1 /* 2 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 /* 7 * Copyright (c) 2001 Atsushi Onoe 8 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. The name of the author may not be used to endorse or promote products 20 * derived from this software without specific prior written permission. 21 * 22 * Alternatively, this software may be distributed under the terms of the 23 * GNU General Public License ("GPL") version 2 as published by the Free 24 * Software Foundation. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 /* 39 * IEEE 802.11i TKIP crypto support. 40 * 41 * Part of this module is derived from similar code in the Host 42 * AP driver. The code is used with the consent of the author and 43 * it's license is included below. 44 */ 45 46 #include <sys/byteorder.h> 47 #include <sys/crypto/common.h> 48 #include <sys/crypto/api.h> 49 #include <sys/crc32.h> 50 #include <sys/random.h> 51 #include <sys/strsun.h> 52 #include "net80211_impl.h" 53 54 static void *tkip_attach(struct ieee80211com *, struct ieee80211_key *); 55 static void tkip_detach(struct ieee80211_key *); 56 static int tkip_setkey(struct ieee80211_key *); 57 static int tkip_encap(struct ieee80211_key *, mblk_t *, uint8_t); 58 static int tkip_decap(struct ieee80211_key *, mblk_t *, int); 59 static int tkip_enmic(struct ieee80211_key *, mblk_t *, int); 60 static int tkip_demic(struct ieee80211_key *, mblk_t *, int); 61 62 const struct ieee80211_cipher tkip = { 63 "TKIP", 64 IEEE80211_CIPHER_TKIP, 65 IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + 66 IEEE80211_WEP_EXTIVLEN, 67 IEEE80211_WEP_CRCLEN, 68 IEEE80211_WEP_MICLEN, 69 tkip_attach, 70 tkip_detach, 71 tkip_setkey, 72 tkip_encap, 73 tkip_decap, 74 tkip_enmic, 75 tkip_demic, 76 }; 77 78 struct tkip_ctx { 79 struct ieee80211com *tc_ic; /* for diagnostics */ 80 uint16_t tx_ttak[5]; 81 int tx_phase1_done; 82 uint8_t tx_rc4key[16]; 83 uint16_t rx_ttak[5]; 84 int rx_phase1_done; 85 uint8_t rx_rc4key[16]; 86 uint64_t rx_rsc; /* held until MIC verified */ 87 }; 88 89 static void michael_mic(struct tkip_ctx *, const uint8_t *, 90 mblk_t *, uint_t, size_t, uint8_t[]); 91 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *, 92 mblk_t *, int); 93 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *, 94 mblk_t *, int); 95 96 extern int rc4_init(crypto_context_t *, const uint8_t *, int); 97 extern int rc4_crypt(crypto_context_t, const uint8_t *, uint8_t *, int); 98 extern int rc4_final(crypto_context_t, uint8_t *, int); 99 100 /* ARGSUSED */ 101 static void * 102 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k) 103 { 104 struct tkip_ctx *ctx; 105 106 ctx = kmem_zalloc(sizeof (struct tkip_ctx), KM_SLEEP); 107 if (ctx == NULL) 108 return (NULL); 109 110 ctx->tc_ic = ic; 111 return (ctx); 112 } 113 114 static void 115 tkip_detach(struct ieee80211_key *k) 116 { 117 struct tkip_ctx *ctx = k->wk_private; 118 119 if (ctx != NULL) 120 kmem_free(ctx, sizeof (struct tkip_ctx)); 121 } 122 123 static int 124 tkip_setkey(struct ieee80211_key *k) 125 { 126 if (k->wk_keylen != (128/NBBY)) 127 return (0); 128 129 k->wk_keytsc = 1; /* TSC starts at 1 */ 130 return (1); 131 } 132 133 /* 134 * Add privacy headers appropriate for the specified key. 135 */ 136 static int 137 tkip_encap(struct ieee80211_key *k, mblk_t *mp, uint8_t keyid) 138 { 139 struct tkip_ctx *ctx = k->wk_private; 140 struct ieee80211com *ic = ctx->tc_ic; 141 uint8_t *ivp; 142 int hdrlen; 143 144 /* 145 * Handle TKIP counter measures requirement. 146 */ 147 if (ic->ic_flags & IEEE80211_F_COUNTERM) 148 return (0); 149 150 hdrlen = ieee80211_hdrspace(ic, mp->b_rptr); 151 /* 152 * Copy down 802.11 header and add the IV, KeyID, and ExtIV. 