xref: /openbmc/linux/net/mac80211/wpa.c (revision 9ac8d3fb) 
1 /*
2  * Copyright 2002-2004, Instant802 Networks, Inc.
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License version 2 as
6  * published by the Free Software Foundation.
7  */
8 
9 #include <linux/netdevice.h>
10 #include <linux/types.h>
11 #include <linux/slab.h>
12 #include <linux/skbuff.h>
13 #include <linux/compiler.h>
14 #include <linux/ieee80211.h>
15 #include <asm/unaligned.h>
16 #include <net/mac80211.h>
17 
18 #include "ieee80211_i.h"
19 #include "michael.h"
20 #include "tkip.h"
21 #include "aes_ccm.h"
22 #include "wpa.h"
23 
24 ieee80211_tx_result
25 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
26 {
27 	u8 *data, *key, *mic, key_offset;
28 	size_t data_len;
29 	unsigned int hdrlen;
30 	struct ieee80211_hdr *hdr;
31 	struct sk_buff *skb = tx->skb;
32 	int authenticator;
33 	int wpa_test = 0;
34 	int tail;
35 
36 	hdr = (struct ieee80211_hdr *)skb->data;
37 	if (!tx->key || tx->key->conf.alg != ALG_TKIP || skb->len < 24 ||
38 	    !ieee80211_is_data_present(hdr->frame_control))
39 		return TX_CONTINUE;
40 
41 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
42 	if (skb->len < hdrlen)
43 		return TX_DROP;
44 
45 	data = skb->data + hdrlen;
46 	data_len = skb->len - hdrlen;
47 
48 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
49 	    !(tx->flags & IEEE80211_TX_FRAGMENTED) &&
50 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) &&
51 	    !wpa_test) {
52 		/* hwaccel - with no need for preallocated room for Michael MIC
53 		 */
54 		return TX_CONTINUE;
55 	}
56 
57 	tail = MICHAEL_MIC_LEN;
58 	if (!(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
59 		tail += TKIP_ICV_LEN;
60 
61 	if (WARN_ON(skb_tailroom(skb) < tail ||
62 		    skb_headroom(skb) < TKIP_IV_LEN))
63 		return TX_DROP;
64 
65 #if 0
66 	authenticator = fc & IEEE80211_FCTL_FROMDS; /* FIX */
67 #else
68 	authenticator = 1;
69 #endif
70 	/* At this point we know we're using ALG_TKIP. To get the MIC key
71 	 * we now will rely on the offset from the ieee80211_key_conf::key */
72 	key_offset = authenticator ?
73 		NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY :
74 		NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY;
75 	key = &tx->key->conf.key[key_offset];
76 	mic = skb_put(skb, MICHAEL_MIC_LEN);
77 	michael_mic(key, hdr, data, data_len, mic);
78 
79 	return TX_CONTINUE;
80 }
81 
82 
83 ieee80211_rx_result
84 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
85 {
86 	u8 *data, *key = NULL, key_offset;
87 	size_t data_len;
88 	unsigned int hdrlen;
89 	struct ieee80211_hdr *hdr;
90 	u8 mic[MICHAEL_MIC_LEN];
91 	struct sk_buff *skb = rx->skb;
92 	int authenticator = 1, wpa_test = 0;
93 	DECLARE_MAC_BUF(mac);
94 
95 	/*
96 	 * No way to verify the MIC if the hardware stripped it
97 	 */
98 	if (rx->status->flag & RX_FLAG_MMIC_STRIPPED)
99 		return RX_CONTINUE;
100 
101 	hdr = (struct ieee80211_hdr *)skb->data;
102 	if (!rx->key || rx->key->conf.alg != ALG_TKIP ||
103 	    !ieee80211_has_protected(hdr->frame_control) ||
104 	    !ieee80211_is_data_present(hdr->frame_control))
105 		return RX_CONTINUE;
106 
107 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
108 	if (skb->len < hdrlen + MICHAEL_MIC_LEN)
109 		return RX_DROP_UNUSABLE;
110 
111 	data = skb->data + hdrlen;
112 	data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
113 
114 #if 0
115 	authenticator = fc & IEEE80211_FCTL_TODS; /* FIX */
116 #else
117 	authenticator = 1;
118 #endif
119 	/* At this point we know we're using ALG_TKIP. To get the MIC key
120 	 * we now will rely on the offset from the ieee80211_key_conf::key */
121 	key_offset = authenticator ?
