1 /* 2 * Copyright 2002-2004, Instant802 Networks, Inc. 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 2 as 6 * published by the Free Software Foundation. 7 */ 8 9 #include <linux/netdevice.h> 10 #include <linux/types.h> 11 #include <linux/slab.h> 12 #include <linux/skbuff.h> 13 #include <linux/compiler.h> 14 #include <net/mac80211.h> 15 16 #include "ieee80211_i.h" 17 #include "michael.h" 18 #include "tkip.h" 19 #include "aes_ccm.h" 20 #include "wpa.h" 21 22 static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da, 23 u8 *qos_tid, u8 **data, size_t *data_len) 24 { 25 struct ieee80211_hdr *hdr; 26 size_t hdrlen; 27 u16 fc; 28 int a4_included; 29 u8 *pos; 30 31 hdr = (struct ieee80211_hdr *) skb->data; 32 fc = le16_to_cpu(hdr->frame_control); 33 34 hdrlen = 24; 35 if ((fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) == 36 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) { 37 hdrlen += ETH_ALEN; 38 *sa = hdr->addr4; 39 *da = hdr->addr3; 40 } else if (fc & IEEE80211_FCTL_FROMDS) { 41 *sa = hdr->addr3; 42 *da = hdr->addr1; 43 } else if (fc & IEEE80211_FCTL_TODS) { 44 *sa = hdr->addr2; 45 *da = hdr->addr3; 46 } else { 47 *sa = hdr->addr2; 48 *da = hdr->addr1; 49 } 50 51 if (fc & 0x80) 52 hdrlen += 2; 53 54 *data = skb->data + hdrlen; 55 *data_len = skb->len - hdrlen; 56 57 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 58 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS); 59 if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA && 60 fc & IEEE80211_STYPE_QOS_DATA) { 61 pos = (u8 *) &hdr->addr4; 62 if (a4_included) 63 pos += 6; 64 *qos_tid = pos[0] & 0x0f; 65 *qos_tid |= 0x80; /* qos_included flag */ 66 } else 67 *qos_tid = 0; 68 69 return skb->len < hdrlen ? -1 : 0; 70 } 71 72 73 ieee80211_txrx_result 74 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx) 75 { 76 u8 *data, *sa, *da, *key, *mic, qos_tid; 77 size_t data_len; 78 u16 fc; 79 struct sk_buff *skb = tx->skb; 80 int authenticator; 81 int wpa_test = 0; 82 83 fc = tx->fc; 84 85 if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 || 86 !WLAN_FC_DATA_PRESENT(fc)) 87 return TXRX_CONTINUE; 88 89 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)) 90 return TXRX_DROP; 91 92 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 93 !(tx->flags & IEEE80211_TXRXD_FRAGMENTED) && 94 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) && 95 !wpa_test) { 96 /* hwaccel - with no need for preallocated room for Michael MIC 97 */ 98 return TXRX_CONTINUE; 99 } 100 101 if (skb_tailroom(skb) < MICHAEL_MIC_LEN) { 102 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 103 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, 104 MICHAEL_MIC_LEN + TKIP_ICV_LEN, 105 GFP_ATOMIC))) { 106 printk(KERN_DEBUG "%s: failed to allocate more memory " 107 "for Michael MIC\n", tx->dev->name); 108 return TXRX_DROP; 109 } 110 } 111 112 #if 0 113 authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */ 114 #else 115 authenticator = 1; 116 #endif 117 key = &tx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_TX_MIC_KEY : 118 ALG_TKIP_TEMP_AUTH_RX_MIC_KEY]; 119 mic = skb_put(skb, MICHAEL_MIC_LEN); 120 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic); 121 122 return TXRX_CONTINUE; 123 } 124 125 126 ieee80211_txrx_result 127 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx) 128 { 129 u8 *data, *sa, *da, *key = NULL, qos_tid; 130 size_t data_len; 131 u16 fc; 132 u8 mic[MICHAEL_MIC_LEN]; 133 struct sk_buff *skb = rx->skb; 134 int authenticator = 1, wpa_test = 0; 135 DECLARE_MAC_BUF(mac); 136 137 fc = rx->fc; 138 139 /* 140 * No way to verify the MIC if the hardware stripped it 141 */ 142 if (rx->u.rx.status->flag & RX_FLAG_MMIC_STRIPPED) 143 return TXRX_CONTINUE; 144 145 if (!rx->key || rx->key->conf.alg != ALG_TKIP || 146 !