1138568Ssam/*- 2178354Ssam * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 3138568Ssam * All rights reserved. 4138568Ssam * 5138568Ssam * Redistribution and use in source and binary forms, with or without 6138568Ssam * modification, are permitted provided that the following conditions 7138568Ssam * are met: 8138568Ssam * 1. Redistributions of source code must retain the above copyright 9138568Ssam * notice, this list of conditions and the following disclaimer. 10138568Ssam * 2. Redistributions in binary form must reproduce the above copyright 11138568Ssam * notice, this list of conditions and the following disclaimer in the 12138568Ssam * documentation and/or other materials provided with the distribution. 13138568Ssam * 14138568Ssam * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15138568Ssam * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16138568Ssam * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17138568Ssam * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18138568Ssam * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19138568Ssam * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20138568Ssam * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21138568Ssam * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22138568Ssam * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23138568Ssam * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24138568Ssam */ 25138568Ssam 26138568Ssam#include <sys/cdefs.h> 27138568Ssam__FBSDID("$FreeBSD$"); 28138568Ssam 29138568Ssam/* 30138568Ssam * IEEE 802.11i TKIP crypto support. 31138568Ssam * 32138568Ssam * Part of this module is derived from similar code in the Host 33138568Ssam * AP driver. The code is used with the consent of the author and 34138568Ssam * it's license is included below. 35138568Ssam */ 36178354Ssam#include "opt_wlan.h" 37178354Ssam 38138568Ssam#include <sys/param.h> 39138568Ssam#include <sys/systm.h> 40138568Ssam#include <sys/mbuf.h> 41138568Ssam#include <sys/malloc.h> 42138568Ssam#include <sys/kernel.h> 43138568Ssam#include <sys/module.h> 44138568Ssam#include <sys/endian.h> 45138568Ssam 46138568Ssam#include <sys/socket.h> 47138568Ssam 48138568Ssam#include <net/if.h> 49138568Ssam#include <net/if_media.h> 50138568Ssam#include <net/ethernet.h> 51138568Ssam 52138568Ssam#include <net80211/ieee80211_var.h> 53138568Ssam 54178354Ssamstatic void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *); 55138568Ssamstatic void tkip_detach(struct ieee80211_key *); 56138568Ssamstatic int tkip_setkey(struct ieee80211_key *); 57170530Ssamstatic int tkip_encap(struct ieee80211_key *, struct mbuf *m, uint8_t keyid); 58147045Ssamstatic int tkip_enmic(struct ieee80211_key *, struct mbuf *, int); 59147252Ssamstatic int tkip_decap(struct ieee80211_key *, struct mbuf *, int); 60147045Ssamstatic int tkip_demic(struct ieee80211_key *, struct mbuf *, int); 61138568Ssam 62138568Ssamstatic const struct ieee80211_cipher tkip = { 63138568Ssam .ic_name = "TKIP", 64138568Ssam .ic_cipher = IEEE80211_CIPHER_TKIP, 65138568Ssam .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + 66138568Ssam IEEE80211_WEP_EXTIVLEN, 67138568Ssam .ic_trailer = IEEE80211_WEP_CRCLEN, 68138568Ssam .ic_miclen = IEEE80211_WEP_MICLEN, 69138568Ssam .ic_attach = tkip_attach, 70138568Ssam .ic_detach = tkip_detach, 71138568Ssam .ic_setkey = tkip_setkey, 72138568Ssam .ic_encap = tkip_encap, 73138568Ssam .ic_decap = tkip_decap, 74138568Ssam .ic_enmic = tkip_enmic, 75138568Ssam .ic_demic = tkip_demic, 76138568Ssam}; 77138568Ssam 78138568Ssamtypedef uint8_t u8; 79138568Ssamtypedef uint16_t u16; 80138568Ssamtypedef uint32_t __u32; 81138568Ssamtypedef uint32_t u32; 82138568Ssam 83138568Ssamstruct tkip_ctx { 84178354Ssam struct ieee80211vap *tc_vap; /* for diagnostics+statistics */ 85138568Ssam 86138568Ssam u16 tx_ttak[5]; 87138568Ssam int tx_phase1_done; 88138568Ssam u8 tx_rc4key[16]; /* XXX for test module; make locals? */ 89138568Ssam 90138568Ssam u16 rx_ttak[5]; 91138568Ssam int rx_phase1_done; 92138568Ssam u8 rx_rc4key[16]; /* XXX for test module; make locals? */ 93138568Ssam uint64_t rx_rsc; /* held until MIC verified */ 94138568Ssam}; 95138568Ssam 96138568Ssamstatic void michael_mic(struct tkip_ctx *, const u8 *key, 97138568Ssam struct mbuf *m, u_int off, size_t data_len, 98138568Ssam u8 mic[IEEE80211_WEP_MICLEN]); 99138568Ssamstatic int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *, 100138568Ssam struct mbuf *, int hdr_len); 101138568Ssamstatic int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *, 102138568Ssam struct mbuf *, int hdr_len); 103138568Ssam 104153353Ssam/* number of references from net80211 layer */ 105153353Ssamstatic int nrefs = 0; 106153353Ssam 107138568Ssamstatic void * 108178354Ssamtkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k) 109138568Ssam{ 110138568Ssam struct tkip_ctx *ctx; 111138568Ssam 112186302Ssam ctx = (struct tkip_ctx *) malloc(sizeof(struct tkip_ctx), 113178354Ssam M_80211_CRYPTO, M_NOWAIT | M_ZERO); 114138568Ssam if (ctx == NULL) { 115178354Ssam vap->iv_stats.is_crypto_nomem++; 