xref: /openbmc/linux/net/mac80211/wpa.c (revision 545e4006) 
1 /*
2  * Copyright 2002-2004, Instant802 Networks, Inc.
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8 
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <linux/slab.h>
12 #include <linux/skbuff.h>
13 #include <linux/compiler.h>
14 #include <linux/ieee80211.h>
15 #include <asm/unaligned.h>
16 #include <net/mac80211.h>
17 
18 #include "ieee80211_i.h"
19 #include "michael.h"
20 #include "tkip.h"
21 #include "aes_ccm.h"
22 #include "wpa.h"
23 
24 ieee80211_tx_result
25 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
26 {
27 	u8 *data, *key, *mic, key_offset;
28 	size_t data_len;
29 	unsigned int hdrlen;
30 	struct ieee80211_hdr *hdr;
31 	struct sk_buff *skb = tx->skb;
32 	int authenticator;
33 	int wpa_test = 0;
34 	int tail;
35 
36 	hdr = (struct ieee80211_hdr *)skb->data;
37 	if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
38 	    !ieee80211_is_data_present(hdr->frame_control))
39 		return TX_CONTINUE;
40 
41 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
42 	if (skb->len < hdrlen)
43 		return TX_DROP;
44 
45 	data = skb->data + hdrlen;
46 	data_len = skb->len - hdrlen;
47 
48 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
49 	    !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
50 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
51 	    !wpa_test) {
52 		/* hwaccel - with no need for preallocated room for Michael MIC
53 		 */
54 		return TX_CONTINUE;
55 	}
56 
57 	tail = MICHAEL_MIC_LEN;
58 	if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
59 		tail += TKIP_ICV_LEN;
60 
61 	if (WARN_ON(skb_tailroom(skb) < tail ||
62 		    skb_headroom(skb) < TKIP_IV_LEN))
63 		return TX_DROP;
64 
65 #if 0
66 	authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
67 #else
68 	authenticator = 1;
69 #endif
70 	/* At this point we know we're using ALG_TKIP. To get the MIC key
71 	 * we now will rely on the offset from the ieee80211_key_conf::key */
72 	key_offset = authenticator ?
73 		NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
74 		NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
75 	key = &tx->key->conf.key[key_offset];
76 	mic = skb_put(skb, MICHAEL_MIC_LEN);
77 	michael_mic(key, hdr, data, data_len, mic);
78 
79 	return TX_CONTINUE;
80 }
81 
82 
83 ieee80211_rx_result
84 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
85 {
86 	u8 *data, *key = NULL, key_offset;
87 	size_t data_len;
88 	unsigned int hdrlen;
89 	struct ieee80211_hdr *hdr;
90 	u8 mic[MICHAEL_MIC_LEN];
91 	struct sk_buff *skb = rx->skb;
92 	int authenticator = 1, wpa_test = 0;
93 	DECLARE_MAC_BUF(mac);
94 
95 	/*
96 	 * No way to verify the MIC if the hardware stripped it
97 	 */
98 	if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
99 		return RX_CONTINUE;
100 
101 	hdr = (struct ieee80211_hdr *)skb->data;
102 	if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
103 	    !ieee80211_has_protected(hdr->frame_control) ||
104 	    !ieee80211_is_data_present(hdr->frame_control))
105 		return RX_CONTINUE;
106 
107 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
108 	if (skb->len < hdrlen + MICHAEL_MIC_LEN)
109 		return RX_DROP_UNUSABLE;
110 
111 	data = skb->data + hdrlen;
112 	data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
113 
114 #if 0
115 	authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
116 #else
117 	authenticator = 1;
118 #endif
119 	/* At this point we know we're using ALG_TKIP. To get the MIC key
120 	 * we now will rely on the offset from the ieee80211_key_conf::key */
121 	key_offset = authenticator ?
