1 /*- 2 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include <sys/cdefs.h> 27 __FBSDID("$FreeBSD$"); 28 29 /* 30 * IEEE 802.11i TKIP crypto support. 31 * 32 * Part of this module is derived from similar code in the Host 33 * AP driver. The code is used with the consent of the author and 34 * it's license is included below. 35 */ 36 #include "opt_wlan.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/malloc.h> 42 #include <sys/kernel.h> 43 #include <sys/module.h> 44 #include <sys/endian.h> 45 46 #include <sys/socket.h> 47 48 #include <net/if.h> 49 #include <net/if_var.h> 50 #include <net/if_media.h> 51 #include <net/ethernet.h> 52 53 #include <netproto/802_11/ieee80211_var.h> 54 55 static void *tkip_attach(struct ieee80211vap *, struct ieee80211_key *); 56 static void tkip_detach(struct ieee80211_key *); 57 static int tkip_setkey(struct ieee80211_key *); 58 static void tkip_setiv(struct ieee80211_key *, uint8_t *); 59 static int tkip_encap(struct ieee80211_key *, struct mbuf *); 60 static int tkip_enmic(struct ieee80211_key *, struct mbuf *, int); 61 static int tkip_decap(struct ieee80211_key *, struct mbuf *, int); 62 static int tkip_demic(struct ieee80211_key *, struct mbuf *, int); 63 64 static const struct ieee80211_cipher tkip = { 65 .ic_name = "TKIP", 66 .ic_cipher = IEEE80211_CIPHER_TKIP, 67 .ic_header = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + 68 IEEE80211_WEP_EXTIVLEN, 69 .ic_trailer = IEEE80211_WEP_CRCLEN, 70 .ic_miclen = IEEE80211_WEP_MICLEN, 71 .ic_attach = tkip_attach, 72 .ic_detach = tkip_detach, 73 .ic_setkey = tkip_setkey, 74 .ic_setiv = tkip_setiv, 75 .ic_encap = tkip_encap, 76 .ic_decap = tkip_decap, 77 .ic_enmic = tkip_enmic, 78 .ic_demic = tkip_demic, 79 }; 80 81 typedef uint8_t u8; 82 typedef uint16_t u16; 83 typedef uint32_t __u32; 84 typedef uint32_t u32; 85 86 struct tkip_ctx { 87 struct ieee80211vap *tc_vap; /* for diagnostics+statistics */ 88 89 u16 tx_ttak[5]; 90 u8 tx_rc4key[16]; /* XXX for test module; make locals? */ 91 92 u16 rx_ttak[5]; 93 int rx_phase1_done; 94 u8 rx_rc4key[16]; /* XXX for test module; make locals? */ 95 uint64_t rx_rsc; /* held until MIC verified */ 96 }; 97 98 static void michael_mic(struct tkip_ctx *, const u8 *key, 99 struct mbuf *m, u_int off, size_t data_len, 100 u8 mic[IEEE80211_WEP_MICLEN]); 101 static int tkip_encrypt(struct tkip_ctx *, struct ieee80211_key *, 102 struct mbuf *, int hdr_len); 103 static int tkip_decrypt(struct tkip_ctx *, struct ieee80211_key *, 104 struct mbuf *, int hdr_len); 105 106 /* number of references from net80211 layer */ 107 static int nrefs = 0; 108 109 static void * 110 tkip_attach(struct ieee80211vap *vap, struct ieee80211_key *k) 111 { 112 struct tkip_ctx *ctx; 113 114 #if defined(__DragonFly__) 115 ctx = (struct tkip_ctx *) kmalloc(sizeof(struct tkip_ctx), 116 M_80211_CRYPTO, M_INTWAIT | M_ZERO); 117 #else 118 ctx = (struct tkip_ctx *) IEEE80211_MALLOC(sizeof(struct tkip_ctx), 119 M_80211_CRYPTO, IEEE80211_M_NOWAIT | IEEE80211_M_ZERO); 120 #endif 121 if (ctx == NULL) { 122 vap->iv_stats.is_crypto_nomem++; 123 return NULL; 124 } 125 126 ctx->tc_vap = vap; 127 nrefs++; /* NB: we assume caller locking */ 128 return ctx; 129 } 130 131 static void 132 tkip_detach(struct ieee80211_key *k) 133 { 134 struct tkip_ctx *ctx = k->wk_private; 135 136 IEEE80211_FREE(ctx, M_80211_CRYPTO); 137 KASSERT(nrefs > 0, ("imbalanced attach/detach")); 138 nrefs--; /* NB: we assume caller locking */ 139 } 140 141 static int 142 tkip_setkey(struct ieee80211_key *k) 143 { 144 struct tkip_ctx *ctx = k->wk_private; 145 146 if (k->wk_keylen != (128/NBBY)) { 147 (void) ctx; /* XXX */ 148 IEEE80211_DPRINTF(ctx->tc_vap, IEEE80211_MSG_CRYPTO, 149 "%s: Invalid key length %u, expecting %u\n", 150 __func__, k->wk_keylen, 