1 /* 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 * 32 * $FreeBSD: src/sys/net80211/ieee80211_crypto.c,v 1.10.2.2 2005/09/03 22:40:02 sam Exp $ 33 * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_crypto.c,v 1.3 2006/05/18 13:51:46 sephe Exp $ 34 */ 35 36 /* 37 * IEEE 802.11 generic crypto support. 38 */ 39 #include <sys/param.h> 40 #include <sys/mbuf.h> 41 42 #include <sys/socket.h> 43 44 #include <net/if.h> 45 #include <net/if_arp.h> 46 #include <net/if_media.h> 47 #include <net/ethernet.h> /* XXX ETHER_HDR_LEN */ 48 49 #include <netproto/802_11/ieee80211_var.h> 50 51 /* 52 * Table of registered cipher modules. 53 */ 54 static const struct ieee80211_cipher *ciphers[IEEE80211_CIPHER_MAX]; 55 56 static int _ieee80211_crypto_delkey(struct ieee80211com *, 57 struct ieee80211_key *); 58 59 /* 60 * Default "null" key management routines. 61 */ 62 static int 63 null_key_alloc(struct ieee80211com *ic, const struct ieee80211_key *k, 64 ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix) 65 { 66 if (!(&ic->ic_nw_keys[0] <= k && 67 k < &ic->ic_nw_keys[IEEE80211_WEP_NKID])) { 68 /* 69 * Not in the global key table, the driver should handle this 70 * by allocating a slot in the h/w key table/cache. In 71 * lieu of that return key slot 0 for any unicast key 72 * request. We disallow the request if this is a group key. 73 * This default policy does the right thing for legacy hardware 74 * with a 4 key table. It also handles devices that pass 75 * packets through untouched when marked with the WEP bit 76 * and key index 0. 77 */ 78 if (k->wk_flags & IEEE80211_KEY_GROUP) 79 return 0; 80 *keyix = 0; /* NB: use key index 0 for ucast key */ 81 } else { 82 *keyix = k - ic->ic_nw_keys; 83 } 84 *rxkeyix = IEEE80211_KEYIX_NONE; /* XXX maybe *keyix? */ 85 return 1; 86 } 87 88 static int 89 null_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k) 90 { 91 return 1; 92 } 93 94 static int 95 null_key_set(struct ieee80211com *ic, const struct ieee80211_key *k, 96 const uint8_t mac[IEEE80211_ADDR_LEN]) 97 { 98 return 1; 99 } 100 101 static void null_key_update(struct ieee80211com *ic) 102 { 103 } 104 105 /* 106 * Write-arounds for common operations. 107 */ 108 static __inline void 109 cipher_detach(struct ieee80211_key *key) 110 { 111 key->wk_cipher->ic_detach(key); 112 } 113 114 static __inline void * 115 cipher_attach(struct ieee80211com *ic, struct ieee80211_key *key) 116 { 117 return key->wk_cipher->ic_attach(ic, key); 118 } 119 120 /* 121 * Wrappers for driver key management methods. 122 */ 123 static __inline int 124 dev_key_alloc(struct ieee80211com *ic, 125 const struct ieee80211_key *key, 126 ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix) 127 { 128 return ic->ic_crypto.cs_key_alloc(ic, key, keyix, rxkeyix); 129 } 130 131 static __inline int 132 dev_key_delete(struct ieee80211com *ic, 133 const struct ieee80211_key *key) 134 { 135 return ic->ic_crypto.cs_key_delete(ic, key); 136 } 137 138 static __inline int 139 dev_key_set(struct ieee80211com *ic, const struct ieee80211_key *key, 140 const uint8_t mac[IEEE80211_ADDR_LEN]) 141 { 142 return ic->ic_crypto.cs_key_set(ic, key, mac); 143 } 144 145 /* 146 * Setup crypto support. 147 */ 148 void 149 ieee80211_crypto_attach(struct ieee80211com *ic) 150 { 151 struct ieee80211_crypto_state *cs = &ic->ic_crypto; 152 int i; 153 154 /* NB: we assume everything is pre-zero'd */ 155 cs->cs_def_txkey = IEEE80211_KEYIX_NONE; 156 cs->cs_max_keyix = IEEE80211_WEP_NKID; 157 ciphers[IEEE80211_CIPHER_NONE] = &ieee80211_cipher_none; 158 for (i = 0; i < IEEE80211_WEP_NKID; i++) 159 ieee80211_crypto_resetkey(ic, &cs->cs_nw_keys[i], 160 IEEE80211_KEYIX_NONE); 161 /* 162 * Initialize the driver key support routines to noop entries. 