153 */ 154 ivp = mp->b_rptr; 155 ivp += hdrlen; 156 157 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */ 158 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */ 159 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */ 160 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */ 161 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */ 162 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */ 163 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */ 164 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */ 165 166 /* 167 * Finally, do software encrypt if neeed. 168 */ 169 if (k->wk_flags & IEEE80211_KEY_SWCRYPT) { 170 if (!tkip_encrypt(ctx, k, mp, hdrlen)) 171 return (0); 172 } else 173 k->wk_keytsc++; /* wrap at 48 bits */ 174 175 return (1); 176 } 177 178 uint64_t 179 ieee80211_read_6(uint8_t b0, uint8_t b1, uint8_t b2, 180 uint8_t b3, uint8_t b4, uint8_t b5) 181 { 182 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24); 183 uint16_t iv16 = (b4 << 0) | (b5 << 8); 184 return ((((uint64_t)iv16) << 32) | iv32); 185 } 186 187 /* 188 * Validate and strip privacy headers (and trailer) for a 189 * received frame. If necessary, decrypt the frame using 190 * the specified key. 191 */ 192 static int 193 tkip_decap(struct ieee80211_key *k, mblk_t *mp, int hdrlen) 194 { 195 struct tkip_ctx *ctx = k->wk_private; 196 struct ieee80211com *ic = ctx->tc_ic; 197 uint8_t *ivp; 198 uint64_t pn; 199 200 /* 201 * Header should have extended IV and sequence number; 202 * verify the former and validate the latter. 203 */ 204 ivp = mp->b_rptr + hdrlen; 205 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) { 206 /* 207 * No extended IV; discard frame. 208 */ 209 return (0); 210 } 211 /* 212 * Handle TKIP counter measures requirement. 213 */ 214 if (ic->ic_flags & IEEE80211_F_COUNTERM) 215 return (0); 216 217 /* NB: assume IEEEE80211_WEP_MINLEN covers the extended IV */ 218 pn = ieee80211_read_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]); 219 ctx->rx_rsc = pn; 220 if (ctx->rx_rsc <= k->wk_keyrsc) 221 return (0); 222 /* 223 * NB: We can't update the rsc in the key until MIC is verified. 224 * 225 * We assume we are not preempted between doing the check above 226 * and updating wk_keyrsc when stripping the MIC in tkip_demic. 227 * Otherwise we might process another packet and discard it as 228 * a replay. 229 */ 230 231 /* 232 * Check if the device handled the decrypt in hardware. 233 * If so we just strip the header; otherwise we need to 234 * handle the decrypt in software. 235 */ 236 if (k->wk_flags & IEEE80211_KEY_SWCRYPT) { 237 if (!tkip_decrypt(ctx, k, mp, hdrlen)) 238 return (0); 239 } 240 241 /* 242 * Copy up 802.11 header and strip crypto bits. 243 */ 244 (void) memmove(mp->b_rptr + tkip.ic_header, mp->b_rptr, hdrlen); 245 mp->b_rptr += tkip.ic_header; 246 mp->b_wptr -= tkip.ic_trailer; 247 248 return (1); 249 } 250 251 /* 252 * Add MIC to the frame as needed. 253 */ 254 static int 255 tkip_enmic(struct ieee80211_key *k, mblk_t *mp, int force) 256 { 257 struct tkip_ctx *ctx = k->wk_private; 258 259 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) { 260 int hdrlen; 261 uint8_t *mic; 262 263 hdrlen = ieee80211_hdrspace(ctx->tc_ic, mp->b_rptr); 264 mic = mp->b_wptr; 265 mp->b_wptr += tkip.ic_miclen; 266 267 if ((int)(MBLKL(mp) - 268 (hdrlen + tkip.ic_header + tkip.ic_miclen)) < 0) 269 return (0); /* dead packet */ 270 271 michael_mic(ctx, k->wk_txmic, mp, (hdrlen + tkip.ic_header), 272 MBLKL(mp) - 273 (hdrlen + tkip.ic_header + tkip.ic_miclen), mic); 274 } 275 return (1); 276 } 277 278 /* 279 * Verify and strip MIC from the frame. 