128/NBBY); 151 return 0; 152 } 153 ctx->rx_phase1_done = 0; 154 return 1; 155 } 156 157 static void 158 tkip_setiv(struct ieee80211_key *k, uint8_t *ivp) 159 { 160 struct tkip_ctx *ctx = k->wk_private; 161 struct ieee80211vap *vap = ctx->tc_vap; 162 uint8_t keyid; 163 164 keyid = ieee80211_crypto_get_keyid(vap, k) << 6; 165 166 k->wk_keytsc++; 167 ivp[0] = k->wk_keytsc >> 8; /* TSC1 */ 168 ivp[1] = (ivp[0] | 0x20) & 0x7f; /* WEP seed */ 169 ivp[2] = k->wk_keytsc >> 0; /* TSC0 */ 170 ivp[3] = keyid | IEEE80211_WEP_EXTIV; /* KeyID | ExtID */ 171 ivp[4] = k->wk_keytsc >> 16; /* TSC2 */ 172 ivp[5] = k->wk_keytsc >> 24; /* TSC3 */ 173 ivp[6] = k->wk_keytsc >> 32; /* TSC4 */ 174 ivp[7] = k->wk_keytsc >> 40; /* TSC5 */ 175 } 176 177 /* 178 * Add privacy headers and do any s/w encryption required. 179 */ 180 static int 181 tkip_encap(struct ieee80211_key *k, struct mbuf *m) 182 { 183 struct tkip_ctx *ctx = k->wk_private; 184 struct ieee80211vap *vap = ctx->tc_vap; 185 struct ieee80211com *ic = vap->iv_ic; 186 uint8_t *ivp; 187 int hdrlen; 188 189 /* 190 * Handle TKIP counter measures requirement. 191 */ 192 if (vap->iv_flags & IEEE80211_F_COUNTERM) { 193 #ifdef IEEE80211_DEBUG 194 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 195 #endif 196 197 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 198 "discard frame due to countermeasures (%s)", __func__); 199 vap->iv_stats.is_crypto_tkipcm++; 200 return 0; 201 } 202 hdrlen = ieee80211_hdrspace(ic, mtod(m, void *)); 203 204 /* 205 * Copy down 802.11 header and add the IV, KeyID, and ExtIV. 206 */ 207 M_PREPEND(m, tkip.ic_header, M_NOWAIT); 208 if (m == NULL) 209 return 0; 210 ivp = mtod(m, uint8_t *); 211 memmove(ivp, ivp + tkip.ic_header, hdrlen); 212 ivp += hdrlen; 213 214 tkip_setiv(k, ivp); 215 216 /* 217 * Finally, do software encrypt if needed. 218 */ 219 if ((k->wk_flags & IEEE80211_KEY_SWENCRYPT) && 220 !tkip_encrypt(ctx, k, m, hdrlen)) 221 return 0; 222 223 return 1; 224 } 225 226 /* 227 * Add MIC to the frame as needed. 228 */ 229 static int 230 tkip_enmic(struct ieee80211_key *k, struct mbuf *m, int force) 231 { 232 struct tkip_ctx *ctx = k->wk_private; 233 234 if (force || (k->wk_flags & IEEE80211_KEY_SWENMIC)) { 235 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 236 struct ieee80211vap *vap = ctx->tc_vap; 237 struct ieee80211com *ic = vap->iv_ic; 238 int hdrlen; 239 uint8_t mic[IEEE80211_WEP_MICLEN]; 240 241 vap->iv_stats.is_crypto_tkipenmic++; 242 243 hdrlen = ieee80211_hdrspace(ic, wh); 244 245 michael_mic(ctx, k->wk_txmic, 246 m, hdrlen, m->m_pkthdr.len - hdrlen, mic); 247 return m_append(m, tkip.ic_miclen, mic); 248 } 249 return 1; 250 } 251 252 static __inline uint64_t 253 READ_6(uint8_t b0, uint8_t b1, uint8_t b2, uint8_t b3, uint8_t b4, uint8_t b5) 254 { 255 uint32_t iv32 = (b0 << 0) | (b1 << 8) | (b2 << 16) | (b3 << 24); 256 uint16_t iv16 = (b4 << 0) | (b5 << 8); 257 return (((uint64_t)iv16) << 32) | iv32; 258 } 259 260 /* 261 * Validate and strip privacy headers (and trailer) for a 262 * received frame. If necessary, decrypt the frame using 263 * the specified key. 264 */ 265 static int 266 tkip_decap(struct ieee80211_key *k, struct mbuf *m, int hdrlen) 267 { 268 struct tkip_ctx *ctx = k->wk_private; 269 struct ieee80211vap *vap = ctx->tc_vap; 270 struct ieee80211_frame *wh; 271 uint8_t *ivp, tid; 272 273 /* 274 * Header should have extended IV and sequence number; 275 * verify the former and validate the latter. 276 */ 277 wh = mtod(m, struct ieee80211_frame *); 278 ivp = mtod(m, uint8_t *) + hdrlen; 279 if ((ivp[IEEE80211_WEP_IVLEN] & IEEE80211_WEP_EXTIV) == 0) { 280 /* 281 * No extended IV; discard frame. 