The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_crypto_tkip.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 __FBSDID("$FreeBSD: releng/10.0/sys/net80211/ieee80211_crypto_tkip.c 209636 2010-07-01 20:50:12Z bschmidt $");
   28 
   29 /*
   30  * IEEE 802.11i TKIP crypto support.
   31  *
   32  * Part of this module is derived from similar code in the Host
   33  * AP driver. The code is used with the consent of the author and
   34  * it's license is included below.
   35  */
   36 #include "opt_wlan.h"
   37 
   38 #include <sys/param.h>
   39 #include <sys/systm.h> 
   40 #include <sys/mbuf.h>   
   41 #include <sys/malloc.h>
   42 #include <sys/kernel.h>
   43 #include <sys/module.h>
   44 #include <sys/endian.h>
   45 
   46 #include <sys/socket.h>
   47 
   48 #include <net/if.h>
   49 #include <net/if_media.h>
   50 #include <net/ethernet.h>
   51 
   52 #include <net80211/ieee80211_var.h>
   53 
   54 static  void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *);
   55 static  void tkip_detach(struct ieee80211_key *);
   56 static  int tkip_setkey(struct ieee80211_key *);
   57 static  int tkip_encap(struct ieee80211_key *, struct mbuf *m, uint8_t keyid);
   58 static  int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
   59 static  int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
   60 static  int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
   61 
   62 static const struct ieee80211_cipher tkip  = {
   63         .ic_name        = "TKIP",
   64         .ic_cipher      = IEEE80211_CIPHER_TKIP,
   65         .ic_header      = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
   66                           IEEE80211_WEP_EXTIVLEN,
   67         .ic_trailer     = IEEE80211_WEP_CRCLEN,
   68         .ic_miclen      = IEEE80211_WEP_MICLEN,
   69         .ic_attach      = tkip_attach,
   70         .ic_detach      = tkip_detach,
   71         .ic_setkey      = tkip_setkey,
   72         .ic_encap       = tkip_encap,
   73         .ic_decap       = tkip_decap,
   74         .ic_enmic       = tkip_enmic,
   75         .ic_demic       = tkip_demic,
   76 };
   77 
   78 typedef uint8_t u8;
   79 typedef uint16_t u16;
   80 typedef uint32_t __u32;
   81 typedef uint32_t u32;
   82 
   83 struct tkip_ctx {
   84         struct ieee80211vap *tc_vap;    /* for diagnostics+statistics */
   85 
   86         u16     tx_ttak[5];
   87         int     tx_phase1_done;
   88         u8      tx_rc4key[16];          /* XXX for test module; make locals? */
   89 
   90         u16     rx_ttak[5];
   91         int     rx_phase1_done;
   92         u8      rx_rc4key[16];          /* XXX for test module; make locals? */
   93         uint64_t rx_rsc;                /* held until MIC verified */
   94 };
   95 
   96 static  void michael_mic(struct tkip_ctx *, const u8 *key,
   97                 struct mbuf *m, u_int off, size_t data_len,
   98                 u8 mic[IEEE80211_WEP_MICLEN]);
   99 static  int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
  100                 struct mbuf *, int hdr_len);
  101 static  int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
  102                 struct mbuf *, int hdr_len);
  103 
  104 /* number of references from net80211 layer */
  105 static  int nrefs = 0;
  106 
  107 static void *
  108 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k)
  109 {
  110         struct tkip_ctx *ctx;
  111 
  112         ctx = (struct tkip_ctx *) malloc(sizeof(struct tkip_ctx),
  113                 M_80211_CRYPTO, M_NOWAIT | M_ZERO);
  114         if (ctx == NULL) {
  115                 vap->iv_stats.is_crypto_nomem++;
  116                 return NULL;
  117         }
  118 
  119         ctx->tc_vap = vap;
  120         nrefs++;                        /* NB: we assume caller locking */
  121         return ctx;
  122 }
  123 
  124 static void
  125 tkip_detach(struct ieee80211_key *k)
  126 {
  127         struct tkip_ctx *ctx = k->wk_private;
  128 
  129         free(ctx, M_80211_CRYPTO);
  130         KASSERT(nrefs > 0, ("imbalanced attach/detach"));
  131         nrefs--;                        /* NB: we assume caller locking */
  132 }
  133 
  134 static int
  135 tkip_setkey(struct ieee80211_key *k)
  136 {
  137         struct tkip_ctx *ctx = k->wk_private;
  138 
  139         if (k->wk_keylen != (128/NBBY)) {
  140                 (void) ctx;             /* XXX */
  141                 IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO,
  142                         "%s: Invalid key length %u, expecting %u\n",
  143                         __func__, k->wk_keylen, 128/NBBY);
  144                 return 0;
  145         }
  146         k->wk_keytsc = 1;               /* TSC starts at 1 */
  147         ctx->rx_phase1_done = 0;
  148         return 1;
  149 }
  150 
  151 /*
  152  * Add privacy headers and do any s/w encryption required.