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc)) 147 return TXRX_CONTINUE; 148 149 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len) 150 || data_len < MICHAEL_MIC_LEN) 151 return TXRX_DROP; 152 153 data_len -= MICHAEL_MIC_LEN; 154 155 #if 0 156 authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */ 157 #else 158 authenticator = 1; 159 #endif 160 key = &rx->key->conf.key[authenticator ? ALG_TKIP_TEMP_AUTH_RX_MIC_KEY : 161 ALG_TKIP_TEMP_AUTH_TX_MIC_KEY]; 162 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic); 163 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) { 164 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) 165 return TXRX_DROP; 166 167 printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from " 168 "%s\n", rx->dev->name, print_mac(mac, sa)); 169 170 mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx, 171 (void *) skb->data); 172 return TXRX_DROP; 173 } 174 175 /* remove Michael MIC from payload */ 176 skb_trim(skb, skb->len - MICHAEL_MIC_LEN); 177 178 /* update IV in key information to be able to detect replays */ 179 rx->key->u.tkip.iv32_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv32; 180 rx->key->u.tkip.iv16_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv16; 181 182 return TXRX_CONTINUE; 183 } 184 185 186 static int tkip_encrypt_skb(struct ieee80211_txrx_data *tx, 187 struct sk_buff *skb, int test) 188 { 189 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 190 struct ieee80211_key *key = tx->key; 191 int hdrlen, len, tailneed; 192 u16 fc; 193 u8 *pos; 194 195 fc = le16_to_cpu(hdr->frame_control); 196 hdrlen = ieee80211_get_hdrlen(fc); 197 len = skb->len - hdrlen; 198 199 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) 200 tailneed = 0; 201 else 202 tailneed = TKIP_ICV_LEN; 203 204 if ((skb_headroom(skb) < TKIP_IV_LEN || 205 skb_tailroom(skb) < tailneed)) { 206 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 207 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, tailneed, 208 GFP_ATOMIC))) 209 return -1; 210 } 211 212 pos = skb_push(skb, TKIP_IV_LEN); 213 memmove(pos, pos + TKIP_IV_LEN, hdrlen); 214 pos += hdrlen; 215 216 /* Increase IV for the frame */ 217 key->u.tkip.iv16++; 218 if (key->u.tkip.iv16 == 0) 219 key->u.tkip.iv32++; 220 221 if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { 222 hdr = (struct ieee80211_hdr *)skb->data; 223 224 /* hwaccel - with preallocated room for IV */ 225 ieee80211_tkip_add_iv(pos, key, 226 (u8) (key->u.tkip.iv16 >> 8), 227 (u8) (((key->u.tkip.iv16 >> 8) | 0x20) & 228 0x7f), 229 (u8) key->u.tkip.iv16); 230 231 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx; 232 return 0; 233 } 234 235 /* Add room for ICV */ 236 skb_put(skb, TKIP_ICV_LEN); 237 238 hdr = (struct ieee80211_hdr *) skb->data; 239 ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm, 240 key, pos, len, hdr->addr2); 241 return 0; 242 } 243 244 245 ieee80211_txrx_result 246 ieee80211_crypto_tkip_encrypt(struct ieee80211_txrx_data *tx) 247 { 248 