122 		NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY :
123 		NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY;
124 	key = &rx->key->conf.key[key_offset];
125 	michael_mic(key, hdr, data, data_len, mic);
126 	if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0 || wpa_test) {
127 		if (!(rx->flags & IEEE80211_RX_RA_MATCH))
128 			return RX_DROP_UNUSABLE;
129 
130 		mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
131 						(void *) skb->data);
132 		return RX_DROP_UNUSABLE;
133 	}
134 
135 	/* remove Michael MIC from payload */
136 	skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
137 
138 	/* update IV in key information to be able to detect replays */
139 	rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
140 	rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
141 
142 	return RX_CONTINUE;
143 }
144 
145 
146 static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
147 {
148 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
149 	struct ieee80211_key *key = tx->key;
150 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
151 	unsigned int hdrlen;
152 	int len, tail;
153 	u8 *pos;
154 
155 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
156 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
157 		/* hwaccel - with no need for preallocated room for IV/ICV */
158 		info->control.hw_key = &tx->key->conf;
159 		return 0;
160 	}
161 
162 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
163 	len = skb->len - hdrlen;
164 
165 	if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
166 		tail = 0;
167 	else
168 		tail = TKIP_ICV_LEN;
169 
170 	if (WARN_ON(skb_tailroom(skb) < tail ||
171 		    skb_headroom(skb) < TKIP_IV_LEN))
172 		return -1;
173 
174 	pos = skb_push(skb, TKIP_IV_LEN);
175 	memmove(pos, pos + TKIP_IV_LEN, hdrlen);
176 	pos += hdrlen;
177 
178 	/* Increase IV for the frame */
179 	key->u.tkip.tx.iv16++;
180 	if (key->u.tkip.tx.iv16 == 0)
181 		key->u.tkip.tx.iv32++;
182 
183 	if (tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
184 		/* hwaccel - with preallocated room for IV */
185 		ieee80211_tkip_add_iv(pos, key, key->u.tkip.tx.iv16);
186 
187 		info->control.hw_key = &tx->key->conf;
188 		return 0;
189 	}
190 
191 	/* Add room for ICV */
192 	skb_put(skb, TKIP_ICV_LEN);
193 
194 	hdr = (struct ieee80211_hdr *) skb->data;
195 	ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
196 				    key, pos, len, hdr->addr2);
197 	return 0;
198 }
199 
200 
201 ieee80211_tx_result
202 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
203 {
204 	struct sk_buff *skb = tx->skb;
205 
206 	ieee80211_tx_set_protected(tx);
207 
208 	if (tkip_encrypt_skb(tx, skb) < 0)
209 		return TX_DROP;
210 
211 	if (tx->extra_frag) {
212 		int i;
213 		for (i = 0; i < tx->num_extra_frag; i++) {
214 			if (tkip_encrypt_skb(tx, tx->extra_frag[i]) < 0)
215 				return TX_DROP;
216 		}
217 	}
218 
219 	return TX_CONTINUE;
220 }
221 
222 
223 ieee80211_rx_result
224 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
225 {
226 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
227 	int hdrlen, res, hwaccel = 0, wpa_test = 0;
228 	struct ieee80211_key *key = rx->key;
229 	struct sk_buff *skb = rx->skb;
230 	DECLARE_MAC_BUF(mac);
231 
232 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
233 
234 	if (!ieee80211_is_data(hdr->frame_control))
235 		return RX_CONTINUE;
236 
237 	if (!rx->sta || skb->len - hdrlen < 12)
238 		return RX_DROP_UNUSABLE;
239 
240 	if (rx->status->flag & RX_FLAG_DECRYPTED) {
241 		if (rx->status->flag & RX_FLAG_IV_STRIPPED) {
242 			/*
243 			 * Hardware took care of all processing, including
244 			 * replay protection, and stripped the ICV/IV so
245 			 * we cannot do any checks here.
