1 /* 2 * Host AP crypt: host-based CCMP encryption implementation for Host AP driver 3 * 4 * Copyright (c) 2003-2004, Jouni Malinen <jkmaline@cc.hut.fi> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. See README and COPYING for 9 * more details. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/init.h> 14 #include <linux/slab.h> 15 #include <linux/random.h> 16 #include <linux/skbuff.h> 17 #include <linux/netdevice.h> 18 #include <linux/if_ether.h> 19 #include <linux/if_arp.h> 20 #include <linux/string.h> 21 #include <linux/wireless.h> 22 #include "rtllib.h" 23 24 #include <linux/crypto.h> 25 26 #include <linux/scatterlist.h> 27 28 #define AES_BLOCK_LEN 16 29 #define CCMP_HDR_LEN 8 30 #define CCMP_MIC_LEN 8 31 #define CCMP_TK_LEN 16 32 #define CCMP_PN_LEN 6 33 34 struct rtllib_ccmp_data { 35 u8 key[CCMP_TK_LEN]; 36 int key_set; 37 38 u8 tx_pn[CCMP_PN_LEN]; 39 u8 rx_pn[CCMP_PN_LEN]; 40 41 u32 dot11RSNAStatsCCMPFormatErrors; 42 u32 dot11RSNAStatsCCMPReplays; 43 u32 dot11RSNAStatsCCMPDecryptErrors; 44 45 int key_idx; 46 47 struct crypto_tfm *tfm; 48 49 /* scratch buffers for virt_to_page() (crypto API) */ 50 u8 tx_b0[AES_BLOCK_LEN], tx_b[AES_BLOCK_LEN], 51 tx_e[AES_BLOCK_LEN], tx_s0[AES_BLOCK_LEN]; 52 u8 rx_b0[AES_BLOCK_LEN], rx_b[AES_BLOCK_LEN], rx_a[AES_BLOCK_LEN]; 53 }; 54 55 static void rtllib_ccmp_aes_encrypt(struct crypto_tfm *tfm, 56 const u8 pt[16], u8 ct[16]) 57 { 58 crypto_cipher_encrypt_one((void *)tfm, ct, pt); 59 } 60 61 static void *rtllib_ccmp_init(int key_idx) 62 { 63 struct rtllib_ccmp_data *priv; 64 65 priv = kzalloc(sizeof(*priv), GFP_ATOMIC); 66 if (priv == NULL) 67 goto fail; 68 priv->key_idx = key_idx; 69 70 priv->tfm = (void *)crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC); 71 if (IS_ERR(priv->tfm)) { 72 pr_debug("Could not allocate crypto API aes\n"); 73 priv->tfm = NULL; 74 goto fail; 75 } 76 return priv; 77 78 fail: 79 if (priv) { 80 if (priv->tfm) 81 crypto_free_cipher((void *)priv->tfm); 82 kfree(priv); 83 } 84 85 return NULL; 86 } 87 88 89 static void rtllib_ccmp_deinit(void *priv) 90 { 91 struct rtllib_ccmp_data *_priv = priv; 92 93 if (_priv && _priv->tfm) 94 crypto_free_cipher((void *)_priv->tfm); 95 kfree(priv); 96 } 97 98 99 static inline void xor_block(u8 *b, u8 *a, size_t len) 100 { 101 int i; 102 103 for (i = 0; i < len; i++) 104 b[i] ^= a[i]; 105 } 106 107 108 109 static void ccmp_init_blocks(struct crypto_tfm *tfm, 110 struct rtllib_hdr_4addr *hdr, 111 u8 *pn, size_t dlen, u8 *b0, u8 *auth, 112 u8 *s0) 113 { 114 u8 *pos, qc = 0; 115 size_t aad_len; 116 u16 fc; 117 int a4_included, qc_included; 118 u8 aad[2 * AES_BLOCK_LEN]; 119 120 fc = le16_to_cpu(hdr->frame_ctl); 121 a4_included = ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) == 122 (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)); 123 124 qc_included = ((WLAN_FC_GET_TYPE(fc) == RTLLIB_FTYPE_DATA) && 125 (WLAN_FC_GET_STYPE(fc) & 