rtw_security.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2/******************************************************************************
  3 *
  4 * Copyright(c) 2007 - 2011 Realtek Corporation. All rights reserved.
  5 *
  6 ******************************************************************************/
  7#ifndef __RTW_SECURITY_H_
  8#define __RTW_SECURITY_H_
  9
 10#include <crypto/arc4.h>
 11
 12#define _NO_PRIVACY_		0x0
 13#define _WEP40_				0x1
 14#define _TKIP_				0x2
 15#define _TKIP_WTMIC_		0x3
 16#define _AES_				0x4
 17#define _WEP104_			0x5
 18#define _WEP_WPA_MIXED_	0x07  /*  WEP + WPA */
 19#define _SMS4_				0x06
 20#define _BIP_				0x8
 21#define is_wep_enc(alg) (((alg) == _WEP40_) || ((alg) == _WEP104_))
 22
 23const char *security_type_str(u8 value);
 24
 25#define AES_BLOCK_SIZE 16
 26#define AES_PRIV_SIZE (4 * 44)
 27
 28enum {
 29	ENCRYP_PROTOCOL_OPENSYS,   /* open system */
 30	ENCRYP_PROTOCOL_WEP,       /* WEP */
 31	ENCRYP_PROTOCOL_WPA,       /* WPA */
 32	ENCRYP_PROTOCOL_WPA2,      /* WPA2 */
 33	ENCRYP_PROTOCOL_WAPI,      /* WAPI: Not support in this version */
 34	ENCRYP_PROTOCOL_MAX
 35};
 36
 37
 38#ifndef Ndis802_11AuthModeWPA2
 39#define Ndis802_11AuthModeWPA2 (Ndis802_11AuthModeWPANone + 1)
 40#endif
 41
 42#ifndef Ndis802_11AuthModeWPA2PSK
 43#define Ndis802_11AuthModeWPA2PSK (Ndis802_11AuthModeWPANone + 2)
 44#endif
 45
 46union pn48	{
 47
 48	u64	val;
 49
 50#ifdef __LITTLE_ENDIAN
 51
 52struct {
 53	u8 TSC0;
 54	u8 TSC1;
 55	u8 TSC2;
 56	u8 TSC3;
 57	u8 TSC4;
 58	u8 TSC5;
 59	u8 TSC6;
 60	u8 TSC7;
 61} _byte_;
 62#else
 63struct {
 64	u8 TSC7;
 65	u8 TSC6;
 66	u8 TSC5;
 67	u8 TSC4;
 68	u8 TSC3;
 69	u8 TSC2;
 70	u8 TSC1;
 71	u8 TSC0;
 72} _byte_;
 73#endif
 74
 75};
 76
 77union Keytype {
 78	u8   skey[16];
 79	u32    lkey[4];
 80};
 81
 82
 83struct rt_pmkid_list {
 84	u8				bUsed;
 85	u8				Bssid[6];
 86	u8				PMKID[16];
 87	u8				SsidBuf[33];
 88	u8 *ssid_octet;
 89	u16					ssid_length;
 90};
 91
 92
 93struct security_priv {
 94	u32   dot11AuthAlgrthm;		/*  802.11 auth, could be open, shared, 8021x and authswitch */
 95	u32   dot11PrivacyAlgrthm;	/*  This specify the privacy for shared auth. algorithm. */
 96
 97	/* WEP */
 98	u32   dot11PrivacyKeyIndex;	/*  this is only valid for legendary wep, 0~3 for key id. (tx key index) */
 99	union Keytype dot11DefKey[4];	/*  this is only valid for def. key */
100	u32 dot11DefKeylen[4];
101	u8 key_mask; /* use to restore wep key after hal_init */
102
103	u32 dot118021XGrpPrivacy;	/*  This specify the privacy algthm. used for Grp key */
104	u32 dot118021XGrpKeyid;		/*  key id used for Grp Key (tx key index) */
105	union Keytype	dot118021XGrpKey[BIP_MAX_KEYID + 1];	/*  802.1x Group Key, for inx0 and inx1 */
