The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_crypto_tkip.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
    3  *
    4  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  *
   16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   26  */
   27 
   28 #include <sys/cdefs.h>
   29 __FBSDID("$FreeBSD$");
   30 
   31 /*
   32  * IEEE 802.11i TKIP crypto support.
   33  *
   34  * Part of this module is derived from similar code in the Host
   35  * AP driver. The code is used with the consent of the author and
   36  * it's license is included below.
   37  */
   38 #include "opt_wlan.h"
   39 
   40 #include <sys/param.h>
   41 #include <sys/systm.h> 
   42 #include <sys/mbuf.h>   
   43 #include <sys/malloc.h>
   44 #include <sys/kernel.h>
   45 #include <sys/module.h>
   46 #include <sys/endian.h>
   47 
   48 #include <sys/socket.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_media.h>
   52 #include <net/ethernet.h>
   53 
   54 #include <net80211/ieee80211_var.h>
   55 
   56 static  void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *);
   57 static  void tkip_detach(struct ieee80211_key *);
   58 static  int tkip_setkey(struct ieee80211_key *);
   59 static  void tkip_setiv(struct ieee80211_key *, uint8_t *);
   60 static  int tkip_encap(struct ieee80211_key *, struct mbuf *);
   61 static  int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
   62 static  int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
   63 static  int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
   64 
   65 static const struct ieee80211_cipher tkip  = {
   66         .ic_name        = "TKIP",
   67         .ic_cipher      = IEEE80211_CIPHER_TKIP,
   68         .ic_header      = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
   69                           IEEE80211_WEP_EXTIVLEN,
   70         .ic_trailer     = IEEE80211_WEP_CRCLEN,
   71         .ic_miclen      = IEEE80211_WEP_MICLEN,
   72         .ic_attach      = tkip_attach,
   73         .ic_detach      = tkip_detach,
   74         .ic_setkey      = tkip_setkey,
   75         .ic_setiv       = tkip_setiv,
   76         .ic_encap       = tkip_encap,
   77         .ic_decap       = tkip_decap,
   78         .ic_enmic       = tkip_enmic,
   79         .ic_demic       = tkip_demic,
   80 };
   81 
   82 typedef uint8_t u8;
   83 typedef uint16_t u16;
   84 typedef uint32_t __u32;
   85 typedef uint32_t u32;
   86 
   87 struct tkip_ctx {
   88         struct ieee80211vap *tc_vap;    /* for diagnostics+statistics */
   89 
   90         u16     tx_ttak[5];
   91         u8      tx_rc4key[16];          /* XXX for test module; make locals? */
   92 
   93         u16     rx_ttak[5];
   94         int     rx_phase1_done;
   95         u8      rx_rc4key[16];          /* XXX for test module; make locals? */
   96         uint64_t rx_rsc;                /* held until MIC verified */
   97 };
   98 
   99 static  void michael_mic(struct tkip_ctx *, const u8 *key,
  100                 struct mbuf *m, u_int off, size_t data_len,
  101                 u8 mic[IEEE80211_WEP_MICLEN]);
  102 static  int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
  103                 struct mbuf *, int hdr_len);
  104 static  int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
  105                 struct mbuf *, int hdr_len);
  106 
  107 /* number of references from net80211 layer */
  108 static  int nrefs = 0;
  109 
  110 static void *
  111 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k)
  112 {
  113         struct tkip_ctx *ctx;
  114 
  115         ctx = (struct tkip_ctx *) IEEE80211_MALLOC(sizeof(struct tkip_ctx),
  116                 M_80211_CRYPTO, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
  117         if (ctx == NULL) {
  118                 vap->iv_stats.is_crypto_nomem++;
  119                 return NULL;
  120         }
  121 
  122         ctx->tc_vap = vap;
  123         nrefs++;                        /* NB: we assume caller locking */
  124         return ctx;
  125 }
  126 
  127 static void
  128 tkip_detach(struct ieee80211_key *k)
  129 {
  130         struct tkip_ctx *ctx = k->wk_private;
  131 
  132         IEEE80211_FREE(ctx, M_80211_CRYPTO);
