The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_crypto_tkip.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 __FBSDID("$FreeBSD: releng/7.4/sys/net80211/ieee80211_crypto_tkip.c 215543 2010-11-19 18:59:35Z bschmidt $");
   28 
   29 /*
   30  * IEEE 802.11i TKIP crypto support.
   31  *
   32  * Part of this module is derived from similar code in the Host
   33  * AP driver. The code is used with the consent of the author and
   34  * it's license is included below.
   35  */
   36 #include <sys/param.h>
   37 #include <sys/systm.h> 
   38 #include <sys/mbuf.h>   
   39 #include <sys/malloc.h>
   40 #include <sys/kernel.h>
   41 #include <sys/module.h>
   42 #include <sys/endian.h>
   43 
   44 #include <sys/socket.h>
   45 
   46 #include <net/if.h>
   47 #include <net/if_media.h>
   48 #include <net/ethernet.h>
   49 
   50 #include <net80211/ieee80211_var.h>
   51 
   52 static  void *tkip_attach(struct ieee80211com *, struct ieee80211_key *);
   53 static  void tkip_detach(struct ieee80211_key *);
   54 static  int tkip_setkey(struct ieee80211_key *);
   55 static  int tkip_encap(struct ieee80211_key *, struct mbuf *m, uint8_t keyid);
   56 static  int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
   57 static  int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
   58 static  int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
   59 
   60 static const struct ieee80211_cipher tkip  = {
   61         .ic_name        = "TKIP",
   62         .ic_cipher      = IEEE80211_CIPHER_TKIP,
   63         .ic_header      = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
   64                           IEEE80211_WEP_EXTIVLEN,
   65         .ic_trailer     = IEEE80211_WEP_CRCLEN,
   66         .ic_miclen      = IEEE80211_WEP_MICLEN,
   67         .ic_attach      = tkip_attach,
   68         .ic_detach      = tkip_detach,
   69         .ic_setkey      = tkip_setkey,
   70         .ic_encap       = tkip_encap,
   71         .ic_decap       = tkip_decap,
   72         .ic_enmic       = tkip_enmic,
   73         .ic_demic       = tkip_demic,
   74 };
   75 
   76 typedef uint8_t u8;
   77 typedef uint16_t u16;
   78 typedef uint32_t __u32;
   79 typedef uint32_t u32;
   80 #define memmove(dst, src, n)    ovbcopy(src, dst, n)
   81 
   82 struct tkip_ctx {
   83         struct ieee80211com *tc_ic;     /* for diagnostics */
   84 
   85         u16     tx_ttak[5];
   86         int     tx_phase1_done;
   87         u8      tx_rc4key[16];          /* XXX for test module; make locals? */
   88 
   89         u16     rx_ttak[5];
   90         int     rx_phase1_done;
   91         u8      rx_rc4key[16];          /* XXX for test module; make locals? */
   92         uint64_t rx_rsc;                /* held until MIC verified */
   93 };
   94 
   95 static  void michael_mic(struct tkip_ctx *, const u8 *key,
   96                 struct mbuf *m, u_int off, size_t data_len,
   97                 u8 mic[IEEE80211_WEP_MICLEN]);
   98 static  int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
   99                 struct mbuf *, int hdr_len);
  100 static  int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
  101                 struct mbuf *, int hdr_len);
  102 
  103 /* number of references from net80211 layer */
  104 static  int nrefs = 0;
  105 
  106 static void *
  107 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k)
  108 {
  109         struct tkip_ctx *ctx;
  110 
  111         MALLOC(ctx, struct tkip_ctx *, sizeof(struct tkip_ctx),
  112                 M_DEVBUF, M_NOWAIT | M_ZERO);
  113         if (ctx == NULL) {
