Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_crypto_tkip.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. The name of the author may not be used to endorse or promote products 14 * derived from this software without specific prior written permission. 15 * 16 * Alternatively, this software may be distributed under the terms of the 17 * GNU General Public License ("GPL") version 2 as published by the Free 18 * Software Foundation. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD: releng/6.4/sys/net80211/ieee80211_crypto_tkip.c 153653 2005-12-22 19:02:08Z sam $"); 34 35 /* 36 * IEEE 802.11i TKIP crypto support. 37 * 38 * Part of this module is derived from similar code in the Host 39 * AP driver. The code is used with the consent of the author and 40 * it's license is included below. 41 */ 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/mbuf.h> 45 #include <sys/malloc.h> 46 #include <sys/kernel.h> 47 #include <sys/module.h> 48 #include <sys/endian.h> 49 50 #include <sys/socket.h> 51 52 #include <net/if.h> 53 #include <net/if_media.h> 54 #include <net/ethernet.h> 55 56 #include <net80211/ieee80211_var.h> 57 58 static void *tkip_attach(struct ieee80211com *, struct ieee80211_key *); 59 static void tkip_detach(struct ieee80211_key *); 60 static int tkip_setkey(struct ieee80211_key *); 61 static int tkip_encap(struct ieee80211_key *, struct mbuf *m, u_int8_t keyid); 62 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int); 63 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int); 64 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int); 65 66 static const struct ieee80211_cipher tkip = { 67 .ic_name = "TKIP", 68 .ic_cipher = IEEE80211_CIPHER_TKIP, 69 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + 70 IEEE80211_WEP_EXTIVLEN, 71 .ic_trailer = IEEE80211_WEP_CRCLEN, 72 .ic_miclen = IEEE80211_WEP_MICLEN, 73 .ic_attach = tkip_attach, 74 .ic_detach = tkip_detach, 75 .ic_setkey = tkip_setkey, 76 .ic_encap = tkip_encap, 77 .ic_decap = tkip_decap, 78 .ic_enmic = tkip_enmic, 79 .ic_demic = tkip_demic, 80 }; 81 82 typedef uint8_t u8; 83 typedef uint16_t u16; 84 typedef uint32_t __u32; 85 typedef uint32_t u32; 86 #define memmove(dst, src, n) ovbcopy(src, dst, n) 87 88 struct tkip_ctx { 89 struct ieee80211com *tc_ic; /* for diagnostics */ 90 91 u16 tx_ttak[5]; 92 int tx_phase1_done; 93 u8 tx_rc4key[16]; /* XXX for test module; make locals? */ 94 95 u16 rx_ttak[5]; 96 int rx_phase1_done; 97 u8 rx_rc4key[16]; /* XXX for test module; make locals? */ 98 uint64_t rx_rsc; /* held until MIC verified */ 99 }; 100 101 static void michael_mic(struct tkip_ctx *, const u8 *key, 102 struct mbuf *m, u_int off, size_t data_len, 103 u8 mic[IEEE80211_WEP_MICLEN]); 104 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *, 105 struct mbuf *, int hdr_len); 106 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *, 107 struct mbuf *, int hdr_len); 108 109 /* number of references from net80211 layer */ 110 static int nrefs = 0; 111 112 static void * 113 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k) 114 { 115 struct tkip_ctx *ctx; 116 117 MALLOC(ctx, struct tkip_ctx *, sizeof(struct tkip_ctx), 118 M_DEVBUF, M_NOWAIT | M_ZERO); 119 if (ctx == NULL) { 120 ic->ic_stats.is_crypto_nomem++; 121 return NULL; 122 } 123 124 ctx->tc_ic = ic; 125 nrefs++; /* NB: we assume caller locking */ 126 return ctx; 127 } 128 129 static void 130 tkip_detach(struct ieee80211_key *k) 131 { 132 struct tkip_ctx *ctx = k->wk_private; 133 134 FREE(ctx, M_DEVBUF); 135 KASSERT(nrefs > 0, ("imbalanced attach/detach")); 136 nrefs--; /* NB: we assume caller locking */ 137 } 138 139 static int 140 tkip_setkey(struct ieee80211_key *k) 141 { 142 struct tkip_ctx *ctx = k->wk_private; 143 144 if (k->wk_keylen != (128/NBBY)) { 145 (void) ctx; /* XXX */ 146 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO, 147 "%s: Invalid key length %u, expecting %u\n", 148 __func__, k->wk_keylen, 128/NBBY); 149 return 0; 150 } 151 k->wk_keytsc = 1; /* TSC starts at 1 */ 152 return 1; 153 } 154 155 /* 156 * Add privacy headers and do any s/w encryption required. 