  153  */
  154 static int
  155 tkip_encap(struct ieee80211_key *k, struct mbuf *m, uint8_t keyid)
  156 {
  157         struct tkip_ctx *ctx = k->wk_private;
  158         struct ieee80211vap *vap = ctx->tc_vap;
  159         struct ieee80211com *ic = vap->iv_ic;
  160         uint8_t *ivp;
  161         int hdrlen;
  162 
  163         /*
  164          * Handle TKIP counter measures requirement.
  165          */
  166         if (vap->iv_flags & IEEE80211_F_COUNTERM) {
  167 #ifdef IEEE80211_DEBUG
  168                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  169 #endif
  170 
  171                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  172                     "discard frame due to countermeasures (%s)", __func__);
  173                 vap->iv_stats.is_crypto_tkipcm++;
  174                 return 0;
  175         }
  176         hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
  177 
  178         /*
  179          * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
  180          */
  181         M_PREPEND(m, tkip.ic_header, M_NOWAIT);
  182         if (m == NULL)
  183                 return 0;
  184         ivp = mtod(m, uint8_t *);
  185         memmove(ivp, ivp + tkip.ic_header, hdrlen);
  186         ivp += hdrlen;
  187 
  188         ivp[0] = k->wk_keytsc >> 8;             /* TSC1 */
  189         ivp[1] = (ivp[0] | 0x20) & 0x7f;        /* WEP seed */
  190         ivp[2] = k->wk_keytsc >> 0;             /* TSC0 */
  191         ivp[3] = keyid | IEEE80211_WEP_EXTIV;   /* KeyID | ExtID */
  192         ivp[4] = k->wk_keytsc >> 16;            /* TSC2 */
  193         ivp[5] = k->wk_keytsc >> 24;            /* TSC3 */
  194         ivp[6] = k->wk_keytsc >> 32;            /* TSC4 */
  195         ivp[7] = k->wk_keytsc >> 40;            /* TSC5 */
  196 
  197         /*
  198          * Finally, do software encrypt if neeed.
  199          */
  200         if (k->wk_flags & IEEE80211_KEY_SWENCRYPT) {
  201                 if (!tkip_encrypt(ctx, k, m, hdrlen))
  202                         return 0;
  203                 /* NB: tkip_encrypt handles wk_keytsc */
  204         } else
  205                 k->wk_keytsc++;
  206 
  207         return 1;
  208 }
  209 
  210 /*
  211  * Add MIC to the frame as needed.