  133         KASSERT(nrefs > 0, ("imbalanced attach/detach"));
  134         nrefs--;                        /* NB: we assume caller locking */
  135 }
  136 
  137 static int
  138 tkip_setkey(struct ieee80211_key *k)
  139 {
  140         struct tkip_ctx *ctx = k->wk_private;
  141 
  142         if (k->wk_keylen != (128/NBBY)) {
  143                 (void) ctx;             /* XXX */
  144                 IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO,
  145                         "%s: Invalid key length %u, expecting %u\n",
  146                         __func__, k->wk_keylen, 128/NBBY);
  147                 return 0;
  148         }
  149         ctx->rx_phase1_done = 0;
  150         return 1;
  151 }
  152 
  153 static void
  154 tkip_setiv(struct ieee80211_key *k, uint8_t *ivp)
  155 {
  156         struct tkip_ctx *ctx = k->wk_private;
  157         struct ieee80211vap *vap = ctx->tc_vap;
  158         uint8_t keyid;
  159 
  160         keyid = ieee80211_crypto_get_keyid(vap, k) << 6;
  161 
  162         k->wk_keytsc++;
  163         ivp[0] = k->wk_keytsc >> 8;             /* TSC1 */
  164         ivp[1] = (ivp[0] | 0x20) & 0x7f;        /* WEP seed */
  165         ivp[2] = k->wk_keytsc >> 0;             /* TSC0 */
  166         ivp[3] = keyid | IEEE80211_WEP_EXTIV;   /* KeyID | ExtID */
  167         ivp[4] = k->wk_keytsc >> 16;            /* TSC2 */
  168         ivp[5] = k->wk_keytsc >> 24;            /* TSC3 */
  169         ivp[6] = k->wk_keytsc >> 32;            /* TSC4 */
  170         ivp[7] = k->wk_keytsc >> 40;            /* TSC5 */
  171 }
  172 
  173 /*
  174  * Add privacy headers and do any s/w encryption required.
  175  */
  176 static int
  177 tkip_encap(struct ieee80211_key *k, struct mbuf *m)
  178 {
  179         struct tkip_ctx *ctx = k->wk_private;
  180         struct ieee80211vap *vap = ctx->tc_vap;
  181         struct ieee80211com *ic = vap->iv_ic;
  182         struct ieee80211_frame *wh;
  183         uint8_t *ivp;
  184         int hdrlen;
  185         int is_mgmt;
  186 
  187         wh = mtod(m, struct ieee80211_frame *);
  188         is_mgmt = IEEE80211_IS_MGMT(wh);
  189 
  190         /*
  191          * Handle TKIP counter measures requirement.
  192          */
  193         if (vap->iv_flags & IEEE80211_F_COUNTERM) {
  194 #ifdef IEEE80211_DEBUG
  195                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  196 #endif
  197 
  198                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  199                     "discard frame due to countermeasures (%s)", __func__);
  200                 vap->iv_stats.is_crypto_tkipcm++;
  201                 return 0;
  202         }
  203 
  204         /*
  205          * Check to see whether IV needs to be included.
  206          */
  207         if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOIVMGT))
  208                 return 1;
  209         if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOIV))
  210                 return 1;
  211 
  212         hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
  213 
  214         /*
  215          * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
  216          */
  217         M_PREPEND(m, tkip.ic_header, IEEE80211_M_NOWAIT);
  218         if (m == NULL)
  219                 return 0;
  220         ivp = mtod(m, uint8_t *);
  221         memmove(ivp, ivp + tkip.ic_header, hdrlen);
  222         ivp += hdrlen;
  223 
  224         tkip_setiv(k, ivp);
  225 
  226         /*
  227          * Finally, do software encrypt if needed.
  228          */
  229         if ((k->wk_flags & IEEE80211_KEY_SWENCRYPT) &&
  230             !tkip_encrypt(ctx, k, m, hdrlen))
  231                 return 0;
  232 
  233         return 1;
  234 }
  235 
  236 /*
  237  * Add MIC to the frame as needed.
  238  */
  239 static int
  240 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
  241 {
  242         struct tkip_ctx *ctx = k->wk_private;
  243         struct ieee80211_frame *wh;
  244         int is_mgmt;
  245 
  246         wh = mtod(m, struct ieee80211_frame *);
  247         is_mgmt = IEEE80211_IS_MGMT(wh);
  248 
  249         /*
  250          * Check to see whether MIC needs to be included.
