2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
17 * Alternatively, this software may be distributed under the terms of the
18 * GNU General Public License ("GPL") version 2 as published by the Free
19 * Software Foundation.
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 * $Id: ieee80211_crypto.c 3710 2008-06-06 20:32:29Z mentor $
39 * IEEE 802.11 generic crypto support.
41 #ifndef AUTOCONF_INCLUDED
42 #include <linux/config.h>
44 #include <linux/version.h>
45 #include <linux/module.h>
46 #include <linux/kmod.h>
47 #include <linux/skbuff.h>
48 #include <linux/netdevice.h>
49 #include <linux/random.h>
51 #include "if_ethersubr.h" /* for ETHER_HDR_LEN */
54 #include <net80211/ieee80211_var.h>
57 * Table of registered cipher modules.
59 static const struct ieee80211_cipher
*ciphers
[IEEE80211_CIPHER_MAX
];
61 static int ieee80211_crypto_delkey_locked(struct ieee80211vap
*,
62 struct ieee80211_key
*, struct ieee80211_node
*);
65 * Default "null" key management routines.
67 static ieee80211_keyix_t
68 null_key_alloc(struct ieee80211vap
*vap
, const struct ieee80211_key
*k
)
70 return IEEE80211_KEYIX_NONE
;
73 null_key_delete(struct ieee80211vap
*vap
, const struct ieee80211_key
*k
,
74 struct ieee80211_node
*ni
)
79 null_key_set(struct ieee80211vap
*vap
, const struct ieee80211_key
*k
,
80 const u_int8_t mac
[IEEE80211_ADDR_LEN
])
84 static void null_key_update(struct ieee80211vap
*vap
)
88 #ifdef ATH_SUPERG_COMP
90 null_comp_set(struct ieee80211vap
*vap
, struct ieee80211_node
*ni
,
97 * Write-arounds for common operations.
100 cipher_detach(struct ieee80211_key
*key
)
102 key
->wk_cipher
->ic_detach(key
);
105 static __inline
void *
106 cipher_attach(struct ieee80211vap
*vap
, struct ieee80211_key
*key
)
108 return key
->wk_cipher
->ic_attach(vap
, key
);
112 * Wrappers for driver key management methods.
114 static __inline ieee80211_keyix_t
115 dev_key_alloc(struct ieee80211vap
*vap
, const struct ieee80211_key
*key
)
117 return vap
->iv_key_alloc(vap
, key
);
121 dev_key_delete(struct ieee80211vap
*vap
, const struct ieee80211_key
*key
,
122 struct ieee80211_node
*ni
)
124 return vap
->iv_key_delete(vap
, key
, ni
);
128 dev_key_set(struct ieee80211vap
*vap
, const struct ieee80211_key
*key
,
129 const u_int8_t mac
[IEEE80211_ADDR_LEN
])
131 return vap
->iv_key_set(vap
, key
, mac
);
134 #ifdef ATH_SUPERG_COMP
136 dev_comp_set(struct ieee80211vap
*vap
, struct ieee80211_node
*ni
, int en
)
138 return vap
->iv_comp_set(vap
, ni
, en
);
143 * Setup crypto support for a device/shared instance.
146 ieee80211_crypto_attach(struct ieee80211com
*ic
)
148 /* NB: we assume everything is pre-zero'd */
149 ciphers
[IEEE80211_CIPHER_NONE
] = &ieee80211_cipher_none
;
151 EXPORT_SYMBOL(ieee80211_crypto_attach
);
154 * Teardown crypto support.
157 ieee80211_crypto_detach(struct ieee80211com
*ic
)
160 EXPORT_SYMBOL(ieee80211_crypto_detach
);
163 * Setup crypto support for a VAP.
166 ieee80211_crypto_vattach(struct ieee80211vap
*vap
)
170 /* NB: We assume everything is pre-zeroed */
171 vap
->iv_def_txkey
= IEEE80211_KEYIX_NONE
;
172 for (i
= 0; i
< IEEE80211_WEP_NKID
; i
++)
173 ieee80211_crypto_resetkey(vap
, &vap
->iv_nw_keys
[i
],
174 IEEE80211_KEYIX_NONE
);
176 * Initialize the driver key support routines to noop entries.
177 * This is useful especially for the cipher test modules.
