1 /*-
2 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. The name of the author may not be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * Alternatively, this software may be distributed under the terms of the
17 * GNU General Public License ("GPL") version 2 as published by the Free
18 * Software Foundation.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD: releng/6.0/sys/net80211/ieee80211_crypto_tkip.c 149772 2005-09-03 22:40:02Z sam $");
34
35 /*
36 * IEEE 802.11i TKIP crypto support.
37 *
38 * Part of this module is derived from similar code in the Host
39 * AP driver. The code is used with the consent of the author and
40 * it's license is included below.
41 */
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/kernel.h>
47 #include <sys/module.h>
48 #include <sys/endian.h>
49
50 #include <sys/socket.h>
51
52 #include <net/if.h>
53 #include <net/if_media.h>
54 #include <net/ethernet.h>
55
56 #include <net80211/ieee80211_var.h>
57
58 static void *tkip_attach(struct ieee80211com *, struct ieee80211_key *);
59 static void tkip_detach(struct ieee80211_key *);
60 static int tkip_setkey(struct ieee80211_key *);
61 static int tkip_encap(struct ieee80211_key *, struct mbuf *m, u_int8_t keyid);
62 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
63 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
64 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
65
66 static const struct ieee80211_cipher tkip = {
67 .ic_name = "TKIP",
68 .ic_cipher = IEEE80211_CIPHER_TKIP,
69 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
70 IEEE80211_WEP_EXTIVLEN,
71 .ic_trailer = IEEE80211_WEP_CRCLEN,
72 .ic_miclen = IEEE80211_WEP_MICLEN,
73 .ic_attach = tkip_attach,
74 .ic_detach = tkip_detach,
75 .ic_setkey = tkip_setkey,
76 .ic_encap = tkip_encap,
77 .ic_decap = tkip_decap,
78 .ic_enmic = tkip_enmic,
79 .ic_demic = tkip_demic,
80 };
81
82 typedef uint8_t u8;
83 typedef uint16_t u16;
84 typedef uint32_t __u32;
85 typedef uint32_t u32;
86 #define memmove(dst, src, n) ovbcopy(src, dst, n)
87
88 struct tkip_ctx {
89 struct ieee80211com *tc_ic; /* for diagnostics */
90
91 u16 tx_ttak[5];
92 int tx_phase1_done;
93 u8 tx_rc4key[16]; /* XXX for test module; make locals? */
94
95 u16 rx_ttak[5];
96 int rx_phase1_done;
97 u8 rx_rc4key[16]; /* XXX for test module; make locals? */
98 uint64_t rx_rsc; /* held until MIC verified */
99 };
100
101 static void michael_mic(struct tkip_ctx *, const u8 *key,
102 struct mbuf *m, u_int off, size_t data_len,
103 u8 mic[IEEE80211_WEP_MICLEN]);
104 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
105 struct mbuf *, int hdr_len);
106 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
107 struct mbuf *, int hdr_len);
108
109 static void *
110 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k)
111 {
112 struct tkip_ctx *ctx;
113
114 MALLOC(ctx, struct tkip_ctx *, sizeof(struct tkip_ctx),
115 M_DEVBUF, M_NOWAIT | M_ZERO);
116 if (ctx == NULL) {
117 ic->ic_stats.is_crypto_nomem++;
118 return NULL;
119 }
120
121 ctx->tc_ic = ic;
122 return ctx;
123 }
124
125 static void
126 tkip_detach(struct ieee80211_key *k)
127 {
128 struct tkip_ctx *ctx = k->wk_private;
129
130 FREE(ctx, M_DEVBUF);
131 }
132
133 static int
134 tkip_setkey(struct ieee80211_key *k)
135 {
136 struct tkip_ctx *ctx = k->wk_private;
137
138 if (k->wk_keylen != (128/NBBY)) {
139 (void) ctx; /* XXX */
140 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
141 "%s: Invalid key length %u, expecting %u\n",
142 __func__, k->wk_keylen, 128/NBBY);
143 return 0;
144 }
145 k->wk_keytsc = 1; /* TSC starts at 1 */
146 return 1;
147 }
148
149 /*
150 * Add privacy headers and do any s/w encryption required.
151 */
152 static int
153 tkip_encap(struct ieee80211_key *k, struct mbuf *m, u_int8_t keyid)
154 {
155 struct tkip_ctx *ctx = k->wk_private;
156 struct ieee80211com *ic = ctx->tc_ic;
157 u_int8_t *ivp;
158 int hdrlen;
159
160 /*
161 * Handle TKIP counter measures requirement.