163 * This is useful especially for the cipher test modules. 164 */ 165 cs->cs_key_alloc = null_key_alloc; 166 cs->cs_key_set = null_key_set; 167 cs->cs_key_delete = null_key_delete; 168 cs->cs_key_update_begin = null_key_update; 169 cs->cs_key_update_end = null_key_update; 170 } 171 172 /* 173 * Teardown crypto support. 174 */ 175 void 176 ieee80211_crypto_detach(struct ieee80211com *ic) 177 { 178 ieee80211_crypto_delglobalkeys(ic); 179 } 180 181 /* 182 * Register a crypto cipher module. 183 */ 184 void 185 ieee80211_crypto_register(const struct ieee80211_cipher *cip) 186 { 187 if (cip->ic_cipher >= IEEE80211_CIPHER_MAX) { 188 printf("%s: cipher %s has an invalid cipher index %u\n", 189 __func__, cip->ic_name, cip->ic_cipher); 190 return; 191 } 192 if (ciphers[cip->ic_cipher] != NULL && ciphers[cip->ic_cipher] != cip) { 193 printf("%s: cipher %s registered with a different template\n", 194 __func__, cip->ic_name); 195 return; 196 } 197 ciphers[cip->ic_cipher] = cip; 198 } 199 200 /* 201 * Unregister a crypto cipher module. 202 */ 203 void 204 ieee80211_crypto_unregister(const struct ieee80211_cipher *cip) 205 { 206 if (cip->ic_cipher >= IEEE80211_CIPHER_MAX) { 207 printf("%s: cipher %s has an invalid cipher index %u\n", 208 __func__, cip->ic_name, cip->ic_cipher); 209 return; 210 } 211 if (ciphers[cip->ic_cipher] != NULL && ciphers[cip->ic_cipher] != cip) { 212 printf("%s: cipher %s registered with a different template\n", 213 __func__, cip->ic_name); 214 return; 215 } 216 /* NB: don't complain about not being registered */ 217 /* XXX disallow if references */ 218 ciphers[cip->ic_cipher] = NULL; 219 } 220 221 int 222 ieee80211_crypto_available(u_int cipher) 223 { 224 return cipher < IEEE80211_CIPHER_MAX && ciphers[cipher] != NULL; 225 } 226 227 /* XXX well-known names! */ 228 static const char *cipher_modnames[] = { 229 "wlan_wep", /* IEEE80211_CIPHER_WEP */ 230 "wlan_tkip", /* IEEE80211_CIPHER_TKIP */ 231 "wlan_aes_ocb", /* IEEE80211_CIPHER_AES_OCB */ 232 "wlan_ccmp", /* IEEE80211_CIPHER_AES_CCM */ 233 "wlan_ckip", /* IEEE80211_CIPHER_CKIP */ 234 }; 235 236 /* 237 * Establish a relationship between the specified key and cipher 238 * and, if necessary, allocate a hardware index from the driver. 239 * Note that when a fixed key index is required it must be specified 240 * and we blindly assign it w/o consulting the driver (XXX). 241 * 242 * This must be the first call applied to a key; all the other key 243 * routines assume wk_cipher is setup. 244 * 245 * Locking must be handled by the caller using: 246 * ieee80211_key_update_begin(ic); 247 * ieee80211_key_update_end(ic); 248 */ 249 int 250 ieee80211_crypto_newkey(struct ieee80211com *ic, 251 int cipher, int flags, struct ieee80211_key *key) 252 { 253 #define N(a) (sizeof(a) / sizeof(a[0])) 254 const struct ieee80211_cipher *cip; 255 ieee80211_keyix keyix, rxkeyix; 256 void *keyctx; 257 int oflags; 258 259 /* 260 * Validate cipher and set reference to cipher routines. 261 */ 262 if (cipher >= IEEE80211_CIPHER_MAX) { 263 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 264 "%s: invalid cipher %u\n", __func__, cipher); 265 ic->ic_stats.is_crypto_badcipher++; 266 return 0; 267 } 268 cip = ciphers[cipher]; 269 if (cip == NULL) { 270 /* 271 * Auto-load cipher module if we have a well-known name 272 * for it. It might be better to use string names rather 273 * than numbers and craft a module name based on the cipher 274 * name; e.g. wlan_cipher_<cipher-name>. 