0xff;
756 			j = (j + S[i]) & 0xff;
757 			S_SWAP(i, j);
758 			*pos ^= S[(S[i] + S[j]) & 0xff];
759 			crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
760 			pos++;
761 		}
762 		m = m->m_next;
763 		if (m == NULL) {
764 			KASSERT(data_len == 0,
765 			    ("out of buffers with data_len %zu\n", data_len));
766 			break;
767 		}
768 		pos = mtod(m, uint8_t *);
769 		buflen = m->m_len;
770 	}
771 	crc = ~crc;
772 
773 	/* Encrypt little-endian CRC32 and verify that it matches with the
774 	 * received ICV */
775 	icv[0] = crc;
776 	icv[1] = crc >> 8;
777 	icv[2] = crc >> 16;
778 	icv[3] = crc >> 24;
779 	for (k = 0; k < 4; k++) {
780 		i = (i + 1) & 0xff;
781 		j = (j + S[i]) & 0xff;
782 		S_SWAP(i, j);
783 		if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
784 			/* ICV mismatch - drop frame */
785 			return -1;
786 		}
787 	}
788 
789 	return 0;
790 }
791 
792 static __inline u32 rotl(u32 val, int bits)
793 {
794 	return (val << bits) | (val >> (32 - bits));
795 }
796 
797 static __inline u32 rotr(u32 val, int bits)
798 {
799 	return (val >> bits) | (val << (32 - bits));
800 }
801 
802 static __inline u32 xswap(u32 val)
803 {
804 	return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
805 }
806 
807 #define michael_block(l, r)	\
808 do {				\
809 	r ^= rotl(l, 17);	\
810 	l += r;			\
811 	r ^= xswap(l);		\
812 	l += r;			\
813 	r ^= rotl(l, 3);	\
814 	l += r;			\
815 	r ^= rotr(l, 2);	\
816 	l += r;			\
817 } while (0)
818 
819 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
820 {
821 	return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
822 }
823 
824 static __inline u32 get_le32(const u8 *p)
825 {
826 	return get_le32_split(p[0], p[1], p[2], p[3]);
827 }
828 
829 static __inline void put_le32(u8 *p, u32 v)
830 {
831 	p[0] = v;
832 	p[1] = v >> 8;
833 	p[2] = v >> 16;
834 	p[3] = v >> 24;
835 }
836 
837 /*
838  * Craft pseudo header used to calculate the MIC.
839  */
840 static void
841 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
842 {
843 	const struct ieee80211_frame_addr4 *wh =
844 		(const struct ieee80211_frame_addr4 *) wh0;
845 
846 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
847 	case IEEE80211_FC1_DIR_NODS:
848 		IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
849 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
850 		break;
851 	case IEEE80211_FC1_DIR_TODS:
852 		IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
853 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
854 		break;
855 	case IEEE80211_FC1_DIR_FROMDS:
856 		IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
857 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
858 		break;
859 	case IEEE80211_FC1_DIR_DSTODS:
860 		IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
861 		IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
862 		break;
863 	}
864 
865 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_DATA) {
866 		const struct ieee80211_qosframe *qwh =
867 			(const struct ieee80211_qosframe *) wh;
868 		hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
869 	} else
870 		hdr[12] = 0;
871 	hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
872 }
873 
874 static void
875 michael_mic(struct tkip_ctx *ctx, const u8 *key,
876 	struct mbuf *m, u_int off, size_t data_len,
877 	u8 mic[IEEE80211_WEP_MICLEN])
878 {
879 	uint8_t hdr[16];
880 	u32 l, r;
881 	const uint8_t *data;
882 	u_int space;
883 
884 	michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
885 
886 	l = get_le32(key);
887 	r = get_le32(key + 4);
888 
889 	/* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
890 	l ^= get_le32(hdr);
891 	michael_block(l, r);
892 	l ^= get_le32(&hdr[4]);
893 	michael_block(l, r);
894 	l ^= get_le32(&hdr[8]);
895 	michael_block(l, r);
896 	l ^= get_le32(&hdr[12]);
897 	michael_block(l, r);
898 
899 	/* first buffer has special handling */
900 	data = mtod(m, const uint8_t *) + off;
901 	space = m->m_len - off;
902 	for (;;) {
903 		if (space > data_len)
904 			space = data_len;
905 		/* collect 32-bit blocks from current buffer */
906 		while (space >= sizeof(uint32_t)) {
907 			l ^= get_le32(data);
908 			michael_block(l, r);
909 			data += sizeof(uint32_t), space -= sizeof(uint32_t);
910 			data_len -= sizeof(uint32_t);
911 		}
912 		/*
913 		 * NB: when space is zero we make one more trip around
914 		 * the loop to advance to the next mbuf where there is
915 		 * data.  This handles the case where there are 4*n
916 		 * bytes in an mbuf followed by <4 bytes in a later mbuf.
917 		 * By making an extra trip we'll drop out of the loop
918 		 * with m pointing at the mbuf with 3 bytes and space
919 		 * set as required by the remainder handling below.
