wpa.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright 2002-2004, Instant802 Networks, Inc.
   4 * Copyright 2008, Jouni Malinen <j@w1.fi>
   5 * Copyright (C) 2016-2017 Intel Deutschland GmbH
   6 * Copyright (C) 2020-2023 Intel Corporation
   7 */
   8
   9#include <linux/netdevice.h>
  10#include <linux/types.h>
  11#include <linux/skbuff.h>
  12#include <linux/compiler.h>
  13#include <linux/ieee80211.h>
  14#include <linux/gfp.h>
  15#include <linux/unaligned.h>
  16#include <net/mac80211.h>
  17#include <crypto/aes.h>
  18#include <crypto/utils.h>
  19
  20#include "ieee80211_i.h"
  21#include "michael.h"
  22#include "tkip.h"
  23#include "aes_ccm.h"
  24#include "aes_cmac.h"
  25#include "aes_gmac.h"
  26#include "aes_gcm.h"
  27#include "wpa.h"
  28
  29ieee80211_tx_result
  30ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
  31{
  32	u8 *data, *key, *mic;
  33	size_t data_len;
  34	unsigned int hdrlen;
  35	struct ieee80211_hdr *hdr;
  36	struct sk_buff *skb = tx->skb;
  37	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  38	int tail;
  39
  40	hdr = (struct ieee80211_hdr *)skb->data;
  41	if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
  42	    skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
  43		return TX_CONTINUE;
  44
  45	hdrlen = ieee80211_hdrlen(hdr->frame_control);
  46	if (skb->len < hdrlen)
  47		return TX_DROP;
  48
  49	data = skb->data + hdrlen;
  50	data_len = skb->len - hdrlen;
  51
  52	if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
  53		/* Need to use software crypto for the test */
  54		info->control.hw_key = NULL;
  55	}
  56
  57	if (info->control.hw_key &&
  58	    (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
  59	     ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
  60	    !(tx->key->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC |
  61				     IEEE80211_KEY_FLAG_PUT_MIC_SPACE))) {
  62		/* hwaccel - with no need for SW-generated MMIC or MIC space */
  63		return TX_CONTINUE;
  64	}
  65
  66	tail = MICHAEL_MIC_LEN;
  67	if (!info->control.hw_key)
  68		tail += IEEE80211_TKIP_ICV_LEN;
  69
  70	if (WARN(skb_tailroom(skb) < tail ||
  71		 skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
  72		 "mmic: not enough head/tail (%d/%d,%d/%d)\n",
  73		 skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
  74		 skb_tailroom(skb), tail))
  75		return TX_DROP;
  76
  77	mic = skb_put(skb, MICHAEL_MIC_LEN);
  78
  79	if (tx->key->conf.flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) {
  80		/* Zeroed MIC can help with debug */
  81		memset(mic, 0, MICHAEL_MIC_LEN);
  82		return TX_CONTINUE;
  83	}
  84
  85	key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
  86	michael_mic(key, hdr, data, data_len, mic);
  87	if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
  88		mic[0]++;
  89
  90	return TX_CONTINUE;
  91}
  92
  93
  94ieee80211_rx_result
  95ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
  96{
  97	u8 *data, *key = NULL;
  98	size_t data_len;
  99	unsigned int hdrlen;
 100	u8 mic[MICHAEL_MIC_LEN];
 101	struct sk_buff *skb = rx->skb;
 102	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 103	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 104
 105	/*
 106	 * it makes no sense to check for MIC errors on anything other
 107	 * than data frames.
 108	 */
 109	if (!ieee80211_is_data_present(hdr->frame_control))
 110		return RX_CONTINUE;
 111
 112	/*
 113	 * No way to verify the MIC if the hardware stripped it or
 114	 * the IV with the key index. In this case we have solely rely
 115	 * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
 116	 * MIC failure report.