  251          */
  252         if (is_mgmt && (k->wk_flags & IEEE80211_KEY_NOMICMGT))
  253                 return 1;
  254         if ((! is_mgmt) && (k->wk_flags & IEEE80211_KEY_NOMIC))
  255                 return 1;
  256 
  257         if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) {
  258                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  259                 struct ieee80211vap *vap = ctx->tc_vap;
  260                 struct ieee80211com *ic = vap->iv_ic;
  261                 int hdrlen;
  262                 uint8_t mic[IEEE80211_WEP_MICLEN];
  263 
  264                 vap->iv_stats.is_crypto_tkipenmic++;
  265 
  266                 hdrlen = ieee80211_hdrspace(ic, wh);
  267 
  268                 michael_mic(ctx, k->wk_txmic,
  269                         m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
  270                 return m_append(m, tkip.ic_miclen, mic);
  271         }
  272         return 1;
  273 }
  274 
  275 static __inline uint64_t
  276 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
  277 {
  278         uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
  279         uint16_t iv16 = (b4 << 0) | (b5 << 8);
  280         return (((uint64_t)iv16) << 32) | iv32;
  281 }
  282 
  283 /*
  284  * Validate and strip privacy headers (and trailer) for a
  285  * received frame.  If necessary, decrypt the frame using
  286  * the specified key.
  287  */
  288 static int
  289 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
  290 {
  291         const struct ieee80211_rx_stats *rxs;
  292         struct tkip_ctx *ctx = k->wk_private;
  293         struct ieee80211vap *vap = ctx->tc_vap;
  294         struct ieee80211_frame *wh;
  295         uint8_t *ivp, tid;
  296 
  297         rxs = ieee80211_get_rx_params_ptr(m);
  298 
  299         /*
  300          * If IV has been stripped, we skip most of the below.
  301          */
  302         if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))
  303                 goto finish;
  304 
  305         /*
  306          * Header should have extended IV and sequence number;
  307          * verify the former and validate the latter.
  308          */
  309         wh = mtod(m, struct ieee80211_frame *);
  310         ivp = mtod(m, uint8_t *) + hdrlen;
  311         if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
  312                 /*
  313                  * No extended IV; discard frame.
  314                  */
  315                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  316                     "%s", "missing ExtIV for TKIP cipher");
  317                 vap->iv_stats.is_rx_tkipformat++;
  318                 return 0;
  319         }
  320         /*
  321          * Handle TKIP counter measures requirement.
  322          */
  323         if (vap->iv_flags & IEEE80211_F_COUNTERM) {
  324                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
  325                     "discard frame due to countermeasures (%s)", __func__);
  326                 vap->iv_stats.is_crypto_tkipcm++;
  327                 return 0;
  328         }
  329 
  330         tid = ieee80211_gettid(wh);
  331         ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
  332         if (ctx->rx_rsc <= k->wk_keyrsc[tid] &&
  333             (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) {
  334                 /*
  335                  * Replay violation; notify upper layer.
  336                  */
  337                 ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid);
  338                 vap->iv_stats.is_rx_tkipreplay++;
  339                 return 0;
  340         }
  341         /*
  342          * NB: We can't update the rsc in the key until MIC is verified.
  343          *
  344          * We assume we are not preempted between doing the check above
  345          * and updating wk_keyrsc when stripping the MIC in tkip_demic.
  346          * Otherwise we might process another packet and discard it as
  347          * a replay.
  348          */
  349 
  350         /*
  351          * Check if the device handled the decrypt in hardware.
  352          * If so we just strip the header; otherwise we need to
  353          * handle the decrypt in software.
  354          */
  355         if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) &&
  356             !tkip_decrypt(ctx, k, m, hdrlen))
  357                 return 0;
  358 
  359 finish:
  360 
  361         /*
  362          * Copy up 802.11 header and strip crypto bits - but only if we
  363          * are required to.
  364          */
  365         if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
  366                 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *),
  367                     hdrlen);
  368                 m_adj(m, tkip.ic_header);
  369         }
  370 
  371         /*
  372          * XXX TODO: do we need an option to potentially not strip the
  373          * WEP trailer?  Does "MMIC_STRIP" also mean this? Or?
  374          */
  375         m_adj(m, -tkip.ic_trailer);
  376 
  377         return 1;
  378 }
  379 
  380 /*
  381  * Verify and strip MIC from the frame.