116138568Ssam return NULL; 117138568Ssam } 118138568Ssam 119178354Ssam ctx->tc_vap = vap; 120153353Ssam nrefs++; /* NB: we assume caller locking */ 121138568Ssam return ctx; 122138568Ssam} 123138568Ssam 124138568Ssamstatic void 125138568Ssamtkip_detach(struct ieee80211_key *k) 126138568Ssam{ 127138568Ssam struct tkip_ctx *ctx = k->wk_private; 128138568Ssam 129186302Ssam free(ctx, M_80211_CRYPTO); 130153353Ssam KASSERT(nrefs > 0, ("imbalanced attach/detach")); 131153353Ssam nrefs--; /* NB: we assume caller locking */ 132138568Ssam} 133138568Ssam 134138568Ssamstatic int 135138568Ssamtkip_setkey(struct ieee80211_key *k) 136138568Ssam{ 137138568Ssam struct tkip_ctx *ctx = k->wk_private; 138138568Ssam 139138568Ssam if (k->wk_keylen != (128/NBBY)) { 140138568Ssam (void) ctx; /* XXX */ 141178354Ssam IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO, 142138568Ssam "%s: Invalid key length %u, expecting %u\n", 143138568Ssam __func__, k->wk_keylen, 128/NBBY); 144138568Ssam return 0; 145138568Ssam } 146138568Ssam k->wk_keytsc = 1; /* TSC starts at 1 */ 147203673Sbschmidt ctx->rx_phase1_done = 0; 148138568Ssam return 1; 149138568Ssam} 150138568Ssam 151138568Ssam/* 152138568Ssam * Add privacy headers and do any s/w encryption required. 153138568Ssam */ 154138568Ssamstatic int 155170530Ssamtkip_encap(struct ieee80211_key *k, struct mbuf *m, uint8_t keyid) 156138568Ssam{ 157138568Ssam struct tkip_ctx *ctx = k->wk_private; 158178354Ssam struct ieee80211vap *vap = ctx->tc_vap; 159178354Ssam struct ieee80211com *ic = vap->iv_ic; 160170530Ssam uint8_t *ivp; 161138568Ssam int hdrlen; 162138568Ssam 163138568Ssam /* 164138568Ssam * Handle TKIP counter measures requirement. 165138568Ssam */ 166178354Ssam if (vap->iv_flags & IEEE80211_F_COUNTERM) { 167138568Ssam#ifdef IEEE80211_DEBUG 168138568Ssam struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 169138568Ssam#endif 170138568Ssam 171178354Ssam IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 172178354Ssam "discard frame due to countermeasures (%s)", __func__); 173178354Ssam vap->iv_stats.is_crypto_tkipcm++; 174138568Ssam return 0; 175138568Ssam } 176139508Ssam hdrlen = ieee80211_hdrspace(ic, mtod(m, void *)); 177138568Ssam 178138568Ssam /* 179138568Ssam * Copy down 802.11 header and add the IV, KeyID, and ExtIV. 180138568Ssam */ 181138568Ssam M_PREPEND(m, tkip.ic_header, M_NOWAIT); 182138568Ssam if (m == NULL) 183138568Ssam return 0; 184170530Ssam ivp = mtod(m, uint8_t *); 185138568Ssam memmove(ivp, ivp + tkip.ic_header, hdrlen); 186138568Ssam ivp += hdrlen; 187138568Ssam 188138568Ssam ivp[0] = k->wk_keytsc >> 8; /* TSC1 */ 189138568Ssam ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */ 190138568Ssam ivp[2] = k->wk_keytsc >> 0; /* TSC0 */ 191138568Ssam ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */ 192138568Ssam ivp[4] = k->wk_keytsc >> 16; /* TSC2 */ 193138568Ssam ivp[5] = k->wk_keytsc >> 24; /* TSC3 */ 194138568Ssam ivp[6] = k->wk_keytsc >> 32; /* TSC4 */ 195138568Ssam ivp[7] = k->wk_keytsc >> 40; /* TSC5 */ 196138568Ssam 197138568Ssam /* 198138568Ssam * Finally, do software encrypt if neeed. 199138568Ssam */ 200179394Ssam if (k->wk_flags & IEEE80211_KEY_SWENCRYPT) { 201138568Ssam if (!tkip_encrypt(ctx, k, m, hdrlen)) 202138568Ssam return 0; 203138568Ssam /* NB: tkip_encrypt handles wk_keytsc */ 204138568Ssam } else 205139510Ssam k->wk_keytsc++; 206138568Ssam 207138568Ssam return 1; 208138568Ssam} 209138568Ssam 210138568Ssam/* 211138568Ssam * Add MIC to the frame as needed. 212138568Ssam */ 213138568Ssamstatic int 214147045Ssamtkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force) 215138568Ssam{ 216138568Ssam struct tkip_ctx *ctx = k->wk_private; 217138568Ssam 218179394Ssam if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) { 219138568Ssam struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 220178354Ssam struct ieee80211vap *vap = ctx->tc_vap; 221178354Ssam struct ieee80211com *ic = vap->iv_ic; 222139508Ssam int hdrlen; 223138568Ssam uint8_t mic[IEEE80211_WEP_MICLEN]; 224138568Ssam 225178354Ssam vap->iv_stats.is_crypto_tkipenmic++; 226138568Ssam 227139508Ssam hdrlen = ieee80211_hdrspace(ic, wh); 228139508Ssam 229138568Ssam michael_mic(ctx, k->wk_txmic, 230138568Ssam m, hdrlen, m->m_pkthdr.len - hdrlen, mic); 231138568Ssam return m_append(m, tkip.ic_miclen, mic); 232138568Ssam } 233138568Ssam return 1; 234138568Ssam} 235138568Ssam 236138568Ssamstatic __inline uint64_t 237138568SsamREAD_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5) 238138568Ssam{ 239138568Ssam uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24); 240138568Ssam uint16_t iv16 = (b4 << 0) | (b5 << 8); 241138568Ssam return (((uint64_t)iv16) << 32) | iv32; 242138568Ssam} 243138568Ssam 244138568Ssam/* 245138568Ssam * Validate and strip privacy headers (and trailer) for a 246138568Ssam * received frame. If necessary, decrypt the frame using 247138568Ssam * the specified key. 248138568Ssam */ 249138568Ssamstatic int 250147252Ssamtkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen) 251138568Ssam{ 252138568Ssam struct tkip_ctx *ctx = k->wk_private; 253178354Ssam struct ieee80211vap *vap = ctx->tc_vap; 254138568Ssam struct ieee80211_frame *wh; 255178354Ssam uint8_t *ivp, tid; 256138568Ssam 257138568Ssam /* 258138568Ssam * Header should have extended IV and sequence number; 259138568Ssam * verify the former and validate the latter. 