246 			 */
247 			return RX_CONTINUE;
248 		}
249 
250 		/* let TKIP code verify IV, but skip decryption */
251 		hwaccel = 1;
252 	}
253 
254 	res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
255 					  key, skb->data + hdrlen,
256 					  skb->len - hdrlen, rx->sta->sta.addr,
257 					  hdr->addr1, hwaccel, rx->queue,
258 					  &rx->tkip_iv32,
259 					  &rx->tkip_iv16);
260 	if (res != TKIP_DECRYPT_OK || wpa_test)
261 		return RX_DROP_UNUSABLE;
262 
263 	/* Trim ICV */
264 	skb_trim(skb, skb->len - TKIP_ICV_LEN);
265 
266 	/* Remove IV */
267 	memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
268 	skb_pull(skb, TKIP_IV_LEN);
269 
270 	return RX_CONTINUE;
271 }
272 
273 
274 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
275 				int encrypted)
276 {
277 	__le16 mask_fc;
278 	int a4_included;
279 	u8 qos_tid;
280 	u8 *b_0, *aad;
281 	u16 data_len, len_a;
282 	unsigned int hdrlen;
283 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
284 
285 	b_0 = scratch + 3 * AES_BLOCK_LEN;
286 	aad = scratch + 4 * AES_BLOCK_LEN;
287 
288 	/*
289 	 * Mask FC: zero subtype b4 b5 b6
290 	 * Retry, PwrMgt, MoreData; set Protected
291 	 */
292 	mask_fc = hdr->frame_control;
293 	mask_fc &= ~cpu_to_le16(0x0070 | IEEE80211_FCTL_RETRY |
294 				IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
295 	mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
296 
297 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
298 	len_a = hdrlen - 2;
299 	a4_included = ieee80211_has_a4(hdr->frame_control);
300 
301 	if (ieee80211_is_data_qos(hdr->frame_control))
302 		qos_tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
303 	else
304 		qos_tid = 0;
305 
306 	data_len = skb->len - hdrlen - CCMP_HDR_LEN;
307 	if (encrypted)
308 		data_len -= CCMP_MIC_LEN;
309 
310 	/* First block, b_0 */
311 	b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
312 	/* Nonce: QoS Priority | A2 | PN */
313 	b_0[1] = qos_tid;
314 	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
315 	memcpy(&b_0[8], pn, CCMP_PN_LEN);
316 	/* l(m) */
317 	put_unaligned_be16(data_len, &b_0[14]);
318 
319 	/* AAD (extra authenticate-only data) / masked 802.11 header
320 	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
321 	put_unaligned_be16(len_a, &aad[0]);
322 	put_unaligned(mask_fc, (__le16 *)&aad[2]);
323 	memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
324 
325 	/* Mask Seq#, leave Frag# */
326 	aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
327 	aad[23] = 0;
328 
329 	if (a4_included) {
330 		memcpy(&aad[24], hdr->addr4, ETH_ALEN);
331 		aad[30] = qos_tid;
332 		aad[31] = 0;
333 	} else {
334 		memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
335 		aad[24] = qos_tid;
336 	}
337 }
338 
339 
340 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
341 {
342 	hdr[0] = pn[5];
343 	hdr[1] = pn[4];
344 	hdr[2] = 0;
345 	hdr[3] = 0x20 | (key_id << 6);
346 	hdr[4] = pn[3];
347 	hdr[5] = pn[2];
348 	hdr[6] = pn[1];
349 	hdr[7] = pn[0];
350 }
351 
352 
353 static inline int ccmp_hdr2pn(u8 *pn, u8 *hdr)
354 {
355 	pn[0] = hdr[7];
356 	pn[1] = hdr[6];
357 	pn[2] = hdr[5];
358 	pn[3] = hdr[4];
359 	pn[4] = hdr[1];
360 	pn[5] = hdr[0];
361 	return (hdr[3] >> 6) & 0x03;
362 }
363 
364 
365 static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
366 {
367 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
368 	struct ieee80211_key *key = tx->key;
369 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
370 	int hdrlen, len, tail;
371 	u8 *pos, *pn;
372 	int i;
373 
374 	if ((tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) &&