  382  */
  383 static int
  384 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
  385 {
  386         const struct ieee80211_rx_stats *rxs;
  387         struct tkip_ctx *ctx = k->wk_private;
  388         struct ieee80211_frame *wh;
  389         uint8_t tid;
  390 
  391         wh = mtod(m, struct ieee80211_frame *);
  392         rxs = ieee80211_get_rx_params_ptr(m);
  393 
  394         /*
  395          * If we are told about a MIC failure from the driver,
  396          * directly notify as a michael failure to the upper
  397          * layers.
  398          */
  399         if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_FAIL_MIC)) {
  400                 struct ieee80211vap *vap = ctx->tc_vap;
  401                 ieee80211_notify_michael_failure(vap, wh,
  402                     k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
  403                     k->wk_rxkeyix : k->wk_keyix);
  404                 return 0;
  405         }
  406 
  407         /*
  408          * If IV has been stripped, we skip most of the below.
  409          */
  410         if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_MMIC_STRIP))
  411                 goto finish;
  412 
  413         if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) {
  414                 struct ieee80211vap *vap = ctx->tc_vap;
  415                 int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh);
  416                 u8 mic[IEEE80211_WEP_MICLEN];
  417                 u8 mic0[IEEE80211_WEP_MICLEN];
  418 
  419                 vap->iv_stats.is_crypto_tkipdemic++;
  420 
  421                 michael_mic(ctx, k->wk_rxmic, 
  422                         m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
  423                         mic);
  424                 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
  425                         tkip.ic_miclen, mic0);
  426                 if (memcmp(mic, mic0, tkip.ic_miclen)) {
  427                         /* NB: 802.11 layer handles statistic and debug msg */
  428                         ieee80211_notify_michael_failure(vap, wh,
  429                                 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
  430                                         k->wk_rxkeyix : k->wk_keyix);
  431                         return 0;
  432                 }
  433         }
  434         /*
  435          * Strip MIC from the tail.
  436          */
  437         m_adj(m, -tkip.ic_miclen);
  438 
  439         /*
  440          * Ok to update rsc now that MIC has been verified.
  441          */
  442         tid = ieee80211_gettid(wh);
  443         k->wk_keyrsc[tid] = ctx->rx_rsc;
  444 
  445 finish:
  446         return 1;
  447 }
  448 
  449 /*
  450  * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
  451  *
  452  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
  453  *
  454  * This program is free software; you can redistribute it and/or modify
  455  * it under the terms of the GNU General Public License version 2 as
  456  * published by the Free Software Foundation. See README and COPYING for
  457  * more details.
  458  *
  459  * Alternatively, this software may be distributed under the terms of BSD
  460  * license.
  461  */
  462 
  463 static const __u32 crc32_table[256] = {
  464         0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
  465         0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
  466         0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
  467         0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
  468         0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
  469         0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
  470         0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
  471         0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
  472         0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
  473         0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
  474         0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
  475         0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
  476         0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
  477         0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
  478         0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
  479         0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
  480         0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
  481         0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
  482         0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
  483         0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
  484         0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
  485         0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
  486         0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
  487         0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
  488         0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
  489         0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
  490         0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
  491         0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
  492         0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
  493         0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
  494         0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
  495         0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
  496         0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
  497         0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
  498         0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
  499         0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
  500         0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
  501         0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
  502         0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
  503         0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
  504         0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
  505         0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
  506         0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
  507         0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