 117	 */
 118	if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
 119		if (status->flag & RX_FLAG_MMIC_ERROR)
 120			goto mic_fail_no_key;
 121
 122		if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
 123		    rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
 124			goto update_iv;
 125
 126		return RX_CONTINUE;
 127	}
 128
 129	/*
 130	 * Some hardware seems to generate Michael MIC failure reports; even
 131	 * though, the frame was not encrypted with TKIP and therefore has no
 132	 * MIC. Ignore the flag them to avoid triggering countermeasures.
 133	 */
 134	if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
 135	    !(status->flag & RX_FLAG_DECRYPTED))
 136		return RX_CONTINUE;
 137
 138	if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
 139		/*
 140		 * APs with pairwise keys should never receive Michael MIC
 141		 * errors for non-zero keyidx because these are reserved for
 142		 * group keys and only the AP is sending real multicast
 143		 * frames in the BSS.
 144		 */
 145		return RX_DROP_U_AP_RX_GROUPCAST;
 146	}
 147
 148	if (status->flag & RX_FLAG_MMIC_ERROR)
 149		goto mic_fail;
 150
 151	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 152	if (skb->len < hdrlen + MICHAEL_MIC_LEN)
 153		return RX_DROP_U_SHORT_MMIC;
 154
 155	if (skb_linearize(rx->skb))
 156		return RX_DROP_U_OOM;
 157	hdr = (void *)skb->data;
 158
 159	data = skb->data + hdrlen;
 160	data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
 161	key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
 162	michael_mic(key, hdr, data, data_len, mic);
 163	if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
 164		goto mic_fail;
 165
 166	/* remove Michael MIC from payload */
 167	skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 168
 169update_iv:
 170	/* update IV in key information to be able to detect replays */
 171	rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32;
 172	rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16;
 173
 174	return RX_CONTINUE;
 175
 176mic_fail:
 177	rx->key->u.tkip.mic_failures++;
 178
 179mic_fail_no_key:
 180	/*
 181	 * In some cases the key can be unset - e.g. a multicast packet, in
 182	 * a driver that supports HW encryption. Send up the key idx only if
 183	 * the key is set.
 184	 */
 185	cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
 186				     is_multicast_ether_addr(hdr->addr1) ?
 187				     NL80211_KEYTYPE_GROUP :
 188				     NL80211_KEYTYPE_PAIRWISE,
 189				     rx->key ? rx->key->conf.keyidx : -1,
 190				     NULL, GFP_ATOMIC);
 191	return RX_DROP_U_MMIC_FAIL;
 192}
 193
 194static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 195{
 196	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 197	struct ieee80211_key *key = tx->key;
 198	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 199	unsigned int hdrlen;
 200	int len, tail;
 201	u64 pn;
 202	u8 *pos;
 203
 204	if (info->control.hw_key &&
 205	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
 206	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
 207		/* hwaccel - with no need for software-generated IV */
 208		return 0;
 209	}
 210
 211	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 212	len = skb->len - hdrlen;
 213
 214	if (info->control.hw_key)
 215		tail = 0;
 216	else
 217		tail = IEEE80211_TKIP_ICV_LEN;
 218
 219	if (WARN_ON(skb_tailroom(skb) < tail ||
 220		    skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
 221		return -1;
 222
 223	pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
 224	memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
 225	pos += hdrlen;
 226
 227	/* the HW only needs room for the IV, but not the actual IV */
 228	if (info->control.hw_key &&
 229	    (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
 230		return 0;
 231
 232	/* Increase IV for the frame */
 233	pn = atomic64_inc_return(&key->conf.tx_pn);
 234	pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
 235
 236	/* hwaccel - with software IV */
 237	if (info->control.hw_key)
 238		return 0;
 239
 240	/* Add room for ICV */
 241	skb_put(skb, IEEE80211_TKIP_ICV_LEN);
 242
 243	return ieee80211_tkip_encrypt_data(&tx->local->wep_tx_ctx,
 244					   key, skb, pos, len);
 245}
 246
 247
 248ieee80211_tx_result
 249ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 250{
 251	struct sk_buff *skb;
 252
 253	ieee80211_tx_set_protected(tx);
 254
 255	skb_queue_walk(&tx->skbs, skb) {
 256		if (tkip_encrypt_skb(tx, skb) < 0)
 257			return TX_DROP;
 258	}
 259
 260	return TX_CONTINUE;
 261}
 262
 263
 264ieee80211_rx_result
 265ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
 266{
 267	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
 268	int hdrlen, res, hwaccel = 0;
 269	struct ieee80211_key *key = rx->key;
 270	struct sk_buff *skb = rx->skb;
 271	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 272
 273	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 274
 275	if (!ieee80211_is_data(hdr->frame_control))
 276		return RX_CONTINUE;
 277
 278	if (!rx->sta || skb->len - hdrlen < 12)
 279		return RX_DROP_U_SHORT_TKIP;
 280
 281	/* it may be possible to optimize this a bit more */
 282	if (skb_linearize(rx->skb))
 283		return RX_DROP_U_OOM;
 284	hdr = (void *)skb->data;
 285
 286	/*
 287	 * Let TKIP code verify IV, but skip decryption.