280 */ 281 /* ARGSUSED */ 282 static int 283 tkip_demic(struct ieee80211_key *k, mblk_t *mp, int force) 284 { 285 struct tkip_ctx *ctx = k->wk_private; 286 287 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) { 288 int hdrlen = ieee80211_hdrspace(ctx->tc_ic, mp->b_rptr); 289 uint8_t mic[IEEE80211_WEP_MICLEN]; 290 uint8_t mic0[IEEE80211_WEP_MICLEN]; 291 292 michael_mic(ctx, k->wk_rxmic, 293 mp, hdrlen, 294 MBLKL(mp) - (hdrlen + tkip.ic_miclen), 295 mic); 296 bcopy(mp->b_wptr - tkip.ic_miclen, mic0, tkip.ic_miclen); 297 if (bcmp(mic, mic0, tkip.ic_miclen)) { 298 ieee80211_dbg(IEEE80211_MSG_CRYPTO, 299 "tkip_demic() mic mismatch\n"); 300 return (0); 301 } 302 } 303 /* 304 * Strip MIC from the tail. 305 */ 306 mp->b_wptr -= tkip.ic_miclen; 307 /* 308 * Ok to update rsc now that MIC has been verified. 309 */ 310 k->wk_keyrsc = ctx->rx_rsc; 311 return (1); 312 } 313 314 /* 315 * For the avoidance of doubt, except that if any license choice other 316 * than GPL or LGPL is available it will apply instead, Sun elects to 317 * use only the General Public License version 2 (GPLv2) at this time 318 * for any software where a choice of GPL license versions is made 319 * available with the language indicating that GPLv2 or any later 320 * version may be used, or where a choice of which version of the GPL 321 * is applied is otherwise unspecified. 322 */ 323 324 /* 325 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver 326 * 327 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 328 * 329 * This program is free software; you can redistribute it and/or modify 330 * it under the terms of the GNU General Public License version 2 as 331 * published by the Free Software Foundation. See README and COPYING for 332 * more details. 333 * 334 * Alternatively, this software may be distributed under the terms of BSD 335 * license. 336 */ 337 338 /* Table of CRCs of all 8-bit messages */ 339 static uint32_t crc_table[] = { CRC32_TABLE }; 340 341 static uint16_t 342 RotR1(uint16_t val) 343 { 344 return ((val >> 1) | (val << 15)); 345 } 346 347 static uint8_t 348 Lo8(uint16_t val) 349 { 350 return (val & 0xff); 351 } 352 353 static uint8_t 354 Hi8(uint16_t val) 355 { 356 return (val >> 8); 357 } 358 359 static uint16_t 360 Lo16(uint32_t val) 361 { 362 return (val & 0xffff); 363 } 364 365 static uint16_t 366 Hi16(uint32_t val) 367 { 368 return (val >> 16); 369 } 370 371 static uint16_t 372 Mk16(uint8_t hi, uint8_t lo) 373 { 374 return (lo | (((uint16_t)hi) << 8)); 375 } 376 377 static uint16_t 378 Mk16_le(const uint16_t *v) 379 { 380 return (LE_16(*v)); 381 } 382 383 static const uint16_t Sbox[256] = { 384 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 385 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 386 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 387 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 388 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, 389 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, 390 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, 391 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, 392 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, 393 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 394 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 395 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 396 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 397 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, 398 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, 399 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, 