Loading...
1/*
2 * Copyright 2002-2004, Instant802 Networks, Inc.
3 * Copyright 2008, Jouni Malinen <j@w1.fi>
4 * Copyright (C) 2016 Intel Deutschland GmbH
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11#include <linux/netdevice.h>
12#include <linux/types.h>
13#include <linux/skbuff.h>
14#include <linux/compiler.h>
15#include <linux/ieee80211.h>
16#include <linux/gfp.h>
17#include <asm/unaligned.h>
18#include <net/mac80211.h>
19#include <crypto/aes.h>
20
21#include "ieee80211_i.h"
22#include "michael.h"
23#include "tkip.h"
24#include "aes_ccm.h"
25#include "aes_cmac.h"
26#include "aes_gmac.h"
27#include "aes_gcm.h"
28#include "wpa.h"
29
30ieee80211_tx_result
31ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
32{
33 u8 *data, *key, *mic;
34 size_t data_len;
35 unsigned int hdrlen;
36 struct ieee80211_hdr *hdr;
37 struct sk_buff *skb = tx->skb;
38 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
39 int tail;
40
41 hdr = (struct ieee80211_hdr *)skb->data;
42 if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
43 skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
44 return TX_CONTINUE;
45
46 hdrlen = ieee80211_hdrlen(hdr->frame_control);
47 if (skb->len < hdrlen)
48 return TX_DROP;
49
50 data = skb->data + hdrlen;
51 data_len = skb->len - hdrlen;
52
53 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
54 /* Need to use software crypto for the test */
55 info->control.hw_key = NULL;
56 }
57
58 if (info->control.hw_key &&
59 (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
60 ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
61 !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC)) {
62 /* hwaccel - with no need for SW-generated MMIC */
63 return TX_CONTINUE;
64 }
65
66 tail = MICHAEL_MIC_LEN;
67 if (!info->control.hw_key)
68 tail += IEEE80211_TKIP_ICV_LEN;
69
70 if (WARN(skb_tailroom(skb) < tail ||
71 skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
72 "mmic: not enough head/tail (%d/%d,%d/%d)\n",
73 skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
74 skb_tailroom(skb), tail))
75 return TX_DROP;
76
77 key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
78 mic = skb_put(skb, MICHAEL_MIC_LEN);
79 michael_mic(key, hdr, data, data_len, mic);
80 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
81 mic[0]++;
82
83 return TX_CONTINUE;
84}
85
86
87ieee80211_rx_result
88ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
89{
90 u8 *data, *key = NULL;
91 size_t data_len;
92 unsigned int hdrlen;
93 u8 mic[MICHAEL_MIC_LEN];
94 struct sk_buff *skb = rx->skb;
95 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
96 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
97
98 /*
99 * it makes no sense to check for MIC errors on anything other
100 * than data frames.
101 */
102 if (!ieee80211_is_data_present(hdr->frame_control))
103 return RX_CONTINUE;
104
105 /*
106 * No way to verify the MIC if the hardware stripped it or
107 * the IV with the key index. In this case we have solely rely
108 * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
109 * MIC failure report.
110 */
111 if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
112 if (status->flag & RX_FLAG_MMIC_ERROR)
113 goto mic_fail_no_key;
114
115 if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
116 rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
117 goto update_iv;
118
119 return RX_CONTINUE;
120 }
121
122 /*
123 * Some hardware seems to generate Michael MIC failure reports; even
124 * though, the frame was not encrypted with TKIP and therefore has no
125 * MIC. Ignore the flag them to avoid triggering countermeasures.
126 */
127 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
128 !(status->flag & RX_FLAG_DECRYPTED))
129 return RX_CONTINUE;
130
131 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
132 /*
133 * APs with pairwise keys should never receive Michael MIC
134 * errors for non-zero keyidx because these are reserved for
135 * group keys and only the AP is sending real multicast
136 * frames in the BSS.
137 */
138 return RX_DROP_UNUSABLE;
139 }
140
141 if (status->flag & RX_FLAG_MMIC_ERROR)
142 goto mic_fail;
143
144 hdrlen = ieee80211_hdrlen(hdr->frame_control);
145 if (skb->len < hdrlen + MICHAEL_MIC_LEN)
146 return RX_DROP_UNUSABLE;
147
148 if (skb_linearize(rx->skb))
149 return RX_DROP_UNUSABLE;
150 hdr = (void *)skb->data;
151
152 data = skb->data + hdrlen;
153 data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
154 key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
155 michael_mic(key, hdr, data, data_len, mic);
156 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
157 goto mic_fail;
158
159 /* remove Michael MIC from payload */
160 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
161
162update_iv:
163 /* update IV in key information to be able to detect replays */
164 rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
165 rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
166
167 return RX_CONTINUE;
168
169mic_fail:
170 rx->key->u.tkip.mic_failures++;
171
172mic_fail_no_key:
173 /*
174 * In some cases the key can be unset - e.g. a multicast packet, in
175 * a driver that supports HW encryption. Send up the key idx only if
176 * the key is set.
177 */
178 cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
179 is_multicast_ether_addr(hdr->addr1) ?
180 NL80211_KEYTYPE_GROUP :
181 NL80211_KEYTYPE_PAIRWISE,
182 rx->key ? rx->key->conf.keyidx : -1,
183 NULL, GFP_ATOMIC);
184 return RX_DROP_UNUSABLE;
185}
186
187static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
188{
189 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
190 struct ieee80211_key *key = tx->key;
191 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
192 unsigned int hdrlen;
193 int len, tail;
194 u64 pn;
195 u8 *pos;
196
197 if (info->control.hw_key &&
198 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
199 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
200 /* hwaccel - with no need for software-generated IV */
201 return 0;
202 }
203
204 hdrlen = ieee80211_hdrlen(hdr->frame_control);
205 len = skb->len - hdrlen;
206
207 if (info->control.hw_key)
208 tail = 0;
209 else
210 tail = IEEE80211_TKIP_ICV_LEN;
211
212 if (WARN_ON(skb_tailroom(skb) < tail ||
213 skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
214 return -1;
215
216 pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
217 memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
218 pos += hdrlen;
219
220 /* the HW only needs room for the IV, but not the actual IV */
221 if (info->control.hw_key &&
222 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
223 return 0;
224
225 /* Increase IV for the frame */
226 pn = atomic64_inc_return(&key->conf.tx_pn);
227 pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
228
229 /* hwaccel - with software IV */
230 if (info->control.hw_key)
231 return 0;
232
233 /* Add room for ICV */
234 skb_put(skb, IEEE80211_TKIP_ICV_LEN);
235
236 return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
237 key, skb, pos, len);
238}
239
240
241ieee80211_tx_result
242ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
243{
244 struct sk_buff *skb;
245
246 ieee80211_tx_set_protected(tx);
247
248 skb_queue_walk(&tx->skbs, skb) {
249 if (tkip_encrypt_skb(tx, skb) < 0)
250 return TX_DROP;
251 }
252
253 return TX_CONTINUE;
254}
255
256
257ieee80211_rx_result
258ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
259{
260 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
261 int hdrlen, res, hwaccel = 0;
262 struct ieee80211_key *key = rx->key;
263 struct sk_buff *skb = rx->skb;
264 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
265
266 hdrlen = ieee80211_hdrlen(hdr->frame_control);
267
268 if (!ieee80211_is_data(hdr->frame_control))
269 return RX_CONTINUE;
270
271 if (!rx->sta || skb->len - hdrlen < 12)
272 return RX_DROP_UNUSABLE;
273
274 /* it may be possible to optimize this a bit more */
275 if (skb_linearize(rx->skb))
276 return RX_DROP_UNUSABLE;
277 hdr = (void *)skb->data;
278
279 /*
280 * Let TKIP code verify IV, but skip decryption.
281 * In the case where hardware checks the IV as well,
282 * we don't even get here, see ieee80211_rx_h_decrypt()
283 */
284 if (status->flag & RX_FLAG_DECRYPTED)
285 hwaccel = 1;
286
287 res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
288 key, skb->data + hdrlen,
289 skb->len - hdrlen, rx->sta->sta.addr,
290 hdr->addr1, hwaccel, rx->security_idx,
291 &rx->tkip_iv32,
292 &rx->tkip_iv16);
293 if (res != TKIP_DECRYPT_OK)
294 return RX_DROP_UNUSABLE;
295
296 /* Trim ICV */
297 skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
298
299 /* Remove IV */
300 memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
301 skb_pull(skb, IEEE80211_TKIP_IV_LEN);
302
303 return RX_CONTINUE;
304}
305
306
307static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
308{
309 __le16 mask_fc;
310 int a4_included, mgmt;
311 u8 qos_tid;
312 u16 len_a;
313 unsigned int hdrlen;
314 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
315
316 /*
317 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
318 * Retry, PwrMgt, MoreData; set Protected
319 */
320 mgmt = ieee80211_is_mgmt(hdr->frame_control);
321 mask_fc = hdr->frame_control;
322 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
323 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
324 if (!mgmt)
325 mask_fc &= ~cpu_to_le16(0x0070);
326 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
327
328 hdrlen = ieee80211_hdrlen(hdr->frame_control);
329 len_a = hdrlen - 2;
330 a4_included = ieee80211_has_a4(hdr->frame_control);
331
332 if (ieee80211_is_data_qos(hdr->frame_control))
333 qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
334 else
335 qos_tid = 0;
336
337 /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
338 * mode authentication are not allowed to collide, yet both are derived
339 * from this vector b_0. We only set L := 1 here to indicate that the
340 * data size can be represented in (L+1) bytes. The CCM layer will take
341 * care of storing the data length in the top (L+1) bytes and setting
342 * and clearing the other bits as is required to derive the two IVs.