106	union Keytype	dot118021XGrptxmickey[BIP_MAX_KEYID + 1];
107	union Keytype	dot118021XGrprxmickey[BIP_MAX_KEYID + 1];
108	union pn48		dot11Grptxpn;			/*  PN48 used for Grp Key xmit. */
109	union pn48		dot11Grprxpn;			/*  PN48 used for Grp Key recv. */
110	u32 dot11wBIPKeyid;						/*  key id used for BIP Key (tx key index) */
111	union Keytype	dot11wBIPKey[BIP_MAX_KEYID + 1];	/*  BIP Key, for index4 and index5 */
112	union pn48		dot11wBIPtxpn;			/*  PN48 used for Grp Key xmit. */
113	union pn48		dot11wBIPrxpn;			/*  PN48 used for Grp Key recv. */
114
115	/* extend security capabilities for AP_MODE */
116	unsigned int dot8021xalg;/* 0:disable, 1:psk, 2:802.1x */
117	unsigned int wpa_psk;/* 0:disable, bit(0): WPA, bit(1):WPA2 */
118	unsigned int wpa_group_cipher;
119	unsigned int wpa2_group_cipher;
120	unsigned int wpa_pairwise_cipher;
121	unsigned int wpa2_pairwise_cipher;
122
123	u8 wps_ie[MAX_WPS_IE_LEN];/* added in assoc req */
124	int wps_ie_len;
125
126	struct arc4_ctx xmit_arc4_ctx;
127	struct arc4_ctx recv_arc4_ctx;
128
129	u8 binstallGrpkey;
130	u8 binstallBIPkey;
131	u8 busetkipkey;
132	/* _timer tkip_timer; */
133	u8 bcheck_grpkey;
134	u8 bgrpkey_handshake;
135
136	s32	sw_encrypt;/* from registry_priv */
137	s32	sw_decrypt;/* from registry_priv */
138
139	s32	hw_decrypted;/* if the rx packets is hw_decrypted ==false, it means the hw has not been ready. */
140
141
142	/* keeps the auth_type & enc_status from upper layer ioctl(wpa_supplicant or wzc) */
143	u32 ndisauthtype;	/*  enum ndis_802_11_authentication_mode */
144	u32 ndisencryptstatus;	/*  NDIS_802_11_ENCRYPTION_STATUS */
145
146	struct wlan_bssid_ex sec_bss;  /* for joinbss (h2c buffer) usage */
147
148	struct ndis_802_11_wep ndiswep;
149
150	u8 assoc_info[600];
151	u8 szofcapability[256]; /* for wpa2 usage */
152	u8 oidassociation[512]; /* for wpa/wpa2 usage */
153	u8 authenticator_ie[256];  /* store ap security information element */
154	u8 supplicant_ie[256];  /* store sta security information element */
155
156
157	/* for tkip countermeasure */
158	unsigned long last_mic_err_time;
159	u8 btkip_countermeasure;
160	u8 btkip_wait_report;
161	u32 btkip_countermeasure_time;
162
163	/*  For WPA2 Pre-Authentication. */
164	struct rt_pmkid_list		PMKIDList[NUM_PMKID_CACHE];	/*  Renamed from PreAuthKey[NUM_PRE_AUTH_KEY]. Annie, 2006-10-13. */
165	u8		PMKIDIndex;
166
167	u8 bWepDefaultKeyIdxSet;
168
169};
170
171#define GET_ENCRY_ALGO(psecuritypriv, psta, encry_algo, bmcst)\
172do {\
173	switch (psecuritypriv->dot11AuthAlgrthm) {\
174	case dot11AuthAlgrthm_Open:\
175	case dot11AuthAlgrthm_Shared:\
176	case dot11AuthAlgrthm_Auto:\
177		encry_algo = (u8)psecuritypriv->dot11PrivacyAlgrthm;\
178		break;\