0x80)); 126 aad_len = 22; 127 if (a4_included) 128 aad_len += 6; 129 if (qc_included) { 130 pos = (u8 *) &hdr->addr4; 131 if (a4_included) 132 pos += 6; 133 qc = *pos & 0x0f; 134 aad_len += 2; 135 } 136 /* CCM Initial Block: 137 * Flag (Include authentication header, M=3 (8-octet MIC), 138 * L=1 (2-octet Dlen)) 139 * Nonce: 0x00 | A2 | PN 140 * Dlen 141 */ 142 b0[0] = 0x59; 143 b0[1] = qc; 144 memcpy(b0 + 2, hdr->addr2, ETH_ALEN); 145 memcpy(b0 + 8, pn, CCMP_PN_LEN); 146 b0[14] = (dlen >> 8) & 0xff; 147 b0[15] = dlen & 0xff; 148 149 /* AAD: 150 * FC with bits 4..6 and 11..13 masked to zero; 14 is always one 151 * A1 | A2 | A3 152 * SC with bits 4..15 (seq#) masked to zero 153 * A4 (if present) 154 * QC (if present) 155 */ 156 pos = (u8 *) hdr; 157 aad[0] = 0; /* aad_len >> 8 */ 158 aad[1] = aad_len & 0xff; 159 aad[2] = pos[0] & 0x8f; 160 aad[3] = pos[1] & 0xc7; 161 memcpy(aad + 4, hdr->addr1, 3 * ETH_ALEN); 162 pos = (u8 *) &hdr->seq_ctl; 163 aad[22] = pos[0] & 0x0f; 164 aad[23] = 0; /* all bits masked */ 165 memset(aad + 24, 0, 8); 166 if (a4_included) 167 memcpy(aad + 24, hdr->addr4, ETH_ALEN); 168 if (qc_included) { 169 aad[a4_included ? 30 : 24] = qc; 170 /* rest of QC masked */ 171 } 172 173 /* Start with the first block and AAD */ 174 rtllib_ccmp_aes_encrypt(tfm, b0, auth); 175 xor_block(auth, aad, AES_BLOCK_LEN); 176 rtllib_ccmp_aes_encrypt(tfm, auth, auth); 177 xor_block(auth, &aad[AES_BLOCK_LEN], AES_BLOCK_LEN); 178 rtllib_ccmp_aes_encrypt(tfm, auth, auth); 179 b0[0] &= 0x07; 180 b0[14] = b0[15] = 0; 181 rtllib_ccmp_aes_encrypt(tfm, b0, s0); 182 } 183 184 185 186 static int rtllib_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv) 187 { 188 struct rtllib_ccmp_data *key = priv; 189 int data_len, i; 190 u8 *pos; 191 struct rtllib_hdr_4addr *hdr; 192 struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + 193 MAX_DEV_ADDR_SIZE); 194 if (skb_headroom(skb) < CCMP_HDR_LEN || 195 skb_tailroom(skb) < CCMP_MIC_LEN || 196 skb->len < hdr_len) 197 return -1; 198 199 data_len = skb->len - hdr_len; 200 pos = skb_push(skb, CCMP_HDR_LEN); 201 memmove(pos, pos + CCMP_HDR_LEN, hdr_len); 202 pos += hdr_len; 203 204 i = CCMP_PN_LEN - 1; 205 while (i >= 0) { 206 key->tx_pn[i]++; 207 if (key->tx_pn[i] != 0) 208 break; 209 i--; 210 } 211 212 *pos++ = key->tx_pn[5]; 213 *pos++ = key->tx_pn[4]; 214 *pos++ = 0; 215 *pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */; 216 *pos++ = key->tx_pn[3]; 217 *pos++ = key->tx_pn[2]; 218 *pos++ = key->tx_pn[1]; 219 *pos++ = key->tx_pn[0]; 220 221 222 hdr = (struct rtllib_hdr_4addr *) skb->data; 223 if (!tcb_desc->bHwSec) { 224 int blocks, last, len; 225 u8 *mic; 226 u8 *b0 = key->tx_b0; 227 u8 *b = key->tx_b; 228 u8 *e = key->tx_e; 229 u8 *s0 = key->tx_s0; 230 231 mic = skb_put(skb, CCMP_MIC_LEN); 232 233 ccmp_init_blocks(key->tfm, hdr, key->tx_pn, data_len, 234 b0, b, s0); 235 236 blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN; 