343 */
344 b_0[0] = 0x1;
345
346 /* Nonce: Nonce Flags | A2 | PN
347 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
348 */
349 b_0[1] = qos_tid | (mgmt << 4);
350 memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
351 memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
352
353 /* AAD (extra authenticate-only data) / masked 802.11 header
354 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
355 put_unaligned_be16(len_a, &aad[0]);
356 put_unaligned(mask_fc, (__le16 *)&aad[2]);
357 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
358
359 /* Mask Seq#, leave Frag# */
360 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
361 aad[23] = 0;
362
363 if (a4_included) {
364 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
365 aad[30] = qos_tid;
366 aad[31] = 0;
367 } else {
368 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
369 aad[24] = qos_tid;
370 }
371}
372
373
374static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
375{
376 hdr[0] = pn[5];
377 hdr[1] = pn[4];
378 hdr[2] = 0;
379 hdr[3] = 0x20 | (key_id << 6);
380 hdr[4] = pn[3];
381 hdr[5] = pn[2];
382 hdr[6] = pn[1];
383 hdr[7] = pn[0];
384}
385
386
387static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
388{
389 pn[0] = hdr[7];
390 pn[1] = hdr[6];
391 pn[2] = hdr[5];
392 pn[3] = hdr[4];
393 pn[4] = hdr[1];
394 pn[5] = hdr[0];
395}
396
397
398static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
399 unsigned int mic_len)
400{
401 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
402 struct ieee80211_key *key = tx->key;
403 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
404 int hdrlen, len, tail;
405 u8 *pos;
406 u8 pn[6];
407 u64 pn64;
408 u8 aad[CCM_AAD_LEN];
409 u8 b_0[AES_BLOCK_SIZE];
410
411 if (info->control.hw_key &&
412 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
413 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
414 !((info->control.hw_key->flags &
415 IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
416 ieee80211_is_mgmt(hdr->frame_control))) {
417 /*
418 * hwaccel has no need for preallocated room for CCMP
419 * header or MIC fields
420 */
421 return 0;
422 }
423
424 hdrlen = ieee80211_hdrlen(hdr->frame_control);
425 len = skb->len - hdrlen;
426
427 if (info->control.hw_key)
428 tail = 0;
429 else
430 tail = mic_len;
431
432 if (WARN_ON(skb_tailroom(skb) < tail ||
433 skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
434 return -1;
435
436 pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
437 memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
438
439 /* the HW only needs room for the IV, but not the actual IV */
440 if (info->control.hw_key &&
441 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
442 return 0;
443
444 hdr = (struct ieee80211_hdr *) pos;
445 pos += hdrlen;
446
447 pn64 = atomic64_inc_return(&key->conf.tx_pn);
448
449 pn[5] = pn64;
450 pn[4] = pn64 >> 8;
451 pn[3] = pn64 >> 16;
452 pn[2] = pn64 >> 24;
453 pn[1] = pn64 >> 32;
454 pn[0] = pn64 >> 40;
455
456 ccmp_pn2hdr(pos, pn, key->conf.keyidx);
457
458 /* hwaccel - with software CCMP header */
459 if (info->control.hw_key)
460 return 0;
461
462 pos += IEEE80211_CCMP_HDR_LEN;
463 ccmp_special_blocks(skb, pn, b_0, aad);
464 return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
465 skb_put(skb, mic_len), mic_len);
466}
467
468
469ieee80211_tx_result
470ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
471 unsigned int mic_len)
472{
473 struct sk_buff *skb;
474
475 ieee80211_tx_set_protected(tx);
476
477 skb_queue_walk(&tx->skbs, skb) {
478 if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
479 return TX_DROP;
480 }
481
482 return TX_CONTINUE;
483}
484
485
486ieee80211_rx_result
487ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
488 unsigned int mic_len)
489{
490 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
491 int hdrlen;
492 struct ieee80211_key *key = rx->key;
493 struct sk_buff *skb = rx->skb;
494 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
495 u8 pn[IEEE80211_CCMP_PN_LEN];
496 int data_len;
497 int queue;
498
499 hdrlen = ieee80211_hdrlen(hdr->frame_control);
500
501 if (!ieee80211_is_data(hdr->frame_control) &&
502 !ieee80211_is_robust_mgmt_frame(skb))
503 return RX_CONTINUE;
504
505 if (status->flag & RX_FLAG_DECRYPTED) {
506 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
507 return RX_DROP_UNUSABLE;
508 if (status->flag & RX_FLAG_MIC_STRIPPED)
509 mic_len = 0;
510 } else {
511 if (skb_linearize(rx->skb))
512 return RX_DROP_UNUSABLE;
513 }
514
515 data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
516 if (!rx->sta || data_len < 0)
517 return RX_DROP_UNUSABLE;
518
519 if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
520 int res;
521
522 ccmp_hdr2pn(pn, skb->data + hdrlen);
523
524 queue = rx->security_idx;
525
526 res = memcmp(pn, key->u.ccmp.rx_pn[queue],
527 IEEE80211_CCMP_PN_LEN);
528 if (res < 0 ||
529 (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
530 key->u.ccmp.replays++;
531 return RX_DROP_UNUSABLE;
532 }
533
534 if (!(status->flag & RX_FLAG_DECRYPTED)) {
535 u8 aad[2 * AES_BLOCK_SIZE];
536 u8 b_0[AES_BLOCK_SIZE];
537 /* hardware didn't decrypt/verify MIC */
538 ccmp_special_blocks(skb, pn, b_0, aad);
539
540 if (ieee80211_aes_ccm_decrypt(
541 key->u.ccmp.tfm, b_0, aad,
542 skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
543 data_len,
544 skb->data + skb->len - mic_len, mic_len))
545 return RX_DROP_UNUSABLE;
546 }
547
548 memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
549 }
550
551 /* Remove CCMP header and MIC */
552 if (pskb_trim(skb, skb->len - mic_len))
553 return RX_DROP_UNUSABLE;
554 memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
555 skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
556
557 return RX_CONTINUE;
558}
559
560static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
561{
562 __le16 mask_fc;
563 u8 qos_tid;
564 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
565
566 memcpy(j_0, hdr->addr2, ETH_ALEN);
567 memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
568 j_0[13] = 0;
569 j_0[14] = 0;
570 j_0[AES_BLOCK_SIZE - 1] = 0x01;
571
572 /* AAD (extra authenticate-only data) / masked 802.11 header
573 * FC | A1 | A2 | A3 | SC | [A4] | [QC]
574 */
575 put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
576 /* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
577 * Retry, PwrMgt, MoreData; set Protected
578 */
579 mask_fc = hdr->frame_control;
580 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
581 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
582 if (!ieee80211_is_mgmt(hdr->frame_control))
583 mask_fc &= ~cpu_to_le16(0x0070);
584 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
585
586 put_unaligned(mask_fc, (__le16 *)&aad[2]);
587 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
588
589 /* Mask Seq#, leave Frag# */
590 aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
591 aad[23] = 0;
592
593 if (ieee80211_is_data_qos(hdr->frame_control))
594 qos_tid = *ieee80211_get_qos_ctl(hdr) &
595 IEEE80211_QOS_CTL_TID_MASK;
596 else
597 qos_tid = 0;
598
599 if (ieee80211_has_a4(hdr->frame_control)) {
600 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
601 aad[30] = qos_tid;
602 aad[31] = 0;
603 } else {
604 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
605 aad[24] = qos_tid;
606 }
607}
608
609static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
610{
611 hdr[0] = pn[5];
612 hdr[1] = pn[4];
613 hdr[2] = 0;
614 hdr[3] = 0x20 | (key_id << 6);
615 hdr[4] = pn[3];
616 hdr[5] = pn[2];
617 hdr[6] = pn[1];
618 hdr[7] = pn[0];
619}
620
621static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
622{
623 pn[0] = hdr[7];
624 pn[1] = hdr[6];
625 pn[2] = hdr[5];
626 pn[3] = hdr[4];
627 pn[4] = hdr[1];
628 pn[5] = hdr[0];
629}
630
631static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
632{
633 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
634 struct ieee80211_key *key = tx->key;
635 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
636 int hdrlen, len, tail;
637 u8 *pos;
638 u8 pn[6];
639 u64 pn64;
640 u8 aad[GCM_AAD_LEN];
641 u8 j_0[AES_BLOCK_SIZE];
642
643 if (info->control.hw_key &&
644 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
645 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
646 !((info->control.hw_key->flags &
647 IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
