?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
sched: remove the 'u64 now' parameter from put_prev_entity()
[usb.git] / net / mac80211 / wpa.c
blob783af32c6911d89fe90f933e1169c0db6aba2268
1 /*
2 * Copyright 2002-2004, Instant802 Networks, Inc.
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
7 */
8
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <linux/slab.h>
12 #include <linux/skbuff.h>
13 #include <linux/compiler.h>
14 #include <net/iw_handler.h>
15
16 #include <net/mac80211.h>
17 #include "ieee80211_common.h"
18 #include "ieee80211_i.h"
19 #include "michael.h"
20 #include "tkip.h"
21 #include "aes_ccm.h"
22 #include "wpa.h"
23
24 static int ieee80211_get_hdr_info(const struct sk_buff *skb, u8 **sa, u8 **da,
25 u8 *qos_tid, u8 **data, size_t *data_len)
26 {
27 struct ieee80211_hdr *hdr;
28 size_t hdrlen;
29 u16 fc;
30 int a4_included;
31 u8 *pos;
32
33 hdr = (struct ieee80211_hdr *) skb->data;
34 fc = le16_to_cpu(hdr->frame_control);
35
36 hdrlen = 24;
37 if ((fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) ==
38 (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
39 hdrlen += ETH_ALEN;
40 *sa = hdr->addr4;
41 *da = hdr->addr3;
42 } else if (fc & IEEE80211_FCTL_FROMDS) {
43 *sa = hdr->addr3;
44 *da = hdr->addr1;
45 } else if (fc & IEEE80211_FCTL_TODS) {
46 *sa = hdr->addr2;
47 *da = hdr->addr3;
48 } else {
49 *sa = hdr->addr2;
50 *da = hdr->addr1;
51 }
52
53 if (fc & 0x80)
54 hdrlen += 2;
55
56 *data = skb->data + hdrlen;
57 *data_len = skb->len - hdrlen;
58
59 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
60 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
61 if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
62 fc & IEEE80211_STYPE_QOS_DATA) {
63 pos = (u8 *) &hdr->addr4;
64 if (a4_included)
65 pos += 6;
66 *qos_tid = pos[0] & 0x0f;
67 *qos_tid |= 0x80; /* qos_included flag */
68 } else
69 *qos_tid = 0;
70
71 return skb->len < hdrlen ? -1 : 0;
72 }
73
74
75 ieee80211_txrx_result
76 ieee80211_tx_h_michael_mic_add(struct ieee80211_txrx_data *tx)
77 {
78 u8 *data, *sa, *da, *key, *mic, qos_tid;
79 size_t data_len;
80 u16 fc;
81 struct sk_buff *skb = tx->skb;
82 int authenticator;
83 int wpa_test = 0;
84
85 fc = tx->fc;
86
87 if (!tx->key || tx->key->alg != ALG_TKIP || skb->len < 24 ||
88 !WLAN_FC_DATA_PRESENT(fc))
89 return TXRX_CONTINUE;
90
91 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len))
92 return TXRX_DROP;
93
94 if (!tx->key->force_sw_encrypt &&
95 !tx->fragmented &&
96 !(tx->local->hw.flags & IEEE80211_HW_TKIP_INCLUDE_MMIC) &&
97 !wpa_test) {
98 /* hwaccel - with no need for preallocated room for Michael MIC
99 */
100 return TXRX_CONTINUE;
101 }
102
103 if (skb_tailroom(skb) < MICHAEL_MIC_LEN) {
104 I802_DEBUG_INC(tx->local->tx_expand_skb_head);
105 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN,
106 MICHAEL_MIC_LEN + TKIP_ICV_LEN,
107 GFP_ATOMIC))) {
108 printk(KERN_DEBUG "%s: failed to allocate more memory "
109 "for Michael MIC\n", tx->dev->name);
110 return TXRX_DROP;
111 }
112 }
113
114 #if 0
115 authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
116 #else
117 authenticator = 1;