  114                 ic->ic_stats.is_crypto_nomem++;
  115                 return NULL;
  116         }
  117 
  118         ctx->tc_ic = ic;
  119         nrefs++;                        /* NB: we assume caller locking */
  120         return ctx;
  121 }
  122 
  123 static void
  124 tkip_detach(struct ieee80211_key *k)
  125 {
  126         struct tkip_ctx *ctx = k->wk_private;
  127 
  128         FREE(ctx, M_DEVBUF);
  129         KASSERT(nrefs > 0, ("imbalanced attach/detach"));
  130         nrefs--;                        /* NB: we assume caller locking */
  131 }
  132 
  133 static int
  134 tkip_setkey(struct ieee80211_key *k)
  135 {
  136         struct tkip_ctx *ctx = k->wk_private;
  137 
  138         if (k->wk_keylen != (128/NBBY)) {
  139                 (void) ctx;             /* XXX */
  140                 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
  141                         "%s: Invalid key length %u, expecting %u\n",
  142                         __func__, k->wk_keylen, 128/NBBY);
  143                 return 0;
  144         }
  145         k->wk_keytsc = 1;               /* TSC starts at 1 */
  146         ctx->rx_phase1_done = 0;
  147         return 1;
  148 }
  149 
  150 /*
  151  * Add privacy headers and do any s/w encryption required.
  152  */
  153 static int
  154 tkip_encap(struct ieee80211_key *k, struct mbuf *m, uint8_t keyid)
  155 {
  156         struct tkip_ctx *ctx = k->wk_private;
  157         struct ieee80211com *ic = ctx->tc_ic;
  158         uint8_t *ivp;
  159         int hdrlen;
  160 
  161         /*
  162          * Handle TKIP counter measures requirement.
  163          */
  164         if (ic->ic_flags & IEEE80211_F_COUNTERM) {
  165 #ifdef IEEE80211_DEBUG
  166                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  167 #endif
  168 
  169                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
  170                         "[%s] Discard frame due to countermeasures (%s)\n",
  171                         ether_sprintf(wh->i_addr2), __func__);
  172                 ic->ic_stats.is_crypto_tkipcm++;
  173                 return 0;
  174         }
  175         hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
  176 
  177         /*
  178          * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
  179          */
  180         M_PREPEND(m, tkip.ic_header, M_NOWAIT);
  181         if (m == NULL)
  182                 return 0;
  183         ivp = mtod(m, uint8_t *);
  184         memmove(ivp, ivp + tkip.ic_header, hdrlen);
  185         ivp += hdrlen;
  186 
  187         ivp[0] = k->wk_keytsc >> 8;             /* TSC1 */
  188         ivp[1] = (ivp[0] | 0x20) & 0x7f;        /* WEP seed */
  189         ivp[2] = k->wk_keytsc >> 0;             /* TSC0 */
  190         ivp[3] = keyid | IEEE80211_WEP_EXTIV;   /* KeyID | ExtID */
  191         ivp[4] = k->wk_keytsc >> 16;            /* TSC2 */
  192         ivp[5] = k->wk_keytsc >> 24;            /* TSC3 */
  193         ivp[6] = k->wk_keytsc >> 32;            /* TSC4 */
  194         ivp[7] = k->wk_keytsc >> 40;            /* TSC5 */
  195 
  196         /*
  197          * Finally, do software encrypt if neeed.
  198          */
  199         if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
  200                 if (!tkip_encrypt(ctx, k, m, hdrlen))
  201                         return 0;
  202                 /* NB: tkip_encrypt handles wk_keytsc */
  203         } else
  204                 k->wk_keytsc++;
  205 
  206         return 1;
  207 }
  208 
  209 /*
  210  * Add MIC to the frame as needed.