648 ieee80211_is_mgmt(hdr->frame_control))) {
649 /* hwaccel has no need for preallocated room for GCMP
650 * header or MIC fields
651 */
652 return 0;
653 }
654
655 hdrlen = ieee80211_hdrlen(hdr->frame_control);
656 len = skb->len - hdrlen;
657
658 if (info->control.hw_key)
659 tail = 0;
660 else
661 tail = IEEE80211_GCMP_MIC_LEN;
662
663 if (WARN_ON(skb_tailroom(skb) < tail ||
664 skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
665 return -1;
666
667 pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
668 memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
669 skb_set_network_header(skb, skb_network_offset(skb) +
670 IEEE80211_GCMP_HDR_LEN);
671
672 /* the HW only needs room for the IV, but not the actual IV */
673 if (info->control.hw_key &&
674 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
675 return 0;
676
677 hdr = (struct ieee80211_hdr *)pos;
678 pos += hdrlen;
679
680 pn64 = atomic64_inc_return(&key->conf.tx_pn);
681
682 pn[5] = pn64;
683 pn[4] = pn64 >> 8;
684 pn[3] = pn64 >> 16;
685 pn[2] = pn64 >> 24;
686 pn[1] = pn64 >> 32;
687 pn[0] = pn64 >> 40;
688
689 gcmp_pn2hdr(pos, pn, key->conf.keyidx);
690
691 /* hwaccel - with software GCMP header */
692 if (info->control.hw_key)
693 return 0;
694
695 pos += IEEE80211_GCMP_HDR_LEN;
696 gcmp_special_blocks(skb, pn, j_0, aad);
697 return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
698 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
699}
700
701ieee80211_tx_result
702ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
703{
704 struct sk_buff *skb;
705
706 ieee80211_tx_set_protected(tx);
707
708 skb_queue_walk(&tx->skbs, skb) {
709 if (gcmp_encrypt_skb(tx, skb) < 0)
710 return TX_DROP;
711 }
712
713 return TX_CONTINUE;
714}
715
716ieee80211_rx_result
717ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
718{
719 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
720 int hdrlen;
721 struct ieee80211_key *key = rx->key;
722 struct sk_buff *skb = rx->skb;
723 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
724 u8 pn[IEEE80211_GCMP_PN_LEN];
725 int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
726
727 hdrlen = ieee80211_hdrlen(hdr->frame_control);
728
729 if (!ieee80211_is_data(hdr->frame_control) &&
730 !ieee80211_is_robust_mgmt_frame(skb))
731 return RX_CONTINUE;
732
733 if (status->flag & RX_FLAG_DECRYPTED) {
734 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
735 return RX_DROP_UNUSABLE;
736 if (status->flag & RX_FLAG_MIC_STRIPPED)
737 mic_len = 0;
738 } else {
739 if (skb_linearize(rx->skb))
740 return RX_DROP_UNUSABLE;
741 }
742
743 data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
744 if (!rx->sta || data_len < 0)
745 return RX_DROP_UNUSABLE;
746
747 if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
748 int res;
749
750 gcmp_hdr2pn(pn, skb->data + hdrlen);
751
752 queue = rx->security_idx;
753
754 res = memcmp(pn, key->u.gcmp.rx_pn[queue],
755 IEEE80211_GCMP_PN_LEN);
756 if (res < 0 ||
757 (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
758 key->u.gcmp.replays++;
759 return RX_DROP_UNUSABLE;
760 }
761
762 if (!(status->flag & RX_FLAG_DECRYPTED)) {
763 u8 aad[2 * AES_BLOCK_SIZE];
764 u8 j_0[AES_BLOCK_SIZE];
765 /* hardware didn't decrypt/verify MIC */
766 gcmp_special_blocks(skb, pn, j_0, aad);
767
768 if (ieee80211_aes_gcm_decrypt(
769 key->u.gcmp.tfm, j_0, aad,
770 skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
771 data_len,
772 skb->data + skb->len -
773 IEEE80211_GCMP_MIC_LEN))
774 return RX_DROP_UNUSABLE;
775 }
776
777 memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
778 }
779
780 /* Remove GCMP header and MIC */
781 if (pskb_trim(skb, skb->len - mic_len))
782 return RX_DROP_UNUSABLE;
783 memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
784 skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
785
786 return RX_CONTINUE;
787}
788
789static ieee80211_tx_result
790ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
791 struct sk_buff *skb)
792{
793 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
794 struct ieee80211_key *key = tx->key;
795 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
796 int hdrlen;
797 u8 *pos, iv_len = key->conf.iv_len;
798
799 if (info->control.hw_key &&
800 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
801 /* hwaccel has no need for preallocated head room */
802 return TX_CONTINUE;
803 }
804
805 if (unlikely(skb_headroom(skb) < iv_len &&
806 pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
807 return TX_DROP;
808
809 hdrlen = ieee80211_hdrlen(hdr->frame_control);
810
811 pos = skb_push(skb, iv_len);
812 memmove(pos, pos + iv_len, hdrlen);
813
814 return TX_CONTINUE;
815}
816
817static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
818{
819 int i;
820
821 /* pn is little endian */
822 for (i = len - 1; i >= 0; i--) {
823 if (pn1[i] < pn2[i])
824 return -1;
825 else if (pn1[i] > pn2[i])
826 return 1;
827 }
828
829 return 0;
830}
831
832static ieee80211_rx_result
833ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
834{
835 struct ieee80211_key *key = rx->key;
836 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
837 const struct ieee80211_cipher_scheme *cs = NULL;
838 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
839 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
840 int data_len;
841 u8 *rx_pn;
842 u8 *skb_pn;
843 u8 qos_tid;
844
845 if (!rx->sta || !rx->sta->cipher_scheme ||
846 !(status->flag & RX_FLAG_DECRYPTED))
847 return RX_DROP_UNUSABLE;
848
849 if (!ieee80211_is_data(hdr->frame_control))
850 return RX_CONTINUE;
851
852 cs = rx->sta->cipher_scheme;
853
854 data_len = rx->skb->len - hdrlen - cs->hdr_len;
855
856 if (data_len < 0)
857 return RX_DROP_UNUSABLE;
858
859 if (ieee80211_is_data_qos(hdr->frame_control))
860 qos_tid = *ieee80211_get_qos_ctl(hdr) &
861 IEEE80211_QOS_CTL_TID_MASK;
862 else
863 qos_tid = 0;
864
865 if (skb_linearize(rx->skb))
866 return RX_DROP_UNUSABLE;
867
868 hdr = (struct ieee80211_hdr *)rx->skb->data;
869
870 rx_pn = key->u.gen.rx_pn[qos_tid];
871 skb_pn = rx->skb->data + hdrlen + cs->pn_off;
872
873 if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
874 return RX_DROP_UNUSABLE;
875
876 memcpy(rx_pn, skb_pn, cs->pn_len);
877
878 /* remove security header and MIC */
879 if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
880 return RX_DROP_UNUSABLE;
881
882 memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
883 skb_pull(rx->skb, cs->hdr_len);
884
885 return RX_CONTINUE;
886}
887
888static void bip_aad(struct sk_buff *skb, u8 *aad)
889{
890 __le16 mask_fc;
891 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
892
893 /* BIP AAD: FC(masked) || A1 || A2 || A3 */
894
895 /* FC type/subtype */
896 /* Mask FC Retry, PwrMgt, MoreData flags to zero */
897 mask_fc = hdr->frame_control;
898 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
899 IEEE80211_FCTL_MOREDATA);
900 put_unaligned(mask_fc, (__le16 *) &aad[0]);
901 /* A1 || A2 || A3 */
902 memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
903}
904
905
906static inline void bip_ipn_set64(u8 *d, u64 pn)
907{
908 *d++ = pn;
909 *d++ = pn >> 8;
910 *d++ = pn >> 16;
911 *d++ = pn >> 24;
912 *d++ = pn >> 32;
913 *d = pn >> 40;
914}
915
916static inline void bip_ipn_swap(u8 *d, const u8 *s)
917{
918 *d++ = s[5];
919 *d++ = s[4];
920 *d++ = s[3];
921 *d++ = s[2];
922 *d++ = s[1];
923 *d = s[0];
924}
925
926
927ieee80211_tx_result
928ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
929{
930 struct sk_buff *skb;
931 struct ieee80211_tx_info *info;
932 struct ieee80211_key *key = tx->key;
933 struct ieee80211_mmie *mmie;
934 u8 aad[20];
935 u64 pn64;
936
937 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
938 return TX_DROP;
939
940 skb = skb_peek(&tx->skbs);
941
942 info = IEEE80211_SKB_CB(skb);
943
944 if (info->control.hw_key)
945 return TX_CONTINUE;
946
947 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
948 return TX_DROP;
949
950 mmie = (struct ieee80211_mmie *) skb_put(skb, sizeof(*mmie));
951 mmie->element_id = WLAN_EID_MMIE;
952 mmie->length = sizeof(*mmie) - 2;
953 mmie->key_id = cpu_to_le16(key->conf.keyidx);
954
955 /* PN = PN + 1 */
956 pn64 = atomic64_inc_return(&key->conf.tx_pn);
957
958 bip_ipn_set64(mmie->sequence_number, pn64);
959
960 bip_aad(skb, aad);
961
962 /*
963 * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
