1 /*-
2 * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include <sys/cdefs.h>
27 __FBSDID("$FreeBSD: releng/7.4/sys/net80211/ieee80211_crypto_tkip.c 215543 2010-11-19 18:59:35Z bschmidt $");
28
29 /*
30 * IEEE 802.11i TKIP crypto support.
31 *
32 * Part of this module is derived from similar code in the Host
33 * AP driver. The code is used with the consent of the author and
34 * it's license is included below.
35 */
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/malloc.h>
40 #include <sys/kernel.h>
41 #include <sys/module.h>
42 #include <sys/endian.h>
43
44 #include <sys/socket.h>
45
46 #include <net/if.h>
47 #include <net/if_media.h>
48 #include <net/ethernet.h>
49
50 #include <net80211/ieee80211_var.h>
51
52 static void *tkip_attach(struct ieee80211com *, struct ieee80211_key *);
53 static void tkip_detach(struct ieee80211_key *);
54 static int tkip_setkey(struct ieee80211_key *);
55 static int tkip_encap(struct ieee80211_key *, struct mbuf *m, uint8_t keyid);
56 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int);
57 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int);
58 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int);
59
60 static const struct ieee80211_cipher tkip = {
61 .ic_name = "TKIP",
62 .ic_cipher = IEEE80211_CIPHER_TKIP,
63 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
64 IEEE80211_WEP_EXTIVLEN,
65 .ic_trailer = IEEE80211_WEP_CRCLEN,
66 .ic_miclen = IEEE80211_WEP_MICLEN,
67 .ic_attach = tkip_attach,
68 .ic_detach = tkip_detach,
69 .ic_setkey = tkip_setkey,
70 .ic_encap = tkip_encap,
71 .ic_decap = tkip_decap,
72 .ic_enmic = tkip_enmic,
73 .ic_demic = tkip_demic,
74 };
75
76 typedef uint8_t u8;
77 typedef uint16_t u16;
78 typedef uint32_t __u32;
79 typedef uint32_t u32;
80 #define memmove(dst, src, n) ovbcopy(src, dst, n)
81
82 struct tkip_ctx {
83 struct ieee80211com *tc_ic; /* for diagnostics */
84
85 u16 tx_ttak[5];
86 int tx_phase1_done;
87 u8 tx_rc4key[16]; /* XXX for test module; make locals? */
88
89 u16 rx_ttak[5];
90 int rx_phase1_done;
91 u8 rx_rc4key[16]; /* XXX for test module; make locals? */
92 uint64_t rx_rsc; /* held until MIC verified */
93 };
94
95 static void michael_mic(struct tkip_ctx *, const u8 *key,
96 struct mbuf *m, u_int off, size_t data_len,
97 u8 mic[IEEE80211_WEP_MICLEN]);
98 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *,
99 struct mbuf *, int hdr_len);
100 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *,
101 struct mbuf *, int hdr_len);
102
103 /* number of references from net80211 layer */
104 static int nrefs = 0;
105
106 static void *
107 tkip_attach(struct ieee80211com *ic, struct ieee80211_key *k)
108 {
109 struct tkip_ctx *ctx;
110
111 MALLOC(ctx, struct tkip_ctx *, sizeof(struct tkip_ctx),
112 M_DEVBUF, M_NOWAIT | M_ZERO);
113 if (ctx == NULL) {
114 ic->ic_stats.is_crypto_nomem++;
115 return NULL;
116 }
117
118 ctx->tc_ic = ic;
119 nrefs++; /* NB: we assume caller locking */
120 return ctx;
121 }
122
123 static void
124 tkip_detach(struct ieee80211_key *k)
125 {
126 struct tkip_ctx *ctx = k->wk_private;
127
128 FREE(ctx, M_DEVBUF);
129 KASSERT(nrefs > 0, ("imbalanced attach/detach"));
130 nrefs--; /* NB: we assume caller locking */
131 }
132
133 static int
134 tkip_setkey(struct ieee80211_key *k)
135 {
136 struct tkip_ctx *ctx = k->wk_private;
137
138 if (k->wk_keylen != (128/NBBY)) {
139 (void) ctx; /* XXX */
140 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
141 "%s: Invalid key length %u, expecting %u\n",
142 __func__, k->wk_keylen, 128/NBBY);
143 return 0;
144 }
145 k->wk_keytsc = 1; /* TSC starts at 1 */
146 ctx->rx_phase1_done = 0;
147 return 1;
148 }
149
150 /*
151 * Add privacy headers and do any s/w encryption required.