118 #endif
119 key = &tx->key->key[authenticator ? ALG_TKIP_TEMP_AUTH_TX_MIC_KEY :
120 ALG_TKIP_TEMP_AUTH_RX_MIC_KEY];
121 mic = skb_put(skb, MICHAEL_MIC_LEN);
122 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
123
124 return TXRX_CONTINUE;
125 }
126
127
128 ieee80211_txrx_result
129 ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
130 {
131 u8 *data, *sa, *da, *key = NULL, qos_tid;
132 size_t data_len;
133 u16 fc;
134 u8 mic[MICHAEL_MIC_LEN];
135 struct sk_buff *skb = rx->skb;
136 int authenticator = 1, wpa_test = 0;
137
138 fc = rx->fc;
139
140 /* If device handles decryption totally, skip this check */
141 if ((rx->local->hw.flags & IEEE80211_HW_DEVICE_HIDES_WEP) ||
142 (rx->local->hw.flags & IEEE80211_HW_DEVICE_STRIPS_MIC))
143 return TXRX_CONTINUE;
144
145 if (!rx->key || rx->key->alg != ALG_TKIP ||
146 !(rx->fc & IEEE80211_FCTL_PROTECTED) || !WLAN_FC_DATA_PRESENT(fc))
147 return TXRX_CONTINUE;
148
149 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
150 !rx->key->force_sw_encrypt) {
151 if (rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) {
152 if (skb->len < MICHAEL_MIC_LEN)
153 return TXRX_DROP;
154 }
155 /* Need to verify Michael MIC sometimes in software even when
156 * hwaccel is used. Atheros ar5212: fragmented frames and QoS
157 * frames. */
158 if (!rx->fragmented && !wpa_test)
159 goto remove_mic;
160 }
161
162 if (ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len)
163 || data_len < MICHAEL_MIC_LEN)
164 return TXRX_DROP;
165
166 data_len -= MICHAEL_MIC_LEN;
167
168 #if 0
169 authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
170 #else
171 authenticator = 1;
172 #endif
173 key = &rx->key->key[authenticator ? ALG_TKIP_TEMP_AUTH_RX_MIC_KEY :
174 ALG_TKIP_TEMP_AUTH_TX_MIC_KEY];
175 michael_mic(key, da, sa, qos_tid & 0x0f, data, data_len, mic);
176 if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
177 if (!rx->u.rx.ra_match)
178 return TXRX_DROP;
179
180 printk(KERN_DEBUG "%s: invalid Michael MIC in data frame from "
181 MAC_FMT "\n", rx->dev->name, MAC_ARG(sa));
182
183 do {
184 struct ieee80211_hdr *hdr;
185 union iwreq_data wrqu;
186 char *buf = kmalloc(128, GFP_ATOMIC);
187 if (!buf)
188 break;
189
190 /* TODO: needed parameters: count, key type, TSC */
191 hdr = (struct ieee80211_hdr *) skb->data;
192 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
193 "keyid=%d %scast addr=" MAC_FMT ")",
194 rx->key->keyidx,
195 hdr->addr1[0] & 0x01 ? "broad" : "uni",
196 MAC_ARG(hdr->addr2));
197 memset(&wrqu, 0, sizeof(wrqu));
198 wrqu.data.length = strlen(buf);
199 wireless_send_event(rx->dev, IWEVCUSTOM, &wrqu, buf);
200 kfree(buf);
201 } while (0);
202
203 if (!rx->local->apdev)
204 return TXRX_DROP;
205
206 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
207 ieee80211_msg_michael_mic_failure);
208
209 return TXRX_QUEUED;
210 }
211
212 remove_mic:
213 /* remove Michael MIC from payload */
214 skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
215
216 return TXRX_CONTINUE;
217 }
218
219
220 static int tkip_encrypt_skb(struct ieee80211_txrx_data *tx,
221 struct sk_buff *skb, int test)
222 {