179 vap
->iv_key_alloc
= null_key_alloc
;
180 vap
->iv_key_set
= null_key_set
;
181 vap
->iv_key_delete
= null_key_delete
;
182 vap
->iv_key_update_begin
= null_key_update
;
183 vap
->iv_key_update_end
= null_key_update
;
184 #ifdef ATH_SUPERG_COMP
185 vap
->iv_comp_set
= null_comp_set
;
188 EXPORT_SYMBOL(ieee80211_crypto_vattach
);
191 * Teardown crypto support for a vap.
194 ieee80211_crypto_vdetach(struct ieee80211vap
*vap
)
196 ieee80211_crypto_delglobalkeys(vap
);
198 EXPORT_SYMBOL(ieee80211_crypto_vdetach
);
201 * Register a crypto cipher module.
204 ieee80211_crypto_register(const struct ieee80211_cipher
*cip
)
206 if (cip
->ic_cipher
>= IEEE80211_CIPHER_MAX
) {
207 printk(KERN_ERR
"%s: cipher %s has an invalid cipher index %u\n",
208 __func__
, cip
->ic_name
, cip
->ic_cipher
);
211 if ((ciphers
[cip
->ic_cipher
] != NULL
) && (ciphers
[cip
->ic_cipher
] != cip
)) {
212 printk(KERN_ERR
"%s: cipher %s registered with a different template\n",
213 __func__
, cip
->ic_name
);
216 ciphers
[cip
->ic_cipher
] = cip
;
218 EXPORT_SYMBOL(ieee80211_crypto_register
);
221 * Unregister a crypto cipher module.
224 ieee80211_crypto_unregister(const struct ieee80211_cipher
*cip
)
226 if (cip
->ic_cipher
>= IEEE80211_CIPHER_MAX
) {
227 printk(KERN_ERR
"%s: cipher %s has an invalid cipher index %u\n",
228 __func__
, cip
->ic_name
, cip
->ic_cipher
);
231 if (ciphers
[cip
->ic_cipher
] != NULL
&& ciphers
[cip
->ic_cipher
] != cip
) {
232 printk(KERN_ERR
"%s: cipher %s registered with a different template\n",
233 __func__
, cip
->ic_name
);
236 /* NB: don't complain about not being registered */
237 /* XXX: disallow if referenced */
238 ciphers
[cip
->ic_cipher
] = NULL
;
240 EXPORT_SYMBOL(ieee80211_crypto_unregister
);
242 /* XXX: well-known names! */
243 static const char *cipher_modnames
[] = {
244 "wlan_wep", /* IEEE80211_CIPHER_WEP */
245 "wlan_tkip", /* IEEE80211_CIPHER_TKIP */
246 "wlan_aes_ocb", /* IEEE80211_CIPHER_AES_OCB */
247 "wlan_ccmp", /* IEEE80211_CIPHER_AES_CCM */
248 "wlan_ckip", /* IEEE80211_CIPHER_CKIP */
253 ieee80211_crypto_available(struct ieee80211vap
*vap
, u_int cipher
)
255 unsigned int status
= 0;
257 if (cipher
< IEEE80211_CIPHER_MAX
) {
258 if (ciphers
[cipher
] == NULL
) {
260 * Auto-load cipher module if we have a well-known name
261 * for it. It might be better to use string names rather
262 * than numbers and craft a module name based on the cipher
263 * name; e.g. wlan_cipher_<cipher-name>.
265 if (cipher
< ARRAY_SIZE(cipher_modnames
)) {
266 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
267 "%s: unregistered cipher %u, load module %s\n",
268 __func__
, cipher
, cipher_modnames
[cipher
]);
269 ieee80211_load_module(cipher_modnames
[cipher
]);
272 * If cipher module loaded it should immediately
273 * call ieee80211_crypto_register which will fill
274 * in the entry in the ciphers array.
276 if (ciphers
[cipher
] == NULL
) {
277 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
278 "%s: unable to load cipher %u, module %s\n",
280 cipher
< ARRAY_SIZE(cipher_modnames
) ?
281 cipher_modnames
[cipher
] : "<unknown>");
282 vap
->iv_stats
.is_crypto_nocipher
++;
291 EXPORT_SYMBOL(ieee80211_crypto_available
);
294 * Establish a relationship between the specified key and cipher
295 * and, if necessary, allocate a hardware index from the driver.
296 * Note that when a fixed key index is required it must be specified
297 * and we blindly assign it w/o consulting the driver (XXX).
299 * This must be the first call applied to a key; all the other key
300 * routines assume wk_cipher is setup.