964 */
965 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
966 skb->data + 24, skb->len - 24, mmie->mic);
967
968 return TX_CONTINUE;
969}
970
971ieee80211_tx_result
972ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
973{
974 struct sk_buff *skb;
975 struct ieee80211_tx_info *info;
976 struct ieee80211_key *key = tx->key;
977 struct ieee80211_mmie_16 *mmie;
978 u8 aad[20];
979 u64 pn64;
980
981 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
982 return TX_DROP;
983
984 skb = skb_peek(&tx->skbs);
985
986 info = IEEE80211_SKB_CB(skb);
987
988 if (info->control.hw_key)
989 return TX_CONTINUE;
990
991 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
992 return TX_DROP;
993
994 mmie = (struct ieee80211_mmie_16 *)skb_put(skb, sizeof(*mmie));
995 mmie->element_id = WLAN_EID_MMIE;
996 mmie->length = sizeof(*mmie) - 2;
997 mmie->key_id = cpu_to_le16(key->conf.keyidx);
998
999 /* PN = PN + 1 */
1000 pn64 = atomic64_inc_return(&key->conf.tx_pn);
1001
1002 bip_ipn_set64(mmie->sequence_number, pn64);
1003
1004 bip_aad(skb, aad);
1005
1006 /* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
1007 */
1008 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1009 skb->data + 24, skb->len - 24, mmie->mic);
1010
1011 return TX_CONTINUE;
1012}
1013
1014ieee80211_rx_result
1015ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
1016{
1017 struct sk_buff *skb = rx->skb;
1018 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1019 struct ieee80211_key *key = rx->key;
1020 struct ieee80211_mmie *mmie;
1021 u8 aad[20], mic[8], ipn[6];
1022 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1023
1024 if (!ieee80211_is_mgmt(hdr->frame_control))
1025 return RX_CONTINUE;
1026
1027 /* management frames are already linear */
1028
1029 if (skb->len < 24 + sizeof(*mmie))
1030 return RX_DROP_UNUSABLE;
1031
1032 mmie = (struct ieee80211_mmie *)
1033 (skb->data + skb->len - sizeof(*mmie));
1034 if (mmie->element_id != WLAN_EID_MMIE ||
1035 mmie->length != sizeof(*mmie) - 2)
1036 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1037
1038 bip_ipn_swap(ipn, mmie->sequence_number);
1039
1040 if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1041 key->u.aes_cmac.replays++;
1042 return RX_DROP_UNUSABLE;
1043 }
1044
1045 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1046 /* hardware didn't decrypt/verify MIC */
1047 bip_aad(skb, aad);
1048 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
1049 skb->data + 24, skb->len - 24, mic);
1050 if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
1051 key->u.aes_cmac.icverrors++;
1052 return RX_DROP_UNUSABLE;
1053 }
1054 }
1055
1056 memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1057
1058 /* Remove MMIE */
1059 skb_trim(skb, skb->len - sizeof(*mmie));
1060
1061 return RX_CONTINUE;
1062}
1063
1064ieee80211_rx_result
1065ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
1066{
1067 struct sk_buff *skb = rx->skb;
1068 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1069 struct ieee80211_key *key = rx->key;
1070 struct ieee80211_mmie_16 *mmie;
1071 u8 aad[20], mic[16], ipn[6];
1072 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1073
1074 if (!ieee80211_is_mgmt(hdr->frame_control))
1075 return RX_CONTINUE;
1076
1077 /* management frames are already linear */
1078
1079 if (skb->len < 24 + sizeof(*mmie))
1080 return RX_DROP_UNUSABLE;
1081
1082 mmie = (struct ieee80211_mmie_16 *)
1083 (skb->data + skb->len - sizeof(*mmie));
1084 if (mmie->element_id != WLAN_EID_MMIE ||
1085 mmie->length != sizeof(*mmie) - 2)
1086 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1087
1088 bip_ipn_swap(ipn, mmie->sequence_number);
1089
1090 if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1091 key->u.aes_cmac.replays++;
1092 return RX_DROP_UNUSABLE;
1093 }
1094
1095 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1096 /* hardware didn't decrypt/verify MIC */
1097 bip_aad(skb, aad);
1098 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1099 skb->data + 24, skb->len - 24, mic);
1100 if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
1101 key->u.aes_cmac.icverrors++;
1102 return RX_DROP_UNUSABLE;
1103 }
1104 }
1105
1106 memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1107
1108 /* Remove MMIE */
1109 skb_trim(skb, skb->len - sizeof(*mmie));
1110
1111 return RX_CONTINUE;
1112}
1113
1114ieee80211_tx_result
1115ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
1116{
1117 struct sk_buff *skb;
1118 struct ieee80211_tx_info *info;
1119 struct ieee80211_key *key = tx->key;
1120 struct ieee80211_mmie_16 *mmie;
1121 struct ieee80211_hdr *hdr;
1122 u8 aad[GMAC_AAD_LEN];
1123 u64 pn64;
1124 u8 nonce[GMAC_NONCE_LEN];
1125
1126 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
1127 return TX_DROP;
1128
1129 skb = skb_peek(&tx->skbs);
1130
1131 info = IEEE80211_SKB_CB(skb);
1132
1133 if (info->control.hw_key)
1134 return TX_CONTINUE;
1135
1136 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1137 return TX_DROP;
1138
1139 mmie = (struct ieee80211_mmie_16 *)skb_put(skb, sizeof(*mmie));
1140 mmie->element_id = WLAN_EID_MMIE;
1141 mmie->length = sizeof(*mmie) - 2;
1142 mmie->key_id = cpu_to_le16(key->conf.keyidx);
1143
1144 /* PN = PN + 1 */
1145 pn64 = atomic64_inc_return(&key->conf.tx_pn);
1146
1147 bip_ipn_set64(mmie->sequence_number, pn64);
1148
1149 bip_aad(skb, aad);
1150
1151 hdr = (struct ieee80211_hdr *)skb->data;
1152 memcpy(nonce, hdr->addr2, ETH_ALEN);
1153 bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
1154
1155 /* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
1156 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1157 skb->data + 24, skb->len - 24, mmie->mic) < 0)
1158 return TX_DROP;
1159
1160 return TX_CONTINUE;
1161}
1162
1163ieee80211_rx_result
1164ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
1165{
1166 struct sk_buff *skb = rx->skb;
1167 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1168 struct ieee80211_key *key = rx->key;
1169 struct ieee80211_mmie_16 *mmie;
1170 u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LEN], ipn[6], nonce[GMAC_NONCE_LEN];
1171 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1172
1173 if (!ieee80211_is_mgmt(hdr->frame_control))
1174 return RX_CONTINUE;
1175
1176 /* management frames are already linear */
1177
1178 if (skb->len < 24 + sizeof(*mmie))
1179 return RX_DROP_UNUSABLE;
1180
1181 mmie = (struct ieee80211_mmie_16 *)
1182 (skb->data + skb->len - sizeof(*mmie));
1183 if (mmie->element_id != WLAN_EID_MMIE ||
1184 mmie->length != sizeof(*mmie) - 2)
1185 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1186
1187 bip_ipn_swap(ipn, mmie->sequence_number);
1188
1189 if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
1190 key->u.aes_gmac.replays++;
1191 return RX_DROP_UNUSABLE;
1192 }
1193
1194 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1195 /* hardware didn't decrypt/verify MIC */
1196 bip_aad(skb, aad);
1197
1198 memcpy(nonce, hdr->addr2, ETH_ALEN);
1199 memcpy(nonce + ETH_ALEN, ipn, 6);
1200
1201 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1202 skb->data + 24, skb->len - 24,
1203 mic) < 0 ||
1204 memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
1205 key->u.aes_gmac.icverrors++;
1206 return RX_DROP_UNUSABLE;
1207 }
1208 }
1209
1210 memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
1211
1212 /* Remove MMIE */
1213 skb_trim(skb, skb->len - sizeof(*mmie));
1214
1215 return RX_CONTINUE;
1216}
1217
1218ieee80211_tx_result
1219ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
1220{
1221 struct sk_buff *skb;
1222 struct ieee80211_tx_info *info = NULL;
1223 ieee80211_tx_result res;
1224
1225 skb_queue_walk(&tx->skbs, skb) {
1226 info = IEEE80211_SKB_CB(skb);
1227
1228 /* handle hw-only algorithm */
1229 if (!info->control.hw_key)
1230 return TX_DROP;
1231
1232 if (tx->key->flags & KEY_FLAG_CIPHER_SCHEME) {
1233 res = ieee80211_crypto_cs_encrypt(tx, skb);
1234 if (res != TX_CONTINUE)
1235 return res;
1236 }
1237 }
1238
1239 ieee80211_tx_set_protected(tx);
1240
1241 return TX_CONTINUE;
1242}
1243
1244ieee80211_rx_result
1245ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
1246{
1247 if (rx->sta && rx->sta->cipher_scheme)
1248 return ieee80211_crypto_cs_decrypt(rx);
1249
1250 return RX_DROP_UNUSABLE;
1251}
1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright 2002-2004, Instant802 Networks, Inc.