 288	 * In the case where hardware checks the IV as well,
 289	 * we don't even get here, see ieee80211_rx_h_decrypt()
 290	 */
 291	if (status->flag & RX_FLAG_DECRYPTED)
 292		hwaccel = 1;
 293
 294	res = ieee80211_tkip_decrypt_data(&rx->local->wep_rx_ctx,
 295					  key, skb->data + hdrlen,
 296					  skb->len - hdrlen, rx->sta->sta.addr,
 297					  hdr->addr1, hwaccel, rx->security_idx,
 298					  &rx->tkip.iv32,
 299					  &rx->tkip.iv16);
 300	if (res != TKIP_DECRYPT_OK)
 301		return RX_DROP_U_TKIP_FAIL;
 302
 303	/* Trim ICV */
 304	if (!(status->flag & RX_FLAG_ICV_STRIPPED))
 305		skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
 306
 307	/* Remove IV */
 308	memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
 309	skb_pull(skb, IEEE80211_TKIP_IV_LEN);
 310
 311	return RX_CONTINUE;
 312}
 313
 314/*
 315 * Calculate AAD for CCMP/GCMP, returning qos_tid since we
 316 * need that in CCMP also for b_0.
 317 */
 318static u8 ccmp_gcmp_aad(struct sk_buff *skb, u8 *aad, bool spp_amsdu)
 319{
 320	struct ieee80211_hdr *hdr = (void *)skb->data;
 321	__le16 mask_fc;
 322	int a4_included, mgmt;
 323	u8 qos_tid;
 324	u16 len_a = 22;
 325
 326	/*
 327	 * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
 328	 * Retry, PwrMgt, MoreData, Order (if Qos Data); set Protected
 329	 */
 330	mgmt = ieee80211_is_mgmt(hdr->frame_control);
 331	mask_fc = hdr->frame_control;
 332	mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
 333				IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
 334	if (!mgmt)
 335		mask_fc &= ~cpu_to_le16(0x0070);
 336	mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 337
 338	a4_included = ieee80211_has_a4(hdr->frame_control);
 339	if (a4_included)
 340		len_a += 6;
 341
 342	if (ieee80211_is_data_qos(hdr->frame_control)) {
 343		qos_tid = *ieee80211_get_qos_ctl(hdr);
 344
 345		if (spp_amsdu)
 346			qos_tid &= IEEE80211_QOS_CTL_TID_MASK |
 347				   IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 348		else
 349			qos_tid &= IEEE80211_QOS_CTL_TID_MASK;
 350
 351		mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
 352		len_a += 2;
 353	} else {
 354		qos_tid = 0;
 355	}
 356
 357	/* AAD (extra authenticate-only data) / masked 802.11 header
 358	 * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
 359	put_unaligned_be16(len_a, &aad[0]);
 360	put_unaligned(mask_fc, (__le16 *)&aad[2]);
 361	memcpy(&aad[4], &hdr->addrs, 3 * ETH_ALEN);
 362
 363	/* Mask Seq#, leave Frag# */
 364	aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
 365	aad[23] = 0;
 366
 367	if (a4_included) {
 368		memcpy(&aad[24], hdr->addr4, ETH_ALEN);
 369		aad[30] = qos_tid;
 370		aad[31] = 0;
 371	} else {
 372		memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
 373		aad[24] = qos_tid;
 374	}
 375
 376	return qos_tid;
 377}
 378
 379static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
 380				bool spp_amsdu)
 381{
 382	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 383	u8 qos_tid = ccmp_gcmp_aad(skb, aad, spp_amsdu);
 384
 385	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
 386	 * mode authentication are not allowed to collide, yet both are derived
 387	 * from this vector b_0. We only set L := 1 here to indicate that the
 388	 * data size can be represented in (L+1) bytes. The CCM layer will take
 389	 * care of storing the data length in the top (L+1) bytes and setting
 390	 * and clearing the other bits as is required to derive the two IVs.