157 */ 158 static int 159 tkip_encap(struct ieee80211_key *k, struct mbuf *m, u_int8_t keyid) 160 { 161 struct tkip_ctx *ctx = k->wk_private; 162 struct ieee80211com *ic = ctx->tc_ic; 163 u_int8_t *ivp; 164 int hdrlen; 165 166 /* 167 * Handle TKIP counter measures requirement. 168 */ 169 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 170 #ifdef IEEE80211_DEBUG 171 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 172 #endif 173 174 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 175 "[%s] Discard frame due to countermeasures (%s)\n", 176 ether_sprintf(wh->i_addr2), __func__); 177 ic->ic_stats.is_crypto_tkipcm++; 178 return 0; 179 } 180 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *)); 181 182 /* 183 * Copy down 802.11 header and add the IV, KeyID, and ExtIV. 184 */ 185 M_PREPEND(m, tkip.ic_header, M_NOWAIT); 186 if (m == NULL) 187 return 0; 188 ivp = mtod(m, u_int8_t *); 189 memmove(ivp, ivp + tkip.ic_header, hdrlen); 190 ivp += hdrlen; 191 192 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */ 193 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */ 194 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */ 195 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */ 196 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */ 197 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */ 198 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */ 199 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */ 200 201 /* 202 * Finally, do software encrypt if neeed. 203 */ 204 if (k->wk_flags & IEEE80211_KEY_SWCRYPT) { 205 if (!tkip_encrypt(ctx, k, m, hdrlen)) 206 return 0; 207 /* NB: tkip_encrypt handles wk_keytsc */ 208 } else 209 k->wk_keytsc++; 210 211 return 1; 212 } 213 214 /* 215 * Add MIC to the frame as needed. 216 */ 217 static int 218 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force) 219 { 220 struct tkip_ctx *ctx = k->wk_private; 221 222 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) { 223 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 224 struct ieee80211com *ic = ctx->tc_ic; 225 int hdrlen; 226 uint8_t mic[IEEE80211_WEP_MICLEN]; 227 228 ic->ic_stats.is_crypto_tkipenmic++; 229 230 hdrlen = ieee80211_hdrspace(ic, wh); 231 232 michael_mic(ctx, k->wk_txmic, 233 m, hdrlen, m->m_pkthdr.len - hdrlen, mic); 234 return m_append(m, tkip.ic_miclen, mic); 235 } 236 return 1; 237 } 238 239 static __inline uint64_t 240 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5) 241 { 242 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24); 243 uint16_t iv16 = (b4 << 0) | (b5 << 8); 244 return (((uint64_t)iv16) << 32) | iv32; 245 } 246 247 /* 248 * Validate and strip privacy headers (and trailer) for a 249 * received frame. If necessary, decrypt the frame using 250 * the specified key. 251 */ 252 static int 253 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen) 254 { 255 struct tkip_ctx *ctx = k->wk_private; 256 struct ieee80211com *ic = ctx->tc_ic; 257 struct ieee80211_frame *wh; 258 uint8_t *ivp; 259 260 /* 261 * Header should have extended IV and sequence number; 262 * verify the former and validate the latter. 263 */ 264 wh = mtod(m, struct ieee80211_frame *); 265 ivp = mtod(m, uint8_t *) + hdrlen; 266 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) { 267 /* 268 * No extended IV; discard frame. 269 */ 270 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO, 271 "[%s] missing ExtIV for TKIP cipher\n", 272 ether_sprintf(wh->i_addr2)); 273 ctx->tc_ic->ic_stats.is_rx_tkipformat++; 274 return 0; 275 } 276 /* 277 * Handle TKIP counter measures requirement. 278 */ 279 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 280 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 281 "[%s] discard frame due to countermeasures (%s)\n", 282 ether_sprintf(wh->i_addr2), __func__); 283 ic->ic_stats.is_crypto_tkipcm++; 284 return 0; 285 } 286 287 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]); 288 if (ctx->rx_rsc <= k->wk_keyrsc) { 289 /* 290 * Replay violation; notify upper layer. 291 */ 292 ieee80211_notify_replay_failure(ctx->tc_ic, wh, k, ctx->rx_rsc); 293 ctx->tc_ic->ic_stats.is_rx_tkipreplay++; 294 return 0; 295 } 296 /* 297 * NB: We can't update the rsc in the key until MIC is verified. 298 * 299 * We assume we are not preempted between doing the check above 300 * and updating wk_keyrsc when stripping the MIC in tkip_demic. 