  508         0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
  509         0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
  510         0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
  511         0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
  512         0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
  513         0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
  514         0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
  515         0x2d02ef8dL
  516 };
  517 
  518 static __inline u16 RotR1(u16 val)
  519 {
  520         return (val >> 1) | (val << 15);
  521 }
  522 
  523 static __inline u8 Lo8(u16 val)
  524 {
  525         return val & 0xff;
  526 }
  527 
  528 static __inline u8 Hi8(u16 val)
  529 {
  530         return val >> 8;
  531 }
  532 
  533 static __inline u16 Lo16(u32 val)
  534 {
  535         return val & 0xffff;
  536 }
  537 
  538 static __inline u16 Hi16(u32 val)
  539 {
  540         return val >> 16;
  541 }
  542 
  543 static __inline u16 Mk16(u8 hi, u8 lo)
  544 {
  545         return lo | (((u16) hi) << 8);
  546 }
  547 
  548 static __inline u16 Mk16_le(const u16 *v)
  549 {
  550         return le16toh(*v);
  551 }
  552 
  553 static const u16 Sbox[256] = {
  554         0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
  555         0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
  556         0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
  557         0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
  558         0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
  559         0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
  560         0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
  561         0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
  562         0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
  563         0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
  564         0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
  565         0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
  566         0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
  567         0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
  568         0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
  569         0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
  570         0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
  571         0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
  572         0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
  573         0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
  574         0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
  575         0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
  576         0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
  577         0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
  578         0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
  579         0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
  580         0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
  581         0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
  582         0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
  583         0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
  584         0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
  585         0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
  586 };
  587 
  588 static __inline u16 _S_(u16 v)
  589 {
  590         u16 t = Sbox[Hi8(v)];
  591         return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
  592 }
  593 
  594 #define PHASE1_LOOP_COUNT 8
  595 
  596 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
  597 {
  598         int i, j;
  599 
  600         /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
  601         TTAK[0] = Lo16(IV32);
  602         TTAK[1] = Hi16(IV32);
  603         TTAK[2] = Mk16(TA[1], TA[0]);
  604         TTAK[3] = Mk16(TA[3], TA[2]);
  605         TTAK[4] = Mk16(TA[5], TA[4]);
  606 
  607         for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
  608                 j = 2 * (i & 1);
  609                 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
  610                 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
  611                 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
  612                 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
  613                 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
  614         }
  615 }
  616 
  617 #ifndef _BYTE_ORDER
  618 #error "Don't know native byte order"
  619 #endif
  620 
  621 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
  622                                u16 IV16)
  623 {
  624         /* Make temporary area overlap WEP seed so that the final copy can be
  625          * avoided on little endian hosts. */
  626         u16 *PPK = (u16 *) &WEPSeed[4];
  627 
  628         /* Step 1 - make copy of TTAK and bring in TSC */
  629         PPK[0] = TTAK[0];
  630         PPK[1] = TTAK[1];
  631         PPK[2] = TTAK[2];
  632         PPK[3] = TTAK[3];
  633         PPK[4] = TTAK[4];
  634         PPK[5] = TTAK[4] + IV16;
  635 
  636         /* Step 2 - 96-bit bijective mixing using S-box */
  637         PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
  638         PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
  639         PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
  640         PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
  641         PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
  642         PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
  643 
  644         PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
  645         PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
  646         PPK[2] += RotR1(PPK[1]);
  647         PPK[3] += RotR1(PPK[2]);
  648         PPK[4] += RotR1(PPK[3]);
  649         PPK[5] += RotR1(PPK[4]);
  650 
  651         /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
  652          * WEPSeed[0..2] is transmitted as WEP IV */
  653         WEPSeed[0] = Hi8(IV16);
  654         WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
  655         WEPSeed[2] = Lo8(IV16);