223 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
224 struct ieee80211_key *key = tx->key;
225 int hdrlen, len, tailneed;
226 u16 fc;
227 u8 *pos;
228
229 fc = le16_to_cpu(hdr->frame_control);
230 hdrlen = ieee80211_get_hdrlen(fc);
231 len = skb->len - hdrlen;
232
233 tailneed = !tx->key->force_sw_encrypt ? 0 : TKIP_ICV_LEN;
234 if ((skb_headroom(skb) < TKIP_IV_LEN ||
235 skb_tailroom(skb) < tailneed)) {
236 I802_DEBUG_INC(tx->local->tx_expand_skb_head);
237 if (unlikely(pskb_expand_head(skb, TKIP_IV_LEN, tailneed,
238 GFP_ATOMIC)))
239 return -1;
240 }
241
242 pos = skb_push(skb, TKIP_IV_LEN);
243 memmove(pos, pos + TKIP_IV_LEN, hdrlen);
244 pos += hdrlen;
245
246 /* Increase IV for the frame */
247 key->u.tkip.iv16++;
248 if (key->u.tkip.iv16 == 0)
249 key->u.tkip.iv32++;
250
251 if (!tx->key->force_sw_encrypt) {
252 u32 flags = tx->local->hw.flags;
253 hdr = (struct ieee80211_hdr *)skb->data;
254
255 /* hwaccel - with preallocated room for IV */
256 ieee80211_tkip_add_iv(pos, key,
257 (u8) (key->u.tkip.iv16 >> 8),
258 (u8) (((key->u.tkip.iv16 >> 8) | 0x20) &
259 0x7f),
260 (u8) key->u.tkip.iv16);
261
262 if (flags & IEEE80211_HW_TKIP_REQ_PHASE2_KEY)
263 ieee80211_tkip_gen_rc4key(key, hdr->addr2,
264 tx->u.tx.control->tkip_key);
265 else if (flags & IEEE80211_HW_TKIP_REQ_PHASE1_KEY) {
266 if (key->u.tkip.iv16 == 0 ||
267 !key->u.tkip.tx_initialized) {
268 ieee80211_tkip_gen_phase1key(key, hdr->addr2,
269 (u16 *)tx->u.tx.control->tkip_key);
270 key->u.tkip.tx_initialized = 1;
271 tx->u.tx.control->flags |=
272 IEEE80211_TXCTL_TKIP_NEW_PHASE1_KEY;
273 } else
274 tx->u.tx.control->flags &=
275 ~IEEE80211_TXCTL_TKIP_NEW_PHASE1_KEY;
276 }
277
278 tx->u.tx.control->key_idx = tx->key->hw_key_idx;
279 return 0;
280 }
281
282 /* Add room for ICV */
283 skb_put(skb, TKIP_ICV_LEN);
284
285 hdr = (struct ieee80211_hdr *) skb->data;
286 ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
287 key, pos, len, hdr->addr2);
288 return 0;
289 }
290
291
292 ieee80211_txrx_result
293 ieee80211_tx_h_tkip_encrypt(struct ieee80211_txrx_data *tx)
294 {
295 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
296 u16 fc;
297 struct ieee80211_key *key = tx->key;
298 struct sk_buff *skb = tx->skb;
299 int wpa_test = 0, test = 0;
300
301 fc = le16_to_cpu(hdr->frame_control);
302
303 if (!key || key->alg != ALG_TKIP || !WLAN_FC_DATA_PRESENT(fc))
304 return TXRX_CONTINUE;
305
306 tx->u.tx.control->icv_len = TKIP_ICV_LEN;
307 tx->u.tx.control->iv_len = TKIP_IV_LEN;
308 ieee80211_tx_set_iswep(tx);
309
310 if (!tx->key->force_sw_encrypt &&
311 !(tx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV) &&
312 !wpa_test) {
313 /* hwaccel - with no need for preallocated room for IV/ICV */
314 tx->u.tx.control->key_idx = tx->key->hw_key_idx;
315 return TXRX_CONTINUE;
316 }
317
318 if (tkip_encrypt_skb(tx, skb, test) < 0)
319 return TXRX_DROP;
320
321 if (tx->u.tx.extra_frag) {
322 int i;
323 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
324 if (tkip_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
325 < 0)
326 return TXRX_DROP;
327 }
328 }
329
330 return TXRX_CONTINUE;
331 }
332
333