302 * Locking must be handled by the caller using:
303 * ieee80211_key_update_begin(vap);
304 * ieee80211_key_update_end(vap);
307 ieee80211_crypto_newkey(struct ieee80211vap
*vap
,
308 int cipher
, int flags
, struct ieee80211_key
*key
)
310 const struct ieee80211_cipher
*cip
;
315 * Validate cipher and set reference to cipher routines.
317 if (cipher
>= IEEE80211_CIPHER_MAX
) {
318 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
319 "%s: invalid cipher %u\n", __func__
, cipher
);
320 vap
->iv_stats
.is_crypto_badcipher
++;
323 cip
= ciphers
[cipher
];
327 oflags
= key
->wk_flags
;
328 flags
&= IEEE80211_KEY_COMMON
;
330 * If the hardware does not support the cipher then
331 * fallback to a host-based implementation.
333 if (!(vap
->iv_caps
& (1 << cipher
))) {
334 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
335 "%s: no h/w support for cipher %s, falling back to s/w\n",
336 __func__
, cip
->ic_name
);
337 flags
|= IEEE80211_KEY_SWCRYPT
;
340 * Hardware TKIP with software MIC is an important
341 * combination; we handle it by flagging each key,
342 * the cipher modules honor it.
344 if (cipher
== IEEE80211_CIPHER_TKIP
) {
345 if (!(vap
->iv_caps
& IEEE80211_C_TKIPMIC
)) {
346 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
347 "%s: no h/w support for TKIP MIC, falling back to s/w\n",
349 flags
|= IEEE80211_KEY_SWMIC
;
350 } else if (!((vap
->iv_caps
& IEEE80211_C_WME_TKIPMIC
)) &&
351 (vap
->iv_flags
& IEEE80211_F_WME
)) {
352 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
353 "%s: no h/w support for TKIP MIC when WMM is turned on,"
354 " falling back to s/w\n",
356 flags
|= IEEE80211_KEY_SWMIC
;
361 * Bind cipher to key instance. Note we do this
362 * after checking the device capabilities so the
363 * cipher module can optimize space usage based on
364 * whether or not it needs to do the cipher work.
366 if ((key
->wk_cipher
!= cip
) || (key
->wk_flags
!= flags
)) {
369 * Fill in the flags so cipher modules can see s/w
370 * crypto requirements and potentially allocate
371 * different state and/or attach different method
374 * XXX: This is not right when s/w crypto fallback
375 * fails and we try to restore previous state.
377 key
->wk_flags
= flags
;
378 keyctx
= cip
->ic_attach(vap
, key
);
379 if (keyctx
== NULL
) {
380 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
381 "%s: unable to attach cipher %s\n",
382 __func__
, cip
->ic_name
);
383 key
->wk_flags
= oflags
; /* restore old flags */
384 vap
->iv_stats
.is_crypto_attachfail
++;
388 key
->wk_cipher
= cip
; /* XXX: refcnt? */
389 key
->wk_private
= keyctx
;
392 * Commit to requested usage so driver can see the flags.
394 key
->wk_flags
= flags
;
397 * Ask the driver for a key index if we don't have one.
398 * Note that entries in the global key table always have
399 * an index; this means it's safe to call this routine
400 * for these entries just to setup the reference to the
401 * cipher template. Note also that when using software
402 * crypto we also call the driver to give us a key index.
404 if (key
->wk_keyix
== IEEE80211_KEYIX_NONE
) {
405 key
->wk_keyix
= dev_key_alloc(vap
, key
);
406 if (key
->wk_keyix
== IEEE80211_KEYIX_NONE
) {
408 * Driver has no room; fallback to doing crypto
409 * in the host. We change the flags and start the
410 * procedure over. If we get back here then there's
411 * no hope and we bail. Note that this can leave
412 * the key in a inconsistent state if the caller
413 * continues to use it.
415 if ((key
->wk_flags
& IEEE80211_KEY_SWCRYPT
) == 0) {
416 vap
->iv_stats
.is_crypto_swfallback
++;
417 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
418 "%s: no h/w resources for cipher %s, "
419 "falling back to s/w\n",
420 __func__
, cip
->ic_name
);
421 oflags
= key
->wk_flags
;
422 flags
|= IEEE80211_KEY_SWCRYPT
;
423 if (cipher
== IEEE80211_CIPHER_TKIP
)
424 flags
|= IEEE80211_KEY_SWMIC
;
427 vap
->iv_stats
.is_crypto_keyfail
++;
428 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
429 "%s: unable to setup cipher %s\n",
430 __func__
, cip
->ic_name
);
436 EXPORT_SYMBOL(ieee80211_crypto_newkey
);
439 * Remove the key (no locking, for internal use).