920 		 */
921 		if (data_len == 0 ||
922 		    (data_len < sizeof(uint32_t) && space != 0))
923 			break;
924 		m = m->m_next;
925 		if (m == NULL) {
926 			KASSERT(0, ("out of data, data_len %zu\n", data_len));
927 			break;
928 		}
929 		if (space != 0) {
930 			const uint8_t *data_next;
931 			/*
932 			 * Block straddles buffers, split references.
933 			 */
934 			data_next = mtod(m, const uint8_t *);
935 			KASSERT(m->m_len >= sizeof(uint32_t) - space,
936 				("not enough data in following buffer, "
937 				"m_len %u need %zu\n", m->m_len,
938 				sizeof(uint32_t) - space));
939 			switch (space) {
940 			case 1:
941 				l ^= get_le32_split(data[0], data_next[0],
942 					data_next[1], data_next[2]);
943 				data = data_next + 3;
944 				space = m->m_len - 3;
945 				break;
946 			case 2:
947 				l ^= get_le32_split(data[0], data[1],
948 					data_next[0], data_next[1]);
949 				data = data_next + 2;
950 				space = m->m_len - 2;
951 				break;
952 			case 3:
953 				l ^= get_le32_split(data[0], data[1],
954 					data[2], data_next[0]);
955 				data = data_next + 1;
956 				space = m->m_len - 1;
957 				break;
958 			}
959 			michael_block(l, r);
960 			data_len -= sizeof(uint32_t);
961 		} else {
962 			/*
963 			 * Setup for next buffer.
964 			 */
965 			data = mtod(m, const uint8_t *);
966 			space = m->m_len;
967 		}
968 	}
969 	/*
970 	 * Catch degenerate cases like mbuf[4*n+1 bytes] followed by
971 	 * mbuf[2 bytes].  I don't believe these should happen; if they
972 	 * do then we'll need more involved logic.
973 	 */
974 	KASSERT(data_len <= space,
975 	    ("not enough data, data_len %zu space %u\n", data_len, space));
976 
977 	/* Last block and padding (0x5a, 4..7 x 0) */
978 	switch (data_len) {
979 	case 0:
980 		l ^= get_le32_split(0x5a, 0, 0, 0);
981 		break;
982 	case 1:
983 		l ^= get_le32_split(data[0], 0x5a, 0, 0);
984 		break;
985 	case 2:
986 		l ^= get_le32_split(data[0], data[1], 0x5a, 0);
987 		break;
988 	case 3:
989 		l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
990 		break;
991 	}
992 	michael_block(l, r);
993 	/* l ^= 0; */
994 	michael_block(l, r);
995 
996 	put_le32(mic, l);
997 	put_le32(mic + 4, r);
998 }
999 
1000 static int
1001 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1002 	struct mbuf *m, int hdrlen)
1003 {
1004 	struct ieee80211_frame *wh;
1005 	uint8_t icv[IEEE80211_WEP_CRCLEN];
1006 
1007 	ctx->tc_vap->iv_stats.is_crypto_tkip++;
1008 
1009 	wh = mtod(m, struct ieee80211_frame *);
1010 	if ((u16)(key->wk_keytsc) == 0 || key->wk_keytsc == 1) {
1011 		tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
1012 				   (u32)(key->wk_keytsc >> 16));
1013 	}
1014 	tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
1015 		(u16) key->wk_keytsc);
1016 
1017 	wep_encrypt(ctx->tx_rc4key,
1018 		m, hdrlen + tkip.ic_header,
1019 		m->m_pkthdr.len - (hdrlen + tkip.ic_header),
1020 		icv);
1021 	(void) m_append(m, IEEE80211_WEP_CRCLEN, icv);	/* XXX check return */
1022 
1023 	return 1;
1024 }
1025 
1026 static int
1027 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
1028 	struct mbuf *m, int hdrlen)
1029 {
1030 	struct ieee80211_frame *wh;
1031 	struct ieee80211vap *vap = ctx->tc_vap;
1032 	u32 iv32;
1033 	u16 iv16;
1034 	u8 tid;
1035 
1036 	vap->iv_stats.is_crypto_tkip++;
1037 
1038 	wh = mtod(m, struct ieee80211_frame *);
1039 	/* NB: tkip_decap already verified header and left seq in rx_rsc */
1040 	iv16 = (u16) ctx->rx_rsc;
1041 	iv32 = (u32) (ctx->rx_rsc >> 16);
1042 
1043 	tid = ieee80211_gettid(wh);
1044 	if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) {
1045 		tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
1046 			wh->i_addr2, iv32);
1047 		ctx->rx_phase1_done = 1;
1048 	}
1049 	tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
1050 
1051 	/* NB: m is unstripped; deduct headers + ICV to get payload */
1052 	if (wep_decrypt(ctx->rx_rc4key,
1053 		m, hdrlen + tkip.ic_header,
1054 	        m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
1055 		if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) {
1056 			/* Previously cached Phase1 result was already lost, so
1057 			 * it needs to be recalculated for the next packet. */
1058 			ctx->rx_phase1_done = 0;
1059 		}
1060 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
1061 		    "%s", "TKIP ICV mismatch on decrypt");
1062 		vap->iv_stats.is_rx_tkipicv++;
1063 		return 0;
1064 	}
1065 	return 1;
1066 }
1067 
1068 /*
1069  * Module glue.
1070  */
1071 IEEE80211_CRYPTO_MODULE(tkip, 1);
1072