275 */ 276 if (cipher < N(cipher_modnames)) { 277 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 278 "%s: unregistered cipher %u, load module %s\n", 279 __func__, cipher, cipher_modnames[cipher]); 280 ieee80211_load_module(cipher_modnames[cipher]); 281 /* 282 * If cipher module loaded it should immediately 283 * call ieee80211_crypto_register which will fill 284 * in the entry in the ciphers array. 285 */ 286 cip = ciphers[cipher]; 287 } 288 if (cip == NULL) { 289 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 290 "%s: unable to load cipher %u, module %s\n", 291 __func__, cipher, 292 cipher < N(cipher_modnames) ? 293 cipher_modnames[cipher] : "<unknown>"); 294 ic->ic_stats.is_crypto_nocipher++; 295 return 0; 296 } 297 } 298 299 oflags = key->wk_flags; 300 flags &= IEEE80211_KEY_COMMON; 301 /* 302 * If the hardware does not support the cipher then 303 * fallback to a host-based implementation. 304 */ 305 if ((ic->ic_caps & (1<<cipher)) == 0) { 306 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 307 "%s: no h/w support for cipher %s, falling back to s/w\n", 308 __func__, cip->ic_name); 309 flags |= IEEE80211_KEY_SWCRYPT; 310 } 311 /* 312 * Hardware TKIP with software MIC is an important 313 * combination; we handle it by flagging each key, 314 * the cipher modules honor it. 315 */ 316 if (cipher == IEEE80211_CIPHER_TKIP && 317 (ic->ic_caps & IEEE80211_C_TKIPMIC) == 0) { 318 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 319 "%s: no h/w support for TKIP MIC, falling back to s/w\n", 320 __func__); 321 flags |= IEEE80211_KEY_SWMIC; 322 } 323 324 /* 325 * Bind cipher to key instance. Note we do this 326 * after checking the device capabilities so the 327 * cipher module can optimize space usage based on 328 * whether or not it needs to do the cipher work. 329 */ 330 if (key->wk_cipher != cip || key->wk_flags != flags) { 331 again: 332 /* 333 * Fillin the flags so cipher modules can see s/w 334 * crypto requirements and potentially allocate 335 * different state and/or attach different method 336 * pointers. 337 * 338 * XXX this is not right when s/w crypto fallback 339 * fails and we try to restore previous state. 340 */ 341 key->wk_flags = flags; 342 keyctx = cip->ic_attach(ic, key); /* attach new cipher */ 343 if (keyctx == NULL) { 344 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 345 "%s: unable to attach cipher %s\n", 346 __func__, cip->ic_name); 347 key->wk_flags = oflags; /* restore old flags */ 348 ic->ic_stats.is_crypto_attachfail++; 349 return 0; 350 } 351 cipher_detach(key); /* detach old cipher */ 352 key->wk_cipher = cip; /* XXX refcnt? */ 353 key->wk_private = keyctx; 354 } 355 /* 356 * Commit to requested usage so driver can see the flags. 357 */ 358 key->wk_flags = flags; 359 360 /* 361 * Ask the driver for a key index if we don't have one. 362 * Note that entries in the global key table always have 363 * an index; this means it's safe to call this routine 364 * for these entries just to setup the reference to the 365 * cipher template. Note also that when using software 366 * crypto we also call the driver to give us a key index. 