4 * Copyright 2008, Jouni Malinen <j@w1.fi>
5 * Copyright (C) 2016-2017 Intel Deutschland GmbH
6 */
7
8#include <linux/netdevice.h>
9#include <linux/types.h>
10#include <linux/skbuff.h>
11#include <linux/compiler.h>
12#include <linux/ieee80211.h>
13#include <linux/gfp.h>
14#include <asm/unaligned.h>
15#include <net/mac80211.h>
16#include <crypto/aes.h>
17#include <crypto/algapi.h>
18
19#include "ieee80211_i.h"
20#include "michael.h"
21#include "tkip.h"
22#include "aes_ccm.h"
23#include "aes_cmac.h"
24#include "aes_gmac.h"
25#include "aes_gcm.h"
26#include "wpa.h"
27
28ieee80211_tx_result
29ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
30{
31 u8 *data, *key, *mic;
32 size_t data_len;
33 unsigned int hdrlen;
34 struct ieee80211_hdr *hdr;
35 struct sk_buff *skb = tx->skb;
36 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
37 int tail;
38
39 hdr = (struct ieee80211_hdr *)skb->data;
40 if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
41 skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
42 return TX_CONTINUE;
43
44 hdrlen = ieee80211_hdrlen(hdr->frame_control);
45 if (skb->len < hdrlen)
46 return TX_DROP;
47
48 data = skb->data + hdrlen;
49 data_len = skb->len - hdrlen;
50
51 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
52 /* Need to use software crypto for the test */
53 info->control.hw_key = NULL;
54 }
55
56 if (info->control.hw_key &&
57 (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
58 ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
59 !(tx->key->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC |
60 IEEE80211_KEY_FLAG_PUT_MIC_SPACE))) {
61 /* hwaccel - with no need for SW-generated MMIC or MIC space */
62 return TX_CONTINUE;
63 }
64
65 tail = MICHAEL_MIC_LEN;
66 if (!info->control.hw_key)
67 tail += IEEE80211_TKIP_ICV_LEN;
68
69 if (WARN(skb_tailroom(skb) < tail ||
70 skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
71 "mmic: not enough head/tail (%d/%d,%d/%d)\n",
72 skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
73 skb_tailroom(skb), tail))
74 return TX_DROP;
75
76 mic = skb_put(skb, MICHAEL_MIC_LEN);
77
78 if (tx->key->conf.flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) {
79 /* Zeroed MIC can help with debug */
80 memset(mic, 0, MICHAEL_MIC_LEN);
81 return TX_CONTINUE;
82 }
83
84 key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
85 michael_mic(key, hdr, data, data_len, mic);
86 if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
87 mic[0]++;
88
89 return TX_CONTINUE;
90}
91
92
93ieee80211_rx_result
94ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
95{
96 u8 *data, *key = NULL;
97 size_t data_len;
98 unsigned int hdrlen;
99 u8 mic[MICHAEL_MIC_LEN];
100 struct sk_buff *skb = rx->skb;
101 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
102 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
103
104 /*
105 * it makes no sense to check for MIC errors on anything other
106 * than data frames.
107 */
108 if (!ieee80211_is_data_present(hdr->frame_control))
109 return RX_CONTINUE;
110
111 /*
112 * No way to verify the MIC if the hardware stripped it or
113 * the IV with the key index. In this case we have solely rely
114 * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
115 * MIC failure report.
116 */
117 if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
118 if (status->flag & RX_FLAG_MMIC_ERROR)
119 goto mic_fail_no_key;
120
121 if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
122 rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
123 goto update_iv;
124
125 return RX_CONTINUE;
126 }
127
128 /*
129 * Some hardware seems to generate Michael MIC failure reports; even
130 * though, the frame was not encrypted with TKIP and therefore has no
131 * MIC. Ignore the flag them to avoid triggering countermeasures.
132 */
133 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
134 !(status->flag & RX_FLAG_DECRYPTED))
135 return RX_CONTINUE;
136
137 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
138 /*
139 * APs with pairwise keys should never receive Michael MIC
140 * errors for non-zero keyidx because these are reserved for
141 * group keys and only the AP is sending real multicast
142 * frames in the BSS.
143 */
144 return RX_DROP_UNUSABLE;
145 }
146
147 if (status->flag & RX_FLAG_MMIC_ERROR)
148 goto mic_fail;
149
150 hdrlen = ieee80211_hdrlen(hdr->frame_control);
151 if (skb->len < hdrlen + MICHAEL_MIC_LEN)
152 return RX_DROP_UNUSABLE;
153
154 if (skb_linearize(rx->skb))
155 return RX_DROP_UNUSABLE;
156 hdr = (void *)skb->data;
157
158 data = skb->data + hdrlen;
159 data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
160 key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
161 michael_mic(key, hdr, data, data_len, mic);
162 if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
163 goto mic_fail;
164
165 /* remove Michael MIC from payload */
166 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
167
168update_iv:
169 /* update IV in key information to be able to detect replays */
170 rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
171 rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
172
173 return RX_CONTINUE;
174
175mic_fail:
176 rx->key->u.tkip.mic_failures++;
177
178mic_fail_no_key:
179 /*
180 * In some cases the key can be unset - e.g. a multicast packet, in
181 * a driver that supports HW encryption. Send up the key idx only if
182 * the key is set.
183 */
184 cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
185 is_multicast_ether_addr(hdr->addr1) ?
186 NL80211_KEYTYPE_GROUP :
187 NL80211_KEYTYPE_PAIRWISE,
188 rx->key ? rx->key->conf.keyidx : -1,
189 NULL, GFP_ATOMIC);
190 return RX_DROP_UNUSABLE;
191}
192
193static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
194{
195 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
196 struct ieee80211_key *key = tx->key;
197 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
198 unsigned int hdrlen;
199 int len, tail;
200 u64 pn;
201 u8 *pos;
202
203 if (info->control.hw_key &&
204 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
205 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
206 /* hwaccel - with no need for software-generated IV */
207 return 0;
208 }
209
210 hdrlen = ieee80211_hdrlen(hdr->frame_control);
211 len = skb->len - hdrlen;
212
213 if (info->control.hw_key)
214 tail = 0;
215 else
216 tail = IEEE80211_TKIP_ICV_LEN;
217
218 if (WARN_ON(skb_tailroom(skb) < tail ||
219 skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
220 return -1;
221
222 pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
223 memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
224 pos += hdrlen;
225
226 /* the HW only needs room for the IV, but not the actual IV */
227 if (info->control.hw_key &&
228 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
229 return 0;
230
231 /* Increase IV for the frame */
232 pn = atomic64_inc_return(&key->conf.tx_pn);
233 pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
234
235 /* hwaccel - with software IV */
236 if (info->control.hw_key)
237 return 0;
238
239 /* Add room for ICV */
240 skb_put(skb, IEEE80211_TKIP_ICV_LEN);
241
242 return ieee80211_tkip_encrypt_data(&tx->local->wep_tx_ctx,
243 key, skb, pos, len);
244}
245
246
247ieee80211_tx_result
248ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
249{
250 struct sk_buff *skb;
251
252 ieee80211_tx_set_protected(tx);
253
254 skb_queue_walk(&tx->skbs, skb) {
255 if (tkip_encrypt_skb(tx, skb) < 0)
256 return TX_DROP;
257 }
258
259 return TX_CONTINUE;
260}
261
262
263ieee80211_rx_result
264ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
265{
266 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
267 int hdrlen, res, hwaccel = 0;
268 struct ieee80211_key *key = rx->key;
269 struct sk_buff *skb = rx->skb;
270 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
271
272 hdrlen = ieee80211_hdrlen(hdr->frame_control);
273
274 if (!ieee80211_is_data(hdr->frame_control))
275 return RX_CONTINUE;
276
277 if (!rx->sta || skb->len - hdrlen < 12)
278 return RX_DROP_UNUSABLE;
279
280 /* it may be possible to optimize this a bit more */
281 if (skb_linearize(rx->skb))
282 return RX_DROP_UNUSABLE;
283 hdr = (void *)skb->data;
284
285 /*
286 * Let TKIP code verify IV, but skip decryption.
287 * In the case where hardware checks the IV as well,
288 * we don't even get here, see ieee80211_rx_h_decrypt()
289 */
290 if (status->flag & RX_FLAG_DECRYPTED)
291 hwaccel = 1;
292
293 res = ieee80211_tkip_decrypt_data(&rx->local->wep_rx_ctx,
294 key, skb->data + hdrlen,
295 skb->len - hdrlen, rx->sta->sta.addr,
296 hdr->addr1, hwaccel, rx->security_idx,
297 &rx->tkip_iv32,
298 &rx->tkip_iv16);
299 if (res != TKIP_DECRYPT_OK)
300 return RX_DROP_UNUSABLE;
301
302 /* Trim ICV */
303 if (!(status->flag & RX_FLAG_ICV_STRIPPED))
304 skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
305
306 /* Remove IV */
307 memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
308 skb_pull(skb, IEEE80211_TKIP_IV_LEN);
309
310 return RX_CONTINUE;
311}
312
313
314static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
315{
316 __le16 mask_fc;
317 int a4_included, mgmt;
318 u8 qos_tid;
319 u16 len_a;
320 unsigned int hdrlen;
321 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
322
323 /*
324 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
325 * Retry, PwrMgt, MoreData; set Protected
326 */
327 mgmt = ieee80211_is_mgmt(hdr->frame_control);
328 mask_fc = hdr->frame_control;
329 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
330 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
331 if (!mgmt)
332 mask_fc &= ~cpu_to_le16(0x0070);
333 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
334
335 hdrlen = ieee80211_hdrlen(hdr->frame_control);
336 len_a = hdrlen - 2;
337 a4_included = ieee80211_has_a4(hdr->frame_control);
338
339 if (ieee80211_is_data_qos(hdr->frame_control))
340 qos_tid = ieee80211_get_tid(hdr);
341 else
342 qos_tid = 0;
343
344 /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
345 * mode authentication are not allowed to collide, yet both are derived
346 * from this vector b_0. We only set L := 1 here to indicate that the
347 * data size can be represented in (L+1) bytes. The CCM layer will take
348 * care of storing the data length in the top (L+1) bytes and setting
349 * and clearing the other bits as is required to derive the two IVs.