  656         WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
  657 
  658 #if _BYTE_ORDER == _BIG_ENDIAN
  659         {
  660                 int i;
  661                 for (i = 0; i < 6; i++)
  662                         PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
  663         }
  664 #endif
  665 }
  666 
  667 static void
  668 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
  669         uint8_t icv[IEEE80211_WEP_CRCLEN])
  670 {
  671         u32 i, j, k, crc;
  672         size_t buflen;
  673         u8 S[256];
  674         u8 *pos;
  675         struct mbuf *m;
  676 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
  677 
  678         /* Setup RC4 state */
  679         for (i = 0; i < 256; i++)
  680                 S[i] = i;
  681         j = 0;
  682         for (i = 0; i < 256; i++) {
  683                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  684                 S_SWAP(i, j);
  685         }
  686 
  687         /* Compute CRC32 over unencrypted data and apply RC4 to data */
  688         crc = ~0;
  689         i = j = 0;
  690         m = m0;
  691         pos = mtod(m, uint8_t *) + off;
  692         buflen = m->m_len - off;
  693         for (;;) {
  694                 if (buflen > data_len)
  695                         buflen = data_len;
  696                 data_len -= buflen;
  697                 for (k = 0; k < buflen; k++) {
  698                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  699                         i = (i + 1) & 0xff;
  700                         j = (j + S[i]) & 0xff;
  701                         S_SWAP(i, j);
  702                         *pos++ ^= S[(S[i] + S[j]) & 0xff];
  703                 }
  704                 m = m->m_next;
  705                 if (m == NULL) {
  706                         KASSERT(data_len == 0,
  707                             ("out of buffers with data_len %zu\n", data_len));
  708                         break;
  709                 }
  710                 pos = mtod(m, uint8_t *);
  711                 buflen = m->m_len;
  712         }
  713         crc = ~crc;
  714 
  715         /* Append little-endian CRC32 and encrypt it to produce ICV */
  716         icv[0] = crc;
  717         icv[1] = crc >> 8;
  718         icv[2] = crc >> 16;
  719         icv[3] = crc >> 24;
  720         for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
  721                 i = (i + 1) & 0xff;
  722                 j = (j + S[i]) & 0xff;
  723                 S_SWAP(i, j);
  724                 icv[k] ^= S[(S[i] + S[j]) & 0xff];
  725         }
  726 }
  727 
  728 static int
  729 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
  730 {
  731         u32 i, j, k, crc;
  732         u8 S[256];
  733         u8 *pos, icv[4];
  734         size_t buflen;
  735 
  736         /* Setup RC4 state */
  737         for (i = 0; i < 256; i++)
  738                 S[i] = i;
  739         j = 0;
  740         for (i = 0; i < 256; i++) {
  741                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  742                 S_SWAP(i, j);
  743         }
  744 
  745         /* Apply RC4 to data and compute CRC32 over decrypted data */
  746         crc = ~0;
  747         i = j = 0;
  748         pos = mtod(m, uint8_t *) + off;
  749         buflen = m->m_len - off;
  750         for (;;) {
  751                 if (buflen > data_len)
  752                         buflen = data_len;
  753                 data_len -= buflen;
  754                 for (k = 0; k < buflen; k++) {
  755                         i = (i + 1) & 0xff;
  756                         j = (j + S[i]) & 0xff;
  757                         S_SWAP(i, j);
  758                         *pos ^= S[(S[i] + S[j]) & 0xff];
  759                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  760                         pos++;
  761                 }
  762                 m = m->m_next;
  763                 if (m == NULL) {
  764                         KASSERT(data_len == 0,
  765                             ("out of buffers with data_len %zu\n", data_len));
  766                         break;
  767                 }
  768                 pos = mtod(m, uint8_t *);
  769                 buflen = m->m_len;
  770         }
  771         crc = ~crc;
  772 
  773         /* Encrypt little-endian CRC32 and verify that it matches with the
  774          * received ICV */
  775         icv[0] = crc;
  776         icv[1] = crc >> 8;
  777         icv[2] = crc >> 16;
  778         icv[3] = crc >> 24;
  779         for (k = 0; k < 4; k++) {
  780                 i = (i + 1) & 0xff;
  781                 j = (j + S[i]) & 0xff;
  782                 S_SWAP(i, j);
  783                 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
  784                         /* ICV mismatch - drop frame */
  785                         return -1;
  786                 }
  787         }
  788 
  789         return 0;
  790 }
  791 
  792 static __inline u32 rotl(u32 val, int bits)
  793 {
  794         return (val << bits) | (val >> (32 - bits));
  795 }
  796 
  797 static __inline u32 rotr(u32 val, int bits)
  798 {
  799         return (val >> bits) | (val << (32 - bits));
  800 }
  801 
  802 static __inline u32 xswap(u32 val)
  803 {
  804         return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
  805 }
  806 
  807 #define michael_block(l, r)     \
  808 do {                            \
  809         r ^= rotl(l, 17);       \
  810         l += r;                 \
  811         r ^= xswap(l);          \
  812         l += r;                 \
  813         r ^= rotl(l, 3);        \
  814         l += r;                 \
  815         r ^= rotr(l, 2);        \
  816         l += r;                 \
  817 } while (0)
  818 
  819 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
  820 {
  821         return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
  822 }
  823 
  824 static __inline u32 get_le32(const u8 *p)
  825 {
  826         return get_le32_split(p[0], p[1], p[2], p[3]);
  827 }
  828 
  829 static __inline void put_le32(u8 *p, u32 v)
  830 {
  831         p[0] = v;
  832         p[1] = v >> 8;
  833         p[2] = v >> 16;
  834         p[3] = v >> 24;
  835 }
  836 
  837 /*
  838  * Craft pseudo header used to calculate the MIC.