162 */
163 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
164 #ifdef IEEE80211_DEBUG
165 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
166 #endif
167
168 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
169 "[%s] Discard frame due to countermeasures (%s)\n",
170 ether_sprintf(wh->i_addr2), __func__);
171 ic->ic_stats.is_crypto_tkipcm++;
172 return 0;
173 }
174 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
175
176 /*
177 * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
178 */
179 M_PREPEND(m, tkip.ic_header, M_NOWAIT);
180 if (m == NULL)
181 return 0;
182 ivp = mtod(m, u_int8_t *);
183 memmove(ivp, ivp + tkip.ic_header, hdrlen);
184 ivp += hdrlen;
185
186 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */
187 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */
188 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */
189 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */
190 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */
191 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */
192 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */
193 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */
194
195 /*
196 * Finally, do software encrypt if neeed.
197 */
198 if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
199 if (!tkip_encrypt(ctx, k, m, hdrlen))
200 return 0;
201 /* NB: tkip_encrypt handles wk_keytsc */
202 } else
203 k->wk_keytsc++;
204
205 return 1;
206 }
207
208 /*
209 * Add MIC to the frame as needed.
210 */
211 static int
212 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
213 {
214 struct tkip_ctx *ctx = k->wk_private;
215
216 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
217 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
218 struct ieee80211com *ic = ctx->tc_ic;
219 int hdrlen;
220 uint8_t mic[IEEE80211_WEP_MICLEN];
221
222 ic->ic_stats.is_crypto_tkipenmic++;
223
224 hdrlen = ieee80211_hdrspace(ic, wh);
225
226 michael_mic(ctx, k->wk_txmic,
227 m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
228 return m_append(m, tkip.ic_miclen, mic);
229 }
230 return 1;
231 }
232
233 static __inline uint64_t
234 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
235 {
236 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
237 uint16_t iv16 = (b4 << 0) | (b5 << 8);
238 return (((uint64_t)iv16) << 32) | iv32;
239 }
240
241 /*
242 * Validate and strip privacy headers (and trailer) for a
243 * received frame. If necessary, decrypt the frame using
244 * the specified key.
245 */
246 static int
247 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
248 {
249 struct tkip_ctx *ctx = k->wk_private;
250 struct ieee80211com *ic = ctx->tc_ic;
251 struct ieee80211_frame *wh;
252 uint8_t *ivp;
253
254 /*
255 * Header should have extended IV and sequence number;
256 * verify the former and validate the latter.
257 */
258 wh = mtod(m, struct ieee80211_frame *);
259 ivp = mtod(m, uint8_t *) + hdrlen;
260 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
261 /*
262 * No extended IV; discard frame.
263 */
264 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
265 "[%s] missing ExtIV for TKIP cipher\n",
266 ether_sprintf(wh->i_addr2));
267 ctx->tc_ic->ic_stats.is_rx_tkipformat++;
268 return 0;
269 }
270 /*
271 * Handle TKIP counter measures requirement.
272 */
273 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
274 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
275 "[%s] discard frame due to countermeasures (%s)\n",
276 ether_sprintf(wh->i_addr2), __func__);
277 ic->ic_stats.is_crypto_tkipcm++;
278 return 0;
279 }
280
281 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
282 if (ctx->rx_rsc <= k->wk_keyrsc) {
283 /*
284 * Replay violation; notify upper layer.
285 */
286 ieee80211_notify_replay_failure(ctx->tc_ic, wh, k, ctx->rx_rsc);
287 ctx->tc_ic->ic_stats.is_rx_tkipreplay++;
288 return 0;
289 }
290 /*
291 * NB: We can't update the rsc in the key until MIC is verified.
292 *
293 * We assume we are not preempted between doing the check above
294 * and updating wk_keyrsc when stripping the MIC in tkip_demic.
295 * Otherwise we might process another packet and discard it as
296 * a replay.
297 */
298
299 /*
300 * Check if the device handled the decrypt in hardware.
301 * If so we just strip the header; otherwise we need to
302 * handle the decrypt in software.
303 */
304 if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) &&
305 !tkip_decrypt(ctx, k, m, hdrlen))
306 return 0;
307
308 /*
309 * Copy up 802.11 header and strip crypto bits.
310 */
311 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen);
312 m_adj(m, tkip.ic_header);
313 m_adj(m, -tkip.ic_trailer);
314
315 return 1;
316 }
317
318 /*
319 * Verify and strip MIC from the frame.
