1 /* 2 * Copyright 2002-2004, Instant802 Networks, Inc. 3 * Copyright 2008, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 */ 9 10 #include <linux/netdevice.h> 11 #include <linux/types.h> 12 #include <linux/skbuff.h> 13 #include <linux/compiler.h> 14 #include <linux/ieee80211.h> 15 #include <linux/gfp.h> 16 #include <asm/unaligned.h> 17 #include <net/mac80211.h> 18 19 #include "ieee80211_i.h" 20 #include "michael.h" 21 #include "tkip.h" 22 #include "aes_ccm.h" 23 #include "aes_cmac.h" 24 #include "wpa.h" 25 26 ieee80211_tx_result 27 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx) 28 { 29 u8 *data, *key, *mic; 30 size_t data_len; 31 unsigned int hdrlen; 32 struct ieee80211_hdr *hdr; 33 struct sk_buff *skb = tx->skb; 34 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 35 int tail; 36 37 hdr = (struct ieee80211_hdr *)skb->data; 38 if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP || 39 skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control)) 40 return TX_CONTINUE; 41 42 hdrlen = ieee80211_hdrlen(hdr->frame_control); 43 if (skb->len < hdrlen) 44 return TX_DROP; 45 46 data = skb->data + hdrlen; 47 data_len = skb->len - hdrlen; 48 49 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) { 50 /* Need to use software crypto for the test */ 51 info->control.hw_key = NULL; 52 } 53 54 if (info->control.hw_key && 55 !(tx->flags & IEEE80211_TX_FRAGMENTED) && 56 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) { 57 /* hwaccel - with no need for SW-generated MMIC */ 58 return TX_CONTINUE; 59 } 60 61 tail = MICHAEL_MIC_LEN; 62 if (!info->control.hw_key) 63 tail += TKIP_ICV_LEN; 64 65 if (WARN_ON(skb_tailroom(skb) < tail || 66 skb_headroom(skb) < TKIP_IV_LEN)) 67 return TX_DROP; 68 69 key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY]; 70 mic = skb_put(skb, MICHAEL_MIC_LEN); 71 michael_mic(key, hdr, data, data_len, mic); 72 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) 73 mic[0]++; 74 75 return TX_CONTINUE; 76 } 77 78 79 ieee80211_rx_result 80 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) 81 { 82 u8 *data, *key = NULL; 83 size_t data_len; 84 unsigned int hdrlen; 85 u8 mic[MICHAEL_MIC_LEN]; 86 struct sk_buff *skb = rx->skb; 87 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 88 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 89 90 /* No way to verify the MIC if the hardware stripped it */ 91 if (status->flag & RX_FLAG_MMIC_STRIPPED) 92 return RX_CONTINUE; 93 94 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP || 95 !ieee80211_has_protected(hdr->frame_control) || 96 !ieee80211_is_data_present(hdr->frame_control)) 97 return RX_CONTINUE; 98 99 hdrlen = ieee80211_hdrlen(hdr->frame_control); 100 if (skb->len < hdrlen + MICHAEL_MIC_LEN) 101 return RX_DROP_UNUSABLE; 102 103 data = skb->data + hdrlen; 104 data_len = skb->len - hdrlen - MICHAEL_MIC_LEN; 105 106 key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY]; 107 michael_mic(key, hdr, data, data_len, mic); 108 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) { 109 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 110 return RX_DROP_UNUSABLE; 111 112 mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx, 113 (void *) skb->data, NULL, 114 GFP_ATOMIC); 115 return RX_DROP_UNUSABLE; 116 } 117 118 /* remove Michael MIC from payload */ 119 skb_trim(skb, skb->len - MICHAEL_MIC_LEN); 120 121 /* update IV in key information to be able to detect replays */ 122 rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32; 123 rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16; 124 125 return RX_CONTINUE; 126 } 127 128 129 static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb) 130 { 131 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 132 struct ieee80211_key *key = tx->key; 133 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 134 unsigned int hdrlen; 135 int len, tail; 136 u8 *pos; 137 138 if (info->control.hw_key && 139 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) { 140 /* hwaccel - with no need for software-generated IV */ 141 return 0; 142 } 143 144 hdrlen = ieee80211_hdrlen(hdr->frame_control); 145 len = skb->len - hdrlen; 146 147 if (info->control.hw_key) 148 tail = 0; 149 else 150 tail = TKIP_ICV_LEN; 151 152 if (WARN_ON(skb_tailroom(skb) < tail || 153 skb_headroom(skb) < TKIP_IV_LEN)) 154 return -1; 155 156 pos = skb_push(skb, TKIP_IV_LEN); 157 memmove(pos, pos + TKIP_IV_LEN, hdrlen); 158 pos += hdrlen; 159 160 /* Increase IV for the frame */ 161 key->u.tkip.tx.iv16++; 162 if (key->u.tkip.tx.iv16 == 0) 163 key->u.tkip.tx.iv32++; 164 165 pos = ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16); 166 167 /* hwaccel - with software IV */ 168 if (info->control.hw_key) 169 return 0; 170 171 /* Add room for ICV */ 172 skb_put(skb, TKIP_ICV_LEN); 173 174 hdr = (struct ieee80211_hdr *) skb->data; 175 return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm, 176 key, pos, len, hdr->addr2); 177 } 178 179 180 ieee80211_tx_result 181 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx) 182 { 183 struct sk_buff *skb = tx->skb; 184 185 ieee80211_tx_set_protected(tx); 186 187 do { 188 if (tkip_encrypt_skb(tx, skb) < 0) 189 return TX_DROP; 190 } while ((skb = skb->next)); 191 192 return TX_CONTINUE; 193 } 194 195 196 ieee80211_rx_result 197 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx) 198 { 199 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data; 200 int hdrlen, res, hwaccel = 0; 201 struct ieee80211_key *key = rx->key; 202 struct sk_buff *skb = rx->skb; 203 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 204 205 hdrlen = ieee80211_hdrlen(hdr->frame_control); 206 207 if (!ieee80211_is_data(hdr->frame_control)) 208 return RX_CONTINUE; 209 210 if (!rx->sta || skb->len - hdrlen < 12) 211 return RX_DROP_UNUSABLE; 212 213 /* 214 * Let TKIP code verify IV, but skip decryption. 215 * In the case where hardware checks the IV as well, 216 * we don't even get here, see ieee80211_rx_h_decrypt() 217 */ 218 if (status->flag & RX_FLAG_DECRYPTED) 219 hwaccel = 1; 220 221 res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm, 222 key, skb->data + hdrlen, 223 skb->len - hdrlen, rx->sta->sta.addr, 224 hdr->addr1, hwaccel, rx->queue, 225 &rx->tkip_iv32, 226 &rx->tkip_iv16); 227 if (res != TKIP_DECRYPT_OK) 228 return RX_DROP_UNUSABLE; 229 230 /* Trim ICV */ 231 skb_trim(skb, skb->len - TKIP_ICV_LEN); 232 233 /* Remove IV */ 234 memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen); 235 skb_pull(skb, TKIP_IV_LEN); 236 237 return RX_CONTINUE; 238 } 239 240 241 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch, 242 int encrypted) 243 { 244 __le16 mask_fc; 245 int a4_included, mgmt; 246 u8 qos_tid; 247 u8 *b_0, *aad; 248 u16 data_len, len_a; 249 unsigned int hdrlen; 250 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 251 252 b_0 = scratch + 3 * AES_BLOCK_LEN; 253 aad = scratch + 4 * AES_BLOCK_LEN; 254 255 /* 256 * Mask FC: zero subtype b4 b5 b6 (if not mgmt) 257 * Retry, PwrMgt, MoreData; set Protected 258 */ 259 mgmt = ieee80211_is_mgmt(hdr->frame_control); 260 mask_fc = hdr->frame_control; 261 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | 262 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA); 263 if (!mgmt) 264 mask_fc &= ~cpu_to_le16(0x0070); 265 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED); 266 267 hdrlen = ieee80211_hdrlen(hdr->frame_control); 268 len_a = hdrlen - 2; 269 a4_included = ieee80211_has_a4(hdr->frame_control); 270 271 if (ieee80211_is_data_qos(hdr->frame_control)) 272 qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 273 else 274 qos_tid = 0; 275 276 data_len = skb->len - hdrlen - CCMP_HDR_LEN; 277 if (encrypted) 278 data_len -= CCMP_MIC_LEN; 279 280 /* First block, b_0 */ 281 b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */ 282 /* Nonce: Nonce Flags | A2 | PN 283 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7) 284 */ 285 b_0[1] = qos_tid | (mgmt << 4); 286 memcpy(&b_0[2], hdr->addr2, ETH_ALEN); 287 memcpy(&b_0[8], pn, CCMP_PN_LEN); 288 /* l(m) */ 289 put_unaligned_be16(data_len, &b_0[14]); 290 291 /* AAD (extra authenticate-only data) / masked 802.11 header 292 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */ 293 put_unaligned_be16(len_a, &aad[0]); 294 put_unaligned(mask_fc, (__le16 *)&aad[2]); 295 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN); 296 297 /* Mask Seq#, leave Frag# */ 298 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f; 299 aad[23] = 0; 300 301 if (a4_included) { 302 memcpy(&aad[24], hdr->addr4, ETH_ALEN); 303 aad[30] = qos_tid; 304 aad[31] = 0; 305 } else { 306 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN); 307 aad[24] = qos_tid; 308 } 309 } 310 311 312 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id) 313 { 314 hdr[0] = pn[5]; 315 hdr[1] = pn[4]; 316 hdr[2] = 0; 317 hdr[3] = 0x20 | (key_id << 6); 318 hdr[4] = pn[3]; 319 hdr[5] = pn[2]; 320 hdr[6] = pn[1]; 321 hdr[7] = pn[0]; 322 } 323 324 325 static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr) 326 { 327 pn[0] = hdr[7]; 328 pn[1] = hdr[6]; 329 pn[2] = hdr[5]; 330 pn[3] = hdr[4]; 331 pn[4] = hdr[1]; 332 pn[5] = hdr[0]; 333 } 334 335 336 static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb) 337 { 338 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 339 struct ieee80211_key *key = tx->key; 340 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 341 int hdrlen, len, tail; 342 u8 *pos, *pn; 343 int i; 344 345 if (info->control.hw_key && 346 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV)) { 347 /* 348 * hwaccel has no need for preallocated room for CCMP 349 * header or MIC fields 350 */ 351 return 0; 352 } 353 354 hdrlen = ieee80211_hdrlen(hdr->frame_control); 355 len = skb->len - hdrlen; 356 357 if (info->control.hw_key) 358 tail = 0; 359 else 360 tail = CCMP_MIC_LEN; 361 362 if (WARN_ON(skb_tailroom(skb) < tail || 363 skb_headroom(skb) < CCMP_HDR_LEN)) 364 return -1; 365 366 pos = skb_push(skb, CCMP_HDR_LEN); 367 memmove(pos, pos + CCMP_HDR_LEN, hdrlen); 368 hdr = (struct ieee80211_hdr *) pos; 369 pos += hdrlen; 370 371 /* PN = PN + 1 */ 372 pn = key->u.ccmp.tx_pn; 373 374 for (i = CCMP_PN_LEN - 1; i >= 0; i--) { 375 pn[i]++; 376 if (pn[i]) 377 break; 378 } 379 380 ccmp_pn2hdr(pos, pn, key->conf.keyidx); 381 382 /* hwaccel - with software CCMP header */ 383 if (info->control.hw_key) 384 return 0; 385 386 pos += CCMP_HDR_LEN; 387 ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0); 388 ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, key->u.ccmp.tx_crypto_buf, pos, len, 389 pos, skb_put(skb, CCMP_MIC_LEN)); 390 391 return 0; 392 } 393 394 395 ieee80211_tx_result 396 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx) 397 { 398 struct sk_buff *skb = tx->skb; 399 400 ieee80211_tx_set_protected(tx); 401 402 do { 403 if (ccmp_encrypt_skb(tx, skb) < 0) 404 return TX_DROP; 405 } while ((skb = skb->next)); 406 407 return TX_CONTINUE; 408 } 409 410 411 ieee80211_rx_result 412 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx) 413 { 414 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 415 int hdrlen; 416 struct ieee80211_key *key = rx->key; 417 struct sk_buff *skb = rx->skb; 418 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 419 u8 pn[CCMP_PN_LEN]; 420 int data_len; 421 int queue; 422 423 hdrlen = ieee80211_hdrlen(hdr->frame_control); 424 425 if (!ieee80211_is_data(hdr->frame_control) && 426 !ieee80211_is_robust_mgmt_frame(hdr)) 427 return RX_CONTINUE; 428 429 data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN; 430 if (!rx->sta || data_len < 0) 431 return RX_DROP_UNUSABLE; 432 433 ccmp_hdr2pn(pn, skb->data + hdrlen); 434 435 queue = ieee80211_is_mgmt(hdr->frame_control) ? 