 391	 */
 392	b_0[0] = 0x1;
 393
 394	/* Nonce: Nonce Flags | A2 | PN
 395	 * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
 396	 */
 397	b_0[1] = qos_tid | (ieee80211_is_mgmt(hdr->frame_control) << 4);
 398	memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
 399	memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
 400}
 401
 402static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
 403{
 404	hdr[0] = pn[5];
 405	hdr[1] = pn[4];
 406	hdr[2] = 0;
 407	hdr[3] = 0x20 | (key_id << 6);
 408	hdr[4] = pn[3];
 409	hdr[5] = pn[2];
 410	hdr[6] = pn[1];
 411	hdr[7] = pn[0];
 412}
 413
 414
 415static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
 416{
 417	pn[0] = hdr[7];
 418	pn[1] = hdr[6];
 419	pn[2] = hdr[5];
 420	pn[3] = hdr[4];
 421	pn[4] = hdr[1];
 422	pn[5] = hdr[0];
 423}
 424
 425
 426static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
 427			    unsigned int mic_len)
 428{
 429	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 430	struct ieee80211_key *key = tx->key;
 431	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 432	int hdrlen, len, tail;
 433	u8 *pos;
 434	u8 pn[6];
 435	u64 pn64;
 436	u8 aad[CCM_AAD_LEN];
 437	u8 b_0[AES_BLOCK_SIZE];
 438
 439	if (info->control.hw_key &&
 440	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
 441	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
 442	    !((info->control.hw_key->flags &
 443	       IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
 444	      ieee80211_is_mgmt(hdr->frame_control))) {
 445		/*
 446		 * hwaccel has no need for preallocated room for CCMP
 447		 * header or MIC fields
 448		 */
 449		return 0;
 450	}
 451
 452	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 453	len = skb->len - hdrlen;
 454
 455	if (info->control.hw_key)
 456		tail = 0;
 457	else
 458		tail = mic_len;
 459
 460	if (WARN_ON(skb_tailroom(skb) < tail ||
 461		    skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
 462		return -1;
 463
 464	pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
 465	memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
 466
 467	/* the HW only needs room for the IV, but not the actual IV */
 468	if (info->control.hw_key &&
 469	    (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
 470		return 0;
 471
 472	pos += hdrlen;
 473
 474	pn64 = atomic64_inc_return(&key->conf.tx_pn);
 475
 476	pn[5] = pn64;
 477	pn[4] = pn64 >> 8;
 478	pn[3] = pn64 >> 16;
 479	pn[2] = pn64 >> 24;
 480	pn[1] = pn64 >> 32;
 481	pn[0] = pn64 >> 40;
 482
 483	ccmp_pn2hdr(pos, pn, key->conf.keyidx);
 484
 485	/* hwaccel - with software CCMP header */
 486	if (info->control.hw_key)
 487		return 0;
 488
 489	pos += IEEE80211_CCMP_HDR_LEN;
 490	ccmp_special_blocks(skb, pn, b_0, aad,
 491			    key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
 492	return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
 493					 skb_put(skb, mic_len));
 494}
 495
 496
 497ieee80211_tx_result
 498ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
 499			      unsigned int mic_len)
 500{
 501	struct sk_buff *skb;
 502
 503	ieee80211_tx_set_protected(tx);
 504
 505	skb_queue_walk(&tx->skbs, skb) {
 506		if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
 507			return TX_DROP;
 508	}
 509
 510	return TX_CONTINUE;
 511}
 512
 513
 514ieee80211_rx_result
 515ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
 516			      unsigned int mic_len)
 517{