320 */
321 static int
322 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
323 {
324 struct tkip_ctx *ctx = k->wk_private;
325
326 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
327 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
328 struct ieee80211com *ic = ctx->tc_ic;
329 int hdrlen = ieee80211_hdrspace(ic, wh);
330 u8 mic[IEEE80211_WEP_MICLEN];
331 u8 mic0[IEEE80211_WEP_MICLEN];
332
333 ic->ic_stats.is_crypto_tkipdemic++;
334
335 michael_mic(ctx, k->wk_rxmic,
336 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
337 mic);
338 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
339 tkip.ic_miclen, mic0);
340 if (memcmp(mic, mic0, tkip.ic_miclen)) {
341 /* NB: 802.11 layer handles statistic and debug msg */
342 ieee80211_notify_michael_failure(ic, wh,
343 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
344 k->wk_rxkeyix : k->wk_keyix);
345 return 0;
346 }
347 }
348 /*
349 * Strip MIC from the tail.
350 */
351 m_adj(m, -tkip.ic_miclen);
352
353 /*
354 * Ok to update rsc now that MIC has been verified.
355 */
356 k->wk_keyrsc = ctx->rx_rsc;
357
358 return 1;
359 }
360
361 /*
362 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
363 *
364 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
365 *
366 * This program is free software; you can redistribute it and/or modify
367 * it under the terms of the GNU General Public License version 2 as
368 * published by the Free Software Foundation. See README and COPYING for
369 * more details.
370 *
371 * Alternatively, this software may be distributed under the terms of BSD
372 * license.
373 */
374
375 static const __u32 crc32_table[256] = {
376 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
377 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
378 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
379 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
380 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
381 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
382 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
383 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
384 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
385 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
386 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
387 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
388 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
389 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
390 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
391 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
392 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
393 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
394 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
395 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
396 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
397 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
398 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
399 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
400 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
401 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
402 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
403 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
404 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
405 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
406 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
407 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
408 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
409 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
410 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
411 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
412 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
413 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
414 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
415 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
416 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
417 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
418 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
419 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
420 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
421 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
422 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
423 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
424 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
425 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
426 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
427 0x2d02ef8dL
428 };
429
430 static __inline u16 RotR1(u16 val)
431 {
432 return (val >> 1) | (val << 15);
433 }
434
435 static __inline u8 Lo8(u16 val)
436 {
437 return val & 0xff;
438 }
439
440 static __inline u8 Hi8(u16 val)
441 {
442 return val >> 8;
443 }
444
445 static __inline u16 Lo16(u32 val)
446 {
447 return val & 0xffff;
448 }
449
450 static __inline u16 Hi16(u32 val)
451 {
452 return val >> 16;
453 }
454
455 static __inline u16 Mk16(u8 hi, u8 lo)
456 {
457 return lo | (((u16) hi) << 8);
458 }
459
460 static __inline u16 Mk16_le(const u16 *v)
461 {
462 return le16toh(*v);
463 }
464
465 static const u16 Sbox[256] = {
466 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
467 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