301 * Otherwise we might process another packet and discard it as 302 * a replay. 303 */ 304 305 /* 306 * Check if the device handled the decrypt in hardware. 307 * If so we just strip the header; otherwise we need to 308 * handle the decrypt in software. 309 */ 310 if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) && 311 !tkip_decrypt(ctx, k, m, hdrlen)) 312 return 0; 313 314 /* 315 * Copy up 802.11 header and strip crypto bits. 316 */ 317 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen); 318 m_adj(m, tkip.ic_header); 319 m_adj(m, -tkip.ic_trailer); 320 321 return 1; 322 } 323 324 /* 325 * Verify and strip MIC from the frame. 326 */ 327 static int 328 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force) 329 { 330 struct tkip_ctx *ctx = k->wk_private; 331 332 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) { 333 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 334 struct ieee80211com *ic = ctx->tc_ic; 335 int hdrlen = ieee80211_hdrspace(ic, wh); 336 u8 mic[IEEE80211_WEP_MICLEN]; 337 u8 mic0[IEEE80211_WEP_MICLEN]; 338 339 ic->ic_stats.is_crypto_tkipdemic++; 340 341 michael_mic(ctx, k->wk_rxmic, 342 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen), 343 mic); 344 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen, 345 tkip.ic_miclen, mic0); 346 if (memcmp(mic, mic0, tkip.ic_miclen)) { 347 /* NB: 802.11 layer handles statistic and debug msg */ 348 ieee80211_notify_michael_failure(ic, wh, 349 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ? 350 k->wk_rxkeyix : k->wk_keyix); 351 return 0; 352 } 353 } 354 /* 355 * Strip MIC from the tail. 356 */ 357 m_adj(m, -tkip.ic_miclen); 358 359 /* 360 * Ok to update rsc now that MIC has been verified. 361 */ 362 k->wk_keyrsc = ctx->rx_rsc; 363 364 return 1; 365 } 366 367 /* 368 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver 369 * 370 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 371 * 372 * This program is free software; you can redistribute it and/or modify 373 * it under the terms of the GNU General Public License version 2 as 374 * published by the Free Software Foundation. See README and COPYING for 375 * more details. 376 * 377 * Alternatively, this software may be distributed under the terms of BSD 378 * license. 379 */ 380 381 static const __u32 crc32_table[256] = { 382 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, 383 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, 384 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 385 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, 386 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, 387 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, 388 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 389 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, 390 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, 391 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, 392 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 393 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, 394 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, 395 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, 396 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 397 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, 398 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, 399 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, 400 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 401 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, 402 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, 403 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, 404 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, 405 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, 406 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, 407 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, 408 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, 409 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, 410 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, 411 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, 412 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 413 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, 414 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, 