260138568Ssam */ 261138568Ssam wh = mtod(m, struct ieee80211_frame *); 262138568Ssam ivp = mtod(m, uint8_t *) + hdrlen; 263138568Ssam if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) { 264138568Ssam /* 265138568Ssam * No extended IV; discard frame. 266138568Ssam */ 267178354Ssam IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 268178354Ssam "%s", "missing ExtIV for TKIP cipher"); 269178354Ssam vap->iv_stats.is_rx_tkipformat++; 270138568Ssam return 0; 271138568Ssam } 272138568Ssam /* 273138568Ssam * Handle TKIP counter measures requirement. 274138568Ssam */ 275178354Ssam if (vap->iv_flags & IEEE80211_F_COUNTERM) { 276178354Ssam IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 277178354Ssam "discard frame due to countermeasures (%s)", __func__); 278178354Ssam vap->iv_stats.is_crypto_tkipcm++; 279138568Ssam return 0; 280138568Ssam } 281138568Ssam 282178354Ssam tid = ieee80211_gettid(wh); 283139510Ssam ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]); 284209636Sbschmidt if (ctx->rx_rsc <= k->wk_keyrsc[tid] && 285209636Sbschmidt (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) { 286138568Ssam /* 287138568Ssam * Replay violation; notify upper layer. 288138568Ssam */ 289193541Ssam ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid); 290178354Ssam vap->iv_stats.is_rx_tkipreplay++; 291138568Ssam return 0; 292138568Ssam } 293138568Ssam /* 294138568Ssam * NB: We can't update the rsc in the key until MIC is verified. 295138568Ssam * 296138568Ssam * We assume we are not preempted between doing the check above 297138568Ssam * and updating wk_keyrsc when stripping the MIC in tkip_demic. 298138568Ssam * Otherwise we might process another packet and discard it as 299138568Ssam * a replay. 300138568Ssam */ 301138568Ssam 302138568Ssam /* 303138568Ssam * Check if the device handled the decrypt in hardware. 304138568Ssam * If so we just strip the header; otherwise we need to 305138568Ssam * handle the decrypt in software. 306138568Ssam */ 307179394Ssam if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) && 308138568Ssam !tkip_decrypt(ctx, k, m, hdrlen)) 309138568Ssam return 0; 310138568Ssam 311138568Ssam /* 312138568Ssam * Copy up 802.11 header and strip crypto bits. 313138568Ssam */ 314138568Ssam memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen); 315138568Ssam m_adj(m, tkip.ic_header); 316138568Ssam m_adj(m, -tkip.ic_trailer); 317138568Ssam 318138568Ssam return 1; 319138568Ssam} 320138568Ssam 321138568Ssam/* 322138568Ssam * Verify and strip MIC from the frame. 323138568Ssam */ 324138568Ssamstatic int 325147045Ssamtkip_demic(struct ieee80211_key *k, struct mbuf *m, int force) 326138568Ssam{ 327138568Ssam struct tkip_ctx *ctx = k->wk_private; 328178354Ssam struct ieee80211_frame *wh; 329178354Ssam uint8_t tid; 330138568Ssam 331178354Ssam wh = mtod(m, struct ieee80211_frame *); 332179394Ssam if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) { 333178354Ssam struct ieee80211vap *vap = ctx->tc_vap; 334178354Ssam int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh); 335138568Ssam u8 mic[IEEE80211_WEP_MICLEN]; 336138568Ssam u8 mic0[IEEE80211_WEP_MICLEN]; 337138568Ssam 338178354Ssam vap->iv_stats.is_crypto_tkipdemic++; 339138568Ssam 340138568Ssam michael_mic(ctx, k->wk_rxmic, 341138568Ssam m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen), 342138568Ssam mic); 343138568Ssam m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen, 344138568Ssam tkip.ic_miclen, mic0); 345138568Ssam if (memcmp(mic, mic0, tkip.ic_miclen)) { 346138568Ssam /* NB: 802.11 layer handles statistic and debug msg */ 347178354Ssam ieee80211_notify_michael_failure(vap, wh, 348148863Ssam k->wk_rxkeyix != IEEE80211_KEYIX_NONE ? 349148863Ssam k->wk_rxkeyix : k->wk_keyix); 350138568Ssam return 0; 351138568Ssam } 352138568Ssam } 353138568Ssam /* 354138568Ssam * Strip MIC from the tail. 355138568Ssam */ 356138568Ssam m_adj(m, -tkip.ic_miclen); 357138568Ssam 358138568Ssam /* 359138568Ssam * Ok to update rsc now that MIC has been verified. 360138568Ssam */ 361178354Ssam tid = ieee80211_gettid(wh); 362178354Ssam k->wk_keyrsc[tid] = ctx->rx_rsc; 363138568Ssam 364138568Ssam return 1; 365138568Ssam} 366138568Ssam 367138568Ssam/* 368138568Ssam * Host AP crypt: host-based TKIP encryption implementation for Host AP driver 369138568Ssam * 370138568Ssam * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 371138568Ssam * 372138568Ssam * This program is free software; you can redistribute it and/or modify 373138568Ssam * it under the terms of the GNU General Public License version 2 as 374138568Ssam * published by the Free Software Foundation. See README and COPYING for 375138568Ssam * more details. 