  211  */
  212 static int
  213 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
  214 {
  215         struct tkip_ctx *ctx = k->wk_private;
  216 
  217         if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
  218                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  219                 struct ieee80211com *ic = ctx->tc_ic;
  220                 int hdrlen;
  221                 uint8_t mic[IEEE80211_WEP_MICLEN];
  222 
  223                 ic->ic_stats.is_crypto_tkipenmic++;
  224 
  225                 hdrlen = ieee80211_hdrspace(ic, wh);
  226 
  227                 michael_mic(ctx, k->wk_txmic,
  228                         m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
  229                 return m_append(m, tkip.ic_miclen, mic);
  230         }
  231         return 1;
  232 }
  233 
  234 static __inline uint64_t
  235 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
  236 {
  237         uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
  238         uint16_t iv16 = (b4 << 0) | (b5 << 8);
  239         return (((uint64_t)iv16) << 32) | iv32;
  240 }
  241 
  242 /*
  243  * Validate and strip privacy headers (and trailer) for a
  244  * received frame.  If necessary, decrypt the frame using
  245  * the specified key.
  246  */
  247 static int
  248 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
  249 {
  250         struct tkip_ctx *ctx = k->wk_private;
  251         struct ieee80211com *ic = ctx->tc_ic;
  252         struct ieee80211_frame *wh;
  253         uint8_t *ivp;
  254 
  255         /*
  256          * Header should have extended IV and sequence number;
  257          * verify the former and validate the latter.
  258          */
  259         wh = mtod(m, struct ieee80211_frame *);
  260         ivp = mtod(m, uint8_t *) + hdrlen;
  261         if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
  262                 /*
  263                  * No extended IV; discard frame.
  264                  */
  265                 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
  266                         "[%s] missing ExtIV for TKIP cipher\n",
  267                         ether_sprintf(wh->i_addr2));
  268                 ctx->tc_ic->ic_stats.is_rx_tkipformat++;
  269                 return 0;
  270         }
  271         /*
  272          * Handle TKIP counter measures requirement.
  273          */
  274         if (ic->ic_flags & IEEE80211_F_COUNTERM) {
  275                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
  276                         "[%s] discard frame due to countermeasures (%s)\n",
  277                         ether_sprintf(wh->i_addr2), __func__);
  278                 ic->ic_stats.is_crypto_tkipcm++;
  279                 return 0;
  280         }
  281 
  282         ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
  283         if (ctx->rx_rsc <= k->wk_keyrsc) {
  284                 /*
  285                  * Replay violation; notify upper layer.
  286                  */
  287                 ieee80211_notify_replay_failure(ctx->tc_ic, wh, k, ctx->rx_rsc);
  288                 ctx->tc_ic->ic_stats.is_rx_tkipreplay++;
  289                 return 0;
  290         }
  291         /*
  292          * NB: We can't update the rsc in the key until MIC is verified.
  293          *
  294          * We assume we are not preempted between doing the check above
  295          * and updating wk_keyrsc when stripping the MIC in tkip_demic.
  296          * Otherwise we might process another packet and discard it as
  297          * a replay.
  298          */
  299 
  300         /*
  301          * Check if the device handled the decrypt in hardware.
  302          * If so we just strip the header; otherwise we need to
  303          * handle the decrypt in software.
  304          */
  305         if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) &&
  306             !tkip_decrypt(ctx, k, m, hdrlen))
  307                 return 0;
  308 
  309         /*
  310          * Copy up 802.11 header and strip crypto bits.
  311          */
  312         memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen);
  313         m_adj(m, tkip.ic_header);
  314         m_adj(m, -tkip.ic_trailer);
  315 
  316         return 1;
  317 }
  318 
  319 /*
  320  * Verify and strip MIC from the frame.