  212  */
  213 static int
  214 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
  215 {
  216         struct tkip_ctx *ctx = k->wk_private;
  217 
  218         if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) {
  219                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  220                 struct ieee80211vap *vap = ctx->tc_vap;
  221                 struct ieee80211com *ic = vap->iv_ic;
  222                 int hdrlen;
  223                 uint8_t mic[IEEE80211_WEP_MICLEN];
  224 
  225                 vap->iv_stats.is_crypto_tkipenmic++;
  226 
  227                 hdrlen = ieee80211_hdrspace(ic, wh);
  228 
  229                 michael_mic(ctx, k->wk_txmic,
  230                         m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
  231                 return m_append(m, tkip.ic_miclen, mic);
  232         }
  233         return 1;
  234 }
  235 
  236 static __inline uint64_t
  237 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
  238 {
  239         uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
  240         uint16_t iv16 = (b4 << 0) | (b5 << 8);
  241         return (((uint64_t)iv16) << 32) | iv32;
  242 }
  243 
  244 /*
  245  * Validate and strip privacy headers (and trailer) for a
  246  * received frame.  If necessary, decrypt the frame using
  247  * the specified key.
  248  */
  249 static int
  250 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
  251 {
  252         struct tkip_ctx *ctx = k->wk_private;
  253         struct ieee80211vap *vap = ctx->tc_vap;
  254         struct ieee80211_frame *wh;
  255         uint8_t *ivp, tid;
  256 
  257         /*
  258          * Header should have extended IV and sequence number;
  259          * verify the former and validate the latter.
  260          */
  261         wh = mtod(m, struct ieee80211_frame *);
  262         ivp = mtod(m, uint8_t *) + hdrlen;
  263         if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
  264                 /*
  265                  * No extended IV; discard frame.
  266                  */
  267                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  268                     "%s", "missing ExtIV for TKIP cipher");
  269                 vap->iv_stats.is_rx_tkipformat++;
  270                 return 0;
  271         }
  272         /*
  273          * Handle TKIP counter measures requirement.
  274          */
  275         if (vap->iv_flags & IEEE80211_F_COUNTERM) {
  276                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  277                     "discard frame due to countermeasures (%s)", __func__);
  278                 vap->iv_stats.is_crypto_tkipcm++;
  279                 return 0;
  280         }
  281 
  282         tid = ieee80211_gettid(wh);
  283         ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
  284         if (ctx->rx_rsc <= k->wk_keyrsc[tid] &&
  285             (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) {
  286                 /*
  287                  * Replay violation; notify upper layer.
  288                  */
  289                 ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid);
  290                 vap->iv_stats.is_rx_tkipreplay++;
  291                 return 0;
  292         }
  293         /*
  294          * NB: We can't update the rsc in the key until MIC is verified.
  295          *
  296          * We assume we are not preempted between doing the check above
  297          * and updating wk_keyrsc when stripping the MIC in tkip_demic.
  298          * Otherwise we might process another packet and discard it as
  299          * a replay.
  300          */
  301 
  302         /*
  303          * Check if the device handled the decrypt in hardware.
  304          * If so we just strip the header; otherwise we need to
  305          * handle the decrypt in software.
  306          */
  307         if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
  308             !tkip_decrypt(ctx, k, m, hdrlen))
  309                 return 0;
  310 
  311         /*
  312          * Copy up 802.11 header and strip crypto bits.
  313          */
  314         memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen);
  315         m_adj(m, tkip.ic_header);
  316         m_adj(m, -tkip.ic_trailer);
  317 
  318         return 1;
  319 }
  320 
  321 /*
  322  * Verify and strip MIC from the frame.
  323  */
  324 static int
  325 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
  326 {
  327         struct tkip_ctx *ctx = k->wk_private;
  328         struct ieee80211_frame *wh;
  329         uint8_t tid;
  330 
  331         wh = mtod(m, struct ieee80211_frame *);
  332         if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) {
  333                 struct ieee80211vap *vap = ctx->tc_vap;
  334                 int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh);
  335                 u8 mic[IEEE80211_WEP_MICLEN];
  336                 u8 mic0[IEEE80211_WEP_MICLEN];
  337 
  338                 vap->iv_stats.is_crypto_tkipdemic++;
  339 
  340                 michael_mic(ctx, k->wk_rxmic, 
  341                         m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
  342                         mic);
  343                 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
  344                         tkip.ic_miclen, mic0);
  345                 if (memcmp(mic, mic0, tkip.ic_miclen)) {
  346                         /* NB: 802.11 layer handles statistic and debug msg */
  347                         ieee80211_notify_michael_failure(vap, wh,
  348                                 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
  349                                         k->wk_rxkeyix : k->wk_keyix);
  350                         return 0;
  351                 }
  352         }
  353         /*
  354          * Strip MIC from the tail.