152 */
153 static int
154 tkip_encap(struct ieee80211_key *k, struct mbuf *m, uint8_t keyid)
155 {
156 struct tkip_ctx *ctx = k->wk_private;
157 struct ieee80211com *ic = ctx->tc_ic;
158 uint8_t *ivp;
159 int hdrlen;
160
161 /*
162 * Handle TKIP counter measures requirement.
163 */
164 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
165 #ifdef IEEE80211_DEBUG
166 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
167 #endif
168
169 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
170 "[%s] Discard frame due to countermeasures (%s)\n",
171 ether_sprintf(wh->i_addr2), __func__);
172 ic->ic_stats.is_crypto_tkipcm++;
173 return 0;
174 }
175 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *));
176
177 /*
178 * Copy down 802.11 header and add the IV, KeyID, and ExtIV.
179 */
180 M_PREPEND(m, tkip.ic_header, M_NOWAIT);
181 if (m == NULL)
182 return 0;
183 ivp = mtod(m, uint8_t *);
184 memmove(ivp, ivp + tkip.ic_header, hdrlen);
185 ivp += hdrlen;
186
187 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */
188 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */
189 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */
190 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */
191 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */
192 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */
193 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */
194 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */
195
196 /*
197 * Finally, do software encrypt if neeed.
198 */
199 if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
200 if (!tkip_encrypt(ctx, k, m, hdrlen))
201 return 0;
202 /* NB: tkip_encrypt handles wk_keytsc */
203 } else
204 k->wk_keytsc++;
205
206 return 1;
207 }
208
209 /*
210 * Add MIC to the frame as needed.
211 */
212 static int
213 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force)
214 {
215 struct tkip_ctx *ctx = k->wk_private;
216
217 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
218 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
219 struct ieee80211com *ic = ctx->tc_ic;
220 int hdrlen;
221 uint8_t mic[IEEE80211_WEP_MICLEN];
222
223 ic->ic_stats.is_crypto_tkipenmic++;
224
225 hdrlen = ieee80211_hdrspace(ic, wh);
226
227 michael_mic(ctx, k->wk_txmic,
228 m, hdrlen, m->m_pkthdr.len - hdrlen, mic);
229 return m_append(m, tkip.ic_miclen, mic);
230 }
231 return 1;
232 }
233
234 static __inline uint64_t
235 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5)
236 {
237 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24);
238 uint16_t iv16 = (b4 << 0) | (b5 << 8);
239 return (((uint64_t)iv16) << 32) | iv32;
240 }
241
242 /*
243 * Validate and strip privacy headers (and trailer) for a
244 * received frame. If necessary, decrypt the frame using
245 * the specified key.
246 */
247 static int
248 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen)
249 {
250 struct tkip_ctx *ctx = k->wk_private;
251 struct ieee80211com *ic = ctx->tc_ic;
252 struct ieee80211_frame *wh;
253 uint8_t *ivp;
254
255 /*
256 * Header should have extended IV and sequence number;
257 * verify the former and validate the latter.
258 */
259 wh = mtod(m, struct ieee80211_frame *);
260 ivp = mtod(m, uint8_t *) + hdrlen;
261 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) {
262 /*
263 * No extended IV; discard frame.
264 */
265 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
266 "[%s] missing ExtIV for TKIP cipher\n",
267 ether_sprintf(wh->i_addr2));
268 ctx->tc_ic->ic_stats.is_rx_tkipformat++;
269 return 0;
270 }
271 /*
272 * Handle TKIP counter measures requirement.