282 */ 283 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 284 "%s", "missing ExtIV for TKIP cipher"); 285 vap->iv_stats.is_rx_tkipformat++; 286 return 0; 287 } 288 /* 289 * Handle TKIP counter measures requirement. 290 */ 291 if (vap->iv_flags & IEEE80211_F_COUNTERM) { 292 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 293 "discard frame due to countermeasures (%s)", __func__); 294 vap->iv_stats.is_crypto_tkipcm++; 295 return 0; 296 } 297 298 tid = ieee80211_gettid(wh); 299 ctx->rx_rsc = READ_6(ivp[2], ivp[0], ivp[4], ivp[5], ivp[6], ivp[7]); 300 if (ctx->rx_rsc <= k->wk_keyrsc[tid] && 301 (k->wk_flags & IEEE80211_KEY_NOREPLAY) == 0) { 302 /* 303 * Replay violation; notify upper layer. 304 */ 305 ieee80211_notify_replay_failure(vap, wh, k, ctx->rx_rsc, tid); 306 vap->iv_stats.is_rx_tkipreplay++; 307 return 0; 308 } 309 /* 310 * NB: We can't update the rsc in the key until MIC is verified. 311 * 312 * We assume we are not preempted between doing the check above 313 * and updating wk_keyrsc when stripping the MIC in tkip_demic. 314 * Otherwise we might process another packet and discard it as 315 * a replay. 316 */ 317 318 /* 319 * Check if the device handled the decrypt in hardware. 320 * If so we just strip the header; otherwise we need to 321 * handle the decrypt in software. 322 */ 323 if ((k->wk_flags & IEEE80211_KEY_SWDECRYPT) && 324 !tkip_decrypt(ctx, k, m, hdrlen)) 325 return 0; 326 327 /* 328 * Copy up 802.11 header and strip crypto bits. 329 */ 330 memmove(mtod(m, uint8_t *) + tkip.ic_header, mtod(m, void *), hdrlen); 331 m_adj(m, tkip.ic_header); 332 m_adj(m, -tkip.ic_trailer); 333 334 return 1; 335 } 336 337 /* 338 * Verify and strip MIC from the frame. 339 */ 340 static int 341 tkip_demic(struct ieee80211_key *k, struct mbuf *m, int force) 342 { 343 struct tkip_ctx *ctx = k->wk_private; 344 struct ieee80211_frame *wh; 345 uint8_t tid; 346 347 wh = mtod(m, struct ieee80211_frame *); 348 if ((k->wk_flags & IEEE80211_KEY_SWDEMIC) || force) { 349 struct ieee80211vap *vap = ctx->tc_vap; 350 int hdrlen = ieee80211_hdrspace(vap->iv_ic, wh); 351 u8 mic[IEEE80211_WEP_MICLEN]; 352 u8 mic0[IEEE80211_WEP_MICLEN]; 353 354 vap->iv_stats.is_crypto_tkipdemic++; 355 356 michael_mic(ctx, k->wk_rxmic, 357 m, hdrlen, m->m_pkthdr.len - (hdrlen + tkip.ic_miclen), 358 mic); 359 m_copydata(m, m->m_pkthdr.len - tkip.ic_miclen, 360 tkip.ic_miclen, mic0); 361 if (memcmp(mic, mic0, tkip.ic_miclen)) { 362 /* NB: 802.11 layer handles statistic and debug msg */ 363 ieee80211_notify_michael_failure(vap, wh, 364 k->wk_rxkeyix != IEEE80211_KEYIX_NONE ? 365 k->wk_rxkeyix : k->wk_keyix); 366 return 0; 367 } 368 } 369 /* 370 * Strip MIC from the tail. 371 */ 372 m_adj(m, -tkip.ic_miclen); 373 374 /* 375 * Ok to update rsc now that MIC has been verified. 376 */ 377 tid = ieee80211_gettid(wh); 378 k->wk_keyrsc[tid] = ctx->rx_rsc; 379 380 return 1; 381 } 382 383 /* 384 * Host AP crypt: host-based TKIP encryption implementation for Host AP driver 385 * 386 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 387 * 388 * This program is free software; you can redistribute it and/or modify 389 * it under the terms of the GNU General Public License version 2 as 390 * published by the Free Software Foundation. See README and COPYING for 391 * more details. 392 * 393 * Alternatively, this software may be distributed under the terms of BSD 394 * license. 