122 		NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
123 		NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
124 	key = &rx->key->conf.key[key_offset];
125 	michael_mic(key, hdr, data, data_len, mic);
126 	if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
127 		if (!(rx->flags & IEEE80211_RX_RA_MATCH))
128 			return RX_DROP_UNUSABLE;
129 
130 		mac80211_ev_michael_mic_failure(rx->dev, rx->key->conf.keyidx,
131 						(void *) skb->data);
132 		return RX_DROP_UNUSABLE;
133 	}
134 
135 	/* remove Michael MIC from payload */
136 	skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
137 
138 	/* update IV in key information to be able to detect replays */
139 	rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
140 	rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
141 
142 	return RX_CONTINUE;
143 }
144 
145 
146 static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
147 {
148 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
149 	struct ieee80211_key *key = tx->key;
150 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
151 	unsigned int hdrlen;
152 	int len, tail;
153 	u8 *pos;
154 
155 	info->control.icv_len = TKIP_ICV_LEN;
156 	info->control.iv_len = TKIP_IV_LEN;
157 
158 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
159 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
160 		/* hwaccel - with no need for preallocated room for IV/ICV */
161 		info->control.hw_key = &tx->key->conf;
162 		return 0;
163 	}
164 
165 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
166 	len = skb->len - hdrlen;
167 
168 	if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
169 		tail = 0;
170 	else
171 		tail = TKIP_ICV_LEN;
172 
173 	if (WARN_ON(skb_tailroom(skb) < tail ||
174 		    skb_headroom(skb) < TKIP_IV_LEN))
175 		return -1;
176 
177 	pos = skb_push(skb, TKIP_IV_LEN);
178 	memmove(pos, pos + TKIP_IV_LEN, hdrlen);
179 	pos += hdrlen;
180 
181 	/* Increase IV for the frame */
182 	key->u.tkip.tx.iv16++;
183 	if (key->u.tkip.tx.iv16 == 0)
184 		key->u.tkip.tx.iv32++;
185 
186 	if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
187 		/* hwaccel - with preallocated room for IV */
188 		ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
189 
190 		info->control.hw_key = &tx->key->conf;
191 		return 0;
192 	}
193 
194 	/* Add room for ICV */
195 	skb_put(skb, TKIP_ICV_LEN);
196 
197 	hdr = (struct ieee80211_hdr *) skb->data;
198 	ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
199 				    key, pos, len, hdr->addr2);
200 	return 0;
201 }
202 
203 
204 ieee80211_tx_result
205 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
206 {
207 	struct sk_buff *skb = tx->skb;
208 
209 	ieee80211_tx_set_protected(tx);
210 
211 	if (tkip_encrypt_skb(tx, skb) < 0)
212 		return TX_DROP;
213 
214 	if (tx->extra_frag) {
215 		int i;
216 		for (i = 0; i < tx->num_extra_frag; i++) {
217 			if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
218 				return TX_DROP;
219 		}
220 	}
221 
222 	return TX_CONTINUE;
223 }
224 
225 
226 ieee80211_rx_result
227 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
228 {
229 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
230 	int hdrlen, res, hwaccel = 0, wpa_test = 0;
231 	struct ieee80211_key *key = rx->key;
232 	struct sk_buff *skb = rx->skb;
233 	DECLARE_MAC_BUF(mac);
234 
235 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
236 
237 	if (!ieee80211_is_data(hdr->frame_control))
238 		return RX_CONTINUE;
239 
240 	if (!rx->sta || skb->len - hdrlen < 12)
241 		return RX_DROP_UNUSABLE;
242 
243 	if (rx->status->flag & RX_FLAG_DECRYPTED) {
244 		if (rx->status->flag & RX_FLAG_IV_STRIPPED) {
245 			/*
246 			 * Hardware took care of all processing, including
247 			 * replay protection, and stripped the ICV/IV so
248 			 * we cannot do any checks here.