237 last = data_len % AES_BLOCK_LEN; 238 239 for (i = 1; i <= blocks; i++) { 240 len = (i == blocks && last) ? last : AES_BLOCK_LEN; 241 /* Authentication */ 242 xor_block(b, pos, len); 243 rtllib_ccmp_aes_encrypt(key->tfm, b, b); 244 /* Encryption, with counter */ 245 b0[14] = (i >> 8) & 0xff; 246 b0[15] = i & 0xff; 247 rtllib_ccmp_aes_encrypt(key->tfm, b0, e); 248 xor_block(pos, e, len); 249 pos += len; 250 } 251 252 for (i = 0; i < CCMP_MIC_LEN; i++) 253 mic[i] = b[i] ^ s0[i]; 254 } 255 return 0; 256 } 257 258 259 static int rtllib_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv) 260 { 261 struct rtllib_ccmp_data *key = priv; 262 u8 keyidx, *pos; 263 struct rtllib_hdr_4addr *hdr; 264 struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + 265 MAX_DEV_ADDR_SIZE); 266 u8 pn[6]; 267 268 if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) { 269 key->dot11RSNAStatsCCMPFormatErrors++; 270 return -1; 271 } 272 273 hdr = (struct rtllib_hdr_4addr *) skb->data; 274 pos = skb->data + hdr_len; 275 keyidx = pos[3]; 276 if (!(keyidx & (1 << 5))) { 277 if (net_ratelimit()) { 278 pr_debug("CCMP: received packet without ExtIV flag from %pM\n", 279 hdr->addr2); 280 } 281 key->dot11RSNAStatsCCMPFormatErrors++; 282 return -2; 283 } 284 keyidx >>= 6; 285 if (key->key_idx != keyidx) { 286 pr_debug("CCMP: RX tkey->key_idx=%d frame keyidx=%d priv=%p\n", 287 key->key_idx, keyidx, priv); 288 return -6; 289 } 290 if (!key->key_set) { 291 if (net_ratelimit()) { 292 pr_debug("CCMP: received packet from %pM with keyid=%d that does not have a configured key\n", 293 hdr->addr2, keyidx); 294 } 295 return -3; 296 } 297 298 pn[0] = pos[7]; 299 pn[1] = pos[6]; 300 pn[2] = pos[5]; 301 pn[3] = pos[4]; 302 pn[4] = pos[1]; 303 pn[5] = pos[0]; 304 pos += 8; 305 if (memcmp(pn, key->rx_pn, CCMP_PN_LEN) <= 0) { 306 key->dot11RSNAStatsCCMPReplays++; 307 return -4; 308 } 309 if (!tcb_desc->bHwSec) { 310 size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN - 311 CCMP_MIC_LEN; 312 u8 *mic = skb->data + skb->len - CCMP_MIC_LEN; 313 u8 *b0 = key->rx_b0; 314 u8 *b = key->rx_b; 315 u8 *a = key->rx_a; 316 int i, blocks, last, len; 317 318 319 ccmp_init_blocks(key->tfm, hdr, pn, data_len, b0, a, b); 320 xor_block(mic, b, CCMP_MIC_LEN); 321 322 blocks = (data_len + AES_BLOCK_LEN - 1) / AES_BLOCK_LEN; 323 last = data_len % AES_BLOCK_LEN; 324 325 for (i = 1; i <= blocks; i++) { 326 len = (i == blocks && last) ? last : AES_BLOCK_LEN; 327 /* Decrypt, with counter */ 328 b0[14] = (i >> 8) & 0xff; 329 b0[15] = i & 0xff; 330 rtllib_ccmp_aes_encrypt(key->tfm, b0, b); 331 xor_block(pos, b, len); 332 /* Authentication */ 333 xor_block(a, pos, len); 334 rtllib_ccmp_aes_encrypt(key->tfm, a, a); 335 pos += len; 336 } 337 338 if (memcmp(mic, a, CCMP_MIC_LEN) != 0) { 339 if (net_ratelimit()) { 340 pr_debug("CCMP: decrypt failed: STA= %pM\n", 341 hdr->addr2); 342 } 343 