415 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, 416 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 417 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, 418 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, 419 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, 420 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 421 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, 422 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, 423 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, 424 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 425 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, 426 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, 427 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, 428 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 429 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, 430 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, 431 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, 432 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 433 0x2d02ef8dL 434 }; 435 436 static __inline u16 RotR1(u16 val) 437 { 438 return (val >> 1) | (val << 15); 439 } 440 441 static __inline u8 Lo8(u16 val) 442 { 443 return val & 0xff; 444 } 445 446 static __inline u8 Hi8(u16 val) 447 { 448 return val >> 8; 449 } 450 451 static __inline u16 Lo16(u32 val) 452 { 453 return val & 0xffff; 454 } 455 456 static __inline u16 Hi16(u32 val) 457 { 458 return val >> 16; 459 } 460 461 static __inline u16 Mk16(u8 hi, u8 lo) 462 { 463 return lo | (((u16) hi) << 8); 464 } 465 466 static __inline u16 Mk16_le(const u16 *v) 467 { 468 return le16toh(*v); 469 } 470 471 static const u16 Sbox[256] = { 472 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 473 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 474 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 475 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 476 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, 477 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, 478 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, 479 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, 480 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, 481 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 482 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 483 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 484 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 485 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, 486 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, 487 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, 488 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, 489 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, 490 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 491 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 492 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 493 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 494 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, 495 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, 496 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, 497 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, 498 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, 499 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 500 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 501 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 502 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 503 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, 504 }; 505 506 static __inline u16 _S_(u16 v) 507 { 508 u16 t = Sbox[Hi8(v)]; 509 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8)); 510 } 511 512 #define PHASE1_LOOP_COUNT 8 513 514 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32) 515 { 516 int i, j; 517 518 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */ 519 TTAK[0] = Lo16(IV32); 520 TTAK[1] = Hi16(IV32); 521 TTAK[2] = Mk16(TA[1], TA[0]); 522 TTAK[3] = Mk16(TA[3], TA[2]); 523 TTAK[4] = Mk16(TA[5], TA[4]); 524 525 for (i = 0; i < PHASE1_LOOP_COUNT; i++) { 526 j = 2 * (i & 1); 527 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j])); 528 