  321  */
  322 static int
  323 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
  324 {
  325         struct tkip_ctx *ctx = k->wk_private;
  326 
  327         if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
  328                 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  329                 struct ieee80211com *ic = ctx->tc_ic;
  330                 int hdrlen = ieee80211_hdrspace(ic, wh);
  331                 u8 mic[IEEE80211_WEP_MICLEN];
  332                 u8 mic0[IEEE80211_WEP_MICLEN];
  333 
  334                 ic->ic_stats.is_crypto_tkipdemic++;
  335 
  336                 michael_mic(ctx, k->wk_rxmic, 
  337                         m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
  338                         mic);
  339                 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
  340                         tkip.ic_miclen, mic0);
  341                 if (memcmp(mic, mic0, tkip.ic_miclen)) {
  342                         /* NB: 802.11 layer handles statistic and debug msg */
  343                         ieee80211_notify_michael_failure(ic, wh,
  344                                 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
  345                                         k->wk_rxkeyix : k->wk_keyix);
  346                         return 0;
  347                 }
  348         }
  349         /*
  350          * Strip MIC from the tail.
  351          */
  352         m_adj(m, -tkip.ic_miclen);
  353 
  354         /*
  355          * Ok to update rsc now that MIC has been verified.
  356          */
  357         k->wk_keyrsc = ctx->rx_rsc;
  358 
  359         return 1;
  360 }
  361 
  362 /*
  363  * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
  364  *
  365  * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
  366  *
  367  * This program is free software; you can redistribute it and/or modify
  368  * it under the terms of the GNU General Public License version 2 as
  369  * published by the Free Software Foundation. See README and COPYING for
  370  * more details.
  371  *
  372  * Alternatively, this software may be distributed under the terms of BSD
  373  * license.
  374  */
  375 
  376 static const __u32 crc32_table[256] = {
  377         0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
  378         0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
  379         0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
  380         0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
  381         0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
  382         0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
  383         0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
  384         0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
  385         0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
  386         0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
  387         0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
  388         0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
  389         0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
  390         0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
  391         0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
  392         0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
  393         0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
  394         0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
  395         0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
  396         0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
  397         0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
  398         0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
  399         0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
  400         0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
  401         0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
  402         0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
  403         0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
  404         0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
  405         0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
  406         0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
  407         0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
  408         0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
  409         0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
  410         0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
  411         0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
  412         0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
  413         0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
  414         0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
  415         0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
  416         0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
  417         0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
  418         0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
  419         0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
  420         0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
  421         0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
  422         0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
  423         0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
  424         0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
  425         0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
  426         0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
  427         0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
  428         0x2d02ef8dL
  429 };
  430 
  431 static __inline u16 RotR1(u16 val)
  432 {
  433         return (val >> 1) | (val << 15);
  434 }
  435 
  436 static __inline u8 Lo8(u16 val)
  437 {
  438         return val & 0xff;