395 */ 396 397 static const __u32 crc32_table[256] = { 398 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, 399 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, 400 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, 401 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, 402 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, 403 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, 404 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, 405 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, 406 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, 407 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, 408 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, 409 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, 410 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, 411 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, 412 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, 413 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, 414 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, 415 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, 416 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, 417 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, 418 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, 419 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, 420 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, 421 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, 422 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, 423 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, 424 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, 425 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, 426 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, 427 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, 428 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, 429 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, 430 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, 431 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, 432 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, 433 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, 434 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, 435 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, 436 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, 437 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, 438 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, 439 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, 440 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, 441 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, 442 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, 443 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, 444 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, 445 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, 446 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, 447 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, 448 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, 449 0x2d02ef8dL 450 }; 451 452 static __inline u16 RotR1(u16 val) 453 { 454 return (val >> 1) | (val << 15); 455 } 456 457 static __inline u8 Lo8(u16 val) 458 { 459 return val & 0xff; 460 } 461 462 static __inline u8 Hi8(u16 val) 463 { 464 return val >> 8; 465 } 466 467 static __inline u16 Lo16(u32 val) 468 { 469 return val & 0xffff; 470 } 471 472 static __inline u16 Hi16(u32 val) 473 { 474 return val >> 16; 475 } 476 477 static __inline u16 Mk16(u8 hi, u8 lo) 478 { 479 return lo | (((u16) hi) << 8); 480 } 481 482 static __inline u16 Mk16_le(const u16 *v) 483 { 484 return le16toh(*v); 485 } 486 487 static const u16 Sbox[256] = { 488 0xC6A5, 0xF884, 0xEE99, 0xF68D, 0xFF0D, 0xD6BD, 0xDEB1, 0x9154, 489 0x6050, 0x0203, 0xCEA9, 0x567D, 0xE719, 0xB562, 0x4DE6, 0xEC9A, 490 0x8F45, 0x1F9D, 0x8940, 0xFA87, 0xEF15, 0xB2EB, 0x8EC9, 0xFB0B, 491 0x41EC, 0xB367, 0x5FFD, 0x45EA, 0x23BF, 0x53F7, 0xE496, 0x9B5B, 492 0x75C2, 0xE11C, 0x3DAE, 0x4C6A, 0x6C5A, 0x7E41, 0xF502, 0x834F, 493 0x685C, 0x51F4, 0xD134, 0xF908, 0xE293, 0xAB73, 0x6253, 0x2A3F, 494 0x080C, 0x9552, 0x4665, 0x9D5E, 0x3028, 0x37A1, 0x0A0F, 0x2FB5, 495 0x0E09, 0x2436, 0x1B9B, 0xDF3D, 