  839  */
  840 static void
  841 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
  842 {
  843         const struct ieee80211_frame_addr4 *wh =
  844                 (const struct ieee80211_frame_addr4 *) wh0;
  845 
  846         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
  847         case IEEE80211_FC1_DIR_NODS:
  848                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  849                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  850                 break;
  851         case IEEE80211_FC1_DIR_TODS:
  852                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  853                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  854                 break;
  855         case IEEE80211_FC1_DIR_FROMDS:
  856                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  857                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
  858                 break;
  859         case IEEE80211_FC1_DIR_DSTODS:
  860                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  861                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
  862                 break;
  863         }
  864 
  865         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS_DATA) {
  866                 const struct ieee80211_qosframe *qwh =
  867                         (const struct ieee80211_qosframe *) wh;
  868                 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
  869         } else
  870                 hdr[12] = 0;
  871         hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
  872 }
  873 
  874 static void
  875 michael_mic(struct tkip_ctx *ctx, const u8 *key,
  876         struct mbuf *m, u_int off, size_t data_len,
  877         u8 mic[IEEE80211_WEP_MICLEN])
  878 {
  879         uint8_t hdr[16];
  880         u32 l, r;
  881         const uint8_t *data;
  882         u_int space;
  883 
  884         michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
  885 
  886         l = get_le32(key);
  887         r = get_le32(key + 4);
  888 
  889         /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
  890         l ^= get_le32(hdr);
  891         michael_block(l, r);
  892         l ^= get_le32(&hdr[4]);
  893         michael_block(l, r);
  894         l ^= get_le32(&hdr[8]);
  895         michael_block(l, r);
  896         l ^= get_le32(&hdr[12]);
  897         michael_block(l, r);
  898 
  899         /* first buffer has special handling */
  900         data = mtod(m, const uint8_t *) + off;
  901         space = m->m_len - off;
  902         for (;;) {
  903                 if (space > data_len)
  904                         space = data_len;
  905                 /* collect 32-bit blocks from current buffer */
  906                 while (space >= sizeof(uint32_t)) {
  907                         l ^= get_le32(data);
  908                         michael_block(l, r);
  909                         data += sizeof(uint32_t), space -= sizeof(uint32_t);
  910                         data_len -= sizeof(uint32_t);
  911                 }
  912                 /*
  913                  * NB: when space is zero we make one more trip around
  914                  * the loop to advance to the next mbuf where there is
  915                  * data.  This handles the case where there are 4*n
  916                  * bytes in an mbuf followed by <4 bytes in a later mbuf.
  917                  * By making an extra trip we'll drop out of the loop
  918                  * with m pointing at the mbuf with 3 bytes and space
  919                  * set as required by the remainder handling below.
  920                  */
  921                 if (data_len == 0 ||
  922                     (data_len < sizeof(uint32_t) && space != 0))
  923                         break;
  924                 m = m->m_next;
  925                 if (m == NULL) {
  926                         KASSERT(0, ("out of data, data_len %zu\n", data_len));
  927                         break;
  928                 }
  929                 if (space != 0) {
  930                         const uint8_t *data_next;
  931                         /*
  932                          * Block straddles buffers, split references.
  933                          */
  934                         data_next = mtod(m, const uint8_t *);
  935                         KASSERT(m->m_len >= sizeof(uint32_t) - space,
  936                                 ("not enough data in following buffer, "
  937                                 "m_len %u need %zu\n", m->m_len,
  938                                 sizeof(uint32_t) - space));
  939                         switch (space) {
  940                         case 1:
  941                                 l ^= get_le32_split(data[0], data_next[0],
  942                                         data_next[1], data_next[2]);
  943                                 data = data_next + 3;
  944                                 space = m->m_len - 3;
  945                                 break;
  946                         case 2:
  947                                 l ^= get_le32_split(data[0], data[1],
  948                                         data_next[0], data_next[1]);
  949                                 data = data_next + 2;
  950                                 space = m->m_len - 2;
  951                                 break;
  952                         case 3:
  953                                 l ^= get_le32_split(data[0], data[1],
  954                                         data[2], data_next[0]);
  955                                 data = data_next + 1;
  956                                 space = m->m_len - 1;
  957                                 break;
  958                         }
  959                         michael_block(l, r);
  960                         data_len -= sizeof(uint32_t);
  961                 } else {
  962                         /*
  963                          * Setup for next buffer.