273 */
274 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
275 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO,
276 "[%s] discard frame due to countermeasures (%s)\n",
277 ether_sprintf(wh->i_addr2), __func__);
278 ic->ic_stats.is_crypto_tkipcm++;
279 return 0;
280 }
281
282 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]);
283 if (ctx->rx_rsc <= k->wk_keyrsc) {
284 /*
285 * Replay violation; notify upper layer.
286 */
287 ieee80211_notify_replay_failure(ctx->tc_ic, wh, k, ctx->rx_rsc);
288 ctx->tc_ic->ic_stats.is_rx_tkipreplay++;
289 return 0;
290 }
291 /*
292 * NB: We can't update the rsc in the key until MIC is verified.
293 *
294 * We assume we are not preempted between doing the check above
295 * and updating wk_keyrsc when stripping the MIC in tkip_demic.
296 * Otherwise we might process another packet and discard it as
297 * a replay.
298 */
299
300 /*
301 * Check if the device handled the decrypt in hardware.
302 * If so we just strip the header; otherwise we need to
303 * handle the decrypt in software.
304 */
305 if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) &&
306 !tkip_decrypt(ctx, k, m, hdrlen))
307 return 0;
308
309 /*
310 * Copy up 802.11 header and strip crypto bits.
311 */
312 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen);
313 m_adj(m, tkip.ic_header);
314 m_adj(m, -tkip.ic_trailer);
315
316 return 1;
317 }
318
319 /*
320 * Verify and strip MIC from the frame.
321 */
322 static int
323 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force)
324 {
325 struct tkip_ctx *ctx = k->wk_private;
326
327 if (force || (k->wk_flags & IEEE80211_KEY_SWMIC)) {
328 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
329 struct ieee80211com *ic = ctx->tc_ic;
330 int hdrlen = ieee80211_hdrspace(ic, wh);
331 u8 mic[IEEE80211_WEP_MICLEN];
332 u8 mic0[IEEE80211_WEP_MICLEN];
333
334 ic->ic_stats.is_crypto_tkipdemic++;
335
336 michael_mic(ctx, k->wk_rxmic,
337 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen),
338 mic);
339 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen,
340 tkip.ic_miclen, mic0);
341 if (memcmp(mic, mic0, tkip.ic_miclen)) {
342 /* NB: 802.11 layer handles statistic and debug msg */
343 ieee80211_notify_michael_failure(ic, wh,
344 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ?
345 k->wk_rxkeyix : k->wk_keyix);
346 return 0;
347 }
348 }
349 /*
350 * Strip MIC from the tail.
351 */
352 m_adj(m, -tkip.ic_miclen);
353
354 /*
355 * Ok to update rsc now that MIC has been verified.
356 */
357 k->wk_keyrsc = ctx->rx_rsc;
358
359 return 1;
360 }
361
362 /*
363 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver
364 *
365 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi>
366 *
367 * This program is free software; you can redistribute it and/or modify
368 * it under the terms of the GNU General Public License version 2 as
369 * published by the Free Software Foundation. See README and COPYING for
370 * more details.
371 *
372 * Alternatively, this software may be distributed under the terms of BSD
373 * license.