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data; 249 u16 fc; 250 struct sk_buff *skb = tx->skb; 251 int wpa_test = 0, test = 0; 252 253 fc = le16_to_cpu(hdr->frame_control); 254 255 if (!WLAN_FC_DATA_PRESENT(fc)) 256 return TXRX_CONTINUE; 257 258 tx->u.tx.control->icv_len = TKIP_ICV_LEN; 259 tx->u.tx.control->iv_len = TKIP_IV_LEN; 260 ieee80211_tx_set_iswep(tx); 261 262 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 263 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) && 264 !wpa_test) { 265 /* hwaccel - with no need for preallocated room for IV/ICV */ 266 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx; 267 return TXRX_CONTINUE; 268 } 269 270 if (tkip_encrypt_skb(tx, skb, test) < 0) 271 return TXRX_DROP; 272 273 if (tx->u.tx.extra_frag) { 274 int i; 275 for (i = 0; i < tx->u.tx.num_extra_frag; i++) { 276 if (tkip_encrypt_skb(tx, tx->u.tx.extra_frag[i], test) 277 < 0) 278 return TXRX_DROP; 279 } 280 } 281 282 return TXRX_CONTINUE; 283 } 284 285 286 ieee80211_txrx_result 287 ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx) 288 { 289 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 290 u16 fc; 291 int hdrlen, res, hwaccel = 0, wpa_test = 0; 292 struct ieee80211_key *key = rx->key; 293 struct sk_buff *skb = rx->skb; 294 DECLARE_MAC_BUF(mac); 295 296 fc = le16_to_cpu(hdr->frame_control); 297 hdrlen = ieee80211_get_hdrlen(fc); 298 299 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) 300 return TXRX_CONTINUE; 301 302 if (!rx->sta || skb->len - hdrlen < 12) 303 return TXRX_DROP; 304 305 if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED) { 306 if (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) { 307 /* 308 * Hardware took care of all processing, including 309 * replay protection, and stripped the ICV/IV so 310 * we cannot do any checks here. 311 */ 312 return TXRX_CONTINUE; 313 } 314 315 /* let TKIP code verify IV, but skip decryption */ 316 hwaccel = 1; 317 } 318 319 res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm, 320 key, skb->data + hdrlen, 321 skb->len - hdrlen, rx->sta->addr, 322 hwaccel, rx->u.rx.queue, 323 &rx->u.rx.tkip_iv32, 324 &rx->u.rx.tkip_iv16); 325 if (res != TKIP_DECRYPT_OK || wpa_test) { 326 printk(KERN_DEBUG "%s: TKIP decrypt failed for RX frame from " 327 "%s (res=%d)\n", 328 rx->dev->name, print_mac(mac, rx->sta->addr), res); 329 return TXRX_DROP; 330 } 331 332 /* Trim ICV */ 333 skb_trim(skb, skb->len - TKIP_ICV_LEN); 334 335 /* Remove IV */ 336 memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen); 337 skb_pull(skb, TKIP_IV_LEN); 338 339 return TXRX_CONTINUE; 340 } 341 342 343 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad, 344 int encrypted) 345 { 346 u16 fc; 347 int a4_included, qos_included; 348 u8 qos_tid, *fc_pos, *data, *sa, *da; 349 int len_a; 350 size_t data_len; 351 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 352 353 fc_pos = (u8 *) &hdr->frame_control; 354 fc = fc_pos[0] ^ (fc_pos[1] << 8); 355 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) == 356 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS); 357 358 ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len); 359 data_len -= CCMP_HDR_LEN + (encrypted ? CCMP_MIC_LEN : 0); 360 if (qos_tid & 0x80) { 361 qos_included = 1; 362 qos_tid &= 0x0f; 363 } else 364 qos_included = 0; 365 /* First block, b_0 */ 366 367 b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */ 368 /* Nonce: QoS Priority | A2 | PN */ 369 b_0[1] = qos_tid; 370 memcpy(&b_0[2], hdr->addr2, 6); 371 memcpy(&b_0[8], pn, CCMP_PN_LEN); 372 /* l(m) */ 373 b_0[14] = (data_len >> 8) & 0xff; 374 b_0[15] = data_len & 0xff; 375 376 377 /* AAD (extra authenticate-only data) / masked 802.11 header 378 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */ 379 380 len_a = a4_included ? 