350 */
351 b_0[0] = 0x1;
352
353 /* Nonce: Nonce Flags | A2 | PN
354 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
355 */
356 b_0[1] = qos_tid | (mgmt << 4);
357 memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
358 memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
359
360 /* AAD (extra authenticate-only data) / masked 802.11 header
361 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
362 put_unaligned_be16(len_a, &aad[0]);
363 put_unaligned(mask_fc, (__le16 *)&aad[2]);
364 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
365
366 /* Mask Seq#, leave Frag# */
367 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
368 aad[23] = 0;
369
370 if (a4_included) {
371 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
372 aad[30] = qos_tid;
373 aad[31] = 0;
374 } else {
375 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
376 aad[24] = qos_tid;
377 }
378}
379
380
381static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
382{
383 hdr[0] = pn[5];
384 hdr[1] = pn[4];
385 hdr[2] = 0;
386 hdr[3] = 0x20 | (key_id << 6);
387 hdr[4] = pn[3];
388 hdr[5] = pn[2];
389 hdr[6] = pn[1];
390 hdr[7] = pn[0];
391}
392
393
394static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
395{
396 pn[0] = hdr[7];
397 pn[1] = hdr[6];
398 pn[2] = hdr[5];
399 pn[3] = hdr[4];
400 pn[4] = hdr[1];
401 pn[5] = hdr[0];
402}
403
404
405static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
406 unsigned int mic_len)
407{
408 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
409 struct ieee80211_key *key = tx->key;
410 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
411 int hdrlen, len, tail;
412 u8 *pos;
413 u8 pn[6];
414 u64 pn64;
415 u8 aad[CCM_AAD_LEN];
416 u8 b_0[AES_BLOCK_SIZE];
417
418 if (info->control.hw_key &&
419 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
420 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
421 !((info->control.hw_key->flags &
422 IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
423 ieee80211_is_mgmt(hdr->frame_control))) {
424 /*
425 * hwaccel has no need for preallocated room for CCMP
426 * header or MIC fields
427 */
428 return 0;
429 }
430
431 hdrlen = ieee80211_hdrlen(hdr->frame_control);
432 len = skb->len - hdrlen;
433
434 if (info->control.hw_key)
435 tail = 0;
436 else
437 tail = mic_len;
438
439 if (WARN_ON(skb_tailroom(skb) < tail ||
440 skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
441 return -1;
442
443 pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
444 memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
445
446 /* the HW only needs room for the IV, but not the actual IV */
447 if (info->control.hw_key &&
448 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
449 return 0;
450
451 hdr = (struct ieee80211_hdr *) pos;
452 pos += hdrlen;
453
454 pn64 = atomic64_inc_return(&key->conf.tx_pn);
455
456 pn[5] = pn64;
457 pn[4] = pn64 >> 8;
458 pn[3] = pn64 >> 16;
459 pn[2] = pn64 >> 24;
460 pn[1] = pn64 >> 32;
461 pn[0] = pn64 >> 40;
462
463 ccmp_pn2hdr(pos, pn, key->conf.keyidx);
464
465 /* hwaccel - with software CCMP header */
466 if (info->control.hw_key)
467 return 0;
468
469 pos += IEEE80211_CCMP_HDR_LEN;
470 ccmp_special_blocks(skb, pn, b_0, aad);
471 return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
472 skb_put(skb, mic_len));
473}
474
475
476ieee80211_tx_result
477ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
478 unsigned int mic_len)
479{
480 struct sk_buff *skb;
481
482 ieee80211_tx_set_protected(tx);
483
484 skb_queue_walk(&tx->skbs, skb) {
485 if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
486 return TX_DROP;
487 }
488
489 return TX_CONTINUE;
490}
491
492
493ieee80211_rx_result
494ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
495 unsigned int mic_len)
496{
497 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
498 int hdrlen;
499 struct ieee80211_key *key = rx->key;
500 struct sk_buff *skb = rx->skb;
501 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
502 u8 pn[IEEE80211_CCMP_PN_LEN];
503 int data_len;
504 int queue;
505
506 hdrlen = ieee80211_hdrlen(hdr->frame_control);
507
508 if (!ieee80211_is_data(hdr->frame_control) &&
509 !ieee80211_is_robust_mgmt_frame(skb))
510 return RX_CONTINUE;
511
512 if (status->flag & RX_FLAG_DECRYPTED) {
513 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
514 return RX_DROP_UNUSABLE;
515 if (status->flag & RX_FLAG_MIC_STRIPPED)
516 mic_len = 0;
517 } else {
518 if (skb_linearize(rx->skb))
519 return RX_DROP_UNUSABLE;
520 }
521
522 data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
523 if (!rx->sta || data_len < 0)
524 return RX_DROP_UNUSABLE;
525
526 if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
527 int res;
528
529 ccmp_hdr2pn(pn, skb->data + hdrlen);
530
531 queue = rx->security_idx;
532
533 res = memcmp(pn, key->u.ccmp.rx_pn[queue],
534 IEEE80211_CCMP_PN_LEN);
535 if (res < 0 ||
536 (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
537 key->u.ccmp.replays++;
538 return RX_DROP_UNUSABLE;
539 }
540
541 if (!(status->flag & RX_FLAG_DECRYPTED)) {
542 u8 aad[2 * AES_BLOCK_SIZE];
543 u8 b_0[AES_BLOCK_SIZE];
544 /* hardware didn't decrypt/verify MIC */
545 ccmp_special_blocks(skb, pn, b_0, aad);
546
547 if (ieee80211_aes_ccm_decrypt(
548 key->u.ccmp.tfm, b_0, aad,
549 skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
550 data_len,
551 skb->data + skb->len - mic_len))
552 return RX_DROP_UNUSABLE;
553 }
554
555 memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
556 }
557
558 /* Remove CCMP header and MIC */
559 if (pskb_trim(skb, skb->len - mic_len))
560 return RX_DROP_UNUSABLE;
561 memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
562 skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
563
564 return RX_CONTINUE;
565}
566
567static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
568{
569 __le16 mask_fc;
570 u8 qos_tid;
571 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
572
573 memcpy(j_0, hdr->addr2, ETH_ALEN);
574 memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
575 j_0[13] = 0;
576 j_0[14] = 0;
577 j_0[AES_BLOCK_SIZE - 1] = 0x01;
578
579 /* AAD (extra authenticate-only data) / masked 802.11 header
580 * FC | A1 | A2 | A3 | SC | [A4] | [QC]
581 */
582 put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
583 /* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
584 * Retry, PwrMgt, MoreData; set Protected
585 */
586 mask_fc = hdr->frame_control;
587 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
588 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
589 if (!ieee80211_is_mgmt(hdr->frame_control))
590 mask_fc &= ~cpu_to_le16(0x0070);
591 mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
592
593 put_unaligned(mask_fc, (__le16 *)&aad[2]);
594 memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
595
596 /* Mask Seq#, leave Frag# */
597 aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
598 aad[23] = 0;
599
600 if (ieee80211_is_data_qos(hdr->frame_control))
601 qos_tid = ieee80211_get_tid(hdr);
602 else
603 qos_tid = 0;
604
605 if (ieee80211_has_a4(hdr->frame_control)) {
606 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
607 aad[30] = qos_tid;
608 aad[31] = 0;
609 } else {
610 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
611 aad[24] = qos_tid;
612 }
613}
614
615static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
616{
617 hdr[0] = pn[5];
618 hdr[1] = pn[4];
619 hdr[2] = 0;
620 hdr[3] = 0x20 | (key_id << 6);
621 hdr[4] = pn[3];
622 hdr[5] = pn[2];
623 hdr[6] = pn[1];
624 hdr[7] = pn[0];
625}
626
627static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
628{
629 pn[0] = hdr[7];
630 pn[1] = hdr[6];
631 pn[2] = hdr[5];
632 pn[3] = hdr[4];
633 pn[4] = hdr[1];
634 pn[5] = hdr[0];
635}
636
637static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
638{
639 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
640 struct ieee80211_key *key = tx->key;
641 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
642 int hdrlen, len, tail;
643 u8 *pos;
644 u8 pn[6];
645 u64 pn64;
646 u8 aad[GCM_AAD_LEN];
647 u8 j_0[AES_BLOCK_SIZE];
648
649 if (info->control.hw_key &&
650 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
651 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
652 !((info->control.hw_key->flags &
653 IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
654 ieee80211_is_mgmt(hdr->frame_control))) {