367 */ 368 if (key->wk_keyix == IEEE80211_KEYIX_NONE) { 369 if (!dev_key_alloc(ic, key, &keyix, &rxkeyix)) { 370 /* 371 * Driver has no room; fallback to doing crypto 372 * in the host. We change the flags and start the 373 * procedure over. If we get back here then there's 374 * no hope and we bail. Note that this can leave 375 * the key in a inconsistent state if the caller 376 * continues to use it. 377 */ 378 if ((key->wk_flags & IEEE80211_KEY_SWCRYPT) == 0) { 379 ic->ic_stats.is_crypto_swfallback++; 380 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 381 "%s: no h/w resources for cipher %s, " 382 "falling back to s/w\n", __func__, 383 cip->ic_name); 384 oflags = key->wk_flags; 385 flags |= IEEE80211_KEY_SWCRYPT; 386 if (cipher == IEEE80211_CIPHER_TKIP) 387 flags |= IEEE80211_KEY_SWMIC; 388 goto again; 389 } 390 ic->ic_stats.is_crypto_keyfail++; 391 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 392 "%s: unable to setup cipher %s\n", 393 __func__, cip->ic_name); 394 return 0; 395 } 396 key->wk_keyix = keyix; 397 key->wk_rxkeyix = rxkeyix; 398 } 399 return 1; 400 #undef N 401 } 402 403 /* 404 * Remove the key (no locking, for internal use). 405 */ 406 static int 407 _ieee80211_crypto_delkey(struct ieee80211com *ic, struct ieee80211_key *key) 408 { 409 ieee80211_keyix keyix; 410 411 KASSERT(key->wk_cipher != NULL, ("No cipher!")); 412 413 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 414 "%s: %s keyix %u flags 0x%x rsc %ju tsc %ju len %u\n", 415 __func__, key->wk_cipher->ic_name, 416 key->wk_keyix, key->wk_flags, 417 key->wk_keyrsc, key->wk_keytsc, key->wk_keylen); 418 419 keyix = key->wk_keyix; 420 if (keyix != IEEE80211_KEYIX_NONE) { 421 /* 422 * Remove hardware entry. 423 */ 424 /* XXX key cache */ 425 if (!dev_key_delete(ic, key)) { 426 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 427 "%s: driver did not delete key index %u\n", 428 __func__, keyix); 429 ic->ic_stats.is_crypto_delkey++; 430 /* XXX recovery? */ 431 } 432 } 433 cipher_detach(key); 434 memset(key, 0, sizeof(*key)); 435 ieee80211_crypto_resetkey(ic, key, IEEE80211_KEYIX_NONE); 436 return 1; 437 } 438 439 /* 440 * Remove the specified key. 441 */ 442 int 443 ieee80211_crypto_delkey(struct ieee80211com *ic, struct ieee80211_key *key) 444 { 445 int status; 446 447 ieee80211_key_update_begin(ic); 448 status = _ieee80211_crypto_delkey(ic, key); 449 ieee80211_key_update_end(ic); 450 return status; 451 } 452 453 /* 454 * Clear the global key table. 455 */ 456 void 457 ieee80211_crypto_delglobalkeys(struct ieee80211com *ic) 458 { 459 int i; 460 461 ieee80211_key_update_begin(ic); 462 for (i = 0; i < IEEE80211_WEP_NKID; i++) 463 _ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[i]); 464 ieee80211_key_update_end(ic); 465 } 466 467 /* 468 * Set the contents of the specified key. 469 * 470 * Locking must be handled by the caller using: 471 * ieee80211_key_update_begin(ic); 472 * ieee80211_key_update_end(ic); 473 */ 474 int 475 ieee80211_crypto_setkey(struct ieee80211com *ic, struct ieee80211_key *key, 476 const uint8_t macaddr[IEEE80211_ADDR_LEN]) 477 { 478 const struct ieee80211_cipher *cip = key->wk_cipher; 479 480 KASSERT(cip != NULL, ("No cipher!")); 481 482 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 483 "%s: %s keyix %u flags 0x%x mac %6D rsc %ju tsc %ju len %u\n", 484 __func__, cip->ic_name, key->wk_keyix, 485 key->wk_flags, macaddr, ":", 486 key->wk_keyrsc, key->wk_keytsc, key->wk_keylen); 487 488 /* 489 * Give cipher a chance to validate key contents. 490 * XXX should happen before modifying state. 491 */ 492 if (!cip->ic_setkey(key)) { 493 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 494 "%s: cipher %s rejected key index %u len %u flags 0x%x\n", 495 __func__, cip->ic_name, key->wk_keyix, 496 key->wk_keylen, key->wk_flags); 497 ic->ic_stats.is_crypto_setkey_cipher++; 498 return 0; 499 } 500 if (key->wk_keyix == IEEE80211_KEYIX_NONE) { 501 /* XXX nothing allocated, should not happen */ 502 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 503 "%s: no key index; should not happen!