  355          */
  356         m_adj(m, -tkip.ic_miclen);
  357 
  358         /*
  359          * Ok to update rsc now that MIC has been verified.
  360          */
  361         tid = ieee80211_gettid(wh);
  362         k->wk_keyrsc[tid] = ctx->rx_rsc;
  363 
  364         return 1;
  365 }
  366 
  367 /*
  368  * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
  369  *
  370  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
  371  *
  372  * This program is free software; you can redistribute it and/or modify
  373  * it under the terms of the GNU General Public License version 2 as
  374  * published by the Free Software Foundation. See README and COPYING for
  375  * more details.
  376  *
  377  * Alternatively, this software may be distributed under the terms of BSD
  378  * license.
  379  */
  380 
  381 static const __u32 crc32_table[256] = {
  382         0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
  383         0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
  384         0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
  385         0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
  386         0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
  387         0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
  388         0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
  389         0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
  390         0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
  391         0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
  392         0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
  393         0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
  394         0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
  395         0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
  396         0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
  397         0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
  398         0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
  399         0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
  400         0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
  401         0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
  402         0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
  403         0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
  404         0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
  405         0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
  406         0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
  407         0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
  408         0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
  409         0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
  410         0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
  411         0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
  412         0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
  413         0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
  414         0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
  415         0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
  416         0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
  417         0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
  418         0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
  419         0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
  420         0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
  421         0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
  422         0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
  423         0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
  424         0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
  425         0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
  426         0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
  427         0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
  428         0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
  429         0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
  430         0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
  431         0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
  432         0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
  433         0x2d02ef8dL
  434 };
  435 
  436 static __inline u16 RotR1(u16 val)
  437 {
  438         return (val >> 1) | (val << 15);
  439 }
  440 
  441 static __inline u8 Lo8(u16 val)
  442 {
  443         return val & 0xff;
  444 }
  445 
  446 static __inline u8 Hi8(u16 val)
  447 {
  448         return val >> 8;
  449 }
  450 
  451 static __inline u16 Lo16(u32 val)
  452 {
  453         return val & 0xffff;
  454 }
  455 
  456 static __inline u16 Hi16(u32 val)
  457 {
  458         return val >> 16;
  459 }
  460 
  461 static __inline u16 Mk16(u8 hi, u8 lo)
  462 {
  463         return lo | (((u16) hi) << 8);
  464 }
  465 
  466 static __inline u16 Mk16_le(const u16 *v)
  467 {
  468         return le16toh(*v);
  469 }
  470 
  471 static const u16 Sbox[256] = {
  472         0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
  473         0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
  474         0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
  475         0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
  476         0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