374 */
375
376 static const __u32 crc32_table[256] = {
377 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L,
378 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L,
379 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L,
380 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL,
381 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L,
382 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L,
383 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L,
384 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL,
385 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L,
386 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL,
387 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L,
388 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L,
389 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L,
390 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL,
391 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL,
392 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L,
393 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL,
394 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L,
395 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L,
396 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L,
397 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL,
398 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L,
399 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L,
400 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL,
401 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L,
402 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L,
403 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L,
404 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L,
405 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L,
406 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL,
407 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL,
408 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L,
409 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L,
410 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL,
411 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL,
412 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L,
413 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL,
414 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L,
415 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL,
416 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L,
417 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL,
418 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L,
419 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L,
420 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL,
421 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L,
422 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L,
423 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L,
424 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L,
425 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L,
426 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L,
427 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL,
428 0x2d02ef8dL
429 };
430
431 static __inline u16 RotR1(u16 val)
432 {
433 return (val >> 1) | (val << 15);
434 }
435
436 static __inline u8 Lo8(u16 val)
437 {
438 return val & 0xff;
439 }
440
441 static __inline u8 Hi8(u16 val)
442 {
443 return val >> 8;
444 }
445
446 static __inline u16 Lo16(u32 val)
447 {
448 return val & 0xffff;
449 }
450
451 static __inline u16 Hi16(u32 val)
452 {
453 return val >> 16;
454 }
455
456 static __inline u16 Mk16(u8 hi, u8 lo)
457 {
458 return lo | (((u16) hi) << 8);
459 }
460
461 static __inline u16 Mk16_le(const u16 *v)
462 {
463 return le16toh(*v);
464 }
465
466 static const u16 Sbox[256] = {
467 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154,
468 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A,
469 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B,
470 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B,
471 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F,
472 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F,
473 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5,
474 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F,
475 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB,
476 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397,
477 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED,
478 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A,
479 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194,
480 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3,
481 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104,
482 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D,
483 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39,
484 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695,
485 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83,
486 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76,
487 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4,
488 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B,
489 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0,
490 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018,
491 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751,
492 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85,
493 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12,
494 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9,
495 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7,
496 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A,
497 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8,
498 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A,
499 };
500
501 static __inline u16 _S_(u16 v)
502 {
503 u16 t = Sbox[Hi8(v)];
504 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8));
505 }
506
507 #define PHASE1_LOOP_COUNT 8
508
509 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32)
510 {
511 int i, j;
512
513 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */
514 TTAK[0] = Lo16(IV32);
515 TTAK[1] = Hi16(IV32);
516 TTAK[2] = Mk16(TA[1], TA[0]);