375 	    !(tx->key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)) {
376 		/* hwaccel - with no need for preallocated room for CCMP "
377 		 * header or MIC fields */
378 		info->control.hw_key = &tx->key->conf;
379 		return 0;
380 	}
381 
382 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
383 	len = skb->len - hdrlen;
384 
385 	if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
386 		tail = 0;
387 	else
388 		tail = CCMP_MIC_LEN;
389 
390 	if (WARN_ON(skb_tailroom(skb) < tail ||
391 		    skb_headroom(skb) < CCMP_HDR_LEN))
392 		return -1;
393 
394 	pos = skb_push(skb, CCMP_HDR_LEN);
395 	memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
396 	hdr = (struct ieee80211_hdr *) pos;
397 	pos += hdrlen;
398 
399 	/* PN = PN + 1 */
400 	pn = key->u.ccmp.tx_pn;
401 
402 	for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
403 		pn[i]++;
404 		if (pn[i])
405 			break;
406 	}
407 
408 	ccmp_pn2hdr(pos, pn, key->conf.keyidx);
409 
410 	if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
411 		/* hwaccel - with preallocated room for CCMP header */
412 		info->control.hw_key = &tx->key->conf;
413 		return 0;
414 	}
415 
416 	pos += CCMP_HDR_LEN;
417 	ccmp_special_blocks(skb, pn, key->u.ccmp.tx_crypto_buf, 0);
418 	ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, key->u.ccmp.tx_crypto_buf, pos, len,
419 				  pos, skb_put(skb, CCMP_MIC_LEN));
420 
421 	return 0;
422 }
423 
424 
425 ieee80211_tx_result
426 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
427 {
428 	struct sk_buff *skb = tx->skb;
429 
430 	ieee80211_tx_set_protected(tx);
431 
432 	if (ccmp_encrypt_skb(tx, skb) < 0)
433 		return TX_DROP;
434 
435 	if (tx->extra_frag) {
436 		int i;
437 		for (i = 0; i < tx->num_extra_frag; i++) {
438 			if (ccmp_encrypt_skb(tx, tx->extra_frag[i]) < 0)
439 				return TX_DROP;
440 		}
441 	}
442 
443 	return TX_CONTINUE;
444 }
445 
446 
447 ieee80211_rx_result
448 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
449 {
450 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
451 	int hdrlen;
452 	struct ieee80211_key *key = rx->key;
453 	struct sk_buff *skb = rx->skb;
454 	u8 pn[CCMP_PN_LEN];
455 	int data_len;
456 	DECLARE_MAC_BUF(mac);
457 
458 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
459 
460 	if (!ieee80211_is_data(hdr->frame_control))
461 		return RX_CONTINUE;
462 
463 	data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
464 	if (!rx->sta || data_len < 0)
465 		return RX_DROP_UNUSABLE;
466 
467 	if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
468 	    (rx->status->flag & RX_FLAG_IV_STRIPPED))
469 		return RX_CONTINUE;
470 
471 	(void) ccmp_hdr2pn(pn, skb->data + hdrlen);
472 
473 	if (memcmp(pn, key->u.ccmp.rx_pn[rx->queue], CCMP_PN_LEN) <= 0) {
474 		key->u.ccmp.replays++;
475 		return RX_DROP_UNUSABLE;
476 	}
477 
478 	if (!(rx->status->flag & RX_FLAG_DECRYPTED)) {
479 		/* hardware didn't decrypt/verify MIC */
480 		ccmp_special_blocks(skb, pn, key->u.ccmp.rx_crypto_buf, 1);
481 
482 		if (ieee80211_aes_ccm_decrypt(
483 			    key->u.ccmp.tfm, key->u.ccmp.rx_crypto_buf,
484 			    skb->data + hdrlen + CCMP_HDR_LEN, data_len,
485 			    skb->data + skb->len - CCMP_MIC_LEN,
486 			    skb->data + hdrlen + CCMP_HDR_LEN)) {
487 			return RX_DROP_UNUSABLE;
488 		}
489 	}
490 
491 	memcpy(key->u.ccmp.rx_pn[rx->queue], pn, CCMP_PN_LEN);
492 
493 	/* Remove CCMP header and MIC */
494 	skb_trim(skb, skb->len - CCMP_MIC_LEN);
495 	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
496 	skb_pull(skb, CCMP_HDR_LEN);
497 
498 	return RX_CONTINUE;
499 }
500