442 ieee80211_crypto_delkey_locked(struct ieee80211vap
*vap
, struct ieee80211_key
*key
,
443 struct ieee80211_node
*ni
)
445 ieee80211_keyix_t keyix
;
447 KASSERT(key
->wk_cipher
!= NULL
, ("No cipher!"));
449 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
450 "%s: %s keyix %u flags 0x%x tsc %llu len %u\n", __func__
,
451 key
->wk_cipher
->ic_name
, key
->wk_keyix
, key
->wk_flags
,
452 (unsigned long long)key
->wk_keytsc
, key
->wk_keylen
);
454 keyix
= key
->wk_keyix
;
455 if (keyix
!= IEEE80211_KEYIX_NONE
) {
456 /* Remove hardware entry. */
458 if (!dev_key_delete(vap
, key
, ni
)) {
459 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
460 "%s: driver did not delete key index %u\n",
462 vap
->iv_stats
.is_crypto_delkey
++;
467 memset(key
, 0, sizeof(*key
));
468 ieee80211_crypto_resetkey(vap
, key
, IEEE80211_KEYIX_NONE
);
473 * Remove the specified key.
476 ieee80211_crypto_delkey(struct ieee80211vap
*vap
, struct ieee80211_key
*key
,
477 struct ieee80211_node
*ni
)
481 #ifdef ATH_SUPERG_COMP
482 /* If valid node entry is present cleanup the compression state */
484 dev_comp_set(vap
, ni
, 0);
486 ieee80211_key_update_begin(vap
);
487 status
= ieee80211_crypto_delkey_locked(vap
, key
, ni
);
488 ieee80211_key_update_end(vap
);
492 EXPORT_SYMBOL(ieee80211_crypto_delkey
);
495 * Clear the global key table.
498 ieee80211_crypto_delglobalkeys(struct ieee80211vap
*vap
)
502 ieee80211_key_update_begin(vap
);
503 for (i
= 0; i
< IEEE80211_WEP_NKID
; i
++)
504 (void) ieee80211_crypto_delkey_locked(vap
, &vap
->iv_nw_keys
[i
], NULL
);
505 ieee80211_key_update_end(vap
);
507 EXPORT_SYMBOL(ieee80211_crypto_delglobalkeys
);
510 * Set the contents of the specified key.
512 * Locking must be handled by the caller using:
513 * ieee80211_key_update_begin(vap);
514 * ieee80211_key_update_end(vap);
517 ieee80211_crypto_setkey(struct ieee80211vap
*vap
, struct ieee80211_key
*key
,
518 const u_int8_t macaddr
[IEEE80211_ADDR_LEN
],
519 struct ieee80211_node
*ni
)
521 const struct ieee80211_cipher
*cip
= key
->wk_cipher
;
524 KASSERT(cip
!= NULL
, ("No cipher!"));
526 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
527 "%s: %s keyix %u flags 0x%x mac " MAC_FMT
" tsc %llu len %u\n", __func__
,
528 cip
->ic_name
, key
->wk_keyix
, key
->wk_flags
,
529 MAC_ADDR(macaddr
), (unsigned long long)key
->wk_keytsc
,
533 * Give cipher a chance to validate key contents.
534 * XXX: Should happen before modifying state.
536 if (!cip
->ic_setkey(key
)) {
537 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
538 "%s: cipher %s rejected key index %u len %u flags 0x%x\n",
539 __func__
, cip
->ic_name
, key
->wk_keyix
,
540 key
->wk_keylen
, key
->wk_flags
);
541 vap
->iv_stats
.is_crypto_setkey_cipher
++;
544 if (key
->wk_keyix
== IEEE80211_KEYIX_NONE
) {
545 /* NB: Nothing allocated, should not happen */
546 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_CRYPTO
,
547 "%s: no key index; should not happen!\n", __func__
);
548 vap
->iv_stats
.is_crypto_setkey_nokey
++;
551 ret
= dev_key_set(vap
, key
, macaddr
);
552 #ifdef ATH_SUPERG_COMP
554 /* Enable decompression only on receive key entries */
555 if (key
->wk_flags
& IEEE80211_KEY_RECV
)
556 dev_comp_set(vap
, ni
, 1);
562 EXPORT_SYMBOL(ieee80211_crypto_setkey
);
565 * Add privacy headers appropriate for the specified key.