436 NUM_RX_DATA_QUEUES : rx->queue; 437 438 if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) { 439 key->u.ccmp.replays++; 440 return RX_DROP_UNUSABLE; 441 } 442 443 if (!(status->flag & RX_FLAG_DECRYPTED)) { 444 /* hardware didn't decrypt/verify MIC */ 445 ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1); 446 447 if (ieee80211_aes_ccm_decrypt( 448 key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf, 449 skb->data + hdrlen + CCMP_HDR_LEN, data_len, 450 skb->data + skb->len - CCMP_MIC_LEN, 451 skb->data + hdrlen + CCMP_HDR_LEN)) 452 return RX_DROP_UNUSABLE; 453 } 454 455 memcpy(key->u.ccmp.rx_pn[queue], pn, CCMP_PN_LEN); 456 457 /* Remove CCMP header and MIC */ 458 skb_trim(skb, skb->len - CCMP_MIC_LEN); 459 memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen); 460 skb_pull(skb, CCMP_HDR_LEN); 461 462 return RX_CONTINUE; 463 } 464 465 466 static void bip_aad(struct sk_buff *skb, u8 *aad) 467 { 468 /* BIP AAD: FC(masked) || A1 || A2 || A3 */ 469 470 /* FC type/subtype */ 471 aad[0] = skb->data[0]; 472 /* Mask FC Retry, PwrMgt, MoreData flags to zero */ 473 aad[1] = skb->data[1] & ~(BIT(4) | BIT(5) | BIT(6)); 474 /* A1 || A2 || A3 */ 475 memcpy(aad + 2, skb->data + 4, 3 * ETH_ALEN); 476 } 477 478 479 static inline void bip_ipn_swap(u8 *d, const u8 *s) 480 { 481 *d++ = s[5]; 482 *d++ = s[4]; 483 *d++ = s[3]; 484 *d++ = s[2]; 485 *d++ = s[1]; 486 *d = s[0]; 487 } 488 489 490 ieee80211_tx_result 491 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx) 492 { 493 struct sk_buff *skb = tx->skb; 494 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 495 struct ieee80211_key *key = tx->key; 496 struct ieee80211_mmie *mmie; 497 u8 *pn, aad[20]; 498 int i; 499 500 if (info->control.hw_key) 501 return 0; 502 503 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie))) 504 return TX_DROP; 505 506 mmie = (struct ieee80211_mmie *) skb_put(skb, sizeof(*mmie)); 507 mmie->element_id = WLAN_EID_MMIE; 508 mmie->length = sizeof(*mmie) - 2; 509 mmie->key_id = cpu_to_le16(key->conf.keyidx); 510 511 /* PN = PN + 1 */ 512 pn = key->u.aes_cmac.tx_pn; 513 514 for (i = sizeof(key->u.aes_cmac.tx_pn) - 1; i >= 0; i--) { 515 pn[i]++; 516 if (pn[i]) 517 break; 518 } 519 bip_ipn_swap(mmie->sequence_number, pn); 520 521 bip_aad(skb, aad); 522 523 /* 524 * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64) 525 */ 526 ieee80211_aes_cmac(key->u.aes_cmac.tfm, key->u.aes_cmac.tx_crypto_buf, 527 aad, skb->data + 24, skb->len - 24, mmie->mic); 528 529 return TX_CONTINUE; 530 } 531 532 533 ieee80211_rx_result 534 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx) 535 { 536 struct sk_buff *skb = rx->skb; 537 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 538 struct ieee80211_key *key = rx->key; 539 struct ieee80211_mmie *mmie; 540 u8 aad[20], mic[8], ipn[6]; 541 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 542 543 if (!ieee80211_is_mgmt(hdr->frame_control)) 544 return RX_CONTINUE; 545 546 if (skb->len < 24 + sizeof(*mmie)) 547 return RX_DROP_UNUSABLE; 548 549 mmie = (struct ieee80211_mmie *) 550 (skb->data + skb->len - sizeof(*mmie)); 551 if (mmie->element_id != WLAN_EID_MMIE || 552 mmie->length != sizeof(*mmie) - 2) 553 return RX_DROP_UNUSABLE; /* Invalid MMIE */ 554 555 bip_ipn_swap(ipn, mmie->sequence_number); 556 557 if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) { 558 key->u.aes_cmac.replays++; 559 return RX_DROP_UNUSABLE; 560 } 561 562 if (!(status->flag & RX_FLAG_DECRYPTED)) { 563 /* hardware didn't decrypt/verify MIC */ 564 bip_aad(skb, aad); 565 ieee80211_aes_cmac(key->u.aes_cmac.tfm, 566 key->u.aes_cmac.rx_crypto_buf, aad, 567 skb->data + 24, skb->len - 24, mic); 568 if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { 569 key->u.aes_cmac.icverrors++; 570 return RX_DROP_UNUSABLE; 571 } 572 } 573 574 memcpy(key->u.aes_cmac.rx_pn, ipn, 6); 575 576 /* Remove MMIE */ 577 skb_trim(skb, skb->len - sizeof(*mmie)); 578 579 return RX_CONTINUE; 580 } 581