  477         0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
  478         0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
  479         0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
  480         0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
  481         0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
  482         0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
  483         0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
  484         0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
  485         0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
  486         0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
  487         0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
  488         0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
  489         0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
  490         0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
  491         0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
  492         0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
  493         0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
  494         0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
  495         0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
  496         0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
  497         0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
  498         0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
  499         0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
  500         0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
  501         0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
  502         0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
  503         0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
  504 };
  505 
  506 static __inline u16 _S_(u16 v)
  507 {
  508         u16 t = Sbox[Hi8(v)];
  509         return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
  510 }
  511 
  512 #define PHASE1_LOOP_COUNT 8
  513 
  514 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
  515 {
  516         int i, j;
  517 
  518         /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
  519         TTAK[0] = Lo16(IV32);
  520         TTAK[1] = Hi16(IV32);
  521         TTAK[2] = Mk16(TA[1], TA[0]);
  522         TTAK[3] = Mk16(TA[3], TA[2]);
  523         TTAK[4] = Mk16(TA[5], TA[4]);
  524 
  525         for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
  526                 j = 2 * (i & 1);
  527                 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
  528                 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
  529                 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
  530                 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
  531                 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
  532         }
  533 }
  534 
  535 #ifndef _BYTE_ORDER
  536 #error "Don't know native byte order"
  537 #endif
  538 
  539 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
  540                                u16 IV16)
  541 {
  542         /* Make temporary area overlap WEP seed so that the final copy can be
  543          * avoided on little endian hosts. */
  544         u16 *PPK = (u16 *) &WEPSeed[4];
  545 
  546         /* Step 1 - make copy of TTAK and bring in TSC */
  547         PPK[0] = TTAK[0];
  548         PPK[1] = TTAK[1];
  549         PPK[2] = TTAK[2];
  550         PPK[3] = TTAK[3];
  551         PPK[4] = TTAK[4];
  552         PPK[5] = TTAK[4] + IV16;
  553 
  554         /* Step 2 - 96-bit bijective mixing using S-box */
  555         PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
  556         PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
  557         PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
  558         PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
  559         PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
  560         PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
  561 
  562         PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
  563         PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
  564         PPK[2] += RotR1(PPK[1]);
  565         PPK[3] += RotR1(PPK[2]);
  566         PPK[4] += RotR1(PPK[3]);
  567         PPK[5] += RotR1(PPK[4]);
  568 
  569         /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
  570          * WEPSeed[0..2] is transmitted as WEP IV */
  571         WEPSeed[0] = Hi8(IV16);
  572         WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
  573         WEPSeed[2] = Lo8(IV16);
  574         WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
  575 
  576 #if _BYTE_ORDER == _BIG_ENDIAN
  577         {
  578                 int i;
  579                 for (i = 0; i < 6; i++)
  580                         PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
  581         }
  582 #endif
  583 }
  584 
  585 static void
  586 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
  587         uint8_t icv[IEEE80211_WEP_CRCLEN])
  588 {
  589         u32 i, j, k, crc;
  590         size_t buflen;
  591         u8 S[256];
  592         u8 *pos;
  593         struct mbuf *m;
  594 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
  595 
  596         /* Setup RC4 state */
  597         for (i = 0; i < 256; i++)
  598                 S[i] = i;
  599         j = 0;
  600         for (i = 0; i < 256; i++) {