376138568Ssam * 377138568Ssam * Alternatively, this software may be distributed under the terms of BSD 378138568Ssam * license. 379138568Ssam */ 380138568Ssam 381138568Ssamstatic const __u32 crc32_table[256] = { 382138568Ssam 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, 383138568Ssam 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, 384138568Ssam 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 385138568Ssam 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, 386138568Ssam 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, 387138568Ssam 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, 388138568Ssam 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 389138568Ssam 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, 390138568Ssam 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, 391138568Ssam 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, 392138568Ssam 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 393138568Ssam 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, 394138568Ssam 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, 395138568Ssam 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, 396138568Ssam 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 397138568Ssam 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, 398138568Ssam 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, 399138568Ssam 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, 400138568Ssam 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 401138568Ssam 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, 402138568Ssam 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, 403138568Ssam 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, 404138568Ssam 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, 405138568Ssam 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, 406138568Ssam 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, 407138568Ssam 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, 408138568Ssam 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, 409138568Ssam 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, 410138568Ssam 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, 411138568Ssam 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, 412138568Ssam 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 413138568Ssam 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, 414138568Ssam 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, 415138568Ssam 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, 416138568Ssam 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 417138568Ssam 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, 418138568Ssam 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, 419138568Ssam 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, 420138568Ssam 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 421138568Ssam 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, 422138568Ssam 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, 423138568Ssam 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, 424138568Ssam 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 425138568Ssam 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, 426138568Ssam 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, 427138568Ssam 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, 428138568Ssam 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 429138568Ssam 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, 430138568Ssam 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, 431138568Ssam 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, 432138568Ssam 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 433138568Ssam 0x2d02ef8dL 434138568Ssam}; 435138568Ssam 436138568Ssamstatic __inline u16 RotR1(u16 val) 437138568Ssam{ 438138568Ssam return (val >> 1) | (val << 15); 439138568Ssam} 440138568Ssam 441138568Ssamstatic __inline u8 Lo8(u16 val) 442138568Ssam{ 443138568Ssam return val & 0xff; 444138568Ssam} 445138568Ssam 446138568Ssamstatic __inline u8 Hi8(u16 val) 447138568Ssam{ 448138568Ssam return val >> 8; 449138568Ssam} 450138568Ssam 451138568Ssamstatic __inline u16 Lo16(u32 val) 452138568Ssam{ 453138568Ssam return val & 0xffff; 454138568Ssam} 455138568Ssam 456138568Ssamstatic __inline u16 Hi16(u32 val) 457138568Ssam{ 458138568Ssam return val >> 16; 459138568Ssam} 460138568Ssam 461138568Ssamstatic __inline u16 Mk16(u8 hi, u8 lo) 462138568Ssam{ 463138568Ssam return lo | (((u16) hi) << 8); 464138568Ssam} 465138568Ssam 466138568Ssamstatic __inline u16 Mk16_le(const u16 *v) 467138568Ssam{ 468138568Ssam return le16toh(*v); 469138568Ssam} 470138568Ssam 471138568Ssamstatic const u16 Sbox[256] = { 472138568Ssam 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 473138568Ssam 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 474138568Ssam 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 475138568Ssam 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 476138568Ssam 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, 477138568Ssam 