  964                          */
  965                         data = mtod(m, const uint8_t *);
  966                         space = m->m_len;
  967                 }
  968         }
  969         /*
  970          * Catch degenerate cases like mbuf[4*n+1 bytes] followed by
  971          * mbuf[2 bytes].  I don't believe these should happen; if they
  972          * do then we'll need more involved logic.
  973          */
  974         KASSERT(data_len <= space,
  975             ("not enough data, data_len %zu space %u\n", data_len, space));
  976 
  977         /* Last block and padding (0x5a, 4..7 x 0) */
  978         switch (data_len) {
  979         case 0:
  980                 l ^= get_le32_split(0x5a, 0, 0, 0);
  981                 break;
  982         case 1:
  983                 l ^= get_le32_split(data[0], 0x5a, 0, 0);
  984                 break;
  985         case 2:
  986                 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
  987                 break;
  988         case 3:
  989                 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
  990                 break;
  991         }
  992         michael_block(l, r);
  993         /* l ^= 0; */
  994         michael_block(l, r);
  995 
  996         put_le32(mic, l);
  997         put_le32(mic + 4, r);
  998 }
  999 
 1000 static int
 1001 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
 1002         struct mbuf *m, int hdrlen)
 1003 {
 1004         struct ieee80211_frame *wh;
 1005         uint8_t icv[IEEE80211_WEP_CRCLEN];
 1006 
 1007         ctx->tc_vap->iv_stats.is_crypto_tkip++;
 1008 
 1009         wh = mtod(m, struct ieee80211_frame *);
 1010         if ((u16)(key->wk_keytsc) == 0 || key->wk_keytsc == 1) {
 1011                 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
 1012                                    (u32)(key->wk_keytsc >> 16));
 1013         }
 1014         tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
 1015                 (u16) key->wk_keytsc);
 1016 
 1017         wep_encrypt(ctx->tx_rc4key,
 1018                 m, hdrlen + tkip.ic_header,
 1019                 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
 1020                 icv);
 1021         (void) m_append(m, IEEE80211_WEP_CRCLEN, icv);  /* XXX check return */
 1022 
 1023         return 1;
 1024 }
 1025 
 1026 static int
 1027 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
 1028         struct mbuf *m, int hdrlen)
 1029 {
 1030         struct ieee80211_frame *wh;
 1031         struct ieee80211vap *vap = ctx->tc_vap;
 1032         u32 iv32;
 1033         u16 iv16;
 1034         u8 tid;
 1035 
 1036         vap->iv_stats.is_crypto_tkip++;
 1037 
 1038         wh = mtod(m, struct ieee80211_frame *);
 1039         /* NB: tkip_decap already verified header and left seq in rx_rsc */
 1040         iv16 = (u16) ctx->rx_rsc;
 1041         iv32 = (u32) (ctx->rx_rsc >> 16);
 1042 
 1043         tid = ieee80211_gettid(wh);
 1044         if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) {
 1045                 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
 1046                         wh->i_addr2, iv32);
 1047                 ctx->rx_phase1_done = 1;
 1048         }
 1049         tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
 1050 
 1051         /* NB: m is unstripped; deduct headers + ICV to get payload */
 1052         if (wep_decrypt(ctx->rx_rc4key,
 1053                 m, hdrlen + tkip.ic_header,
 1054                 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
 1055                 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) {
 1056                         /* Previously cached Phase1 result was already lost, so
 1057                          * it needs to be recalculated for the next packet. */
 1058                         ctx->rx_phase1_done = 0;
 1059                 }
 1060                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2,
 1061                     "%s", "TKIP ICV mismatch on decrypt");
 1062                 vap->iv_stats.is_rx_tkipicv++;
 1063                 return 0;
 1064         }
 1065         return 1;
 1066 }
 1067 
 1068 /*
 1069  * Module glue.
 1070  */
 1071 IEEE80211_CRYPTO_MODULE(tkip, 1);

Cache object: a94eac58fb1e0d1481cd977fba786080


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.