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j])); 529 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j])); 530 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j])); 531 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i; 532 } 533 } 534 535 #ifndef _BYTE_ORDER 536 #error "Don't know native byte order" 537 #endif 538 539 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK, 540 u16 IV16) 541 { 542 /* Make temporary area overlap WEP seed so that the final copy can be 543 * avoided on little endian hosts. */ 544 u16 *PPK = (u16 *) &WEPSeed[4]; 545 546 /* Step 1 - make copy of TTAK and bring in TSC */ 547 PPK[0] = TTAK[0]; 548 PPK[1] = TTAK[1]; 549 PPK[2] = TTAK[2]; 550 PPK[3] = TTAK[3]; 551 PPK[4] = TTAK[4]; 552 PPK[5] = TTAK[4] + IV16; 553 554 /* Step 2 - 96-bit bijective mixing using S-box */ 555 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0])); 556 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2])); 557 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4])); 558 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6])); 559 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8])); 560 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10])); 561 562 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12])); 563 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14])); 564 PPK[2] += RotR1(PPK[1]); 565 PPK[3] += RotR1(PPK[2]); 566 PPK[4] += RotR1(PPK[3]); 567 PPK[5] += RotR1(PPK[4]); 568 569 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value 570 * WEPSeed[0..2] is transmitted as WEP IV */ 571 WEPSeed[0] = Hi8(IV16); 572 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F; 573 WEPSeed[2] = Lo8(IV16); 574 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1); 575 576 #if _BYTE_ORDER == _BIG_ENDIAN 577 { 578 int i; 579 for (i = 0; i < 6; i++) 580 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8); 581 } 582 #endif 583 } 584 585 static void 586 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len, 587 uint8_t icv[IEEE80211_WEP_CRCLEN]) 588 { 589 u32 i, j, k, crc; 590 size_t buflen; 591 u8 S[256]; 592 u8 *pos; 593 struct mbuf *m; 594 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0) 595 596 /* Setup RC4 state */ 597 for (i = 0; i < 256; i++) 598 S[i] = i; 599 j = 0; 600 for (i = 0; i < 256; i++) { 601 j = (j + S[i] + key[i & 0x0f]) & 0xff; 602 S_SWAP(i, j); 603 } 604 605 /* Compute CRC32 over unencrypted data and apply RC4 to data */ 606 crc = ~0; 607 i = j = 0; 608 m = m0; 609 pos = mtod(m, uint8_t *) + off; 610 buflen = m->m_len - off; 611 for (;;) { 612 if (buflen > data_len) 613 buflen = data_len; 614 data_len -= buflen; 615 for (k = 0; k < buflen; k++) { 616 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 617 i = (i + 1) & 0xff; 618 j = (j + S[i]) & 0xff; 619 S_SWAP(i, j); 620 *pos++ ^= S[(S[i] + S[j]) & 0xff]; 621 } 622 m = m->m_next; 623 if (m == NULL) { 624 KASSERT(data_len == 0, 625 ("out of buffers with data_len %zu\n", data_len)); 626 break; 627 } 628 pos = mtod(m, uint8_t *); 629 buflen = m->m_len; 630 } 631 crc = ~crc; 632 633 /* Append little-endian CRC32 and encrypt it to produce ICV */ 634 icv[0] = crc; 635 icv[1] = crc >> 8; 636 icv[2] = crc >> 16; 637 icv[3] = crc >> 24; 638 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) { 639 i = (i + 1) & 0xff; 640 j = (j + S[i]) & 0xff; 641 S_SWAP(i, j); 642 icv[k] ^= S[(S[i] + S[j]) & 0xff]; 643 } 644 } 645 646 static int 647 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len) 648 { 649 u32 i, j, k, crc; 650 u8 S[256]; 651 u8 *pos, icv[4]; 652 size_t buflen; 653 654 /* Setup RC4 state */ 655 for (i = 0; i < 256; i++) 656 S[i] = i; 657 j = 0; 658 for (i = 0; i < 256; i++) { 659 j = (j + S[i] + key[i & 0x0f]) & 0xff; 660 S_SWAP(i, j); 661 } 662 663 /* Apply RC4 to data and compute CRC32 over decrypted data */ 664 crc = ~0; 665 i = j = 0; 666 pos = mtod(m, uint8_t *) + off; 667 buflen = m->m_len - off; 668 for (;;) { 669 if (buflen > data_len) 670 buflen = data_len; 671 data_len -= buflen; 672 for (k = 0; k < buflen; k++) { 673 i = (i + 1) & 0xff; 674 j = (j + S[i]) & 0xff; 675 S_SWAP(i, j); 676 *pos ^= S[(S[i] + S[j]) & 0xff]; 677 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 678 pos++; 679 } 680 m = m->m_next; 681 if (m == NULL) { 