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, 478138568Ssam 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, 479138568Ssam 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, 480138568Ssam 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, 481138568Ssam 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 482138568Ssam 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 483138568Ssam 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 484138568Ssam 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 485138568Ssam 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, 486138568Ssam 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, 487138568Ssam 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, 488138568Ssam 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, 489138568Ssam 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, 490138568Ssam 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 491138568Ssam 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 492138568Ssam 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 493138568Ssam 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 494138568Ssam 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, 495138568Ssam 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, 496138568Ssam 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, 497138568Ssam 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, 498138568Ssam 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, 499138568Ssam 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 500138568Ssam 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 501138568Ssam 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 502138568Ssam 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 503138568Ssam 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, 504138568Ssam}; 505138568Ssam 506138568Ssamstatic __inline u16 _S_(u16 v) 507138568Ssam{ 508138568Ssam u16 t = Sbox[Hi8(v)]; 509138568Ssam return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8)); 510138568Ssam} 511138568Ssam 512138568Ssam#define PHASE1_LOOP_COUNT 8 513138568Ssam 514138568Ssamstatic void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32) 515138568Ssam{ 516138568Ssam int i, j; 517138568Ssam 518138568Ssam /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */ 519138568Ssam TTAK[0] = Lo16(IV32); 520138568Ssam TTAK[1] = Hi16(IV32); 521138568Ssam TTAK[2] = Mk16(TA[1], TA[0]); 522138568Ssam TTAK[3] = Mk16(TA[3], TA[2]); 523138568Ssam TTAK[4] = Mk16(TA[5], TA[4]); 524138568Ssam 525138568Ssam for (i = 0; i < PHASE1_LOOP_COUNT; i++) { 526138568Ssam j = 2 * (i & 1); 527138568Ssam TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j])); 528138568Ssam TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j])); 529138568Ssam TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j])); 530138568Ssam TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j])); 531138568Ssam TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i; 532138568Ssam } 533138568Ssam} 534138568Ssam 535138568Ssam#ifndef _BYTE_ORDER 536138568Ssam#error "Don't know native byte order" 537138568Ssam#endif 538138568Ssam 539138568Ssamstatic void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK, 540138568Ssam u16 IV16) 541138568Ssam{ 542138568Ssam /* Make temporary area overlap WEP seed so that the final copy can be 543138568Ssam * avoided on little endian hosts. */ 544138568Ssam u16 *PPK = (u16 *) &WEPSeed[4]; 545138568Ssam 546138568Ssam /* Step 1 - make copy of TTAK and bring in TSC */ 547138568Ssam PPK[0] = TTAK[0]; 548138568Ssam PPK[1] = TTAK[1]; 549138568Ssam PPK[2] = TTAK[2]; 550138568Ssam PPK[3] = TTAK[3]; 551138568Ssam PPK[4] = TTAK[4]; 552138568Ssam PPK[5] = TTAK[4] + IV16; 553138568Ssam 554138568Ssam /* Step 2 - 96-bit bijective mixing using S-box */ 555138568Ssam PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0])); 556138568Ssam PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2])); 557138568Ssam PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4])); 558138568Ssam PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6])); 559138568Ssam PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8])); 560138568Ssam PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10])); 561138568Ssam 562138568Ssam PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12])); 563138568Ssam PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14])); 564138568Ssam PPK[2] += RotR1(PPK[1]); 565138568Ssam PPK[3] += RotR1(PPK[2]); 566138568Ssam PPK[4] += RotR1(PPK[3]); 567138568Ssam PPK[5] += RotR1(PPK[4]); 568138568Ssam 569138568Ssam /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value 570138568Ssam * WEPSeed[0..2] is transmitted as WEP IV */ 571138568Ssam WEPSeed[0] = Hi8(IV16); 572138568Ssam WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F; 573138568Ssam WEPSeed[2] = Lo8(IV16); 574138568Ssam WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1); 575138568Ssam 576138568Ssam#if _BYTE_ORDER == _BIG_ENDIAN 577138568Ssam { 578138568Ssam int i; 579138568Ssam for (i = 0; i < 