655 /* hwaccel has no need for preallocated room for GCMP
656 * header or MIC fields
657 */
658 return 0;
659 }
660
661 hdrlen = ieee80211_hdrlen(hdr->frame_control);
662 len = skb->len - hdrlen;
663
664 if (info->control.hw_key)
665 tail = 0;
666 else
667 tail = IEEE80211_GCMP_MIC_LEN;
668
669 if (WARN_ON(skb_tailroom(skb) < tail ||
670 skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
671 return -1;
672
673 pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
674 memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
675 skb_set_network_header(skb, skb_network_offset(skb) +
676 IEEE80211_GCMP_HDR_LEN);
677
678 /* the HW only needs room for the IV, but not the actual IV */
679 if (info->control.hw_key &&
680 (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
681 return 0;
682
683 hdr = (struct ieee80211_hdr *)pos;
684 pos += hdrlen;
685
686 pn64 = atomic64_inc_return(&key->conf.tx_pn);
687
688 pn[5] = pn64;
689 pn[4] = pn64 >> 8;
690 pn[3] = pn64 >> 16;
691 pn[2] = pn64 >> 24;
692 pn[1] = pn64 >> 32;
693 pn[0] = pn64 >> 40;
694
695 gcmp_pn2hdr(pos, pn, key->conf.keyidx);
696
697 /* hwaccel - with software GCMP header */
698 if (info->control.hw_key)
699 return 0;
700
701 pos += IEEE80211_GCMP_HDR_LEN;
702 gcmp_special_blocks(skb, pn, j_0, aad);
703 return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
704 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
705}
706
707ieee80211_tx_result
708ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
709{
710 struct sk_buff *skb;
711
712 ieee80211_tx_set_protected(tx);
713
714 skb_queue_walk(&tx->skbs, skb) {
715 if (gcmp_encrypt_skb(tx, skb) < 0)
716 return TX_DROP;
717 }
718
719 return TX_CONTINUE;
720}
721
722ieee80211_rx_result
723ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
724{
725 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
726 int hdrlen;
727 struct ieee80211_key *key = rx->key;
728 struct sk_buff *skb = rx->skb;
729 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
730 u8 pn[IEEE80211_GCMP_PN_LEN];
731 int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
732
733 hdrlen = ieee80211_hdrlen(hdr->frame_control);
734
735 if (!ieee80211_is_data(hdr->frame_control) &&
736 !ieee80211_is_robust_mgmt_frame(skb))
737 return RX_CONTINUE;
738
739 if (status->flag & RX_FLAG_DECRYPTED) {
740 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
741 return RX_DROP_UNUSABLE;
742 if (status->flag & RX_FLAG_MIC_STRIPPED)
743 mic_len = 0;
744 } else {
745 if (skb_linearize(rx->skb))
746 return RX_DROP_UNUSABLE;
747 }
748
749 data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
750 if (!rx->sta || data_len < 0)
751 return RX_DROP_UNUSABLE;
752
753 if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
754 int res;
755
756 gcmp_hdr2pn(pn, skb->data + hdrlen);
757
758 queue = rx->security_idx;
759
760 res = memcmp(pn, key->u.gcmp.rx_pn[queue],
761 IEEE80211_GCMP_PN_LEN);
762 if (res < 0 ||
763 (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
764 key->u.gcmp.replays++;
765 return RX_DROP_UNUSABLE;
766 }
767
768 if (!(status->flag & RX_FLAG_DECRYPTED)) {
769 u8 aad[2 * AES_BLOCK_SIZE];
770 u8 j_0[AES_BLOCK_SIZE];
771 /* hardware didn't decrypt/verify MIC */
772 gcmp_special_blocks(skb, pn, j_0, aad);
773
774 if (ieee80211_aes_gcm_decrypt(
775 key->u.gcmp.tfm, j_0, aad,
776 skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
777 data_len,
778 skb->data + skb->len -
779 IEEE80211_GCMP_MIC_LEN))
780 return RX_DROP_UNUSABLE;
781 }
782
783 memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
784 }
785
786 /* Remove GCMP header and MIC */
787 if (pskb_trim(skb, skb->len - mic_len))
788 return RX_DROP_UNUSABLE;
789 memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
790 skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
791
792 return RX_CONTINUE;
793}
794
795static ieee80211_tx_result
796ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
797 struct sk_buff *skb)
798{
799 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
800 struct ieee80211_key *key = tx->key;
801 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
802 int hdrlen;
803 u8 *pos, iv_len = key->conf.iv_len;
804
805 if (info->control.hw_key &&
806 !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
807 /* hwaccel has no need for preallocated head room */
808 return TX_CONTINUE;
809 }
810
811 if (unlikely(skb_headroom(skb) < iv_len &&
812 pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
813 return TX_DROP;
814
815 hdrlen = ieee80211_hdrlen(hdr->frame_control);
816
817 pos = skb_push(skb, iv_len);
818 memmove(pos, pos + iv_len, hdrlen);
819
820 return TX_CONTINUE;
821}
822
823static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
824{
825 int i;
826
827 /* pn is little endian */
828 for (i = len - 1; i >= 0; i--) {
829 if (pn1[i] < pn2[i])
830 return -1;
831 else if (pn1[i] > pn2[i])
832 return 1;
833 }
834
835 return 0;
836}
837
838static ieee80211_rx_result
839ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
840{
841 struct ieee80211_key *key = rx->key;
842 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
843 const struct ieee80211_cipher_scheme *cs = NULL;
844 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
845 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
846 int data_len;
847 u8 *rx_pn;
848 u8 *skb_pn;
849 u8 qos_tid;
850
851 if (!rx->sta || !rx->sta->cipher_scheme ||
852 !(status->flag & RX_FLAG_DECRYPTED))
853 return RX_DROP_UNUSABLE;
854
855 if (!ieee80211_is_data(hdr->frame_control))
856 return RX_CONTINUE;
857
858 cs = rx->sta->cipher_scheme;
859
860 data_len = rx->skb->len - hdrlen - cs->hdr_len;
861
862 if (data_len < 0)
863 return RX_DROP_UNUSABLE;
864
865 if (ieee80211_is_data_qos(hdr->frame_control))
866 qos_tid = ieee80211_get_tid(hdr);
867 else
868 qos_tid = 0;
869
870 if (skb_linearize(rx->skb))
871 return RX_DROP_UNUSABLE;
872
873 hdr = (struct ieee80211_hdr *)rx->skb->data;
874
875 rx_pn = key->u.gen.rx_pn[qos_tid];
876 skb_pn = rx->skb->data + hdrlen + cs->pn_off;
877
878 if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
879 return RX_DROP_UNUSABLE;
880
881 memcpy(rx_pn, skb_pn, cs->pn_len);
882
883 /* remove security header and MIC */
884 if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
885 return RX_DROP_UNUSABLE;
886
887 memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
888 skb_pull(rx->skb, cs->hdr_len);
889
890 return RX_CONTINUE;
891}
892
893static void bip_aad(struct sk_buff *skb, u8 *aad)
894{
895 __le16 mask_fc;
896 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
897
898 /* BIP AAD: FC(masked) || A1 || A2 || A3 */
899
900 /* FC type/subtype */
901 /* Mask FC Retry, PwrMgt, MoreData flags to zero */
902 mask_fc = hdr->frame_control;
903 mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
904 IEEE80211_FCTL_MOREDATA);
905 put_unaligned(mask_fc, (__le16 *) &aad[0]);
906 /* A1 || A2 || A3 */
907 memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
908}
909
910
911static inline void bip_ipn_set64(u8 *d, u64 pn)
912{
913 *d++ = pn;
914 *d++ = pn >> 8;
915 *d++ = pn >> 16;
916 *d++ = pn >> 24;
917 *d++ = pn >> 32;
918 *d = pn >> 40;
919}
920
921static inline void bip_ipn_swap(u8 *d, const u8 *s)
922{
923 *d++ = s[5];
924 *d++ = s[4];
925 *d++ = s[3];
926 *d++ = s[2];
927 *d++ = s[1];
928 *d = s[0];
929}
930
931
932ieee80211_tx_result
933ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
934{
935 struct sk_buff *skb;
936 struct ieee80211_tx_info *info;
937 struct ieee80211_key *key = tx->key;
938 struct ieee80211_mmie *mmie;
939 u8 aad[20];
940 u64 pn64;
941
942 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
943 return TX_DROP;
944
945 skb = skb_peek(&tx->skbs);
946
947 info = IEEE80211_SKB_CB(skb);
948
949 if (info->control.hw_key &&
950 !(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIE))
951 return TX_CONTINUE;
952
953 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
954 return TX_DROP;
955
956 mmie = skb_put(skb, sizeof(*mmie));
957 mmie->element_id = WLAN_EID_MMIE;
958 mmie->length = sizeof(*mmie) - 2;
959 mmie->key_id = cpu_to_le16(key->conf.keyidx);
960
961 /* PN = PN + 1 */
962 pn64 = atomic64_inc_return(&key->conf.tx_pn);
963
964 bip_ipn_set64(mmie->sequence_number, pn64);
965
966 if (info->control.hw_key)
967 return TX_CONTINUE;
968
969 bip_aad(skb, aad);
970
971 /*