249 			 */
250 			return RX_CONTINUE;
251 		}
252 
253 		/* let TKIP code verify IV, but skip decryption */
254 		hwaccel = 1;
255 	}
256 
257 	res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
258 					  key, skb->data + hdrlen,
259 					  skb->len - hdrlen, rx->sta->addr,
260 					  hdr->addr1, hwaccel, rx->queue,
261 					  &rx->tkip_iv32,
262 					  &rx->tkip_iv16);
263 	if (res != TKIP_DECRYPT_OK || wpa_test)
264 		return RX_DROP_UNUSABLE;
265 
266 	/* Trim ICV */
267 	skb_trim(skb, skb->len - TKIP_ICV_LEN);
268 
269 	/* Remove IV */
270 	memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
271 	skb_pull(skb, TKIP_IV_LEN);
272 
273 	return RX_CONTINUE;
274 }
275 
276 
277 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
278 				int encrypted)
279 {
280 	__le16 mask_fc;
281 	int a4_included;
282 	u8 qos_tid;
283 	u8 *b_0, *aad;
284 	u16 data_len, len_a;
285 	unsigned int hdrlen;
286 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
287 
288 	b_0 = scratch + 3 * AES_BLOCK_LEN;
289 	aad = scratch + 4 * AES_BLOCK_LEN;
290 
291 	/*
292 	 * Mask FC: zero subtype b4 b5 b6
293 	 * Retry, PwrMgt, MoreData; set Protected
294 	 */
295 	mask_fc = hdr->frame_control;
296 	mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
297 				IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
298 	mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
299 
300 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
301 	len_a = hdrlen - 2;
302 	a4_included = ieee80211_has_a4(hdr->frame_control);
303 
304 	if (ieee80211_is_data_qos(hdr->frame_control))
305 		qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
306 	else
307 		qos_tid = 0;
308 
309 	data_len = skb->len - hdrlen - CCMP_HDR_LEN;
310 	if (encrypted)
311 		data_len -= CCMP_MIC_LEN;
312 
313 	/* First block, b_0 */
314 	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
315 	/* Nonce: QoS Priority | A2 | PN */
316 	b_0[1] = qos_tid;
317 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
318 	memcpy(&b_0[8], pn, CCMP_PN_LEN);
319 	/* l(m) */
320 	put_unaligned_be16(data_len, &b_0[14]);
321 
322 	/* AAD (extra authenticate-only data) / masked 802.11 header
323 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
324 	put_unaligned_be16(len_a, &aad[0]);
325 	put_unaligned(mask_fc, (__le16 *)&aad[2]);
326 	memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
327 
328 	/* Mask Seq#, leave Frag# */
329 	aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
330 	aad[23] = 0;
331 
332 	if (a4_included) {
333 		memcpy(&aad[24], hdr->addr4, ETH_ALEN);
334 		aad[30] = qos_tid;
335 		aad[31] = 0;
336 	} else {
337 		memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
338 		aad[24] = qos_tid;
339 	}
340 }
341 
342 
343 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
344 {
345 	hdr[0] = pn[5];
346 	hdr[1] = pn[4];
347 	hdr[2] = 0;
348 	hdr[3] = 0x20 | (key_id << 6);
349 	hdr[4] = pn[3];
350 	hdr[5] = pn[2];
351 	hdr[6] = pn[1];
352 	hdr[7] = pn[0];
353 }
354 
355 
356 static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
357 {
358 	pn[0] = hdr[7];
359 	pn[1] = hdr[6];
360 	pn[2] = hdr[5];
361 	pn[3] = hdr[4];
362 	pn[4] = hdr[1];
363 	pn[5] = hdr[0];
364 	return (hdr[3] >> 6) & 0x03;
365 }
366 
367 
368 static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
369 {
370 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
371 	struct ieee80211_key *key = tx->key;
372 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
373 	int hdrlen, len, tail;
374 	u8 *pos, *pn;
375 	int i;
376 
377 	info->control.icv_len = CCMP_MIC_LEN;
378 	info->control.iv_len = CCMP_HDR_LEN;
379 