6; i++) 580138568Ssam PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8); 581138568Ssam } 582138568Ssam#endif 583138568Ssam} 584138568Ssam 585138568Ssamstatic void 586138568Ssamwep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len, 587138568Ssam uint8_t icv[IEEE80211_WEP_CRCLEN]) 588138568Ssam{ 589138568Ssam u32 i, j, k, crc; 590138568Ssam size_t buflen; 591138568Ssam u8 S[256]; 592138568Ssam u8 *pos; 593138568Ssam struct mbuf *m; 594138568Ssam#define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0) 595138568Ssam 596138568Ssam /* Setup RC4 state */ 597138568Ssam for (i = 0; i < 256; i++) 598138568Ssam S[i] = i; 599138568Ssam j = 0; 600138568Ssam for (i = 0; i < 256; i++) { 601138568Ssam j = (j + S[i] + key[i & 0x0f]) & 0xff; 602138568Ssam S_SWAP(i, j); 603138568Ssam } 604138568Ssam 605138568Ssam /* Compute CRC32 over unencrypted data and apply RC4 to data */ 606138568Ssam crc = ~0; 607138568Ssam i = j = 0; 608138568Ssam m = m0; 609138568Ssam pos = mtod(m, uint8_t *) + off; 610138568Ssam buflen = m->m_len - off; 611138568Ssam for (;;) { 612138568Ssam if (buflen > data_len) 613138568Ssam buflen = data_len; 614138568Ssam data_len -= buflen; 615138568Ssam for (k = 0; k < buflen; k++) { 616138568Ssam crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 617138568Ssam i = (i + 1) & 0xff; 618138568Ssam j = (j + S[i]) & 0xff; 619138568Ssam S_SWAP(i, j); 620138568Ssam *pos++ ^= S[(S[i] + S[j]) & 0xff]; 621138568Ssam } 622138568Ssam m = m->m_next; 623138568Ssam if (m == NULL) { 624138568Ssam KASSERT(data_len == 0, 625138609Ssam ("out of buffers with data_len %zu\n", data_len)); 626138568Ssam break; 627138568Ssam } 628138568Ssam pos = mtod(m, uint8_t *); 629138568Ssam buflen = m->m_len; 630138568Ssam } 631138568Ssam crc = ~crc; 632138568Ssam 633138568Ssam /* Append little-endian CRC32 and encrypt it to produce ICV */ 634138568Ssam icv[0] = crc; 635138568Ssam icv[1] = crc >> 8; 636138568Ssam icv[2] = crc >> 16; 637138568Ssam icv[3] = crc >> 24; 638138568Ssam for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) { 639138568Ssam i = (i + 1) & 0xff; 640138568Ssam j = (j + S[i]) & 0xff; 641138568Ssam S_SWAP(i, j); 642138568Ssam icv[k] ^= S[(S[i] + S[j]) & 0xff]; 643138568Ssam } 644138568Ssam} 645138568Ssam 646138568Ssamstatic int 647138568Ssamwep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len) 648138568Ssam{ 649138568Ssam u32 i, j, k, crc; 650138568Ssam u8 S[256]; 651138568Ssam u8 *pos, icv[4]; 652138568Ssam size_t buflen; 653138568Ssam 654138568Ssam /* Setup RC4 state */ 655138568Ssam for (i = 0; i < 256; i++) 656138568Ssam S[i] = i; 657138568Ssam j = 0; 658138568Ssam for (i = 0; i < 256; i++) { 659138568Ssam j = (j + S[i] + key[i & 0x0f]) & 0xff; 660138568Ssam S_SWAP(i, j); 661138568Ssam } 662138568Ssam 663138568Ssam /* Apply RC4 to data and compute CRC32 over decrypted data */ 664138568Ssam crc = ~0; 665138568Ssam i = j = 0; 666138568Ssam pos = mtod(m, uint8_t *) + off; 667138568Ssam buflen = m->m_len - off; 668138568Ssam for (;;) { 669138568Ssam if (buflen > data_len) 670138568Ssam buflen = data_len; 671138568Ssam data_len -= buflen; 672138568Ssam for (k = 0; k < buflen; k++) { 673138568Ssam i = (i + 1) & 0xff; 674138568Ssam j = (j + S[i]) & 0xff; 675138568Ssam S_SWAP(i, j); 676138568Ssam *pos ^= S[(S[i] + S[j]) & 0xff]; 677138568Ssam crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 678138568Ssam pos++; 679138568Ssam } 680138568Ssam m = m->m_next; 681138568Ssam if (m == NULL) { 682138568Ssam KASSERT(data_len == 0, 683138609Ssam ("out of buffers with data_len %zu\n", data_len)); 684138568Ssam break; 685138568Ssam } 686138568Ssam pos = mtod(m, uint8_t *); 687138568Ssam buflen = m->m_len; 688138568Ssam } 689138568Ssam crc = ~crc; 690138568Ssam 691138568Ssam /* Encrypt little-endian CRC32 and verify that it matches with the 692138568Ssam * received ICV */ 693138568Ssam icv[0] = crc; 694138568Ssam icv[1] = crc >> 8; 695138568Ssam icv[2] = crc >> 16; 696138568Ssam icv[3] = crc >> 24; 697138568Ssam for (k = 0; k < 4; k++) { 698138568Ssam i = (i + 1) & 0xff; 699138568Ssam j = (j + S[i]) & 0xff; 700138568Ssam S_SWAP(i, j); 701138568Ssam if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) { 702138568Ssam /* ICV mismatch - drop frame */ 703138568Ssam return -1; 704138568Ssam } 705138568Ssam } 706138568Ssam 707138568Ssam return 0; 708138568Ssam} 709138568Ssam 710138568Ssam 711138568Ssamstatic __inline u32 rotl(u32 val, int bits) 712138568Ssam{ 713138568Ssam return (val << bits) | (val >> (32 - bits)); 714138568Ssam} 715138568Ssam 716138568Ssam 717138568Ssamstatic __inline u32 rotr(u32 val, int bits) 718138568Ssam{ 719138568Ssam return (val >> bits) | (val << (32 - bits)); 720138568Ssam} 721138568Ssam 722138568Ssam 723138568Ssamstatic __inline u32 xswap(u32 val) 724138568Ssam{ 725138568Ssam return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8); 726138568Ssam} 727138568Ssam 728138568Ssam 729138568Ssam#define michael_block(l, r) \ 730138568Ssamdo { \ 731138568Ssam r ^= rotl(l, 17); \ 732138568Ssam l += r; \ 733138568Ssam r ^= xswap(l); \ 