468 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
469 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
470 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
471 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
472 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
473 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
474 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
475 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
476 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
477 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
478 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
479 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
480 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
481 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
482 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
483 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
484 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
485 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
486 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
487 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
488 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
489 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
490 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
491 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
492 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
493 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
494 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
495 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
496 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
497 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
498 };
499
500 static __inline u16 _S_(u16 v)
501 {
502 u16 t = Sbox[Hi8(v)];
503 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
504 }
505
506 #define PHASE1_LOOP_COUNT 8
507
508 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
509 {
510 int i, j;
511
512 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
513 TTAK[0] = Lo16(IV32);
514 TTAK[1] = Hi16(IV32);
515 TTAK[2] = Mk16(TA[1], TA[0]);
516 TTAK[3] = Mk16(TA[3], TA[2]);
517 TTAK[4] = Mk16(TA[5], TA[4]);
518
519 for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
520 j = 2 * (i & 1);
521 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
522 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
523 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
524 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
525 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
526 }
527 }
528
529 #ifndef _BYTE_ORDER
530 #error "Don't know native byte order"
531 #endif
532
533 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
534 u16 IV16)
535 {
536 /* Make temporary area overlap WEP seed so that the final copy can be
537 * avoided on little endian hosts. */
538 u16 *PPK = (u16 *) &WEPSeed[4];
539
540 /* Step 1 - make copy of TTAK and bring in TSC */
541 PPK[0] = TTAK[0];
542 PPK[1] = TTAK[1];
543 PPK[2] = TTAK[2];
544 PPK[3] = TTAK[3];
545 PPK[4] = TTAK[4];
546 PPK[5] = TTAK[4] + IV16;
547
548 /* Step 2 - 96-bit bijective mixing using S-box */
549 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
550 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
551 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
552 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
553 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
554 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
555
556 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
557 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
558 PPK[2] += RotR1(PPK[1]);
559 PPK[3] += RotR1(PPK[2]);
560 PPK[4] += RotR1(PPK[3]);
561 PPK[5] += RotR1(PPK[4]);
562
563 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
564 * WEPSeed[0..2] is transmitted as WEP IV */
565 WEPSeed[0] = Hi8(IV16);
566 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
567 WEPSeed[2] = Lo8(IV16);
568 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
569
570 #if _BYTE_ORDER == _BIG_ENDIAN
571 {
572 int i;
573 for (i = 0; i < 6; i++)
574 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
575 }
576 #endif
577 }
578
579 static void
580 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
581 uint8_t icv[IEEE80211_WEP_CRCLEN])
582 {
583 u32 i, j, k, crc;
584 size_t buflen;
585 u8 S[256];
586 u8 *pos;
587 struct mbuf *m;
588 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
589
590 /* Setup RC4 state */
591 for (i = 0; i < 256; i++)
592 S[i] = i;
593 j = 0;
594 for (i = 0; i < 256; i++) {
595 j = (j + S[i] + key[i & 0x0f]) & 0xff;
596 S_SWAP(i, j);
597 }
598
599 /* Compute CRC32 over unencrypted data and apply RC4 to data */
600 crc = ~0;
601 i = j = 0;
602 m = m0;
603 pos = mtod(m, uint8_t *) + off;
604 buflen = m->m_len - off;
605 for (;;) {
606 if (buflen > data_len)
607 buflen = data_len;
608 data_len -= buflen;
609 for (k = 0; k < buflen; k++) {
610 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
611 i = (i + 1) & 0xff;
612 j = (j + S[i]) & 0xff;
613 S_SWAP(i, j);
614 *pos++ ^= S[(S[i] + S[j]) & 0xff];
615 }
616 m = m->m_next;
617 if (m == NULL) {
618 KASSERT(data_len == 0,
619 ("out of buffers with data_len %zu\n", data_len));
620 break;
621 }
622 pos = mtod(m, uint8_t *);
623 buflen = m->m_len;
624 }