334 ieee80211_txrx_result
335 ieee80211_rx_h_tkip_decrypt(struct ieee80211_txrx_data *rx)
336 {
337 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
338 u16 fc;
339 int hdrlen, res, hwaccel = 0, wpa_test = 0;
340 struct ieee80211_key *key = rx->key;
341 struct sk_buff *skb = rx->skb;
342
343 fc = le16_to_cpu(hdr->frame_control);
344 hdrlen = ieee80211_get_hdrlen(fc);
345
346 if (!rx->key || rx->key->alg != ALG_TKIP ||
347 !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
348 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
349 return TXRX_CONTINUE;
350
351 if (!rx->sta || skb->len - hdrlen < 12)
352 return TXRX_DROP;
353
354 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
355 !rx->key->force_sw_encrypt) {
356 if (!(rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV)) {
357 /* Hardware takes care of all processing, including
358 * replay protection, so no need to continue here. */
359 return TXRX_CONTINUE;
360 }
361
362 /* let TKIP code verify IV, but skip decryption */
363 hwaccel = 1;
364 }
365
366 res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
367 key, skb->data + hdrlen,
368 skb->len - hdrlen, rx->sta->addr,
369 hwaccel, rx->u.rx.queue);
370 if (res != TKIP_DECRYPT_OK || wpa_test) {
371 printk(KERN_DEBUG "%s: TKIP decrypt failed for RX frame from "
372 MAC_FMT " (res=%d)\n",
373 rx->dev->name, MAC_ARG(rx->sta->addr), res);
374 return TXRX_DROP;
375 }
376
377 /* Trim ICV */
378 skb_trim(skb, skb->len - TKIP_ICV_LEN);
379
380 /* Remove IV */
381 memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
382 skb_pull(skb, TKIP_IV_LEN);
383
384 return TXRX_CONTINUE;
385 }
386
387
388 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
389 int encrypted)
390 {
391 u16 fc;
392 int a4_included, qos_included;
393 u8 qos_tid, *fc_pos, *data, *sa, *da;
394 int len_a;
395 size_t data_len;
396 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
397
398 fc_pos = (u8 *) &hdr->frame_control;
399 fc = fc_pos[0] ^ (fc_pos[1] << 8);
400 a4_included = (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
401 (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS);
402
403 ieee80211_get_hdr_info(skb, &sa, &da, &qos_tid, &data, &data_len);
404 data_len -= CCMP_HDR_LEN + (encrypted ? CCMP_MIC_LEN : 0);
405 if (qos_tid & 0x80) {
406 qos_included = 1;
407 qos_tid &= 0x0f;
408 } else
409 qos_included = 0;
410 /* First block, b_0 */
411
412 b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
413 /* Nonce: QoS Priority | A2 | PN */
414 b_0[1] = qos_tid;
415 memcpy(&b_0[2], hdr->addr2, 6);
416 memcpy(&b_0[8], pn, CCMP_PN_LEN);
417 /* l(m) */
418 b_0[14] = (data_len >> 8) & 0xff;
419 b_0[15] = data_len & 0xff;
420
421
422 /* AAD (extra authenticate-only data) / masked 802.11 header
423 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
424
425 len_a = a4_included ? 28 : 22;
426 if (qos_included)
427 len_a += 2;
428
429 aad[0] = 0; /* (len_a >> 8) & 0xff; */
430 aad[1] = len_a & 0xff;
431 /* Mask FC: zero subtype b4 b5 b6 */
432 aad[2] = fc_pos[0] & ~(BIT(4) | BIT(5) | BIT(6));
433 /* Retry, PwrMgt, MoreData; set Protected */
434 aad[3] = (fc_pos[1] & ~(BIT(3) | BIT(4) | BIT(5))) | BIT(6);