  601                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  602                 S_SWAP(i, j);
  603         }
  604 
  605         /* Compute CRC32 over unencrypted data and apply RC4 to data */
  606         crc = ~0;
  607         i = j = 0;
  608         m = m0;
  609         pos = mtod(m, uint8_t *) + off;
  610         buflen = m->m_len - off;
  611         for (;;) {
  612                 if (buflen > data_len)
  613                         buflen = data_len;
  614                 data_len -= buflen;
  615                 for (k = 0; k < buflen; k++) {
  616                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  617                         i = (i + 1) & 0xff;
  618                         j = (j + S[i]) & 0xff;
  619                         S_SWAP(i, j);
  620                         *pos++ ^= S[(S[i] + S[j]) & 0xff];
  621                 }
  622                 m = m->m_next;
  623                 if (m == NULL) {
  624                         KASSERT(data_len == 0,
  625                             ("out of buffers with data_len %zu\n", data_len));
  626                         break;
  627                 }
  628                 pos = mtod(m, uint8_t *);
  629                 buflen = m->m_len;
  630         }
  631         crc = ~crc;
  632 
  633         /* Append little-endian CRC32 and encrypt it to produce ICV */
  634         icv[0] = crc;
  635         icv[1] = crc >> 8;
  636         icv[2] = crc >> 16;
  637         icv[3] = crc >> 24;
  638         for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
  639                 i = (i + 1) & 0xff;
  640                 j = (j + S[i]) & 0xff;
  641                 S_SWAP(i, j);
  642                 icv[k] ^= S[(S[i] + S[j]) & 0xff];
  643         }
  644 }
  645 
  646 static int
  647 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
  648 {
  649         u32 i, j, k, crc;
  650         u8 S[256];
  651         u8 *pos, icv[4];
  652         size_t buflen;
  653 
  654         /* Setup RC4 state */
  655         for (i = 0; i < 256; i++)
  656                 S[i] = i;
  657         j = 0;
  658         for (i = 0; i < 256; i++) {
  659                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  660                 S_SWAP(i, j);
  661         }
  662 
  663         /* Apply RC4 to data and compute CRC32 over decrypted data */
  664         crc = ~0;
  665         i = j = 0;
  666         pos = mtod(m, uint8_t *) + off;
  667         buflen = m->m_len - off;
  668         for (;;) {
  669                 if (buflen > data_len)
  670                         buflen = data_len;
  671                 data_len -= buflen;
  672                 for (k = 0; k < buflen; k++) {
  673                         i = (i + 1) & 0xff;
  674                         j = (j + S[i]) & 0xff;
  675                         S_SWAP(i, j);
  676                         *pos ^= S[(S[i] + S[j]) & 0xff];
  677                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  678                         pos++;
  679                 }
  680                 m = m->m_next;
  681                 if (m == NULL) {
  682                         KASSERT(data_len == 0,
  683                             ("out of buffers with data_len %zu\n", data_len));
  684                         break;
  685                 }
  686                 pos = mtod(m, uint8_t *);
  687                 buflen = m->m_len;
  688         }
  689         crc = ~crc;
  690 
  691         /* Encrypt little-endian CRC32 and verify that it matches with the
  692          * received ICV */
  693         icv[0] = crc;
  694         icv[1] = crc >> 8;
  695         icv[2] = crc >> 16;
  696         icv[3] = crc >> 24;
  697         for (k = 0; k < 4; k++) {
  698                 i = (i + 1) & 0xff;
  699                 j = (j + S[i]) & 0xff;
  700                 S_SWAP(i, j);
  701                 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
  702                         /* ICV mismatch - drop frame */
  703                         return -1;
  704                 }
  705         }
  706 
  707         return 0;
  708 }
  709 
  710 
  711 static __inline u32 rotl(u32 val, int bits)
  712 {
  713         return (val << bits) | (val >> (32 - bits));
  714 }
  715 
  716 
  717 static __inline u32 rotr(u32 val, int bits)
  718 {
  719         return (val >> bits) | (val << (32 - bits));
  720 }
  721 
  722 
  723 static __inline u32 xswap(u32 val)
  724 {
  725         return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
  726 }
  727 
  728 
  729 #define michael_block(l, r)     \
  730 do {                            \
  731         r ^= rotl(l, 17);       \
  732         l += r;                 \
  733         r ^= xswap(l);          \
  734         l += r;                 \
  735         r ^= rotl(l, 3);        \
  736         l += r;                 \
  737         r ^= rotr(l, 2);        \
  738         l += r;                 \
  739 } while (0)
  740 
  741 
  742 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
  743 {
  744         return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
  745 }
  746 
  747 static __inline u32 get_le32(const u8 *p)
  748 {
  749         return get_le32_split(p[0], p[1], p[2], p[3]);
  750 }
  751 
  752 
  753 static __inline void put_le32(u8 *p, u32 v)
  754 {
  755         p[0] = v;
  756         p[1] = v >> 8;
  757         p[2] = v >> 16;
  758         p[3] = v >> 24;
  759 }
  760 
  761 /*
  762  * Craft pseudo header used to calculate the MIC.