682 KASSERT(data_len == 0, 683 ("out of buffers with data_len %zu\n", data_len)); 684 break; 685 } 686 pos = mtod(m, uint8_t *); 687 buflen = m->m_len; 688 } 689 crc = ~crc; 690 691 /* Encrypt little-endian CRC32 and verify that it matches with the 692 * received ICV */ 693 icv[0] = crc; 694 icv[1] = crc >> 8; 695 icv[2] = crc >> 16; 696 icv[3] = crc >> 24; 697 for (k = 0; k < 4; k++) { 698 i = (i + 1) & 0xff; 699 j = (j + S[i]) & 0xff; 700 S_SWAP(i, j); 701 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) { 702 /* ICV mismatch - drop frame */ 703 return -1; 704 } 705 } 706 707 return 0; 708 } 709 710 711 static __inline u32 rotl(u32 val, int bits) 712 { 713 return (val << bits) | (val >> (32 - bits)); 714 } 715 716 717 static __inline u32 rotr(u32 val, int bits) 718 { 719 return (val >> bits) | (val << (32 - bits)); 720 } 721 722 723 static __inline u32 xswap(u32 val) 724 { 725 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8); 726 } 727 728 729 #define michael_block(l, r) \ 730 do { \ 731 r ^= rotl(l, 17); \ 732 l += r; \ 733 r ^= xswap(l); \ 734 l += r; \ 735 r ^= rotl(l, 3); \ 736 l += r; \ 737 r ^= rotr(l, 2); \ 738 l += r; \ 739 } while (0) 740 741 742 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3) 743 { 744 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24); 745 } 746 747 static __inline u32 get_le32(const u8 *p) 748 { 749 return get_le32_split(p[0], p[1], p[2], p[3]); 750 } 751 752 753 static __inline void put_le32(u8 *p, u32 v) 754 { 755 p[0] = v; 756 p[1] = v >> 8; 757 p[2] = v >> 16; 758 p[3] = v >> 24; 759 } 760 761 /* 762 * Craft pseudo header used to calculate the MIC. 763 */ 764 static void 765 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16]) 766 { 767 const struct ieee80211_frame_addr4 *wh = 768 (const struct ieee80211_frame_addr4 *) wh0; 769 770 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 771 case IEEE80211_FC1_DIR_NODS: 772 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 773 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 774 break; 775 case IEEE80211_FC1_DIR_TODS: 776 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 777 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 778 break; 779 case IEEE80211_FC1_DIR_FROMDS: 780 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 781 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3); 782 break; 783 case IEEE80211_FC1_DIR_DSTODS: 784 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 785 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4); 786 break; 787 } 788 789 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) { 790 const struct ieee80211_qosframe *qwh = 791 (const struct ieee80211_qosframe *) wh; 792 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID; 793 } else 794 hdr[12] = 0; 795 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */ 796 } 797 798 static void 799 michael_mic(struct tkip_ctx *ctx, const u8 *key, 800 struct mbuf *m, u_int off, size_t data_len, 801 u8 mic[IEEE80211_WEP_MICLEN]) 802 { 803 uint8_t hdr[16]; 804 u32 l, r; 805 const uint8_t *data; 806 u_int space; 807 808 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr); 809 810 l = get_le32(key); 811 r = get_le32(key + 4); 812 813 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ 814 l ^= get_le32(hdr); 815 michael_block(l, r); 816 l ^= get_le32(&hdr[4]); 817 michael_block(l, r); 818 l ^= get_le32(&hdr[8]); 819 michael_block(l, r); 820 l ^= get_le32(&hdr[12]); 821 michael_block(l, r); 822 823 /* first buffer has special handling */ 824 data = mtod(m, const uint8_t *) + off; 825 space = m->m_len - off; 826 for (;;) { 827 if (space > data_len) 828 space = data_len; 829 /* collect 32-bit blocks from current buffer */ 830 while (space >= sizeof(uint32_t)) { 831 l ^= get_le32(data); 832 michael_block(l, r); 833 data += sizeof(uint32_t), space -= sizeof(uint32_t); 834 data_len -= sizeof(uint32_t); 835 } 836 if (data_len < sizeof(uint32_t)) 837 break; 838 m = m->m_next; 839 if (m == NULL) { 840 KASSERT(0, ("out of data, data_len %zu\n", data_len)); 841 break; 842 } 843 if (space != 0) { 844 const uint8_t *data_next; 845 /* 846 * Block straddles buffers, split references. 