435 memcpy(&aad[4], &hdr->addr1, 18);
436
437 /* Mask Seq#, leave Frag# */
438 aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
439 aad[23] = 0;
440 if (a4_included) {
441 memcpy(&aad[24], hdr->addr4, 6);
442 aad[30] = 0;
443 aad[31] = 0;
444 } else
445 memset(&aad[24], 0, 8);
446 if (qos_included) {
447 u8 *dpos = &aad[a4_included ? 30 : 24];
448
449 /* Mask QoS Control field */
450 dpos[0] = qos_tid;
451 dpos[1] = 0;
452 }
453 }
454
455
456 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
457 {
458 hdr[0] = pn[5];
459 hdr[1] = pn[4];
460 hdr[2] = 0;
461 hdr[3] = 0x20 | (key_id << 6);
462 hdr[4] = pn[3];
463 hdr[5] = pn[2];
464 hdr[6] = pn[1];
465 hdr[7] = pn[0];
466 }
467
468
469 static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
470 {
471 pn[0] = hdr[7];
472 pn[1] = hdr[6];
473 pn[2] = hdr[5];
474 pn[3] = hdr[4];
475 pn[4] = hdr[1];
476 pn[5] = hdr[0];
477 return (hdr[3] >> 6) & 0x03;
478 }
479
480
481 static int ccmp_encrypt_skb(struct ieee80211_txrx_data *tx,
482 struct sk_buff *skb, int test)
483 {
484 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
485 struct ieee80211_key *key = tx->key;
486 int hdrlen, len, tailneed;
487 u16 fc;
488 u8 *pos, *pn, *b_0, *aad, *scratch;
489 int i;
490
491 scratch = key->u.ccmp.tx_crypto_buf;
492 b_0 = scratch + 3 * AES_BLOCK_LEN;
493 aad = scratch + 4 * AES_BLOCK_LEN;
494
495 fc = le16_to_cpu(hdr->frame_control);
496 hdrlen = ieee80211_get_hdrlen(fc);
497 len = skb->len - hdrlen;
498
499 tailneed = !key->force_sw_encrypt ? 0 : CCMP_MIC_LEN;
500
501 if ((skb_headroom(skb) < CCMP_HDR_LEN ||
502 skb_tailroom(skb) < tailneed)) {
503 I802_DEBUG_INC(tx->local->tx_expand_skb_head);
504 if (unlikely(pskb_expand_head(skb, CCMP_HDR_LEN, tailneed,
505 GFP_ATOMIC)))
506 return -1;
507 }
508
509 pos = skb_push(skb, CCMP_HDR_LEN);
510 memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
511 hdr = (struct ieee80211_hdr *) pos;
512 pos += hdrlen;
513
514 /* PN = PN + 1 */
515 pn = key->u.ccmp.tx_pn;
516
517 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
518 pn[i]++;
519 if (pn[i])
520 break;
521 }
522
523 ccmp_pn2hdr(pos, pn, key->keyidx);
524
525 if (!key->force_sw_encrypt) {
526 /* hwaccel - with preallocated room for CCMP header */
527 tx->u.tx.control->key_idx = key->hw_key_idx;
528 return 0;
529 }
530
531 pos += CCMP_HDR_LEN;
532 ccmp_special_blocks(skb, pn, b_0, aad, 0);
533 ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, b_0, aad, pos, len,
534 pos, skb_put(skb, CCMP_MIC_LEN));
535
536 return 0;
537 }
538
539
540 ieee80211_txrx_result
541 ieee80211_tx_h_ccmp_encrypt(struct ieee80211_txrx_data *tx)
542 {
543 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) tx->skb->data;
544 struct ieee80211_key *key = tx->key;
545 u16 fc;
546 struct sk_buff *skb = tx->skb;
547 int test = 0;
548
549 fc = le16_to_cpu(hdr->frame_control);
550
551 if (!key || key->alg != ALG_CCMP || !WLAN_FC_DATA_PRESENT(fc))
552 return TXRX_CONTINUE;
553
554 tx->u.tx.control->icv_len = CCMP_MIC_LEN;
555 tx->u.tx.control->iv_len = CCMP_HDR_LEN;
556 ieee80211_tx_set_iswep(tx);
557