179	case dot11AuthAlgrthm_8021X:\
180		if (bmcst)\
181			encry_algo = (u8)psecuritypriv->dot118021XGrpPrivacy;\
182		else\
183			encry_algo = (u8)psta->dot118021XPrivacy;\
184		break;\
185	case dot11AuthAlgrthm_WAPI:\
186		encry_algo = (u8)psecuritypriv->dot11PrivacyAlgrthm;\
187		break;\
188	} \
189} while (0)
190
191#define SET_ICE_IV_LEN(iv_len, icv_len, encrypt)\
192do {\
193	switch (encrypt) {\
194	case _WEP40_:\
195	case _WEP104_:\
196		iv_len = 4;\
197		icv_len = 4;\
198		break;\
199	case _TKIP_:\
200		iv_len = 8;\
201		icv_len = 4;\
202		break;\
203	case _AES_:\
204		iv_len = 8;\
205		icv_len = 8;\
206		break;\
207	case _SMS4_:\
208		iv_len = 18;\
209		icv_len = 16;\
210		break;\
211	default:\
212		iv_len = 0;\
213		icv_len = 0;\
214		break;\
215	} \
216} while (0)
217
218
219#define GET_TKIP_PN(iv, dot11txpn)\
220do {\
221	dot11txpn._byte_.TSC0 = iv[2];\
222	dot11txpn._byte_.TSC1 = iv[0];\
223	dot11txpn._byte_.TSC2 = iv[4];\
224	dot11txpn._byte_.TSC3 = iv[5];\
225	dot11txpn._byte_.TSC4 = iv[6];\
226	dot11txpn._byte_.TSC5 = iv[7];\
227} while (0)
228
229
230#define ROL32(A, n)	(((A) << (n)) | (((A)>>(32-(n)))  & ((1UL << (n)) - 1)))
231#define ROR32(A, n)	ROL32((A), 32-(n))
232
233struct mic_data {
234	u32  K0, K1;         /*  Key */
235	u32  L, R;           /*  Current state */
236	u32  M;              /*  Message accumulator (single word) */
237	u32     nBytesInM;      /*  # bytes in M */
238};
239
240/* ===== start - public domain SHA256 implementation ===== */
241
242/* This is based on SHA256 implementation in LibTomCrypt that was released into
243 * public domain by Tom St Denis.
244 */
245
246int omac1_aes_128(u8 *key, u8 *data, size_t data_len, u8 *mac);
247void rtw_secmicsetkey(struct mic_data *pmicdata, u8 *key);
248void rtw_secmicappendbyte(struct mic_data *pmicdata, u8 b);
249void rtw_secmicappend(struct mic_data *pmicdata, u8 *src, u32 nBytes);
250void rtw_secgetmic(struct mic_data *pmicdata, u8 *dst);
251
252void rtw_seccalctkipmic(
253	u8 *key,
254	u8 *header,
255	u8 *data,
256	u32 data_len,
257	u8 *Miccode,
258	u8   priority);
259
260u32 rtw_aes_encrypt(struct adapter *padapter, u8 *pxmitframe);
261u32 rtw_tkip_encrypt(struct adapter *padapter, u8 *pxmitframe);
262void rtw_wep_encrypt(struct adapter *padapter, u8  *pxmitframe);
263
264u32 rtw_aes_decrypt(struct adapter *padapter, u8  *precvframe);
265u32 rtw_tkip_decrypt(struct adapter *padapter, u8  *precvframe);
266void rtw_wep_decrypt(struct adapter *padapter, u8  *precvframe);
267u32 rtw_BIP_verify(struct adapter *padapter, u8 *precvframe);
268
269void rtw_sec_restore_wep_key(struct adapter *adapter);
270u8 rtw_handle_tkip_countermeasure(struct adapter *adapter, const char *caller);
271
272#endif	/* __RTL871X_SECURITY_H_ */