847 */ 848 data_next = mtod(m, const uint8_t *); 849 KASSERT(m->m_len >= sizeof(uint32_t) - space, 850 ("not enough data in following buffer, " 851 "m_len %u need %zu\n", m->m_len, 852 sizeof(uint32_t) - space)); 853 switch (space) { 854 case 1: 855 l ^= get_le32_split(data[0], data_next[0], 856 data_next[1], data_next[2]); 857 data = data_next + 3; 858 space = m->m_len - 3; 859 break; 860 case 2: 861 l ^= get_le32_split(data[0], data[1], 862 data_next[0], data_next[1]); 863 data = data_next + 2; 864 space = m->m_len - 2; 865 break; 866 case 3: 867 l ^= get_le32_split(data[0], data[1], 868 data[2], data_next[0]); 869 data = data_next + 1; 870 space = m->m_len - 1; 871 break; 872 } 873 michael_block(l, r); 874 data_len -= sizeof(uint32_t); 875 } else { 876 /* 877 * Setup for next buffer. 878 */ 879 data = mtod(m, const uint8_t *); 880 space = m->m_len; 881 } 882 } 883 /* Last block and padding (0x5a, 4..7 x 0) */ 884 switch (data_len) { 885 case 0: 886 l ^= get_le32_split(0x5a, 0, 0, 0); 887 break; 888 case 1: 889 l ^= get_le32_split(data[0], 0x5a, 0, 0); 890 break; 891 case 2: 892 l ^= get_le32_split(data[0], data[1], 0x5a, 0); 893 break; 894 case 3: 895 l ^= get_le32_split(data[0], data[1], data[2], 0x5a); 896 break; 897 } 898 michael_block(l, r); 899 /* l ^= 0; */ 900 michael_block(l, r); 901 902 put_le32(mic, l); 903 put_le32(mic + 4, r); 904 } 905 906 static int 907 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 908 struct mbuf *m, int hdrlen) 909 { 910 struct ieee80211_frame *wh; 911 uint8_t icv[IEEE80211_WEP_CRCLEN]; 912 913 ctx->tc_ic->ic_stats.is_crypto_tkip++; 914 915 wh = mtod(m, struct ieee80211_frame *); 916 if (!ctx->tx_phase1_done) { 917 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2, 918 (u32)(key->wk_keytsc >> 16)); 919 ctx->tx_phase1_done = 1; 920 } 921 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak, 922 (u16) key->wk_keytsc); 923 924 wep_encrypt(ctx->tx_rc4key, 925 m, hdrlen + tkip.ic_header, 926 m->m_pkthdr.len - (hdrlen + tkip.ic_header), 927 icv); 928 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */ 929 930 key->wk_keytsc++; 931 if ((u16)(key->wk_keytsc) == 0) 932 ctx->tx_phase1_done = 0; 933 return 1; 934 } 935 936 static int 937 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 938 struct mbuf *m, int hdrlen) 939 { 940 struct ieee80211_frame *wh; 941 u32 iv32; 942 u16 iv16; 943 944 ctx->tc_ic->ic_stats.is_crypto_tkip++; 945 946 wh = mtod(m, struct ieee80211_frame *); 947 /* NB: tkip_decap already verified header and left seq in rx_rsc */ 948 iv16 = (u16) ctx->rx_rsc; 949 iv32 = (u32) (ctx->rx_rsc >> 16); 950 951 if (iv32 != (u32)(key->wk_keyrsc >> 16) || !ctx->rx_phase1_done) { 952 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key, 953 wh->i_addr2, iv32); 954 ctx->rx_phase1_done = 1; 955 } 956 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16); 957 958 /* NB: m is unstripped; deduct headers + ICV to get payload */ 959 if (wep_decrypt(ctx->rx_rc4key, 960 m, hdrlen + tkip.ic_header, 961 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) { 962 if (iv32 != (u32)(key->wk_keyrsc >> 16)) { 963 /* Previously cached Phase1 result was already lost, so 964 * it needs to be recalculated for the next packet. */ 965 ctx->rx_phase1_done = 0; 966 } 967 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO, 968 "[%s] TKIP ICV mismatch on decrypt\n", 969 ether_sprintf(wh->i_addr2)); 970 ctx->tc_ic->ic_stats.is_rx_tkipicv++; 971 return 0; 972 } 973 return 1; 974 } 975 976 /* 977 * Module glue. 978 */ 979 static int 980 tkip_modevent(module_t mod, int type, void *unused) 981 { 982 switch (type) { 983 case MOD_LOAD: 984 ieee80211_crypto_register(&tkip); 985 return 0; 986 case MOD_UNLOAD: 987 case MOD_QUIESCE: 988 if (nrefs) { 989 printf("wlan_tkip: still in use (%u dynamic refs)\n", 990 nrefs); 991 return EBUSY; 992 } 993 if (type == MOD_UNLOAD) 994 ieee80211_crypto_unregister(&tkip); 995 return 0; 996 } 997 return EINVAL; 998 } 999 1000 static moduledata_t tkip_mod = { 1001 "wlan_tkip", 1002 tkip_modevent, 1003 0 1004 }; 1005 DECLARE_MODULE(wlan_tkip, tkip_mod, SI_SUB_DRIVERS, SI_ORDER_FIRST); 1006 MODULE_VERSION(wlan_tkip, 1); 1007 MODULE_DEPEND(wlan_tkip, wlan, 1, 1, 1);
Cache object: 4e60e22bcb172cefa7d72e58e45f9dec
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]