\n", __func__); 504 ic->ic_stats.is_crypto_setkey_nokey++; 505 return 0; 506 } 507 return dev_key_set(ic, key, macaddr); 508 } 509 510 /* 511 * Add privacy headers appropriate for the specified key. 512 */ 513 struct ieee80211_key * 514 ieee80211_crypto_encap(struct ieee80211com *ic, 515 struct ieee80211_node *ni, struct mbuf *m) 516 { 517 struct ieee80211_key *k; 518 struct ieee80211_frame *wh; 519 const struct ieee80211_cipher *cip; 520 uint8_t keyid; 521 522 /* 523 * Multicast traffic always uses the multicast key. 524 * Otherwise if a unicast key is set we use that and 525 * it is always key index 0. When no unicast key is 526 * set we fall back to the default transmit key. 527 */ 528 wh = mtod(m, struct ieee80211_frame *); 529 if (IEEE80211_IS_MULTICAST(wh->i_addr1) || 530 ni->ni_ucastkey.wk_cipher == &ieee80211_cipher_none) { 531 if (ic->ic_def_txkey == IEEE80211_KEYIX_NONE) { 532 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 533 "[%6D] no default transmit key (%s) deftxkey %u\n", 534 wh->i_addr1, ":", __func__, 535 ic->ic_def_txkey); 536 ic->ic_stats.is_tx_nodefkey++; 537 return NULL; 538 } 539 keyid = ic->ic_def_txkey; 540 k = &ic->ic_nw_keys[ic->ic_def_txkey]; 541 } else { 542 keyid = 0; 543 k = &ni->ni_ucastkey; 544 } 545 cip = k->wk_cipher; 546 return (cip->ic_encap(k, m, keyid<<6) ? k : NULL); 547 } 548 549 /* 550 * Validate and strip privacy headers (and trailer) for a 551 * received frame that has the WEP/Privacy bit set. 552 */ 553 struct ieee80211_key * 554 ieee80211_crypto_decap(struct ieee80211com *ic, 555 struct ieee80211_node *ni, struct mbuf *m, int hdrlen) 556 { 557 #define IEEE80211_WEP_HDRLEN (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN) 558 #define IEEE80211_WEP_MINLEN \ 559 (sizeof(struct ieee80211_frame) + \ 560 IEEE80211_WEP_HDRLEN + IEEE80211_WEP_CRCLEN) 561 struct ieee80211_key *k; 562 struct ieee80211_frame *wh; 563 const struct ieee80211_cipher *cip; 564 const uint8_t *ivp; 565 uint8_t keyid; 566 567 /* NB: this minimum size data frame could be bigger */ 568 if (m->m_pkthdr.len < IEEE80211_WEP_MINLEN) { 569 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 570 "%s: WEP data frame too short, len %u\n", 571 __func__, m->m_pkthdr.len); 572 ic->ic_stats.is_rx_tooshort++; /* XXX need unique stat? */ 573 return NULL; 574 } 575 576 /* 577 * Locate the key. If unicast and there is no unicast 578 * key then we fall back to the key id in the header. 579 * This assumes unicast keys are only configured when 580 * the key id in the header is meaningless (typically 0). 581 */ 582 wh = mtod(m, struct ieee80211_frame *); 583 ivp = mtod(m, const uint8_t *) + hdrlen; /* XXX contig */ 584 keyid = ivp[IEEE80211_WEP_IVLEN]; 585 if (IEEE80211_IS_MULTICAST(wh->i_addr1) || 586 ni->ni_ucastkey.wk_cipher == &ieee80211_cipher_none) 587 k = &ic->ic_nw_keys[keyid >> 6]; 588 else 589 k = &ni->ni_ucastkey; 590 591 /* 592 * Insure crypto header is contiguous for all decap work. 593 */ 594 cip = k->wk_cipher; 595 if (m->m_len < hdrlen + cip->ic_header && 596 (m = m_pullup(m, hdrlen + cip->ic_header)) == NULL) { 597 IEEE80211_DPRINTF(ic, IEEE80211_MSG_CRYPTO, 598 "[%6D] unable to pullup %s header\n", 599 wh->i_addr2, ":", cip->ic_name); 600 ic->ic_stats.is_rx_wepfail++; /* XXX */ 601 return 0; 602 } 603 604 return (cip->ic_decap(k, m, hdrlen) ? k : NULL); 605 #undef IEEE80211_WEP_MINLEN 606 #undef IEEE80211_WEP_HDRLEN 607 } 608