 518	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 519	int hdrlen;
 520	struct ieee80211_key *key = rx->key;
 521	struct sk_buff *skb = rx->skb;
 522	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 523	u8 pn[IEEE80211_CCMP_PN_LEN];
 524	int data_len;
 525	int queue;
 526
 527	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 528
 529	if (!ieee80211_is_data(hdr->frame_control) &&
 530	    !ieee80211_is_robust_mgmt_frame(skb))
 531		return RX_CONTINUE;
 532
 533	if (status->flag & RX_FLAG_DECRYPTED) {
 534		if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
 535			return RX_DROP_U_SHORT_CCMP;
 536		if (status->flag & RX_FLAG_MIC_STRIPPED)
 537			mic_len = 0;
 538	} else {
 539		if (skb_linearize(rx->skb))
 540			return RX_DROP_U_OOM;
 541	}
 542
 543	/* reload hdr - skb might have been reallocated */
 544	hdr = (void *)rx->skb->data;
 545
 546	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
 547	if (!rx->sta || data_len < 0)
 548		return RX_DROP_U_SHORT_CCMP;
 549
 550	if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
 551		int res;
 552
 553		ccmp_hdr2pn(pn, skb->data + hdrlen);
 554
 555		queue = rx->security_idx;
 556
 557		res = memcmp(pn, key->u.ccmp.rx_pn[queue],
 558			     IEEE80211_CCMP_PN_LEN);
 559		if (res < 0 ||
 560		    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
 561			key->u.ccmp.replays++;
 562			return RX_DROP_U_REPLAY;
 563		}
 564
 565		if (!(status->flag & RX_FLAG_DECRYPTED)) {
 566			u8 aad[2 * AES_BLOCK_SIZE];
 567			u8 b_0[AES_BLOCK_SIZE];
 568			/* hardware didn't decrypt/verify MIC */
 569			ccmp_special_blocks(skb, pn, b_0, aad,
 570					    key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
 571
 572			if (ieee80211_aes_ccm_decrypt(
 573				    key->u.ccmp.tfm, b_0, aad,
 574				    skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
 575				    data_len,
 576				    skb->data + skb->len - mic_len))
 577				return RX_DROP_U_MIC_FAIL;
 578		}
 579
 580		memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
 581		if (unlikely(ieee80211_is_frag(hdr)))
 582			memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
 583	}
 584
 585	/* Remove CCMP header and MIC */
 586	if (pskb_trim(skb, skb->len - mic_len))
 587		return RX_DROP_U_SHORT_CCMP_MIC;
 588	memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
 589	skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
 590
 591	return RX_CONTINUE;
 592}
 593
 594static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad,
 595				bool spp_amsdu)
 596{
 597	struct ieee80211_hdr *hdr = (void *)skb->data;
 598
 599	memcpy(j_0, hdr->addr2, ETH_ALEN);
 600	memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
 601
 602	ccmp_gcmp_aad(skb, aad, spp_amsdu);
 603}
 604
 605static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
 606{
 607	hdr[0] = pn[5];
 608	hdr[1] = pn[4];
 609	hdr[2] = 0;
 610	hdr[3] = 0x20 | (key_id << 6);
 611	hdr[4] = pn[3];
 612	hdr[5] = pn[2];
 613	hdr[6] = pn[1];
 614	hdr[7] = pn[0];
 615}
 616
 617static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
 618{
 619	pn[0] = hdr[7];
 620	pn[1] = hdr[6];
 621	pn[2] = hdr[5];
 622	pn[3] = hdr[4];
 623	pn[4] = hdr[1];
 624	pn[5] = hdr[0];
 625}
 626
 627static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 628{
 629	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 630	struct ieee80211_key *key = tx->key;
 631	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 632	int hdrlen, len, tail;
 633	u8 *pos;
 634	u8 pn[6];