567 struct ieee80211_key
*
568 ieee80211_crypto_encap(struct ieee80211_node
*ni
, struct sk_buff
*skb
)
570 struct ieee80211vap
*vap
= ni
->ni_vap
;
571 struct ieee80211_key
*k
;
572 struct ieee80211_frame
*wh
;
573 const struct ieee80211_cipher
*cip
;
577 * Multicast traffic always uses the multicast key.
578 * Otherwise if a unicast key is set we use that and
579 * it is always key index 0. When no unicast key is
580 * set we fall back to the default transmit key.
582 wh
= (struct ieee80211_frame
*)skb
->data
;
583 if (IEEE80211_IS_MULTICAST(wh
->i_addr1
) ||
584 ni
->ni_ucastkey
.wk_cipher
== &ieee80211_cipher_none
) {
585 if (vap
->iv_def_txkey
== IEEE80211_KEYIX_NONE
) {
586 IEEE80211_NOTE_MAC(vap
, IEEE80211_MSG_CRYPTO
,
588 "no default transmit key (%s) deftxkey %u",
589 __func__
, vap
->iv_def_txkey
);
590 vap
->iv_stats
.is_tx_nodefkey
++;
593 keyid
= vap
->iv_def_txkey
;
594 k
= &vap
->iv_nw_keys
[vap
->iv_def_txkey
];
597 k
= &ni
->ni_ucastkey
;
600 if (skb_headroom(skb
) < cip
->ic_header
) {
602 * Should not happen; ieee80211_skbhdr_adjust should
603 * have allocated enough space for all headers.
605 IEEE80211_NOTE_MAC(vap
, IEEE80211_MSG_CRYPTO
, wh
->i_addr1
,
606 "%s: malformed packet for cipher %s; headroom %u",
607 __func__
, cip
->ic_name
, skb_headroom(skb
));
608 vap
->iv_stats
.is_tx_noheadroom
++;
611 return (cip
->ic_encap(k
, skb
, keyid
<< 6) ? k
: NULL
);
613 EXPORT_SYMBOL(ieee80211_crypto_encap
);
616 * Validate and strip privacy headers (and trailer) for a
617 * received frame that has the Protected Frame bit set.
619 struct ieee80211_key
*
620 ieee80211_crypto_decap(struct ieee80211_node
*ni
, struct sk_buff
*skb
, int hdrlen
)
622 #define IEEE80211_WEP_HDRLEN (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN)
623 #define IEEE80211_WEP_MINLEN \
624 (sizeof(struct ieee80211_frame) + \
625 IEEE80211_WEP_HDRLEN + IEEE80211_WEP_CRCLEN)
626 struct ieee80211vap
*vap
= ni
->ni_vap
;
627 struct ieee80211_key
*k
;
628 struct ieee80211_frame
*wh
;
629 const struct ieee80211_cipher
*cip
;
633 /* NB: this minimum size data frame could be bigger */
634 if (skb
->len
< IEEE80211_WEP_MINLEN
) {
635 IEEE80211_NOTE(vap
, IEEE80211_MSG_ANY
, ni
,
636 "%s: WEP data frame too short, len %u",
638 vap
->iv_stats
.is_rx_tooshort
++; /* XXX: unique stat? */
642 * Locate the key. If unicast and there is no unicast
643 * key then we fall back to the key id in the header.
644 * This assumes unicast keys are only configured when
645 * the key id in the header is meaningless (typically 0).
647 wh
= (struct ieee80211_frame
*)skb
->data
;
648 ivp
= skb
->data
+ hdrlen
;
649 keyid
= ivp
[IEEE80211_WEP_IVLEN
];
650 if (IEEE80211_IS_MULTICAST(wh
->i_addr1
) ||
651 ni
->ni_ucastkey
.wk_cipher
== &ieee80211_cipher_none
)
652 k
= &vap
->iv_nw_keys
[keyid
>> 6];
654 k
= &ni
->ni_ucastkey
;
657 return (cip
->ic_decap(k
, skb
, hdrlen
) ? k
: NULL
);
658 #undef IEEE80211_WEP_MINLEN
659 #undef IEEE80211_WEP_HDRLEN
661 EXPORT_SYMBOL(ieee80211_crypto_decap
);