400 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, 401 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, 402 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 403 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 404 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 405 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 406 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, 407 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, 408 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, 409 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, 410 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, 411 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 412 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 413 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 414 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 415 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, 416 }; 417 418 static uint16_t 419 _S_(uint16_t v) 420 { 421 uint16_t t = Sbox[Hi8(v)]; 422 return (Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8))); 423 } 424 425 #define PHASE1_LOOP_COUNT 8 426 427 static void 428 tkip_mixing_phase1(uint16_t *TTAK, const uint8_t *TK, 429 const uint8_t *TA, uint32_t IV32) 430 { 431 int i, j; 432 433 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */ 434 TTAK[0] = Lo16(IV32); 435 TTAK[1] = Hi16(IV32); 436 TTAK[2] = Mk16(TA[1], TA[0]); 437 TTAK[3] = Mk16(TA[3], TA[2]); 438 TTAK[4] = Mk16(TA[5], TA[4]); 439 440 for (i = 0; i < PHASE1_LOOP_COUNT; i++) { 441 j = 2 * (i & 1); 442 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j])); 443 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j])); 444 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j])); 445 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j])); 446 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i; 447 } 448 } 449 450 static void 451 tkip_mixing_phase2(uint8_t *WEPSeed, const uint8_t *TK, 452 const uint16_t *TTAK, uint16_t IV16) 453 { 454 /* 455 * Make temporary area overlap WEP seed so that the final copy can be 456 * avoided on little endian hosts. 457 */ 458 uint16_t *PPK = (uint16_t *)&WEPSeed[4]; 459 460 /* Step 1 - make copy of TTAK and bring in TSC */ 461 PPK[0] = TTAK[0]; 462 PPK[1] = TTAK[1]; 463 PPK[2] = TTAK[2]; 464 PPK[3] = TTAK[3]; 465 PPK[4] = TTAK[4]; 466 PPK[5] = TTAK[4] + IV16; 467 468 /* Step 2 - 96-bit bijective mixing using S-box */ 469 PPK[0] += _S_(PPK[5] ^ Mk16_le((const uint16_t *) &TK[0])); 470 PPK[1] += _S_(PPK[0] ^ Mk16_le((const uint16_t *) &TK[2])); 471 PPK[2] += _S_(PPK[1] ^ Mk16_le((const uint16_t *) &TK[4])); 472 PPK[3] += _S_(PPK[2] ^ Mk16_le((const uint16_t *) &TK[6])); 473 PPK[4] += _S_(PPK[3] ^ Mk16_le((const uint16_t *) &TK[8])); 474 PPK[5] += _S_(PPK[4] ^ Mk16_le((const uint16_t *) &TK[10])); 475 476 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const uint16_t *) &TK[12])); 477 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const uint16_t *) &TK[14])); 478 PPK[2] += RotR1(PPK[1]); 479 PPK[3] += RotR1(PPK[2]); 480 PPK[4] += RotR1(PPK[3]); 481 PPK[5] += RotR1(PPK[4]); 482 483 /* 484 * Step 3 - bring in last of TK bits, assign 24-bit WEP IV value 485 * WEPSeed[0..2] is transmitted as WEP IV 486 */ 487 WEPSeed[0] = Hi8(IV16); 488 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F; 489 WEPSeed[2] = Lo8(IV16); 490 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const uint16_t *) &TK[0])) >> 1); 491 492 #ifdef _BIG_ENDIAN 493 int i; 494 for (i = 0; i < 6; i++) 495 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8); 496 #endif 497 } 498 499 static int 500 