 635	u64 pn64;
 636	u8 aad[GCM_AAD_LEN];
 637	u8 j_0[AES_BLOCK_SIZE];
 638
 639	if (info->control.hw_key &&
 640	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
 641	    !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
 642	    !((info->control.hw_key->flags &
 643	       IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
 644	      ieee80211_is_mgmt(hdr->frame_control))) {
 645		/* hwaccel has no need for preallocated room for GCMP
 646		 * header or MIC fields
 647		 */
 648		return 0;
 649	}
 650
 651	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 652	len = skb->len - hdrlen;
 653
 654	if (info->control.hw_key)
 655		tail = 0;
 656	else
 657		tail = IEEE80211_GCMP_MIC_LEN;
 658
 659	if (WARN_ON(skb_tailroom(skb) < tail ||
 660		    skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
 661		return -1;
 662
 663	pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
 664	memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
 665	skb_set_network_header(skb, skb_network_offset(skb) +
 666				    IEEE80211_GCMP_HDR_LEN);
 667
 668	/* the HW only needs room for the IV, but not the actual IV */
 669	if (info->control.hw_key &&
 670	    (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
 671		return 0;
 672
 673	pos += hdrlen;
 674
 675	pn64 = atomic64_inc_return(&key->conf.tx_pn);
 676
 677	pn[5] = pn64;
 678	pn[4] = pn64 >> 8;
 679	pn[3] = pn64 >> 16;
 680	pn[2] = pn64 >> 24;
 681	pn[1] = pn64 >> 32;
 682	pn[0] = pn64 >> 40;
 683
 684	gcmp_pn2hdr(pos, pn, key->conf.keyidx);
 685
 686	/* hwaccel - with software GCMP header */
 687	if (info->control.hw_key)
 688		return 0;
 689
 690	pos += IEEE80211_GCMP_HDR_LEN;
 691	gcmp_special_blocks(skb, pn, j_0, aad,
 692			    key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
 693	return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
 694					 skb_put(skb, IEEE80211_GCMP_MIC_LEN));
 695}
 696
 697ieee80211_tx_result
 698ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
 699{
 700	struct sk_buff *skb;
 701
 702	ieee80211_tx_set_protected(tx);
 703
 704	skb_queue_walk(&tx->skbs, skb) {
 705		if (gcmp_encrypt_skb(tx, skb) < 0)
 706			return TX_DROP;
 707	}
 708
 709	return TX_CONTINUE;
 710}
 711
 712ieee80211_rx_result
 713ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
 714{
 715	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 716	int hdrlen;
 717	struct ieee80211_key *key = rx->key;
 718	struct sk_buff *skb = rx->skb;
 719	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 720	u8 pn[IEEE80211_GCMP_PN_LEN];
 721	int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
 722
 723	hdrlen = ieee80211_hdrlen(hdr->frame_control);
 724
 725	if (!ieee80211_is_data(hdr->frame_control) &&
 726	    !ieee80211_is_robust_mgmt_frame(skb))
 727		return RX_CONTINUE;
 728
 729	if (status->flag & RX_FLAG_DECRYPTED) {
 730		if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
 731			return RX_DROP_U_SHORT_GCMP;
 732		if (status->flag & RX_FLAG_MIC_STRIPPED)
 733			mic_len = 0;
 734	} else {
 735		if (skb_linearize(rx->skb))
 736			return RX_DROP_U_OOM;
 737	}
 738
 739	/* reload hdr - skb might have been reallocated */
 740	hdr = (void *)rx->skb->data;
 741
 742	data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
 743	if (!rx->sta || data_len < 0)
 744		return RX_DROP_U_SHORT_GCMP;
 745
 746	if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
 747		int res;
 748
 749		gcmp_hdr2pn(pn, skb->data + hdrlen);