558 if (!tx->key->force_sw_encrypt &&
559 !(tx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV)) {
560 /* hwaccel - with no need for preallocated room for CCMP "
561 * header or MIC fields */
562 tx->u.tx.control->key_idx = tx->key->hw_key_idx;
563 return TXRX_CONTINUE;
564 }
565
566 if (ccmp_encrypt_skb(tx, skb, test) < 0)
567 return TXRX_DROP;
568
569 if (tx->u.tx.extra_frag) {
570 int i;
571
572 for (i = 0; i < tx->u.tx.num_extra_frag; i++) {
573 if (ccmp_encrypt_skb(tx, tx->u.tx.extra_frag[i], test)
574 < 0)
575 return TXRX_DROP;
576 }
577 }
578
579 return TXRX_CONTINUE;
580 }
581
582
583 ieee80211_txrx_result
584 ieee80211_rx_h_ccmp_decrypt(struct ieee80211_txrx_data *rx)
585 {
586 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
587 u16 fc;
588 int hdrlen;
589 struct ieee80211_key *key = rx->key;
590 struct sk_buff *skb = rx->skb;
591 u8 pn[CCMP_PN_LEN];
592 int data_len;
593
594 fc = le16_to_cpu(hdr->frame_control);
595 hdrlen = ieee80211_get_hdrlen(fc);
596
597 if (!key || key->alg != ALG_CCMP ||
598 !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
599 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
600 return TXRX_CONTINUE;
601
602 data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
603 if (!rx->sta || data_len < 0)
604 return TXRX_DROP;
605
606 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
607 !key->force_sw_encrypt &&
608 !(rx->local->hw.flags & IEEE80211_HW_WEP_INCLUDE_IV))
609 return TXRX_CONTINUE;
610
611 (void) ccmp_hdr2pn(pn, skb->data + hdrlen);
612
613 if (memcmp(pn, key->u.ccmp.rx_pn[rx->u.rx.queue], CCMP_PN_LEN) <= 0) {
614 #ifdef CONFIG_MAC80211_DEBUG
615 u8 *ppn = key->u.ccmp.rx_pn[rx->u.rx.queue];
616 printk(KERN_DEBUG "%s: CCMP replay detected for RX frame from "
617 MAC_FMT " (RX PN %02x%02x%02x%02x%02x%02x <= prev. PN "
618 "%02x%02x%02x%02x%02x%02x)\n", rx->dev->name,
619 MAC_ARG(rx->sta->addr),
620 pn[0], pn[1], pn[2], pn[3], pn[4], pn[5],
621 ppn[0], ppn[1], ppn[2], ppn[3], ppn[4], ppn[5]);
622 #endif /* CONFIG_MAC80211_DEBUG */
623 key->u.ccmp.replays++;
624 return TXRX_DROP;
625 }
626
627 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
628 !key->force_sw_encrypt) {
629 /* hwaccel has already decrypted frame and verified MIC */
630 } else {
631 u8 *scratch, *b_0, *aad;
632
633 scratch = key->u.ccmp.rx_crypto_buf;
634 b_0 = scratch + 3 * AES_BLOCK_LEN;
635 aad = scratch + 4 * AES_BLOCK_LEN;
636
637 ccmp_special_blocks(skb, pn, b_0, aad, 1);
638
639 if (ieee80211_aes_ccm_decrypt(
640 key->u.ccmp.tfm, scratch, b_0, aad,
641 skb->data + hdrlen + CCMP_HDR_LEN, data_len,
642 skb->data + skb->len - CCMP_MIC_LEN,
643 skb->data + hdrlen + CCMP_HDR_LEN)) {
644 printk(KERN_DEBUG "%s: CCMP decrypt failed for RX "
645 "frame from " MAC_FMT "\n", rx->dev->name,
646 MAC_ARG(rx->sta->addr));
647 return TXRX_DROP;
648 }
649 }
650
651 memcpy(key->u.ccmp.rx_pn[rx->u.rx.queue], pn, CCMP_PN_LEN);
652
653 /* Remove CCMP header and MIC */
654 skb_trim(skb, skb->len - CCMP_MIC_LEN);
655 memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
656 skb_pull(skb, CCMP_HDR_LEN);
657
658 return TXRX_CONTINUE;
659 }
660
USB Experimental Work