key->dot11RSNAStatsCCMPDecryptErrors++; 344 return -5; 345 } 346 347 memcpy(key->rx_pn, pn, CCMP_PN_LEN); 348 } 349 /* Remove hdr and MIC */ 350 memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len); 351 skb_pull(skb, CCMP_HDR_LEN); 352 skb_trim(skb, skb->len - CCMP_MIC_LEN); 353 354 return keyidx; 355 } 356 357 358 static int rtllib_ccmp_set_key(void *key, int len, u8 *seq, void *priv) 359 { 360 struct rtllib_ccmp_data *data = priv; 361 int keyidx; 362 struct crypto_tfm *tfm = data->tfm; 363 364 keyidx = data->key_idx; 365 memset(data, 0, sizeof(*data)); 366 data->key_idx = keyidx; 367 data->tfm = tfm; 368 if (len == CCMP_TK_LEN) { 369 memcpy(data->key, key, CCMP_TK_LEN); 370 data->key_set = 1; 371 if (seq) { 372 data->rx_pn[0] = seq[5]; 373 data->rx_pn[1] = seq[4]; 374 data->rx_pn[2] = seq[3]; 375 data->rx_pn[3] = seq[2]; 376 data->rx_pn[4] = seq[1]; 377 data->rx_pn[5] = seq[0]; 378 } 379 crypto_cipher_setkey((void *)data->tfm, data->key, CCMP_TK_LEN); 380 } else if (len == 0) 381 data->key_set = 0; 382 else 383 return -1; 384 385 return 0; 386 } 387 388 389 static int rtllib_ccmp_get_key(void *key, int len, u8 *seq, void *priv) 390 { 391 struct rtllib_ccmp_data *data = priv; 392 393 if (len < CCMP_TK_LEN) 394 return -1; 395 396 if (!data->key_set) 397 return 0; 398 memcpy(key, data->key, CCMP_TK_LEN); 399 400 if (seq) { 401 seq[0] = data->tx_pn[5]; 402 seq[1] = data->tx_pn[4]; 403 seq[2] = data->tx_pn[3]; 404 seq[3] = data->tx_pn[2]; 405 seq[4] = data->tx_pn[1]; 406 seq[5] = data->tx_pn[0]; 407 } 408 409 return CCMP_TK_LEN; 410 } 411 412 413 static void rtllib_ccmp_print_stats(struct seq_file *m, void *priv) 414 { 415 struct rtllib_ccmp_data *ccmp = priv; 416 417 seq_printf(m, 418 "key[%d] alg=CCMP key_set=%d tx_pn=%pM rx_pn=%pM format_errors=%d replays=%d decrypt_errors=%d\n", 419 ccmp->key_idx, ccmp->key_set, 420 ccmp->tx_pn, ccmp->rx_pn, 421 ccmp->dot11RSNAStatsCCMPFormatErrors, 422 ccmp->dot11RSNAStatsCCMPReplays, 423 ccmp->dot11RSNAStatsCCMPDecryptErrors); 424 } 425 426 static struct lib80211_crypto_ops rtllib_crypt_ccmp = { 427 .name = "R-CCMP", 428 .init = rtllib_ccmp_init, 429 .deinit = rtllib_ccmp_deinit, 430 .encrypt_mpdu = rtllib_ccmp_encrypt, 431 .decrypt_mpdu = rtllib_ccmp_decrypt, 432 .encrypt_msdu = NULL, 433 .decrypt_msdu = NULL, 434 .set_key = rtllib_ccmp_set_key, 435 .get_key = rtllib_ccmp_get_key, 436 .print_stats = rtllib_ccmp_print_stats, 437 .extra_mpdu_prefix_len = CCMP_HDR_LEN, 438 .extra_mpdu_postfix_len = CCMP_MIC_LEN, 439 .owner = THIS_MODULE, 440 }; 441 442 443 static int __init rtllib_crypto_ccmp_init(void) 444 { 445 return lib80211_register_crypto_ops(&rtllib_crypt_ccmp); 446 } 447 448 449 static void __exit rtllib_crypto_ccmp_exit(void) 450 { 451 lib80211_unregister_crypto_ops(&rtllib_crypt_ccmp); 452 } 453 454 module_init(rtllib_crypto_ccmp_init); 455 module_exit(rtllib_crypto_ccmp_exit); 456 457 MODULE_LICENSE("GPL"); 458