  763  */
  764 static void
  765 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
  766 {
  767         const struct ieee80211_frame_addr4 *wh =
  768                 (const struct ieee80211_frame_addr4 *) wh0;
  769 
  770         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
  771         case IEEE80211_FC1_DIR_NODS:
  772                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  773                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  774                 break;
  775         case IEEE80211_FC1_DIR_TODS:
  776                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  777                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  778                 break;
  779         case IEEE80211_FC1_DIR_FROMDS:
  780                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  781                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
  782                 break;
  783         case IEEE80211_FC1_DIR_DSTODS:
  784                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  785                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
  786                 break;
  787         }
  788 
  789         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
  790                 const struct ieee80211_qosframe *qwh =
  791                         (const struct ieee80211_qosframe *) wh;
  792                 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
  793         } else
  794                 hdr[12] = 0;
  795         hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
  796 }
  797 
  798 static void
  799 michael_mic(struct tkip_ctx *ctx, const u8 *key,
  800         struct mbuf *m, u_int off, size_t data_len,
  801         u8 mic[IEEE80211_WEP_MICLEN])
  802 {
  803         uint8_t hdr[16];
  804         u32 l, r;
  805         const uint8_t *data;
  806         u_int space;
  807 
  808         michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
  809 
  810         l = get_le32(key);
  811         r = get_le32(key + 4);
  812 
  813         /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
  814         l ^= get_le32(hdr);
  815         michael_block(l, r);
  816         l ^= get_le32(&hdr[4]);
  817         michael_block(l, r);
  818         l ^= get_le32(&hdr[8]);
  819         michael_block(l, r);
  820         l ^= get_le32(&hdr[12]);
  821         michael_block(l, r);
  822 
  823         /* first buffer has special handling */
  824         data = mtod(m, const uint8_t *) + off;
  825         space = m->m_len - off;
  826         for (;;) {
  827                 if (space > data_len)
  828                         space = data_len;
  829                 /* collect 32-bit blocks from current buffer */
  830                 while (space >= sizeof(uint32_t)) {
  831                         l ^= get_le32(data);
  832                         michael_block(l, r);
  833                         data += sizeof(uint32_t), space -= sizeof(uint32_t);
  834                         data_len -= sizeof(uint32_t);
  835                 }
  836                 /*
  837                  * NB: when space is zero we make one more trip around
  838                  * the loop to advance to the next mbuf where there is
  839                  * data.  This handles the case where there are 4*n
  840                  * bytes in an mbuf followed by <4 bytes in a later mbuf.
  841                  * By making an extra trip we'll drop out of the loop
  842                  * with m pointing at the mbuf with 3 bytes and space
  843                  * set as required by the remainder handling below.
  844                  */
  845                 if (data_len == 0 ||
  846                     (data_len < sizeof(uint32_t) && space != 0))
  847                         break;
  848                 m = m->m_next;
  849                 if (m == NULL) {
  850                         KASSERT(0, ("out of data, data_len %zu\n", data_len));
  851                         break;
  852                 }
  853                 if (space != 0) {
  854                         const uint8_t *data_next;
  855                         /*
  856                          * Block straddles buffers, split references.
  857                          */
  858                         data_next = mtod(m, const uint8_t *);
  859                         KASSERT(m->m_len >= sizeof(uint32_t) - space,
  860                                 ("not enough data in following buffer, "
  861                                 "m_len %u need %zu\n", m->m_len,
  862                                 sizeof(uint32_t) - space));
  863                         switch (space) {
  864                         case 1:
  865                                 l ^= get_le32_split(data[0], data_next[0],
  866                                         data_next[1], data_next[2]);
  867                                 data = data_next + 3;
  868                                 space = m->m_len - 3;
  869                                 break;
  870                         case 2:
  871                                 l ^= get_le32_split(data[0], data[1],
  872                                         data_next[0], data_next[1]);
  873                                 data = data_next + 2;
  874                                 space = m->m_len - 2;
  875                                 break;
  876                         case 3:
  877                                 l ^= get_le32_split(data[0], data[1],
  878                                         data[2], data_next[0]);
  879                                 data = data_next + 1;
  880                                 space = m->m_len - 1;
  881                                 break;
  882                         }
  883                         michael_block(l, r);
  884                         data_len -= sizeof(uint32_t);
  885                 } else {
  886                         /*
  887                          * Setup for next buffer.