517 TTAK[3] = Mk16(TA[3], TA[2]);
518 TTAK[4] = Mk16(TA[5], TA[4]);
519
520 for (i = 0; i < PHASE1_LOOP_COUNT; i++) {
521 j = 2 * (i & 1);
522 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j]));
523 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j]));
524 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j]));
525 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j]));
526 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i;
527 }
528 }
529
530 #ifndef _BYTE_ORDER
531 #error "Don't know native byte order"
532 #endif
533
534 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK,
535 u16 IV16)
536 {
537 /* Make temporary area overlap WEP seed so that the final copy can be
538 * avoided on little endian hosts. */
539 u16 *PPK = (u16 *) &WEPSeed[4];
540
541 /* Step 1 - make copy of TTAK and bring in TSC */
542 PPK[0] = TTAK[0];
543 PPK[1] = TTAK[1];
544 PPK[2] = TTAK[2];
545 PPK[3] = TTAK[3];
546 PPK[4] = TTAK[4];
547 PPK[5] = TTAK[4] + IV16;
548
549 /* Step 2 - 96-bit bijective mixing using S-box */
550 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0]));
551 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2]));
552 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4]));
553 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6]));
554 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8]));
555 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10]));
556
557 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12]));
558 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14]));
559 PPK[2] += RotR1(PPK[1]);
560 PPK[3] += RotR1(PPK[2]);
561 PPK[4] += RotR1(PPK[3]);
562 PPK[5] += RotR1(PPK[4]);
563
564 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value
565 * WEPSeed[0..2] is transmitted as WEP IV */
566 WEPSeed[0] = Hi8(IV16);
567 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F;
568 WEPSeed[2] = Lo8(IV16);
569 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1);
570
571 #if _BYTE_ORDER == _BIG_ENDIAN
572 {
573 int i;
574 for (i = 0; i < 6; i++)
575 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8);
576 }
577 #endif
578 }
579
580 static void
581 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len,
582 uint8_t icv[IEEE80211_WEP_CRCLEN])
583 {
584 u32 i, j, k, crc;
585 size_t buflen;
586 u8 S[256];
587 u8 *pos;
588 struct mbuf *m;
589 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
590
591 /* Setup RC4 state */
592 for (i = 0; i < 256; i++)
593 S[i] = i;
594 j = 0;
595 for (i = 0; i < 256; i++) {
596 j = (j + S[i] + key[i & 0x0f]) & 0xff;
597 S_SWAP(i, j);
598 }
599
600 /* Compute CRC32 over unencrypted data and apply RC4 to data */
601 crc = ~0;
602 i = j = 0;
603 m = m0;
604 pos = mtod(m, uint8_t *) + off;
605 buflen = m->m_len - off;
606 for (;;) {
607 if (buflen > data_len)
608 buflen = data_len;
609 data_len -= buflen;
610 for (k = 0; k < buflen; k++) {
611 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
612 i = (i + 1) & 0xff;
613 j = (j + S[i]) & 0xff;
614 S_SWAP(i, j);
615 *pos++ ^= S[(S[i] + S[j]) & 0xff];
616 }
617 m = m->m_next;
618 if (m == NULL) {
619 KASSERT(data_len == 0,
620 ("out of buffers with data_len %zu\n", data_len));
621 break;
622 }
623 pos = mtod(m, uint8_t *);
624 buflen = m->m_len;
625 }
626 crc = ~crc;
627
628 /* Append little-endian CRC32 and encrypt it to produce ICV */
629 icv[0] = crc;
630 icv[1] = crc >> 8;
631 icv[2] = crc >> 16;
632 icv[3] = crc >> 24;
633 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) {
634 i = (i + 1) & 0xff;
635 j = (j + S[i]) & 0xff;
636 S_SWAP(i, j);
637 icv[k] ^= S[(S[i] + S[j]) & 0xff];
638 }
639 }
640
641 static int
642 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len)
643 {
644 u32 i, j, k, crc;
645 u8 S[256];
646 u8 *pos, icv[4];
647 size_t buflen;
648
649 /* Setup RC4 state */
650 for (i = 0; i < 256; i++)
651 S[i] = i;
652 j = 0;
653 for (i = 0; i < 256; i++) {
654 j = (j + S[i] + key[i & 0x0f]) & 0xff;
655 S_SWAP(i, j);
656 }
657
658 /* Apply RC4 to data and compute CRC32 over decrypted data */
659 crc = ~0;
660 i = j = 0;
661 pos = mtod(m, uint8_t *) + off;
662 buflen = m->m_len - off;
663 for (;;) {
664 if (buflen > data_len)
665 buflen = data_len;
666 data_len -= buflen;
667 for (k = 0; k < buflen; k++) {
668 i = (i + 1) & 0xff;
669 j = (j + S[i]) & 0xff;
670 S_SWAP(i, j);
671 *pos ^= S[(S[i] + S[j]) & 0xff];
672 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8);
673 pos++;
674 }
675 m = m->m_next;
676 if (m == NULL) {
677 KASSERT(data_len == 0,
678 ("out of buffers with data_len %zu\n", data_len));
679 break;
680 }
681 pos = mtod(m, uint8_t *);
682 buflen = m->m_len;
683 }
684 crc = ~crc;
685
686 /* Encrypt little-endian CRC32 and verify that it matches with the
687 * received ICV */
688 icv[0] = crc;
689 icv[1] = crc >> 8;
690 icv[2] = crc >> 16;
691 icv[3] = crc >> 24;
692 for (k = 0; k < 4; k++) {
693 i = (i + 1) & 0xff;
694 j = (j + S[i]) & 0xff;
695 S_SWAP(i, j);
696 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) {
697 /* ICV mismatch - drop frame */
698 return -1;
699 }
700 }
701
702 return 0;
703 }
704
705
706 static __inline u32 rotl(u32 val, int bits)
707 {
708 return (val << bits) | (val >> (32 - bits));
709 }
710
711
712 static __inline u32 rotr(u32 val, int bits)
713 {
714 return (val >> bits) | (val << (32 - bits));
715 }
716
717
718 static __inline u32 xswap(u32 val)
719 {
720 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8);
721 }
722
723
724 #define michael_block(l, r) \
725 do { \
726 r ^= rotl(l, 17); \
727 l += r; \
728 r ^= xswap(l); \
729 l += r; \
730 r ^= rotl(l, 3); \
731 l += r; \
732 r ^= rotr(l, 2); \
733 l += r; \
734 } while (0)
735
736
737 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3)
738 {
739 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24);
740 }
741
742 static __inline u32 get_le32(const u8 *p)
743 {
744 return get_le32_split(p[0], p[1], p[2], p[3]);
745 }
746
747
748 static __inline void put_le32(u8 *p, u32 v)
749 {
750 p[0] = v;
751 p[1] = v >> 8;
752 p[2] = v >> 16;
753 p[3] = v >> 24;
754 }
755
756 /*
757 * Craft pseudo header used to calculate the MIC.