  439 }
  440 
  441 static __inline u8 Hi8(u16 val)
  442 {
  443         return val >> 8;
  444 }
  445 
  446 static __inline u16 Lo16(u32 val)
  447 {
  448         return val & 0xffff;
  449 }
  450 
  451 static __inline u16 Hi16(u32 val)
  452 {
  453         return val >> 16;
  454 }
  455 
  456 static __inline u16 Mk16(u8 hi, u8 lo)
  457 {
  458         return lo | (((u16) hi) << 8);
  459 }
  460 
  461 static __inline u16 Mk16_le(const u16 *v)
  462 {
  463         return le16toh(*v);
  464 }
  465 
  466 static const u16 Sbox[256] = {
  467         0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
  468         0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
  469         0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
  470         0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
  471         0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
  472         0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
  473         0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
  474         0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
  475         0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
  476         0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
  477         0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
  478         0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
  479         0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
  480         0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
  481         0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
  482         0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
  483         0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
  484         0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
  485         0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
  486         0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
  487         0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
  488         0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
  489         0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
  490         0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
  491         0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
  492         0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
  493         0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
  494         0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
  495         0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
  496         0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
  497         0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
  498         0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
  499 };
  500 
  501 static __inline u16 _S_(u16 v)
  502 {
  503         u16 t = Sbox[Hi8(v)];
  504         return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
  505 }
  506 
  507 #define PHASE1_LOOP_COUNT 8
  508 
  509 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
  510 {
  511         int i, j;
  512 
  513         /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
  514         TTAK[0] = Lo16(IV32);
  515         TTAK[1] = Hi16(IV32);
  516         TTAK[2] = Mk16(TA[1], TA[0]);
  517         TTAK[3] = Mk16(TA[3], TA[2]);
  518         TTAK[4] = Mk16(TA[5], TA[4]);
  519 
  520         for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
  521                 j = 2 * (i & 1);
  522                 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
  523                 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
  524                 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
  525                 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
  526                 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
  527         }
  528 }
  529 
  530 #ifndef _BYTE_ORDER
  531 #error "Don't know native byte order"
  532 #endif
  533 
  534 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
  535                                u16 IV16)
  536 {
  537         /* Make temporary area overlap WEP seed so that the final copy can be
  538          * avoided on little endian hosts. */
  539         u16 *PPK = (u16 *) &WEPSeed[4];
  540 
  541         /* Step 1 - make copy of TTAK and bring in TSC */
  542         PPK[0] = TTAK[0];
  543         PPK[1] = TTAK[1];
  544         PPK[2] = TTAK[2];
  545         PPK[3] = TTAK[3];
  546         PPK[4] = TTAK[4];
  547         PPK[5] = TTAK[4] + IV16;
  548 
  549         /* Step 2 - 96-bit bijective mixing using S-box */
  550         PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
  551         PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
  552         PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
  553         PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
  554         PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
  555         PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
  556 
  557         PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
  558         PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
  559         PPK[2] += RotR1(PPK[1]);
  560         PPK[3] += RotR1(PPK[2]);
  561         PPK[4] += RotR1(PPK[3]);
  562         PPK[5] += RotR1(PPK[4]);
  563 
  564         /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
  565          * WEPSeed[0..2] is transmitted as WEP IV */
  566         WEPSeed[0] = Hi8(IV16);
  567         WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
  568         WEPSeed[2] = Lo8(IV16);
  569         WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
  570 
  571 #if _BYTE_ORDER == _BIG_ENDIAN
  572         {
  573                 int i;
  574                 for (i = 0; i < 6; i++)
  575                         PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
  576         }
  577 #endif
  578 }
  579 
  580 static void
  581 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