972 * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
973 */
974 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
975 skb->data + 24, skb->len - 24, mmie->mic);
976
977 return TX_CONTINUE;
978}
979
980ieee80211_tx_result
981ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
982{
983 struct sk_buff *skb;
984 struct ieee80211_tx_info *info;
985 struct ieee80211_key *key = tx->key;
986 struct ieee80211_mmie_16 *mmie;
987 u8 aad[20];
988 u64 pn64;
989
990 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
991 return TX_DROP;
992
993 skb = skb_peek(&tx->skbs);
994
995 info = IEEE80211_SKB_CB(skb);
996
997 if (info->control.hw_key)
998 return TX_CONTINUE;
999
1000 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1001 return TX_DROP;
1002
1003 mmie = skb_put(skb, sizeof(*mmie));
1004 mmie->element_id = WLAN_EID_MMIE;
1005 mmie->length = sizeof(*mmie) - 2;
1006 mmie->key_id = cpu_to_le16(key->conf.keyidx);
1007
1008 /* PN = PN + 1 */
1009 pn64 = atomic64_inc_return(&key->conf.tx_pn);
1010
1011 bip_ipn_set64(mmie->sequence_number, pn64);
1012
1013 bip_aad(skb, aad);
1014
1015 /* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
1016 */
1017 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1018 skb->data + 24, skb->len - 24, mmie->mic);
1019
1020 return TX_CONTINUE;
1021}
1022
1023ieee80211_rx_result
1024ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
1025{
1026 struct sk_buff *skb = rx->skb;
1027 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1028 struct ieee80211_key *key = rx->key;
1029 struct ieee80211_mmie *mmie;
1030 u8 aad[20], mic[8], ipn[6];
1031 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1032
1033 if (!ieee80211_is_mgmt(hdr->frame_control))
1034 return RX_CONTINUE;
1035
1036 /* management frames are already linear */
1037
1038 if (skb->len < 24 + sizeof(*mmie))
1039 return RX_DROP_UNUSABLE;
1040
1041 mmie = (struct ieee80211_mmie *)
1042 (skb->data + skb->len - sizeof(*mmie));
1043 if (mmie->element_id != WLAN_EID_MMIE ||
1044 mmie->length != sizeof(*mmie) - 2)
1045 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1046
1047 bip_ipn_swap(ipn, mmie->sequence_number);
1048
1049 if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1050 key->u.aes_cmac.replays++;
1051 return RX_DROP_UNUSABLE;
1052 }
1053
1054 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1055 /* hardware didn't decrypt/verify MIC */
1056 bip_aad(skb, aad);
1057 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
1058 skb->data + 24, skb->len - 24, mic);
1059 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1060 key->u.aes_cmac.icverrors++;
1061 return RX_DROP_UNUSABLE;
1062 }
1063 }
1064
1065 memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1066
1067 /* Remove MMIE */
1068 skb_trim(skb, skb->len - sizeof(*mmie));
1069
1070 return RX_CONTINUE;
1071}
1072
1073ieee80211_rx_result
1074ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
1075{
1076 struct sk_buff *skb = rx->skb;
1077 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1078 struct ieee80211_key *key = rx->key;
1079 struct ieee80211_mmie_16 *mmie;
1080 u8 aad[20], mic[16], ipn[6];
1081 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1082
1083 if (!ieee80211_is_mgmt(hdr->frame_control))
1084 return RX_CONTINUE;
1085
1086 /* management frames are already linear */
1087
1088 if (skb->len < 24 + sizeof(*mmie))
1089 return RX_DROP_UNUSABLE;
1090
1091 mmie = (struct ieee80211_mmie_16 *)
1092 (skb->data + skb->len - sizeof(*mmie));
1093 if (mmie->element_id != WLAN_EID_MMIE ||
1094 mmie->length != sizeof(*mmie) - 2)
1095 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1096
1097 bip_ipn_swap(ipn, mmie->sequence_number);
1098
1099 if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1100 key->u.aes_cmac.replays++;
1101 return RX_DROP_UNUSABLE;
1102 }
1103
1104 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1105 /* hardware didn't decrypt/verify MIC */
1106 bip_aad(skb, aad);
1107 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1108 skb->data + 24, skb->len - 24, mic);
1109 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1110 key->u.aes_cmac.icverrors++;
1111 return RX_DROP_UNUSABLE;
1112 }
1113 }
1114
1115 memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1116
1117 /* Remove MMIE */
1118 skb_trim(skb, skb->len - sizeof(*mmie));
1119
1120 return RX_CONTINUE;
1121}
1122
1123ieee80211_tx_result
1124ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
1125{
1126 struct sk_buff *skb;
1127 struct ieee80211_tx_info *info;
1128 struct ieee80211_key *key = tx->key;
1129 struct ieee80211_mmie_16 *mmie;
1130 struct ieee80211_hdr *hdr;
1131 u8 aad[GMAC_AAD_LEN];
1132 u64 pn64;
1133 u8 nonce[GMAC_NONCE_LEN];
1134
1135 if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
1136 return TX_DROP;
1137
1138 skb = skb_peek(&tx->skbs);
1139
1140 info = IEEE80211_SKB_CB(skb);
1141
1142 if (info->control.hw_key)
1143 return TX_CONTINUE;
1144
1145 if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1146 return TX_DROP;
1147
1148 mmie = skb_put(skb, sizeof(*mmie));
1149 mmie->element_id = WLAN_EID_MMIE;
1150 mmie->length = sizeof(*mmie) - 2;
1151 mmie->key_id = cpu_to_le16(key->conf.keyidx);
1152
1153 /* PN = PN + 1 */
1154 pn64 = atomic64_inc_return(&key->conf.tx_pn);
1155
1156 bip_ipn_set64(mmie->sequence_number, pn64);
1157
1158 bip_aad(skb, aad);
1159
1160 hdr = (struct ieee80211_hdr *)skb->data;
1161 memcpy(nonce, hdr->addr2, ETH_ALEN);
1162 bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
1163
1164 /* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
1165 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1166 skb->data + 24, skb->len - 24, mmie->mic) < 0)
1167 return TX_DROP;
1168
1169 return TX_CONTINUE;
1170}
1171
1172ieee80211_rx_result
1173ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
1174{
1175 struct sk_buff *skb = rx->skb;
1176 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1177 struct ieee80211_key *key = rx->key;
1178 struct ieee80211_mmie_16 *mmie;
1179 u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
1180 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1181
1182 if (!ieee80211_is_mgmt(hdr->frame_control))
1183 return RX_CONTINUE;
1184
1185 /* management frames are already linear */
1186
1187 if (skb->len < 24 + sizeof(*mmie))
1188 return RX_DROP_UNUSABLE;
1189
1190 mmie = (struct ieee80211_mmie_16 *)
1191 (skb->data + skb->len - sizeof(*mmie));
1192 if (mmie->element_id != WLAN_EID_MMIE ||
1193 mmie->length != sizeof(*mmie) - 2)
1194 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1195
1196 bip_ipn_swap(ipn, mmie->sequence_number);
1197
1198 if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
1199 key->u.aes_gmac.replays++;
1200 return RX_DROP_UNUSABLE;
1201 }
1202
1203 if (!(status->flag & RX_FLAG_DECRYPTED)) {
1204 /* hardware didn't decrypt/verify MIC */
1205 bip_aad(skb, aad);
1206
1207 memcpy(nonce, hdr->addr2, ETH_ALEN);
1208 memcpy(nonce + ETH_ALEN, ipn, 6);
1209
1210 mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC);
1211 if (!mic)
1212 return RX_DROP_UNUSABLE;
1213 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1214 skb->data + 24, skb->len - 24,
1215 mic) < 0 ||
1216 crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1217 key->u.aes_gmac.icverrors++;
1218 kfree(mic);
1219 return RX_DROP_UNUSABLE;
1220 }
1221 kfree(mic);
1222 }
1223
1224 memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
1225
1226 /* Remove MMIE */
1227 skb_trim(skb, skb->len - sizeof(*mmie));
1228
1229 return RX_CONTINUE;
1230}
1231
1232ieee80211_tx_result
1233ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
1234{
1235 struct sk_buff *skb;
1236 struct ieee80211_tx_info *info = NULL;
1237 ieee80211_tx_result res;
1238
1239 skb_queue_walk(&tx->skbs, skb) {
1240 info = IEEE80211_SKB_CB(skb);
1241
1242 /* handle hw-only algorithm */
1243 if (!info->control.hw_key)
1244 return TX_DROP;
1245
1246 if (tx->key->flags & KEY_FLAG_CIPHER_SCHEME) {
1247 res = ieee80211_crypto_cs_encrypt(tx, skb);
1248 if (res != TX_CONTINUE)
1249 return res;
1250 }
1251 }
1252
1253 ieee80211_tx_set_protected(tx);
1254
1255 return TX_CONTINUE;
1256}
1257
1258ieee80211_rx_result
1259ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
1260{
1261 if (rx->sta && rx->sta->cipher_scheme)
1262 return ieee80211_crypto_cs_decrypt(rx);
1263
1264 return RX_DROP_UNUSABLE;
1265}