wep_encrypt(uint8_t *key, mblk_t *mp, uint_t off, size_t data_len, 501 uint8_t icv[IEEE80211_WEP_CRCLEN]) 502 { 503 uint8_t crcbuf[IEEE80211_WEP_CRCLEN]; 504 uint32_t crc; 505 crypto_context_t ctx; 506 int rv; 507 508 ctx = NULL; 509 rv = rc4_init(&ctx, (const uint8_t *)key, 16); 510 if (rv != CRYPTO_SUCCESS) 511 return (0); 512 513 /* calculate CRC over unencrypted data */ 514 CRC32(crc, mp->b_rptr + off, data_len, -1U, crc_table); 515 516 /* encrypt data */ 517 (void) rc4_crypt(ctx, mp->b_rptr + off, mp->b_rptr + off, data_len); 518 519 /* tack on ICV */ 520 *(uint32_t *)crcbuf = LE_32(~crc); 521 (void) rc4_crypt(ctx, crcbuf, icv, IEEE80211_WEP_CRCLEN); 522 523 (void) rc4_final(ctx, icv, IEEE80211_WEP_CRCLEN); 524 525 return (1); 526 } 527 528 static int 529 wep_decrypt(uint8_t *key, mblk_t *mp, uint_t off, size_t data_len) 530 { 531 uint8_t crcbuf[IEEE80211_WEP_CRCLEN]; 532 uint8_t *icv; 533 uint32_t crc; 534 crypto_context_t ctx; 535 int rv; 536 537 ctx = NULL; 538 rv = rc4_init(&ctx, (const uint8_t *)key, 16); 539 if (rv != CRYPTO_SUCCESS) 540 return (0); 541 542 /* decrypt data */ 543 (void) rc4_crypt(ctx, mp->b_rptr + off, mp->b_rptr + off, data_len); 544 545 /* calculate CRC over unencrypted data */ 546 CRC32(crc, mp->b_rptr + off, data_len, -1U, crc_table); 547 548 /* decrypt ICV and compare to CRC */ 549 icv = mp->b_wptr - IEEE80211_WEP_CRCLEN; 550 (void) rc4_crypt(ctx, icv, crcbuf, IEEE80211_WEP_CRCLEN); 551 (void) rc4_final(ctx, crcbuf, IEEE80211_WEP_CRCLEN); 552 553 return (crc == ~LE_32(*(uint32_t *)crcbuf)); 554 } 555 556 static uint32_t 557 rotl(uint32_t val, int bits) 558 { 559 return ((val << bits) | (val >> (32 - bits))); 560 } 561 562 563 static uint32_t 564 rotr(uint32_t val, int bits) 565 { 566 return ((val >> bits) | (val << (32 - bits))); 567 } 568 569 570 static uint32_t 571 xswap(uint32_t val) 572 { 573 return (((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8)); 574 } 575 576 577 #define michael_block(l, r) \ 578 do { \ 579 r ^= rotl(l, 17); \ 580 l += r; \ 581 r ^= xswap(l); \ 582 l += r; \ 583 r ^= rotl(l, 3); \ 584 l += r; \ 585 r ^= rotr(l, 2); \ 586 l += r; \ 587 _NOTE(CONSTANTCONDITION)\ 588 } while (0) 589 590 591 static uint32_t 592 get_le32_split(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3) 593 { 594 return (b0 | (b1 << 8) | (b2 << 16) | (b3 << 24)); 595 } 596 597 static uint32_t 598 get_le32(const uint8_t *p) 599 { 600 return (get_le32_split(p[0], p[1], p[2], p[3])); 601 } 602 603 604 static void 605 put_le32(uint8_t *p, uint32_t v) 606 { 607 p[0] = (uint8_t)v; 608 p[1] = v >> 8; 609 p[2] = v >> 16; 610 p[3] = v >> 24; 611 } 612 613 /* 614 * Craft pseudo header used to calculate the MIC. 615 */ 616 static void 617 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16]) 618 { 619 const struct ieee80211_frame_addr4 *wh = 620 (const struct ieee80211_frame_addr4 *)wh0; 621 622 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 623 case IEEE80211_FC1_DIR_NODS: 624 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 625 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 626 break; 627 case IEEE80211_FC1_DIR_TODS: 628 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 629 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 630 break; 631 case IEEE80211_FC1_DIR_FROMDS: 632 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 633 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3); 634 break; 635 case IEEE80211_FC1_DIR_DSTODS: 636 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 637 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4); 638 break; 639 } 640 641 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) { 