  582         uint8_t icv[IEEE80211_WEP_CRCLEN])
  583 {
  584         u32 i, j, k, crc;
  585         size_t buflen;
  586         u8 S[256];
  587         u8 *pos;
  588         struct mbuf *m;
  589 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
  590 
  591         /* Setup RC4 state */
  592         for (i = 0; i < 256; i++)
  593                 S[i] = i;
  594         j = 0;
  595         for (i = 0; i < 256; i++) {
  596                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  597                 S_SWAP(i, j);
  598         }
  599 
  600         /* Compute CRC32 over unencrypted data and apply RC4 to data */
  601         crc = ~0;
  602         i = j = 0;
  603         m = m0;
  604         pos = mtod(m, uint8_t *) + off;
  605         buflen = m->m_len - off;
  606         for (;;) {
  607                 if (buflen > data_len)
  608                         buflen = data_len;
  609                 data_len -= buflen;
  610                 for (k = 0; k < buflen; k++) {
  611                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  612                         i = (i + 1) & 0xff;
  613                         j = (j + S[i]) & 0xff;
  614                         S_SWAP(i, j);
  615                         *pos++ ^= S[(S[i] + S[j]) & 0xff];
  616                 }
  617                 m = m->m_next;
  618                 if (m == NULL) {
  619                         KASSERT(data_len == 0,
  620                             ("out of buffers with data_len %zu\n", data_len));
  621                         break;
  622                 }
  623                 pos = mtod(m, uint8_t *);
  624                 buflen = m->m_len;
  625         }
  626         crc = ~crc;
  627 
  628         /* Append little-endian CRC32 and encrypt it to produce ICV */
  629         icv[0] = crc;
  630         icv[1] = crc >> 8;
  631         icv[2] = crc >> 16;
  632         icv[3] = crc >> 24;
  633         for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
  634                 i = (i + 1) & 0xff;
  635                 j = (j + S[i]) & 0xff;
  636                 S_SWAP(i, j);
  637                 icv[k] ^= S[(S[i] + S[j]) & 0xff];
  638         }
  639 }
  640 
  641 static int
  642 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
  643 {
  644         u32 i, j, k, crc;
  645         u8 S[256];
  646         u8 *pos, icv[4];
  647         size_t buflen;
  648 
  649         /* Setup RC4 state */
  650         for (i = 0; i < 256; i++)
  651                 S[i] = i;
  652         j = 0;
  653         for (i = 0; i < 256; i++) {
  654                 j = (j + S[i] + key[i & 0x0f]) & 0xff;
  655                 S_SWAP(i, j);
  656         }
  657 
  658         /* Apply RC4 to data and compute CRC32 over decrypted data */
  659         crc = ~0;
  660         i = j = 0;
  661         pos = mtod(m, uint8_t *) + off;
  662         buflen = m->m_len - off;
  663         for (;;) {
  664                 if (buflen > data_len)
  665                         buflen = data_len;
  666                 data_len -= buflen;
  667                 for (k = 0; k < buflen; k++) {
  668                         i = (i + 1) & 0xff;
  669                         j = (j + S[i]) & 0xff;
  670                         S_SWAP(i, j);
  671                         *pos ^= S[(S[i] + S[j]) & 0xff];
  672                         crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
  673                         pos++;
  674                 }
  675                 m = m->m_next;
  676                 if (m == NULL) {
  677                         KASSERT(data_len == 0,
  678                             ("out of buffers with data_len %zu\n", data_len));
  679                         break;
  680                 }
  681                 pos = mtod(m, uint8_t *);
  682                 buflen = m->m_len;
  683         }
  684         crc = ~crc;
  685 
  686         /* Encrypt little-endian CRC32 and verify that it matches with the
  687          * received ICV */
  688         icv[0] = crc;
  689         icv[1] = crc >> 8;
  690         icv[2] = crc >> 16;
  691         icv[3] = crc >> 24;
  692         for (k = 0; k < 4; k++) {
  693                 i = (i + 1) & 0xff;
  694                 j = (j + S[i]) & 0xff;
  695                 S_SWAP(i, j);
  696                 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
  697                         /* ICV mismatch - drop frame */
  698                         return -1;
  699                 }
  700         }
  701 
  702         return 0;
  703 }
  704 
  705 
  706 static __inline u32 rotl(u32 val, int bits)
  707 {
  708         return (val << bits) | (val >> (32 - bits));
  709 }
  710 
  711 
  712 static __inline u32 rotr(u32 val, int bits)
  713 {
  714         return (val >> bits) | (val << (32 - bits));
  715 }
  716 
  717 
  718 static __inline u32 xswap(u32 val)
  719 {
  720         return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
  721 }
  722 
  723 
  724 #define michael_block(l, r)     \
  725 do {                            \
  726         r ^= rotl(l, 17);       \
  727         l += r;                 \
  728         r ^= xswap(l);          \
  729         l += r;                 \
  730         r ^= rotl(l, 3);        \
  731         l += r;                 \
  732         r ^= rotr(l, 2);        \
  733         l += r;                 \
  734 } while (0)
  735 
  736 
  737 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
  738 {
  739         return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
  740 }
  741 
  742 static __inline u32 get_le32(const u8 *p)
  743 {
  744         return get_le32_split(p[0], p[1], p[2], p[3]);
  745 }
  746 
  747 
  748 static __inline void put_le32(u8 *p, u32 v)
  749 {
  750         p[0] = v;
  751         p[1] = v >> 8;
  752         p[2] = v >> 16;
  753         p[3] = v >> 24;
  754 }
  755 
  756 /*
  757  * Craft pseudo header used to calculate the MIC.