0xCD26, 0x4E69, 0x7FCD, 0xEA9F, 496 0x121B, 0x1D9E, 0x5874, 0x342E, 0x362D, 0xDCB2, 0xB4EE, 0x5BFB, 497 0xA4F6, 0x764D, 0xB761, 0x7DCE, 0x527B, 0xDD3E, 0x5E71, 0x1397, 498 0xA6F5, 0xB968, 0x0000, 0xC12C, 0x4060, 0xE31F, 0x79C8, 0xB6ED, 499 0xD4BE, 0x8D46, 0x67D9, 0x724B, 0x94DE, 0x98D4, 0xB0E8, 0x854A, 500 0xBB6B, 0xC52A, 0x4FE5, 0xED16, 0x86C5, 0x9AD7, 0x6655, 0x1194, 501 0x8ACF, 0xE910, 0x0406, 0xFE81, 0xA0F0, 0x7844, 0x25BA, 0x4BE3, 502 0xA2F3, 0x5DFE, 0x80C0, 0x058A, 0x3FAD, 0x21BC, 0x7048, 0xF104, 503 0x63DF, 0x77C1, 0xAF75, 0x4263, 0x2030, 0xE51A, 0xFD0E, 0xBF6D, 504 0x814C, 0x1814, 0x2635, 0xC32F, 0xBEE1, 0x35A2, 0x88CC, 0x2E39, 505 0x9357, 0x55F2, 0xFC82, 0x7A47, 0xC8AC, 0xBAE7, 0x322B, 0xE695, 506 0xC0A0, 0x1998, 0x9ED1, 0xA37F, 0x4466, 0x547E, 0x3BAB, 0x0B83, 507 0x8CCA, 0xC729, 0x6BD3, 0x283C, 0xA779, 0xBCE2, 0x161D, 0xAD76, 508 0xDB3B, 0x6456, 0x744E, 0x141E, 0x92DB, 0x0C0A, 0x486C, 0xB8E4, 509 0x9F5D, 0xBD6E, 0x43EF, 0xC4A6, 0x39A8, 0x31A4, 0xD337, 0xF28B, 510 0xD532, 0x8B43, 0x6E59, 0xDAB7, 0x018C, 0xB164, 0x9CD2, 0x49E0, 511 0xD8B4, 0xACFA, 0xF307, 0xCF25, 0xCAAF, 0xF48E, 0x47E9, 0x1018, 512 0x6FD5, 0xF088, 0x4A6F, 0x5C72, 0x3824, 0x57F1, 0x73C7, 0x9751, 513 0xCB23, 0xA17C, 0xE89C, 0x3E21, 0x96DD, 0x61DC, 0x0D86, 0x0F85, 514 0xE090, 0x7C42, 0x71C4, 0xCCAA, 0x90D8, 0x0605, 0xF701, 0x1C12, 515 0xC2A3, 0x6A5F, 0xAEF9, 0x69D0, 0x1791, 0x9958, 0x3A27, 0x27B9, 516 0xD938, 0xEB13, 0x2BB3, 0x2233, 0xD2BB, 0xA970, 0x0789, 0x33A7, 517 0x2DB6, 0x3C22, 0x1592, 0xC920, 0x8749, 0xAAFF, 0x5078, 0xA57A, 518 0x038F, 0x59F8, 0x0980, 0x1A17, 0x65DA, 0xD731, 0x84C6, 0xD0B8, 519 0x82C3, 0x29B0, 0x5A77, 0x1E11, 0x7BCB, 0xA8FC, 0x6DD6, 0x2C3A, 520 }; 521 522 static __inline u16 _S_(u16 v) 523 { 524 u16 t = Sbox[Hi8(v)]; 525 return Sbox[Lo8(v)] ^ ((t << 8) | (t >> 8)); 526 } 527 528 #define PHASE1_LOOP_COUNT 8 529 530 static void tkip_mixing_phase1(u16 *TTAK, const u8 *TK, const u8 *TA, u32 IV32) 531 { 532 int i, j; 533 534 /* Initialize the 80-bit TTAK from TSC (IV32) and TA[0..5] */ 535 TTAK[0] = Lo16(IV32); 536 TTAK[1] = Hi16(IV32); 537 TTAK[2] = Mk16(TA[1], TA[0]); 538 TTAK[3] = Mk16(TA[3], TA[2]); 539 TTAK[4] = Mk16(TA[5], TA[4]); 540 541 for (i = 0; i < PHASE1_LOOP_COUNT; i++) { 542 j = 2 * (i & 1); 543 TTAK[0] += _S_(TTAK[4] ^ Mk16(TK[1 + j], TK[0 + j])); 544 TTAK[1] += _S_(TTAK[0] ^ Mk16(TK[5 + j], TK[4 + j])); 545 TTAK[2] += _S_(TTAK[1] ^ Mk16(TK[9 + j], TK[8 + j])); 546 TTAK[3] += _S_(TTAK[2] ^ Mk16(TK[13 + j], TK[12 + j])); 547 TTAK[4] += _S_(TTAK[3] ^ Mk16(TK[1 + j], TK[0 + j])) + i; 548 } 549 } 550 551 #ifndef _BYTE_ORDER 552 #error "Don't know native byte order" 553 #endif 554 555 static void tkip_mixing_phase2(u8 *WEPSeed, const u8 *TK, const u16 *TTAK, 556 u16 IV16) 557 { 558 /* Make temporary area overlap WEP seed so that the final copy can be 559 * avoided on little endian hosts. */ 560 u16 *PPK = (u16 *) &WEPSeed[4]; 561 562 /* Step 1 - make copy of TTAK and bring in TSC */ 563 PPK[0] = TTAK[0]; 564 PPK[1] = TTAK[1]; 565 PPK[2] = TTAK[2]; 566 PPK[3] = TTAK[3]; 567 PPK[4] = TTAK[4]; 568 PPK[5] = TTAK[4] + IV16; 569 570 /* Step 2 - 96-bit bijective mixing using S-box */ 571 PPK[0] += _S_(PPK[5] ^ Mk16_le((const u16 *) &TK[0])); 572 PPK[1] += _S_(PPK[0] ^ Mk16_le((const u16 *) &TK[2])); 573 PPK[2] += _S_(PPK[1] ^ Mk16_le((const u16 *) &TK[4])); 574 PPK[3] += _S_(PPK[2] ^ Mk16_le((const u16 *) &TK[6])); 575 PPK[4] += _S_(PPK[3] ^ Mk16_le((const u16 *) &TK[8])); 576 PPK[5] += _S_(PPK[4] ^ Mk16_le((const u16 *) &TK[10])); 577 578 PPK[0] += RotR1(PPK[5] ^ Mk16_le((const u16 *) &TK[12])); 579 PPK[1] += RotR1(PPK[0] ^ Mk16_le((const u16 *) &TK[14])); 580 PPK[2] += RotR1(PPK[1]); 581 PPK[3] += RotR1(PPK[2]); 582 PPK[4] += RotR1(PPK[3]); 583 PPK[5] += RotR1(PPK[4]); 584 585 /* Step 3 - bring