625 crc = ~crc;
626
627 /* Append little-endian CRC32 and encrypt it to produce ICV */
628 icv[0] = crc;
629 icv[1] = crc >> 8;
630 icv[2] = crc >> 16;
631 icv[3] = crc >> 24;
632 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
633 i = (i + 1) & 0xff;
634 j = (j + S[i]) & 0xff;
635 S_SWAP(i, j);
636 icv[k] ^= S[(S[i] + S[j]) & 0xff];
637 }
638 }
639
640 static int
641 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
642 {
643 u32 i, j, k, crc;
644 u8 S[256];
645 u8 *pos, icv[4];
646 size_t buflen;
647
648 /* Setup RC4 state */
649 for (i = 0; i < 256; i++)
650 S[i] = i;
651 j = 0;
652 for (i = 0; i < 256; i++) {
653 j = (j + S[i] + key[i & 0x0f]) & 0xff;
654 S_SWAP(i, j);
655 }
656
657 /* Apply RC4 to data and compute CRC32 over decrypted data */
658 crc = ~0;
659 i = j = 0;
660 pos = mtod(m, uint8_t *) + off;
661 buflen = m->m_len - off;
662 for (;;) {
663 if (buflen > data_len)
664 buflen = data_len;
665 data_len -= buflen;
666 for (k = 0; k < buflen; k++) {
667 i = (i + 1) & 0xff;
668 j = (j + S[i]) & 0xff;
669 S_SWAP(i, j);
670 *pos ^= S[(S[i] + S[j]) & 0xff];
671 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
672 pos++;
673 }
674 m = m->m_next;
675 if (m == NULL) {
676 KASSERT(data_len == 0,
677 ("out of buffers with data_len %zu\n", data_len));
678 break;
679 }
680 pos = mtod(m, uint8_t *);
681 buflen = m->m_len;
682 }
683 crc = ~crc;
684
685 /* Encrypt little-endian CRC32 and verify that it matches with the
686 * received ICV */
687 icv[0] = crc;
688 icv[1] = crc >> 8;
689 icv[2] = crc >> 16;
690 icv[3] = crc >> 24;
691 for (k = 0; k < 4; k++) {
692 i = (i + 1) & 0xff;
693 j = (j + S[i]) & 0xff;
694 S_SWAP(i, j);
695 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
696 /* ICV mismatch - drop frame */
697 return -1;
698 }
699 }
700
701 return 0;
702 }
703
704
705 static __inline u32 rotl(u32 val, int bits)
706 {
707 return (val << bits) | (val >> (32 - bits));
708 }
709
710
711 static __inline u32 rotr(u32 val, int bits)
712 {
713 return (val >> bits) | (val << (32 - bits));
714 }
715
716
717 static __inline u32 xswap(u32 val)
718 {
719 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
720 }
721
722
723 #define michael_block(l, r) \
724 do { \
725 r ^= rotl(l, 17); \
726 l += r; \
727 r ^= xswap(l); \
728 l += r; \
729 r ^= rotl(l, 3); \
730 l += r; \
731 r ^= rotr(l, 2); \
732 l += r; \
733 } while (0)
734
735
736 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
737 {
738 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
739 }
740
741 static __inline u32 get_le32(const u8 *p)
742 {
743 return get_le32_split(p[0], p[1], p[2], p[3]);
744 }
745
746
747 static __inline void put_le32(u8 *p, u32 v)
748 {
749 p[0] = v;
750 p[1] = v >> 8;
751 p[2] = v >> 16;
752 p[3] = v >> 24;
753 }
754
755 /*
756 * Craft pseudo header used to calculate the MIC.
757 */
758 static void
759 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
760 {
761 const struct ieee80211_frame_addr4 *wh =
762 (const struct ieee80211_frame_addr4 *) wh0;
763
764 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
765 case IEEE80211_FC1_DIR_NODS:
766 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
767 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
768 break;
769 case IEEE80211_FC1_DIR_TODS:
770 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
771 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
772 break;
773 case IEEE80211_FC1_DIR_FROMDS:
774 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
775 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
776 break;
777 case IEEE80211_FC1_DIR_DSTODS:
778 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
779 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
780 break;
781 }
782
783 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
784 const struct ieee80211_qosframe *qwh =
785 (const struct ieee80211_qosframe *) wh;
786 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
787 } else
788 hdr[12] = 0;
789 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
790 }
791
792 static void
793 michael_mic(struct tkip_ctx *ctx, const u8 *key,
794 struct mbuf *m, u_int off, size_t data_len,
795 u8 mic[IEEE80211_WEP_MICLEN])
796 {
797 uint8_t hdr[16];
798 u32 l, r;
799 const uint8_t *data;
800 u_int space;
801
802 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
803
804 l = get_le32(key);
805 r = get_le32(key + 4);
806
807 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
808 l ^= get_le32(hdr);
809 michael_block(l, r);
810 l ^= get_le32(&hdr[4]);
811 michael_block(l, r);
812 l ^= get_le32(&hdr[8]);
813 michael_block(l, r);
814 l ^= get_le32(&hdr[12]);
815 michael_block(l, r);
816
817 /* first buffer has special handling */
818 data = mtod(m, const uint8_t *) + off;
819 space = m->m_len - off;
820 for (;;) {
821 if (space > data_len)
822 space = data_len;
823 /* collect 32-bit blocks from current buffer */
824 while (space >= sizeof(uint32_t)) {
825 l ^= get_le32(data);
826 michael_block(l, r);
827 data += sizeof(uint32_t), space -= sizeof(uint32_t);
828 data_len -= sizeof(uint32_t);
829 }
830 if (data_len < sizeof(uint32_t))
831 break;
832 m = m->m_next;
833 if (m == NULL) {
834 KASSERT(0, ("out of data, data_len %zu\n", data_len));
835 break;
836 }
837 if (space != 0) {
838 const uint8_t *data_next;
839 /*
840 * Block straddles buffers, split references.