758 */
759 static void
760 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16])
761 {
762 const struct ieee80211_frame_addr4 *wh =
763 (const struct ieee80211_frame_addr4 *) wh0;
764
765 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
766 case IEEE80211_FC1_DIR_NODS:
767 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
768 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
769 break;
770 case IEEE80211_FC1_DIR_TODS:
771 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
772 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2);
773 break;
774 case IEEE80211_FC1_DIR_FROMDS:
775 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */
776 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3);
777 break;
778 case IEEE80211_FC1_DIR_DSTODS:
779 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */
780 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4);
781 break;
782 }
783
784 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
785 const struct ieee80211_qosframe *qwh =
786 (const struct ieee80211_qosframe *) wh;
787 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID;
788 } else
789 hdr[12] = 0;
790 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */
791 }
792
793 static void
794 michael_mic(struct tkip_ctx *ctx, const u8 *key,
795 struct mbuf *m, u_int off, size_t data_len,
796 u8 mic[IEEE80211_WEP_MICLEN])
797 {
798 uint8_t hdr[16];
799 u32 l, r;
800 const uint8_t *data;
801 u_int space;
802
803 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr);
804
805 l = get_le32(key);
806 r = get_le32(key + 4);
807
808 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */
809 l ^= get_le32(hdr);
810 michael_block(l, r);
811 l ^= get_le32(&hdr[4]);
812 michael_block(l, r);
813 l ^= get_le32(&hdr[8]);
814 michael_block(l, r);
815 l ^= get_le32(&hdr[12]);
816 michael_block(l, r);
817
818 /* first buffer has special handling */
819 data = mtod(m, const uint8_t *) + off;
820 space = m->m_len - off;
821 for (;;) {
822 if (space > data_len)
823 space = data_len;
824 /* collect 32-bit blocks from current buffer */
825 while (space >= sizeof(uint32_t)) {
826 l ^= get_le32(data);
827 michael_block(l, r);
828 data += sizeof(uint32_t), space -= sizeof(uint32_t);
829 data_len -= sizeof(uint32_t);
830 }
831 if (data_len < sizeof(uint32_t))
832 break;
833 m = m->m_next;
834 if (m == NULL) {
835 KASSERT(0, ("out of data, data_len %zu\n", data_len));
836 break;
837 }
838 if (space != 0) {
839 const uint8_t *data_next;
840 /*
841 * Block straddles buffers, split references.
842 */
843 data_next = mtod(m, const uint8_t *);
844 KASSERT(m->m_len >= sizeof(uint32_t) - space,
845 ("not enough data in following buffer, "
846 "m_len %u need %zu\n", m->m_len,
847 sizeof(uint32_t) - space));
848 switch (space) {
849 case 1:
850 l ^= get_le32_split(data[0], data_next[0],
851 data_next[1], data_next[2]);
852 data = data_next + 3;
853 space = m->m_len - 3;
854 break;
855 case 2:
856 l ^= get_le32_split(data[0], data[1],
857 data_next[0], data_next[1]);
858 data = data_next + 2;
859 space = m->m_len - 2;
860 break;
861 case 3:
862 l ^= get_le32_split(data[0], data[1],
863 data[2], data_next[0]);
864 data = data_next + 1;
865 space = m->m_len - 1;
866 break;
867 }
868 michael_block(l, r);
869 data_len -= sizeof(uint32_t);
870 } else {
871 /*
872 * Setup for next buffer.