  758  */
  759 static void
  760 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
  761 {
  762         const struct ieee80211_frame_addr4 *wh =
  763                 (const struct ieee80211_frame_addr4 *) wh0;
  764 
  765         switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
  766         case IEEE80211_FC1_DIR_NODS:
  767                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  768                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  769                 break;
  770         case IEEE80211_FC1_DIR_TODS:
  771                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  772                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
  773                 break;
  774         case IEEE80211_FC1_DIR_FROMDS:
  775                 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
  776                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
  777                 break;
  778         case IEEE80211_FC1_DIR_DSTODS:
  779                 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
  780                 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
  781                 break;
  782         }
  783 
  784         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
  785                 const struct ieee80211_qosframe *qwh =
  786                         (const struct ieee80211_qosframe *) wh;
  787                 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
  788         } else
  789                 hdr[12] = 0;
  790         hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
  791 }
  792 
  793 static void
  794 michael_mic(struct tkip_ctx *ctx, const u8 *key,
  795         struct mbuf *m, u_int off, size_t data_len,
  796         u8 mic[IEEE80211_WEP_MICLEN])
  797 {
  798         uint8_t hdr[16];
  799         u32 l, r;
  800         const uint8_t *data;
  801         u_int space;
  802 
  803         michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
  804 
  805         l = get_le32(key);
  806         r = get_le32(key + 4);
  807 
  808         /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
  809         l ^= get_le32(hdr);
  810         michael_block(l, r);
  811         l ^= get_le32(&hdr[4]);
  812         michael_block(l, r);
  813         l ^= get_le32(&hdr[8]);
  814         michael_block(l, r);
  815         l ^= get_le32(&hdr[12]);
  816         michael_block(l, r);
  817 
  818         /* first buffer has special handling */
  819         data = mtod(m, const uint8_t *) + off;
  820         space = m->m_len - off;
  821         for (;;) {
  822                 if (space > data_len)
  823                         space = data_len;
  824                 /* collect 32-bit blocks from current buffer */
  825                 while (space >= sizeof(uint32_t)) {
  826                         l ^= get_le32(data);
  827                         michael_block(l, r);
  828                         data += sizeof(uint32_t), space -= sizeof(uint32_t);
  829                         data_len -= sizeof(uint32_t);
  830                 }
  831                 if (data_len < sizeof(uint32_t))
  832                         break;
  833                 m = m->m_next;
  834                 if (m == NULL) {
  835                         KASSERT(0, ("out of data, data_len %zu\n", data_len));
  836                         break;
  837                 }
  838                 if (space != 0) {
  839                         const uint8_t *data_next;
  840                         /*
  841                          * Block straddles buffers, split references.
  842                          */
  843                         data_next = mtod(m, const uint8_t *);
  844                         KASSERT(m->m_len >= sizeof(uint32_t) - space,
  845                                 ("not enough data in following buffer, "
  846                                 "m_len %u need %zu\n", m->m_len,
  847                                 sizeof(uint32_t) - space));
  848                         switch (space) {
  849                         case 1:
  850                                 l ^= get_le32_split(data[0], data_next[0],
  851                                         data_next[1], data_next[2]);
  852                                 data = data_next + 3;
  853                                 space = m->m_len - 3;
  854                                 break;
  855                         case 2:
  856                                 l ^= get_le32_split(data[0], data[1],
  857                                         data_next[0], data_next[1]);
  858                                 data = data_next + 2;
  859                                 space = m->m_len - 2;
  860                                 break;
  861                         case 3:
  862                                 l ^= get_le32_split(data[0], data[1],
  863                                         data[2], data_next[0]);
  864                                 data = data_next + 1;
  865                                 space = m->m_len - 1;
  866                                 break;
  867                         }
  868                         michael_block(l, r);
  869                         data_len -= sizeof(uint32_t);
  870                 } else {
  871                         /*
  872                          * Setup for next buffer.