380 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
381 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
382 		/* hwaccel - with no need for preallocated room for CCMP "
383 		 * header or MIC fields */
384 		info->control.hw_key = &tx->key->conf;
385 		return 0;
386 	}
387 
388 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
389 	len = skb->len - hdrlen;
390 
391 	if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
392 		tail = 0;
393 	else
394 		tail = CCMP_MIC_LEN;
395 
396 	if (WARN_ON(skb_tailroom(skb) < tail ||
397 		    skb_headroom(skb) < CCMP_HDR_LEN))
398 		return -1;
399 
400 	pos = skb_push(skb, CCMP_HDR_LEN);
401 	memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
402 	hdr = (struct ieee80211_hdr *) pos;
403 	pos += hdrlen;
404 
405 	/* PN = PN + 1 */
406 	pn = key->u.ccmp.tx_pn;
407 
408 	for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
409 		pn[i]++;
410 		if (pn[i])
411 			break;
412 	}
413 
414 	ccmp_pn2hdr(pos, pn, key->conf.keyidx);
415 
416 	if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
417 		/* hwaccel - with preallocated room for CCMP header */
418 		info->control.hw_key = &tx->key->conf;
419 		return 0;
420 	}
421 
422 	pos += CCMP_HDR_LEN;
423 	ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0);
424 	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, key->u.ccmp.tx_crypto_buf, pos, len,
425 				  pos, skb_put(skb, CCMP_MIC_LEN));
426 
427 	return 0;
428 }
429 
430 
431 ieee80211_tx_result
432 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
433 {
434 	struct sk_buff *skb = tx->skb;
435 
436 	ieee80211_tx_set_protected(tx);
437 
438 	if (ccmp_encrypt_skb(tx, skb) < 0)
439 		return TX_DROP;
440 
441 	if (tx->extra_frag) {
442 		int i;
443 		for (i = 0; i < tx->num_extra_frag; i++) {
444 			if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
445 				return TX_DROP;
446 		}
447 	}
448 
449 	return TX_CONTINUE;
450 }
451 
452 
453 ieee80211_rx_result
454 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
455 {
456 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
457 	int hdrlen;
458 	struct ieee80211_key *key = rx->key;
459 	struct sk_buff *skb = rx->skb;
460 	u8 pn[CCMP_PN_LEN];
461 	int data_len;
462 	DECLARE_MAC_BUF(mac);
463 
464 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
465 
466 	if (!ieee80211_is_data(hdr->frame_control))
467 		return RX_CONTINUE;
468 
469 	data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
470 	if (!rx->sta || data_len < 0)
471 		return RX_DROP_UNUSABLE;
472 
473 	if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
474 	    (rx->status->flag & RX_FLAG_IV_STRIPPED))
475 		return RX_CONTINUE;
476 
477 	(void) ccmp_hdr2pn(pn, skb->data + hdrlen);
478 
479 	if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
480 		key->u.ccmp.replays++;
481 		return RX_DROP_UNUSABLE;
482 	}
483 
484 	if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
485 		/* hardware didn't decrypt/verify MIC */
486 		ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1);
487 
488 		if (ieee80211_aes_ccm_decrypt(
489 			    key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
490 			    skb->data + hdrlen + CCMP_HDR_LEN, data_len,
491 			    skb->data + skb->len - CCMP_MIC_LEN,
492 			    skb->data + hdrlen + CCMP_HDR_LEN)) {
493 			return RX_DROP_UNUSABLE;
494 		}
495 	}
496 
497 	memcpy(key->u.ccmp.rx_pn[rx->queue], pn, CCMP_PN_LEN);
498 
499 	/* Remove CCMP header and MIC */
500 	skb_trim(skb, skb->len - CCMP_MIC_LEN);
501 	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
502 	skb_pull(skb, CCMP_HDR_LEN);
503 
504 	return RX_CONTINUE;
505 }
506