734138568Ssam l += r; \ 735138568Ssam r ^= rotl(l, 3); \ 736138568Ssam l += r; \ 737138568Ssam r ^= rotr(l, 2); \ 738138568Ssam l += r; \ 739138568Ssam} while (0) 740138568Ssam 741138568Ssam 742138568Ssamstatic __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3) 743138568Ssam{ 744138568Ssam return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24); 745138568Ssam} 746138568Ssam 747138568Ssamstatic __inline u32 get_le32(const u8 *p) 748138568Ssam{ 749138568Ssam return get_le32_split(p[0], p[1], p[2], p[3]); 750138568Ssam} 751138568Ssam 752138568Ssam 753138568Ssamstatic __inline void put_le32(u8 *p, u32 v) 754138568Ssam{ 755138568Ssam p[0] = v; 756138568Ssam p[1] = v >> 8; 757138568Ssam p[2] = v >> 16; 758138568Ssam p[3] = v >> 24; 759138568Ssam} 760138568Ssam 761138568Ssam/* 762138568Ssam * Craft pseudo header used to calculate the MIC. 763138568Ssam */ 764138568Ssamstatic void 765138568Ssammichael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16]) 766138568Ssam{ 767138568Ssam const struct ieee80211_frame_addr4 *wh = 768138568Ssam (const struct ieee80211_frame_addr4 *) wh0; 769138568Ssam 770138568Ssam switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 771138568Ssam case IEEE80211_FC1_DIR_NODS: 772138568Ssam IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 773138568Ssam IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 774138568Ssam break; 775138568Ssam case IEEE80211_FC1_DIR_TODS: 776138568Ssam IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 777138568Ssam IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 778138568Ssam break; 779138568Ssam case IEEE80211_FC1_DIR_FROMDS: 780138568Ssam IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 781138568Ssam IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3); 782138568Ssam break; 783138568Ssam case IEEE80211_FC1_DIR_DSTODS: 784138568Ssam IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 785138568Ssam IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4); 786138568Ssam break; 787138568Ssam } 788138568Ssam 789139511Ssam if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) { 790139511Ssam const struct ieee80211_qosframe *qwh = 791139511Ssam (const struct ieee80211_qosframe *) wh; 792139511Ssam hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID; 793139511Ssam } else 794139511Ssam hdr[12] = 0; 795138568Ssam hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */ 796138568Ssam} 797138568Ssam 798138568Ssamstatic void 799138568Ssammichael_mic(struct tkip_ctx *ctx, const u8 *key, 800138568Ssam struct mbuf *m, u_int off, size_t data_len, 801138568Ssam u8 mic[IEEE80211_WEP_MICLEN]) 802138568Ssam{ 803138568Ssam uint8_t hdr[16]; 804138568Ssam u32 l, r; 805138568Ssam const uint8_t *data; 806138568Ssam u_int space; 807138568Ssam 808138568Ssam michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr); 809138568Ssam 810138568Ssam l = get_le32(key); 811138568Ssam r = get_le32(key + 4); 812138568Ssam 813138568Ssam /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ 814138568Ssam l ^= get_le32(hdr); 815138568Ssam michael_block(l, r); 816138568Ssam l ^= get_le32(&hdr[4]); 817138568Ssam michael_block(l, r); 818138568Ssam l ^= get_le32(&hdr[8]); 819138568Ssam michael_block(l, r); 820138568Ssam l ^= get_le32(&hdr[12]); 821138568Ssam michael_block(l, r); 822138568Ssam 823138568Ssam /* first buffer has special handling */ 824138568Ssam data = mtod(m, const uint8_t *) + off; 825138568Ssam space = m->m_len - off; 826138568Ssam for (;;) { 827138568Ssam if (space > data_len) 828138568Ssam space = data_len; 829138568Ssam /* collect 32-bit blocks from current buffer */ 830138568Ssam while (space >= sizeof(uint32_t)) { 831138568Ssam l ^= get_le32(data); 832138568Ssam michael_block(l, r); 833138568Ssam data += sizeof(uint32_t), space -= sizeof(uint32_t); 834138568Ssam data_len -= sizeof(uint32_t); 835138568Ssam } 836182434Ssam /* 837182434Ssam * NB: when space is zero we make one more trip around 838182434Ssam * the loop to advance to the next mbuf where there is 839182434Ssam * data. This handles the case where there are 4*n 840182434Ssam * bytes in an mbuf followed by <4 bytes in a later mbuf. 841182434Ssam * By making an extra trip we'll drop out of the loop 842182434Ssam * with m pointing at the mbuf with 3 bytes and space 843182434Ssam * set as required by the remainder handling below. 844182434Ssam */ 845182434Ssam if (data_len == 0 || 846182434Ssam (data_len < sizeof(uint32_t) && space != 0)) 847138568Ssam break; 848138568Ssam m = m->m_next; 849138568Ssam if (m == NULL) { 850138609Ssam KASSERT(0, ("out of data, data_len %zu\n", data_len)); 851138568Ssam break; 852138568Ssam } 853138568Ssam if (space != 0) { 854138568Ssam const uint8_t *data_next; 855138568Ssam /* 856138568Ssam * Block straddles buffers, split references. 