642 const struct ieee80211_qosframe *qwh = 643 (const struct ieee80211_qosframe *)wh; 644 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID; 645 } else 646 hdr[12] = 0; 647 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */ 648 } 649 650 /* ARGSUSED */ 651 static void 652 michael_mic(struct tkip_ctx *ctx, const uint8_t *key, 653 mblk_t *mp, uint_t off, size_t data_len, 654 uint8_t mic[]) 655 { 656 uint8_t hdr[16]; 657 uint32_t l, r; 658 const uint8_t *data; 659 int i, blocks, last; 660 661 michael_mic_hdr((struct ieee80211_frame *)mp->b_rptr, hdr); 662 663 l = get_le32(key); 664 r = get_le32(key + 4); 665 666 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ 667 l ^= get_le32(hdr); 668 michael_block(l, r); 669 l ^= get_le32(&hdr[4]); 670 michael_block(l, r); 671 l ^= get_le32(&hdr[8]); 672 michael_block(l, r); 673 l ^= get_le32(&hdr[12]); 674 michael_block(l, r); 675 676 /* first buffer has special handling */ 677 data = mp->b_rptr + off; 678 679 blocks = data_len / 4; 680 last = data_len % 4; 681 682 for (i = 0; i < blocks; i++) { 683 l ^= get_le32(&data[4 * i]); 684 michael_block(l, r); 685 } 686 687 /* Last block and padding (0x5a, 4..7 x 0) */ 688 switch (last) { 689 case 0: 690 l ^= 0x5a; 691 break; 692 case 1: 693 l ^= data[4 * i] | 0x5a00; 694 break; 695 case 2: 696 l ^= data[4 * i] | (data[4 * i + 1] << 8) | 0x5a0000; 697 break; 698 case 3: 699 l ^= data[4 * i] | (data[4 * i + 1] << 8) | 700 (data[4 * i + 2] << 16) | 0x5a000000; 701 break; 702 } 703 michael_block(l, r); 704 /* l ^= 0; */ 705 michael_block(l, r); 706 707 put_le32(mic, l); 708 put_le32(mic + 4, r); 709 } 710 711 static int 712 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 713 mblk_t *mp, int hdrlen) 714 { 715 struct ieee80211_frame *wh; 716 uint8_t *icv; 717 718 wh = (struct ieee80211_frame *)mp->b_rptr; 719 if (!ctx->tx_phase1_done) { 720 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2, 721 (uint32_t)(key->wk_keytsc >> 16)); 722 ctx->tx_phase1_done = 1; 723 } 724 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak, 725 (uint16_t)key->wk_keytsc); 726 727 icv = mp->b_wptr; 728 mp->b_wptr += tkip.ic_trailer; 729 730 (void) wep_encrypt(ctx->tx_rc4key, 731 mp, hdrlen + tkip.ic_header, 732 MBLKL(mp) - 733 (hdrlen + tkip.ic_header + tkip.ic_trailer), 734 icv); 735 736 key->wk_keytsc++; 737 if ((uint16_t)(key->wk_keytsc) == 0) 738 ctx->tx_phase1_done = 0; 739 return (1); 740 } 741 742 static int 743 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 744 mblk_t *mp, int hdrlen) 745 { 746 struct ieee80211_frame *wh; 747 uint32_t iv32; 748 uint16_t iv16; 749 750 wh = (struct ieee80211_frame *)mp->b_rptr; 751 /* tkip_decap already verified header and left seq in rx_rsc */ 752 iv16 = (uint16_t)ctx->rx_rsc; 753 iv32 = (uint32_t)(ctx->rx_rsc >> 16); 754 755 if (iv32 != (uint32_t)(key->wk_keyrsc >> 16) || !ctx->rx_phase1_done) { 756 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key, 757 wh->i_addr2, iv32); 758 ctx->rx_phase1_done = 0; /* DHCP */ 759 } 760 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16); 761 762 /* m is unstripped; deduct headers + ICV to get payload */ 763 if (!wep_decrypt(ctx->rx_rc4key, 764 mp, hdrlen + tkip.ic_header, 765 MBLKL(mp) - 766 (hdrlen + tkip.ic_header + tkip.ic_trailer))) { 767 if (iv32 != (uint32_t)(key->wk_keyrsc >> 16)) { 768 /* 769 * Previously cached Phase1 result was already lost, so 770 * it needs to be recalculated for the next packet. 771 */ 772 ctx->rx_phase1_done = 0; 773 } 774 ieee80211_dbg(IEEE80211_MSG_CRYPTO, "tkip_decrypt() error\n"); 775 return (0); 776 } 777 return (1); 778 } 779