873 */
874 data = mtod(m, const uint8_t *);
875 space = m->m_len;
876 }
877 }
878 /* Last block and padding (0x5a, 4..7 x 0) */
879 switch (data_len) {
880 case 0:
881 l ^= get_le32_split(0x5a, 0, 0, 0);
882 break;
883 case 1:
884 l ^= get_le32_split(data[0], 0x5a, 0, 0);
885 break;
886 case 2:
887 l ^= get_le32_split(data[0], data[1], 0x5a, 0);
888 break;
889 case 3:
890 l ^= get_le32_split(data[0], data[1], data[2], 0x5a);
891 break;
892 }
893 michael_block(l, r);
894 /* l ^= 0; */
895 michael_block(l, r);
896
897 put_le32(mic, l);
898 put_le32(mic + 4, r);
899 }
900
901 static int
902 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
903 struct mbuf *m, int hdrlen)
904 {
905 struct ieee80211_frame *wh;
906 uint8_t icv[IEEE80211_WEP_CRCLEN];
907
908 ctx->tc_ic->ic_stats.is_crypto_tkip++;
909
910 wh = mtod(m, struct ieee80211_frame *);
911 if (!ctx->tx_phase1_done) {
912 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2,
913 (u32)(key->wk_keytsc >> 16));
914 ctx->tx_phase1_done = 1;
915 }
916 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak,
917 (u16) key->wk_keytsc);
918
919 wep_encrypt(ctx->tx_rc4key,
920 m, hdrlen + tkip.ic_header,
921 m->m_pkthdr.len - (hdrlen + tkip.ic_header),
922 icv);
923 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */
924
925 key->wk_keytsc++;
926 if ((u16)(key->wk_keytsc) == 0)
927 ctx->tx_phase1_done = 0;
928 return 1;
929 }
930
931 static int
932 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key,
933 struct mbuf *m, int hdrlen)
934 {
935 struct ieee80211_frame *wh;
936 u32 iv32;
937 u16 iv16;
938
939 ctx->tc_ic->ic_stats.is_crypto_tkip++;
940
941 wh = mtod(m, struct ieee80211_frame *);
942 /* NB: tkip_decap already verified header and left seq in rx_rsc */
943 iv16 = (u16) ctx->rx_rsc;
944 iv32 = (u32) (ctx->rx_rsc >> 16);
945
946 if (iv32 != (u32)(key->wk_keyrsc >> 16) || !ctx->rx_phase1_done) {
947 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key,
948 wh->i_addr2, iv32);
949 ctx->rx_phase1_done = 1;
950 }
951 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16);
952
953 /* NB: m is unstripped; deduct headers + ICV to get payload */
954 if (wep_decrypt(ctx->rx_rc4key,
955 m, hdrlen + tkip.ic_header,
956 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) {
957 if (iv32 != (u32)(key->wk_keyrsc >> 16)) {
958 /* Previously cached Phase1 result was already lost, so
959 * it needs to be recalculated for the next packet. */
960 ctx->rx_phase1_done = 0;
961 }
962 IEEE80211_DPRINTF(ctx->tc_ic, IEEE80211_MSG_CRYPTO,
963 "[%s] TKIP ICV mismatch on decrypt\n",
964 ether_sprintf(wh->i_addr2));
965 ctx->tc_ic->ic_stats.is_rx_tkipicv++;
966 return 0;
967 }
968 return 1;
969 }
970
971 /*
972 * Module glue.
973 */
974 IEEE80211_CRYPTO_MODULE(tkip, 1);
Cache object: 7023ccca30e24363535c49832464b27c
|