  888                          */
  889                         data = mtod(m, const uint8_t *);
  890                         space = m->m_len;
  891                 }
  892         }
  893         /*
  894          * Catch degenerate cases like mbuf[4*n+1 bytes] followed by
  895          * mbuf[2 bytes].  I don't believe these should happen; if they
  896          * do then we'll need more involved logic.
  897          */
  898         KASSERT(data_len <= space,
  899             ("not enough data, data_len %zu space %u\n", data_len, space));
  900 
  901         /* Last block and padding (0x5a, 4..7 x 0) */
  902         switch (data_len) {
  903         case 0:
  904                 l ^= get_le32_split(0x5a, 0, 0, 0);
  905                 break;
  906         case 1:
  907                 l ^= get_le32_split(data[0], 0x5a, 0, 0);
  908                 break;
  909         case 2:
  910                 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
  911                 break;
  912         case 3:
  913                 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
  914                 break;
  915         }
  916         michael_block(l, r);
  917         /* l ^= 0; */
  918         michael_block(l, r);
  919 
  920         put_le32(mic, l);
  921         put_le32(mic + 4, r);
  922 }
  923 
  924 static int
  925 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
  926         struct mbuf *m, int hdrlen)
  927 {
  928         struct ieee80211_frame *wh;
  929         uint8_t icv[IEEE80211_WEP_CRCLEN];
  930 
  931         ctx->tc_vap->iv_stats.is_crypto_tkip++;
  932 
  933         wh = mtod(m, struct ieee80211_frame *);
  934         if (!ctx->tx_phase1_done) {
  935                 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
  936                                    (u32)(key->wk_keytsc >> 16));
  937                 ctx->tx_phase1_done = 1;
  938         }
  939         tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
  940                 (u16) key->wk_keytsc);
  941 
  942         wep_encrypt(ctx->tx_rc4key,
  943                 m, hdrlen + tkip.ic_header,
  944                 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
  945                 icv);
  946         (void) m_append(m, IEEE80211_WEP_CRCLEN, icv);  /* XXX check return */
  947 
  948         key->wk_keytsc++;
  949         if ((u16)(key->wk_keytsc) == 0)
  950                 ctx->tx_phase1_done = 0;
  951         return 1;
  952 }
  953 
  954 static int
  955 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
  956         struct mbuf *m, int hdrlen)
  957 {
  958         struct ieee80211_frame *wh;
  959         struct ieee80211vap *vap = ctx->tc_vap;
  960         u32 iv32;
  961         u16 iv16;
  962         u8 tid;
  963 
  964         vap->iv_stats.is_crypto_tkip++;
  965 
  966         wh = mtod(m, struct ieee80211_frame *);
  967         /* NB: tkip_decap already verified header and left seq in rx_rsc */
  968         iv16 = (u16) ctx->rx_rsc;
  969         iv32 = (u32) (ctx->rx_rsc >> 16);
  970 
  971         tid = ieee80211_gettid(wh);
  972         if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) {
  973                 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
  974                         wh->i_addr2, iv32);
  975                 ctx->rx_phase1_done = 1;
  976         }
  977         tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
  978 
  979         /* NB: m is unstripped; deduct headers + ICV to get payload */
  980         if (wep_decrypt(ctx->rx_rc4key,
  981                 m, hdrlen + tkip.ic_header,
  982                 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
  983                 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) {
  984                         /* Previously cached Phase1 result was already lost, so
  985                          * it needs to be recalculated for the next packet. */
  986                         ctx->rx_phase1_done = 0;
  987                 }
  988                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  989                     "%s", "TKIP ICV mismatch on decrypt");
  990                 vap->iv_stats.is_rx_tkipicv++;
  991                 return 0;
  992         }
  993         return 1;
  994 }
  995 
  996 /*
  997  * Module glue.
  998  */
  999 IEEE80211_CRYPTO_MODULE(tkip, 1);

Cache object: 37b24ea64fd9d8f168a62fe9a98ca8a4


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.