  873                          */
  874                         data = mtod(m, const uint8_t *);
  875                         space = m->m_len;
  876                 }
  877         }
  878         /* Last block and padding (0x5a, 4..7 x 0) */
  879         switch (data_len) {
  880         case 0:
  881                 l ^= get_le32_split(0x5a, 0, 0, 0);
  882                 break;
  883         case 1:
  884                 l ^= get_le32_split(data[0], 0x5a, 0, 0);
  885                 break;
  886         case 2:
  887                 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
  888                 break;
  889         case 3:
  890                 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
  891                 break;
  892         }
  893         michael_block(l, r);
  894         /* l ^= 0; */
  895         michael_block(l, r);
  896 
  897         put_le32(mic, l);
  898         put_le32(mic + 4, r);
  899 }
  900 
  901 static int
  902 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
  903         struct mbuf *m, int hdrlen)
  904 {
  905         struct ieee80211_frame *wh;
  906         uint8_t icv[IEEE80211_WEP_CRCLEN];
  907 
  908         ctx->tc_ic->ic_stats.is_crypto_tkip++;
  909 
  910         wh = mtod(m, struct ieee80211_frame *);
  911         if (!ctx->tx_phase1_done) {
  912                 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
  913                                    (u32)(key->wk_keytsc >> 16));
  914                 ctx->tx_phase1_done = 1;
  915         }
  916         tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
  917                 (u16) key->wk_keytsc);
  918 
  919         wep_encrypt(ctx->tx_rc4key,
  920                 m, hdrlen + tkip.ic_header,
  921                 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
  922                 icv);
  923         (void) m_append(m, IEEE80211_WEP_CRCLEN, icv);  /* XXX check return */
  924 
  925         key->wk_keytsc++;
  926         if ((u16)(key->wk_keytsc) == 0)
  927                 ctx->tx_phase1_done = 0;
  928         return 1;
  929 }
  930 
  931 static int
  932 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
  933         struct mbuf *m, int hdrlen)
  934 {
  935         struct ieee80211_frame *wh;
  936         u32 iv32;
  937         u16 iv16;
  938 
  939         ctx->tc_ic->ic_stats.is_crypto_tkip++;
  940 
  941         wh = mtod(m, struct ieee80211_frame *);
  942         /* NB: tkip_decap already verified header and left seq in rx_rsc */
  943         iv16 = (u16) ctx->rx_rsc;
  944         iv32 = (u32) (ctx->rx_rsc >> 16);
  945 
  946         if (iv32 != (u32)(key->wk_keyrsc >> 16) || !ctx->rx_phase1_done) {
  947                 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
  948                         wh->i_addr2, iv32);
  949                 ctx->rx_phase1_done = 1;
  950         }
  951         tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
  952 
  953         /* NB: m is unstripped; deduct headers + ICV to get payload */
  954         if (wep_decrypt(ctx->rx_rc4key,
  955                 m, hdrlen + tkip.ic_header,
  956                 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
  957                 if (iv32 != (u32)(key->wk_keyrsc >> 16)) {
  958                         /* Previously cached Phase1 result was already lost, so
  959                          * it needs to be recalculated for the next packet. */
  960                         ctx->rx_phase1_done = 0;
  961                 }
  962                 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
  963                     "[%s] TKIP ICV mismatch on decrypt\n",
  964                     ether_sprintf(wh->i_addr2));
  965                 ctx->tc_ic->ic_stats.is_rx_tkipicv++;
  966                 return 0;
  967         }
  968         return 1;
  969 }
  970 
  971 /*
  972  * Module glue.
  973  */
  974 IEEE80211_CRYPTO_MODULE(tkip, 1);

Cache object: 7023ccca30e24363535c49832464b27c


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.