in last of TK bits, assign 24-bit WEP IV value 586 * WEPSeed[0..2] is transmitted as WEP IV */ 587 WEPSeed[0] = Hi8(IV16); 588 WEPSeed[1] = (Hi8(IV16) | 0x20) & 0x7F; 589 WEPSeed[2] = Lo8(IV16); 590 WEPSeed[3] = Lo8((PPK[5] ^ Mk16_le((const u16 *) &TK[0])) >> 1); 591 592 #if _BYTE_ORDER == _BIG_ENDIAN 593 { 594 int i; 595 for (i = 0; i < 6; i++) 596 PPK[i] = (PPK[i] << 8) | (PPK[i] >> 8); 597 } 598 #endif 599 } 600 601 static void 602 wep_encrypt(u8 *key, struct mbuf *m0, u_int off, size_t data_len, 603 uint8_t icv[IEEE80211_WEP_CRCLEN]) 604 { 605 u32 i, j, k, crc; 606 size_t buflen; 607 u8 S[256]; 608 u8 *pos; 609 struct mbuf *m; 610 #define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0) 611 612 /* Setup RC4 state */ 613 for (i = 0; i < 256; i++) 614 S[i] = i; 615 j = 0; 616 for (i = 0; i < 256; i++) { 617 j = (j + S[i] + key[i & 0x0f]) & 0xff; 618 S_SWAP(i, j); 619 } 620 621 /* Compute CRC32 over unencrypted data and apply RC4 to data */ 622 crc = ~0; 623 i = j = 0; 624 m = m0; 625 pos = mtod(m, uint8_t *) + off; 626 buflen = m->m_len - off; 627 for (;;) { 628 if (buflen > data_len) 629 buflen = data_len; 630 data_len -= buflen; 631 for (k = 0; k < buflen; k++) { 632 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 633 i = (i + 1) & 0xff; 634 j = (j + S[i]) & 0xff; 635 S_SWAP(i, j); 636 *pos++ ^= S[(S[i] + S[j]) & 0xff]; 637 } 638 m = m->m_next; 639 if (m == NULL) { 640 KASSERT(data_len == 0, 641 ("out of buffers with data_len %zu\n", data_len)); 642 break; 643 } 644 pos = mtod(m, uint8_t *); 645 buflen = m->m_len; 646 } 647 crc = ~crc; 648 649 /* Append little-endian CRC32 and encrypt it to produce ICV */ 650 icv[0] = crc; 651 icv[1] = crc >> 8; 652 icv[2] = crc >> 16; 653 icv[3] = crc >> 24; 654 for (k = 0; k < IEEE80211_WEP_CRCLEN; k++) { 655 i = (i + 1) & 0xff; 656 j = (j + S[i]) & 0xff; 657 S_SWAP(i, j); 658 icv[k] ^= S[(S[i] + S[j]) & 0xff]; 659 } 660 } 661 662 static int 663 wep_decrypt(u8 *key, struct mbuf *m, u_int off, size_t data_len) 664 { 665 u32 i, j, k, crc; 666 u8 S[256]; 667 u8 *pos, icv[4]; 668 size_t buflen; 669 670 /* Setup RC4 state */ 671 for (i = 0; i < 256; i++) 672 S[i] = i; 673 j = 0; 674 for (i = 0; i < 256; i++) { 675 j = (j + S[i] + key[i & 0x0f]) & 0xff; 676 S_SWAP(i, j); 677 } 678 679 /* Apply RC4 to data and compute CRC32 over decrypted data */ 680 crc = ~0; 681 i = j = 0; 682 pos = mtod(m, uint8_t *) + off; 683 buflen = m->m_len - off; 684 for (;;) { 685 if (buflen > data_len) 686 buflen = data_len; 687 data_len -= buflen; 688 for (k = 0; k < buflen; k++) { 689 i = (i + 1) & 0xff; 690 j = (j + S[i]) & 0xff; 691 S_SWAP(i, j); 692 *pos ^= S[(S[i] + S[j]) & 0xff]; 693 crc = crc32_table[(crc ^ *pos) & 0xff] ^ (crc >> 8); 694 pos++; 695 } 696 m = m->m_next; 697 if (m == NULL) { 698 KASSERT(data_len == 0, 699 ("out of buffers with data_len %zu\n", data_len)); 700 break; 701 } 702 pos = mtod(m, uint8_t *); 703 buflen = m->m_len; 704 } 705 crc = ~crc; 706 707 /* Encrypt little-endian CRC32 and verify that it matches with the 708 * received ICV */ 709 icv[0] = crc; 710 icv[1] = crc >> 8; 711 icv[2] = crc >> 16; 712 icv[3] = crc >> 24; 713 for (k = 0; k < 4; k++) { 714 i = (i + 1) & 0xff; 715 j = (j + S[i]) & 0xff; 716 S_SWAP(i, j); 717 if ((icv[k] ^ S[(S[i] + S[j]) & 0xff]) != *pos++) { 718 /* ICV mismatch - drop frame */ 719 return -1; 720 } 721 } 722 723 return 0; 724 } 725 726 727 static __inline u32 rotl(u32 val, int bits) 728 { 729 return (val << bits) | (val >> (32 - bits)); 730 } 731 732 733 static __inline u32 rotr(u32 val, int bits) 734 { 735 return (val >> bits) | (val << (32 - bits)); 736 } 737 738 739 static __inline u32 xswap(u32 val) 740 { 741 return ((val & 0x00ff00ff) << 8) | ((val & 0xff00ff00) >> 8); 742 } 743 744 745 #define