841 */
842 data_next = mtod(m, const uint8_t *);
843 KASSERT(m->m_len >= sizeof(uint32_t) - space,
844 ("not enough data in following buffer, "
845 "m_len %u need %zu\n", m->m_len,
846 sizeof(uint32_t) - space));
847 switch (space) {
848 case 1:
849 l ^= get_le32_split(data[0], data_next[0],
850 data_next[1], data_next[2]);
851 data = data_next + 3;
852 space = m->m_len - 3;
853 break;
854 case 2:
855 l ^= get_le32_split(data[0], data[1],
856 data_next[0], data_next[1]);
857 data = data_next + 2;
858 space = m->m_len - 2;
859 break;
860 case 3:
861 l ^= get_le32_split(data[0], data[1],
862 data[2], data_next[0]);
863 data = data_next + 1;
864 space = m->m_len - 1;
865 break;
866 }
867 michael_block(l, r);
868 data_len -= sizeof(uint32_t);
869 } else {
870 /*
871 * Setup for next buffer.
872 */
873 data = mtod(m, const uint8_t *);
874 space = m->m_len;
875 }
876 }
877 /* Last block and padding (0x5a, 4..7 x 0) */
878 switch (data_len) {
879 case 0:
880 l ^= get_le32_split(0x5a, 0, 0, 0);
881 break;
882 case 1:
883 l ^= get_le32_split(data[0], 0x5a, 0, 0);
884 break;
885 case 2:
886 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
887 break;
888 case 3:
889 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
890 break;
891 }
892 michael_block(l, r);
893 /* l ^= 0; */
894 michael_block(l, r);
895
896 put_le32(mic, l);
897 put_le32(mic + 4, r);
898 }
899
900 static int
901 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
902 struct mbuf *m, int hdrlen)
903 {
904 struct ieee80211_frame *wh;
905 uint8_t icv[IEEE80211_WEP_CRCLEN];
906
907 ctx->tc_ic->ic_stats.is_crypto_tkip++;
908
909 wh = mtod(m, struct ieee80211_frame *);
910 if (!ctx->tx_phase1_done) {
911 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
912 (u32)(key->wk_keytsc >> 16));
913 ctx->tx_phase1_done = 1;
914 }
915 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
916 (u16) key->wk_keytsc);
917
918 wep_encrypt(ctx->tx_rc4key,
919 m, hdrlen + tkip.ic_header,
920 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
921 icv);
922 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */
923
924 key->wk_keytsc++;
925 if ((u16)(key->wk_keytsc) == 0)
926 ctx->tx_phase1_done = 0;
927 return 1;
928 }
929
930 static int
931 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
932 struct mbuf *m, int hdrlen)
933 {
934 struct ieee80211_frame *wh;
935 u32 iv32;
936 u16 iv16;
937
938 ctx->tc_ic->ic_stats.is_crypto_tkip++;
939
940 wh = mtod(m, struct ieee80211_frame *);
941 /* NB: tkip_decap already verified header and left seq in rx_rsc */
942 iv16 = (u16) ctx->rx_rsc;
943 iv32 = (u32) (ctx->rx_rsc >> 16);
944
945 if (iv32 != (u32)(key->wk_keyrsc >> 16) || !ctx->rx_phase1_done) {
946 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
947 wh->i_addr2, iv32);
948 ctx->rx_phase1_done = 1;
949 }
950 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
951
952 /* NB: m is unstripped; deduct headers + ICV to get payload */
953 if (wep_decrypt(ctx->rx_rc4key,
954 m, hdrlen + tkip.ic_header,
955 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
956 if (iv32 != (u32)(key->wk_keyrsc >> 16)) {
957 /* Previously cached Phase1 result was already lost, so
958 * it needs to be recalculated for the next packet. */
959 ctx->rx_phase1_done = 0;
960 }
961 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
962 "[%s] TKIP ICV mismatch on decrypt\n",
963 ether_sprintf(wh->i_addr2));
964 ctx->tc_ic->ic_stats.is_rx_tkipicv++;
965 return 0;
966 }
967 return 1;
968 }
969
970 /*
971 * Module glue.
972 */
973 static int
974 tkip_modevent(module_t mod, int type, void *unused)
975 {
976 switch (type) {
977 case MOD_LOAD:
978 ieee80211_crypto_register(&tkip);
979 return 0;
980 case MOD_UNLOAD:
981 ieee80211_crypto_unregister(&tkip);
982 return 0;
983 }
984 return EINVAL;
985 }
986
987 static moduledata_t tkip_mod = {
988 "wlan_tkip",
989 tkip_modevent,
990 0
991 };
992 DECLARE_MODULE(wlan_tkip, tkip_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST);
993 MODULE_VERSION(wlan_tkip, 1);
994 MODULE_DEPEND(wlan_tkip, wlan, 1, 1, 1);
Cache object: 3eef437d1ce06cf9524397626491585f
|