28 : 22; 381 if (qos_included) 382 len_a += 2; 383 384 aad[0] = 0; /* (len_a >> 8) & 0xff; */ 385 aad[1] = len_a & 0xff; 386 /* Mask FC: zero subtype b4 b5 b6 */ 387 aad[2] = fc_pos[0] & ~(BIT(4) | BIT(5) | BIT(6)); 388 /* Retry, PwrMgt, MoreData; set Protected */ 389 aad[3] = (fc_pos[1] & ~(BIT(3) | BIT(4) | BIT(5))) | BIT(6); 390 memcpy(&aad[4], &hdr->addr1, 18); 391 392 /* Mask Seq#, leave Frag# */ 393 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f; 394 aad[23] = 0; 395 if (a4_included) { 396 memcpy(&aad[24], hdr->addr4, 6); 397 aad[30] = 0; 398 aad[31] = 0; 399 } else 400 memset(&aad[24], 0, 8); 401 if (qos_included) { 402 u8 *dpos = &aad[a4_included ? 30 : 24]; 403 404 /* Mask QoS Control field */ 405 dpos[0] = qos_tid; 406 dpos[1] = 0; 407 } 408 } 409 410 411 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id) 412 { 413 hdr[0] = pn[5]; 414 hdr[1] = pn[4]; 415 hdr[2] = 0; 416 hdr[3] = 0x20 | (key_id << 6); 417 hdr[4] = pn[3]; 418 hdr[5] = pn[2]; 419 hdr[6] = pn[1]; 420 hdr[7] = pn[0]; 421 } 422 423 424 static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr) 425 { 426 pn[0] = hdr[7]; 427 pn[1] = hdr[6]; 428 pn[2] = hdr[5]; 429 pn[3] = hdr[4]; 430 pn[4] = hdr[1]; 431 pn[5] = hdr[0]; 432 return (hdr[3] >> 6) & 0x03; 433 } 434 435 436 static int ccmp_encrypt_skb(struct ieee80211_txrx_data *tx, 437 struct sk_buff *skb, int test) 438 { 439 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 440 struct ieee80211_key *key = tx->key; 441 int hdrlen, len, tailneed; 442 u16 fc; 443 u8 *pos, *pn, *b_0, *aad, *scratch; 444 int i; 445 446 scratch = key->u.ccmp.tx_crypto_buf; 447 b_0 = scratch + 3 * AES_BLOCK_LEN; 448 aad = scratch + 4 * AES_BLOCK_LEN; 449 450 fc = le16_to_cpu(hdr->frame_control); 451 hdrlen = ieee80211_get_hdrlen(fc); 452 len = skb->len - hdrlen; 453 454 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) 455 tailneed = 0; 456 else 457 tailneed = CCMP_MIC_LEN; 458 459 if ((skb_headroom(skb) < CCMP_HDR_LEN || 460 skb_tailroom(skb) < tailneed)) { 461 I802_DEBUG_INC(tx->local->tx_expand_skb_head); 462 if (unlikely(pskb_expand_head(skb, CCMP_HDR_LEN, tailneed, 463 GFP_ATOMIC))) 464 return -1; 465 } 466 467 pos = skb_push(skb, CCMP_HDR_LEN); 468 memmove(pos, pos + CCMP_HDR_LEN, hdrlen); 469 hdr = (struct ieee80211_hdr *) pos; 470 pos += hdrlen; 471 472 /* PN = PN + 1 */ 473 pn = key->u.ccmp.tx_pn; 474 475 for (i = CCMP_PN_LEN - 1; i >= 0; i--) { 476 pn[i]++; 477 if (pn[i]) 478 break; 479 } 480 481 ccmp_pn2hdr(pos, pn, key->conf.keyidx); 482 483 if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) { 484 /* hwaccel - with preallocated room for CCMP header */ 485 tx->u.tx.control->key_idx = key->conf.hw_key_idx; 486 return 0; 487 } 488 489 pos += CCMP_HDR_LEN; 490 ccmp_special_blocks(skb, pn, b_0, aad, 0); 491 ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, b_0, aad, pos, len, 492 pos, skb_put(skb, CCMP_MIC_LEN)); 493 494 return 0; 495 } 496 497 498 ieee80211_txrx_result 499 ieee80211_crypto_ccmp_encrypt(struct ieee80211_txrx_data *tx) 500 { 501 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data; 502 u16 fc; 503 struct sk_buff *skb = tx->skb; 504 int test = 0; 505 506 fc = le16_to_cpu(hdr->frame_control); 507 508 if (!WLAN_FC_DATA_PRESENT(fc)) 509 return TXRX_CONTINUE; 510 511 tx->u.tx.control->icv_len = CCMP_MIC_LEN; 512 tx->u.tx.control->iv_len = CCMP_HDR_LEN; 513 ieee80211_tx_set_iswep(tx); 514 515 if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) && 516 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) { 517 /* hwaccel - with no need for preallocated room for CCMP " 518 * header or MIC fields */ 519 tx->u.tx.control->key_idx = tx->key->conf.hw_key_idx; 520 return TXRX_CONTINUE; 521 } 522 523 if (ccmp_encrypt_skb(tx, skb, test) < 0) 524 return TXRX_DROP; 525 526 if (tx->u.tx.extra_frag) { 527 int i; 528 for (i = 0; i < tx->u.tx.num_extra_frag; i++) { 529 if (ccmp_encrypt_skb(tx, tx->u.tx.extra_frag[i], test) 530 < 0) 531 return TXRX_DROP; 532 } 533 } 534 535 return TXRX_CONTINUE; 536 } 537 538 539 ieee80211_txrx_result 540 ieee80211_crypto_ccmp_decrypt(struct ieee80211_txrx_data *rx) 541 { 542 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 543 u16 fc; 544 int hdrlen; 545 struct ieee80211_key *key = rx->key; 546 struct sk_buff *skb = rx->skb; 547 u8 pn[CCMP_PN_LEN]; 548 int data_len; 549 DECLARE_MAC_BUF(mac); 550 551 fc = le16_to_cpu(hdr->frame_control); 552 hdrlen = ieee80211_get_hdrlen(fc); 553 554 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA) 555 return TXRX_CONTINUE; 556 557 data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN; 558 if (!rx->sta || data_len < 0) 559 return TXRX_DROP; 560 561 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) && 562 (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) 563 return TXRX_CONTINUE; 564 565 (void) ccmp_hdr2pn(pn, skb->data + hdrlen); 566 567 if (memcmp(pn, key->u.ccmp.rx_pn[rx->u.rx.queue], CCMP_PN_LEN) <= 0) { 568 #ifdef CONFIG_MAC80211_DEBUG 569 u8 *ppn = key->u.ccmp.rx_pn[rx->u.rx.queue]; 570 571 printk(KERN_DEBUG "%s: CCMP replay detected for RX frame from " 572 "%s (RX PN %02x%02x%02x%02x%02x%02x <= prev. PN " 573 "%02x%02x%02x%02x%02x%02x)\n", rx->dev->name, 574 print_mac(mac, rx->sta->addr), 575 pn[0], pn[1], pn[2], pn[3], pn[4], pn[5], 576 ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]); 577 #endif /* CONFIG_MAC80211_DEBUG */ 578 key->u.ccmp.replays++; 579 return TXRX_DROP; 580 } 581 582 if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) { 583 /* hardware didn't decrypt/verify MIC */ 584 u8 *scratch, *b_0, *aad; 585 586 scratch = key->u.ccmp.rx_crypto_buf; 587 b_0 = scratch + 3 * AES_BLOCK_LEN; 588 aad = scratch + 4 * AES_BLOCK_LEN; 589 590 ccmp_special_blocks(skb, pn, b_0, aad, 1); 591 592 if (ieee80211_aes_ccm_decrypt( 593 key->u.ccmp.tfm, scratch, b_0, aad, 594 skb->data + hdrlen + CCMP_HDR_LEN, data_len, 595 skb->data + skb->len - CCMP_MIC_LEN, 596 skb->data + hdrlen + CCMP_HDR_LEN)) { 597 printk(KERN_DEBUG "%s: CCMP decrypt failed for RX " 598 "frame from %s\n", rx->dev->name, 599 print_mac(mac, rx->sta->addr)); 600 return TXRX_DROP; 601 } 602 } 603 604 memcpy(key->u.ccmp.rx_pn[rx->u.rx.queue], pn, CCMP_PN_LEN); 605 606 /* Remove CCMP header and MIC */ 607 skb_trim(skb, skb->len - CCMP_MIC_LEN); 608 memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen); 609 skb_pull(skb, CCMP_HDR_LEN); 610 611 return TXRX_CONTINUE; 612 } 613