michael_block(l, r) \ 746 do { \ 747 r ^= rotl(l, 17); \ 748 l += r; \ 749 r ^= xswap(l); \ 750 l += r; \ 751 r ^= rotl(l, 3); \ 752 l += r; \ 753 r ^= rotr(l, 2); \ 754 l += r; \ 755 } while (0) 756 757 758 static __inline u32 get_le32_split(u8 b0, u8 b1, u8 b2, u8 b3) 759 { 760 return b0 | (b1 << 8) | (b2 << 16) | (b3 << 24); 761 } 762 763 static __inline u32 get_le32(const u8 *p) 764 { 765 return get_le32_split(p[0], p[1], p[2], p[3]); 766 } 767 768 769 static __inline void put_le32(u8 *p, u32 v) 770 { 771 p[0] = v; 772 p[1] = v >> 8; 773 p[2] = v >> 16; 774 p[3] = v >> 24; 775 } 776 777 /* 778 * Craft pseudo header used to calculate the MIC. 779 */ 780 static void 781 michael_mic_hdr(const struct ieee80211_frame *wh0, uint8_t hdr[16]) 782 { 783 const struct ieee80211_frame_addr4 *wh = 784 (const struct ieee80211_frame_addr4 *) wh0; 785 786 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 787 case IEEE80211_FC1_DIR_NODS: 788 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 789 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 790 break; 791 case IEEE80211_FC1_DIR_TODS: 792 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 793 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr2); 794 break; 795 case IEEE80211_FC1_DIR_FROMDS: 796 IEEE80211_ADDR_COPY(hdr, wh->i_addr1); /* DA */ 797 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr3); 798 break; 799 case IEEE80211_FC1_DIR_DSTODS: 800 IEEE80211_ADDR_COPY(hdr, wh->i_addr3); /* DA */ 801 IEEE80211_ADDR_COPY(hdr + IEEE80211_ADDR_LEN, wh->i_addr4); 802 break; 803 } 804 805 if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) { 806 const struct ieee80211_qosframe *qwh = 807 (const struct ieee80211_qosframe *) wh; 808 hdr[12] = qwh->i_qos[0] & IEEE80211_QOS_TID; 809 } else 810 hdr[12] = 0; 811 hdr[13] = hdr[14] = hdr[15] = 0; /* reserved */ 812 } 813 814 static void 815 michael_mic(struct tkip_ctx *ctx, const u8 *key, 816 struct mbuf *m, u_int off, size_t data_len, 817 u8 mic[IEEE80211_WEP_MICLEN]) 818 { 819 uint8_t hdr[16]; 820 u32 l, r; 821 const uint8_t *data; 822 u_int space; 823 824 michael_mic_hdr(mtod(m, struct ieee80211_frame *), hdr); 825 826 l = get_le32(key); 827 r = get_le32(key + 4); 828 829 /* Michael MIC pseudo header: DA, SA, 3 x 0, Priority */ 830 l ^= get_le32(hdr); 831 michael_block(l, r); 832 l ^= get_le32(&hdr[4]); 833 michael_block(l, r); 834 l ^= get_le32(&hdr[8]); 835 michael_block(l, r); 836 l ^= get_le32(&hdr[12]); 837 michael_block(l, r); 838 839 /* first buffer has special handling */ 840 data = mtod(m, const uint8_t *) + off; 841 space = m->m_len - off; 842 for (;;) { 843 if (space > data_len) 844 space = data_len; 845 /* collect 32-bit blocks from current buffer */ 846 while (space >= sizeof(uint32_t)) { 847 l ^= get_le32(data); 848 michael_block(l, r); 849 data += sizeof(uint32_t), space -= sizeof(uint32_t); 850 data_len -= sizeof(uint32_t); 851 } 852 /* 853 * NB: when space is zero we make one more trip around 854 * the loop to advance to the next mbuf where there is 855 * data. This handles the case where there are 4*n 856 * bytes in an mbuf followed by <4 bytes in a later mbuf. 857 * By making an extra trip we'll drop out of the loop 858 * with m pointing at the mbuf with 3 bytes and space 859 * set as required by the remainder handling below. 860 */ 861 if (data_len == 0 || 862 (data_len < sizeof(uint32_t) && space != 0)) 863 break; 864 m = m->m_next; 865 if (m == NULL) { 866 KASSERT(0, ("out of data, data_len %zu\n", data_len)); 867 break; 868 } 869 if (space != 0) { 870 const uint8_t *data_next; 871 /* 872 * Block straddles buffers, split references. 