857138568Ssam */ 858138568Ssam data_next = mtod(m, const uint8_t *); 859138568Ssam KASSERT(m->m_len >= sizeof(uint32_t) - space, 860138568Ssam ("not enough data in following buffer, " 861138609Ssam "m_len %u need %zu\n", m->m_len, 862138568Ssam sizeof(uint32_t) - space)); 863138568Ssam switch (space) { 864138568Ssam case 1: 865138568Ssam l ^= get_le32_split(data[0], data_next[0], 866138568Ssam data_next[1], data_next[2]); 867138568Ssam data = data_next + 3; 868138568Ssam space = m->m_len - 3; 869138568Ssam break; 870138568Ssam case 2: 871138568Ssam l ^= get_le32_split(data[0], data[1], 872138568Ssam data_next[0], data_next[1]); 873138568Ssam data = data_next + 2; 874138568Ssam space = m->m_len - 2; 875138568Ssam break; 876138568Ssam case 3: 877138568Ssam l ^= get_le32_split(data[0], data[1], 878138568Ssam data[2], data_next[0]); 879138568Ssam data = data_next + 1; 880138568Ssam space = m->m_len - 1; 881138568Ssam break; 882138568Ssam } 883138568Ssam michael_block(l, r); 884138568Ssam data_len -= sizeof(uint32_t); 885138568Ssam } else { 886138568Ssam /* 887138568Ssam * Setup for next buffer. 888138568Ssam */ 889138568Ssam data = mtod(m, const uint8_t *); 890138568Ssam space = m->m_len; 891138568Ssam } 892138568Ssam } 893182434Ssam /* 894182434Ssam * Catch degenerate cases like mbuf[4*n+1 bytes] followed by 895182434Ssam * mbuf[2 bytes]. I don't believe these should happen; if they 896182434Ssam * do then we'll need more involved logic. 897182434Ssam */ 898182434Ssam KASSERT(data_len <= space, 899182437Savatar ("not enough data, data_len %zu space %u\n", data_len, space)); 900182434Ssam 901138568Ssam /* Last block and padding (0x5a, 4..7 x 0) */ 902138568Ssam switch (data_len) { 903138568Ssam case 0: 904138568Ssam l ^= get_le32_split(0x5a, 0, 0, 0); 905138568Ssam break; 906138568Ssam case 1: 907138568Ssam l ^= get_le32_split(data[0], 0x5a, 0, 0); 908138568Ssam break; 909138568Ssam case 2: 910138568Ssam l ^= get_le32_split(data[0], data[1], 0x5a, 0); 911138568Ssam break; 912138568Ssam case 3: 913138568Ssam l ^= get_le32_split(data[0], data[1], data[2], 0x5a); 914138568Ssam break; 915138568Ssam } 916138568Ssam michael_block(l, r); 917138568Ssam /* l ^= 0; */ 918138568Ssam michael_block(l, r); 919138568Ssam 920138568Ssam put_le32(mic, l); 921138568Ssam put_le32(mic + 4, r); 922138568Ssam} 923138568Ssam 924138568Ssamstatic int 925138568Ssamtkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 926138568Ssam struct mbuf *m, int hdrlen) 927138568Ssam{ 928138568Ssam struct ieee80211_frame *wh; 929138568Ssam uint8_t icv[IEEE80211_WEP_CRCLEN]; 930138568Ssam 931178354Ssam ctx->tc_vap->iv_stats.is_crypto_tkip++; 932138568Ssam 933138568Ssam wh = mtod(m, struct ieee80211_frame *); 934138568Ssam if (!ctx->tx_phase1_done) { 935138568Ssam tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2, 936138568Ssam (u32)(key->wk_keytsc >> 16)); 937138568Ssam ctx->tx_phase1_done = 1; 938138568Ssam } 939138568Ssam tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak, 940138568Ssam (u16) key->wk_keytsc); 941138568Ssam 942138568Ssam wep_encrypt(ctx->tx_rc4key, 943138568Ssam m, hdrlen + tkip.ic_header, 944138568Ssam m->m_pkthdr.len - (hdrlen + tkip.ic_header), 945138568Ssam icv); 946138568Ssam (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */ 947138568Ssam 948139510Ssam key->wk_keytsc++; 949138568Ssam if ((u16)(key->wk_keytsc) == 0) 950138568Ssam ctx->tx_phase1_done = 0; 951138568Ssam return 1; 952138568Ssam} 953138568Ssam 954138568Ssamstatic int 955138568Ssamtkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 956138568Ssam struct mbuf *m, int hdrlen) 957138568Ssam{ 958138568Ssam struct ieee80211_frame *wh; 959178354Ssam struct ieee80211vap *vap = ctx->tc_vap; 960138568Ssam u32 iv32; 961138568Ssam u16 iv16; 962178354Ssam u8 tid; 963138568Ssam 964178354Ssam vap->iv_stats.is_crypto_tkip++; 965138568Ssam 966138568Ssam wh = mtod(m, struct ieee80211_frame *); 967138568Ssam /* NB: tkip_decap already verified header and left seq in rx_rsc */ 968138568Ssam iv16 = (u16) ctx->rx_rsc; 969138568Ssam iv32 = (u32) (ctx->rx_rsc >> 16); 970138568Ssam 971178354Ssam tid = ieee80211_gettid(wh); 972178354Ssam if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) { 973138568Ssam tkip_mixing_phase1(ctx->rx_ttak, key->wk_key, 974138568Ssam wh->i_addr2, iv32); 975138568Ssam ctx->rx_phase1_done = 1; 976138568Ssam } 977138568Ssam tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16); 978138568Ssam 979138568Ssam /* NB: m is unstripped; deduct headers + ICV to get payload */ 980138568Ssam if (wep_decrypt(ctx->rx_rc4key, 981138568Ssam m, hdrlen + tkip.ic_header, 982138568Ssam m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) { 983178354Ssam if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) { 984138568Ssam /* Previously cached Phase1 result was already lost, so 985138568Ssam * it needs to be recalculated for the next packet. */ 986138568Ssam ctx->rx_phase1_done = 0; 987138568Ssam } 988178354Ssam IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 989178354Ssam "%s", "TKIP ICV mismatch on decrypt"); 990178354Ssam vap->iv_stats.is_rx_tkipicv++; 991138568Ssam return 0; 992138568Ssam } 993138568Ssam return 1; 994138568Ssam} 995138568Ssam 996138568Ssam/* 997138568Ssam * Module glue. 998138568Ssam */ 999170530SsamIEEE80211_CRYPTO_MODULE(tkip, 1); 1000