873 */ 874 data_next = mtod(m, const uint8_t *); 875 KASSERT(m->m_len >= sizeof(uint32_t) - space, 876 ("not enough data in following buffer, " 877 "m_len %u need %zu\n", m->m_len, 878 sizeof(uint32_t) - space)); 879 switch (space) { 880 case 1: 881 l ^= get_le32_split(data[0], data_next[0], 882 data_next[1], data_next[2]); 883 data = data_next + 3; 884 space = m->m_len - 3; 885 break; 886 case 2: 887 l ^= get_le32_split(data[0], data[1], 888 data_next[0], data_next[1]); 889 data = data_next + 2; 890 space = m->m_len - 2; 891 break; 892 case 3: 893 l ^= get_le32_split(data[0], data[1], 894 data[2], data_next[0]); 895 data = data_next + 1; 896 space = m->m_len - 1; 897 break; 898 } 899 michael_block(l, r); 900 data_len -= sizeof(uint32_t); 901 } else { 902 /* 903 * Setup for next buffer. 904 */ 905 data = mtod(m, const uint8_t *); 906 space = m->m_len; 907 } 908 } 909 /* 910 * Catch degenerate cases like mbuf[4*n+1 bytes] followed by 911 * mbuf[2 bytes]. I don't believe these should happen; if they 912 * do then we'll need more involved logic. 913 */ 914 KASSERT(data_len <= space, 915 ("not enough data, data_len %zu space %u\n", data_len, space)); 916 917 /* Last block and padding (0x5a, 4..7 x 0) */ 918 switch (data_len) { 919 case 0: 920 l ^= get_le32_split(0x5a, 0, 0, 0); 921 break; 922 case 1: 923 l ^= get_le32_split(data[0], 0x5a, 0, 0); 924 break; 925 case 2: 926 l ^= get_le32_split(data[0], data[1], 0x5a, 0); 927 break; 928 case 3: 929 l ^= get_le32_split(data[0], data[1], data[2], 0x5a); 930 break; 931 } 932 michael_block(l, r); 933 /* l ^= 0; */ 934 michael_block(l, r); 935 936 put_le32(mic, l); 937 put_le32(mic + 4, r); 938 } 939 940 static int 941 tkip_encrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 942 struct mbuf *m, int hdrlen) 943 { 944 struct ieee80211_frame *wh; 945 uint8_t icv[IEEE80211_WEP_CRCLEN]; 946 947 ctx->tc_vap->iv_stats.is_crypto_tkip++; 948 949 wh = mtod(m, struct ieee80211_frame *); 950 if ((u16)(key->wk_keytsc) == 0 || key->wk_keytsc == 1) { 951 tkip_mixing_phase1(ctx->tx_ttak, key->wk_key, wh->i_addr2, 952 (u32)(key->wk_keytsc >> 16)); 953 } 954 tkip_mixing_phase2(ctx->tx_rc4key, key->wk_key, ctx->tx_ttak, 955 (u16) key->wk_keytsc); 956 957 wep_encrypt(ctx->tx_rc4key, 958 m, hdrlen + tkip.ic_header, 959 m->m_pkthdr.len - (hdrlen + tkip.ic_header), 960 icv); 961 (void) m_append(m, IEEE80211_WEP_CRCLEN, icv); /* XXX check return */ 962 963 return 1; 964 } 965 966 static int 967 tkip_decrypt(struct tkip_ctx *ctx, struct ieee80211_key *key, 968 struct mbuf *m, int hdrlen) 969 { 970 struct ieee80211_frame *wh; 971 struct ieee80211vap *vap = ctx->tc_vap; 972 u32 iv32; 973 u16 iv16; 974 u8 tid; 975 976 vap->iv_stats.is_crypto_tkip++; 977 978 wh = mtod(m, struct ieee80211_frame *); 979 /* NB: tkip_decap already verified header and left seq in rx_rsc */ 980 iv16 = (u16) ctx->rx_rsc; 981 iv32 = (u32) (ctx->rx_rsc >> 16); 982 983 tid = ieee80211_gettid(wh); 984 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16) || !ctx->rx_phase1_done) { 985 tkip_mixing_phase1(ctx->rx_ttak, key->wk_key, 986 wh->i_addr2, iv32); 987 ctx->rx_phase1_done = 1; 988 } 989 tkip_mixing_phase2(ctx->rx_rc4key, key->wk_key, ctx->rx_ttak, iv16); 990 991 /* NB: m is unstripped; deduct headers + ICV to get payload */ 992 if (wep_decrypt(ctx->rx_rc4key, 993 m, hdrlen + tkip.ic_header, 994 m->m_pkthdr.len - (hdrlen + tkip.ic_header + tkip.ic_trailer))) { 995 if (iv32 != (u32)(key->wk_keyrsc[tid] >> 16)) { 996 /* Previously cached Phase1 result was already lost, so 997 * it needs to be recalculated for the next packet. */ 998 ctx->rx_phase1_done = 0; 999 } 1000 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, 1001 "%s", "TKIP ICV mismatch on decrypt"); 1002 vap->iv_stats.is_rx_tkipicv++; 1003 return 0; 1004 } 1005 return 1; 1006 } 1007 1008 /* 1009 * Module glue. 1010 */ 1011 IEEE80211_CRYPTO_MODULE(tkip, 1); 1012