 750
 751		queue = rx->security_idx;
 752
 753		res = memcmp(pn, key->u.gcmp.rx_pn[queue],
 754			     IEEE80211_GCMP_PN_LEN);
 755		if (res < 0 ||
 756		    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
 757			key->u.gcmp.replays++;
 758			return RX_DROP_U_REPLAY;
 759		}
 760
 761		if (!(status->flag & RX_FLAG_DECRYPTED)) {
 762			u8 aad[2 * AES_BLOCK_SIZE];
 763			u8 j_0[AES_BLOCK_SIZE];
 764			/* hardware didn't decrypt/verify MIC */
 765			gcmp_special_blocks(skb, pn, j_0, aad,
 766					    key->conf.flags & IEEE80211_KEY_FLAG_SPP_AMSDU);
 767
 768			if (ieee80211_aes_gcm_decrypt(
 769				    key->u.gcmp.tfm, j_0, aad,
 770				    skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
 771				    data_len,
 772				    skb->data + skb->len -
 773				    IEEE80211_GCMP_MIC_LEN))
 774				return RX_DROP_U_MIC_FAIL;
 775		}
 776
 777		memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
 778		if (unlikely(ieee80211_is_frag(hdr)))
 779			memcpy(rx->ccm_gcm.pn, pn, IEEE80211_CCMP_PN_LEN);
 780	}
 781
 782	/* Remove GCMP header and MIC */
 783	if (pskb_trim(skb, skb->len - mic_len))
 784		return RX_DROP_U_SHORT_GCMP_MIC;
 785	memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
 786	skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
 787
 788	return RX_CONTINUE;
 789}
 790
 791static void bip_aad(struct sk_buff *skb, u8 *aad)
 792{
 793	__le16 mask_fc;
 794	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 795
 796	/* BIP AAD: FC(masked) || A1 || A2 || A3 */
 797
 798	/* FC type/subtype */
 799	/* Mask FC Retry, PwrMgt, MoreData flags to zero */
 800	mask_fc = hdr->frame_control;
 801	mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
 802				IEEE80211_FCTL_MOREDATA);
 803	put_unaligned(mask_fc, (__le16 *) &aad[0]);
 804	/* A1 || A2 || A3 */
 805	memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
 806}
 807
 808
 809static inline void bip_ipn_set64(u8 *d, u64 pn)
 810{
 811	*d++ = pn;
 812	*d++ = pn >> 8;
 813	*d++ = pn >> 16;
 814	*d++ = pn >> 24;
 815	*d++ = pn >> 32;
 816	*d = pn >> 40;
 817}
 818
 819static inline void bip_ipn_swap(u8 *d, const u8 *s)
 820{
 821	*d++ = s[5];
 822	*d++ = s[4];
 823	*d++ = s[3];
 824	*d++ = s[2];
 825	*d++ = s[1];
 826	*d = s[0];
 827}
 828
 829
 830ieee80211_tx_result
 831ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx,
 832				  unsigned int mic_len)
 833{
 834	struct sk_buff *skb;
 835	struct ieee80211_tx_info *info;
 836	struct ieee80211_key *key = tx->key;
 837	struct ieee80211_mmie_var *mmie;
 838	size_t mmie_len;
 839	u8 aad[20];
 840	u64 pn64;
 841
 842	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
 843		return TX_DROP;
 844
 845	skb = skb_peek(&tx->skbs);
 846
 847	info = IEEE80211_SKB_CB(skb);
 848
 849	if (info->control.hw_key &&
 850	    !(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIE))
 851		return TX_CONTINUE;
 852
 853	mmie_len = sizeof(*mmie) + mic_len;
 854
 855	if (WARN_ON(skb_tailroom(skb) < mmie_len))
 856		return TX_DROP;
 857
 858	mmie = skb_put(skb, mmie_len);
 859	mmie->element_id = WLAN_EID_MMIE;
 860	mmie->length = mmie_len - 2;
 861	mmie->key_id = cpu_to_le16(key->conf.keyidx);
 862
 863	/* PN = PN + 1 */
 864	pn64 = atomic64_inc_return(&key->conf.tx_pn);
 865
 866	bip_ipn_set64(mmie->sequence_number, pn64);
 867
 868	if (info->control.hw_key)
 869		return TX_CONTINUE;
 870
 871	bip_aad(skb, aad);
 872
 873	if (ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
 874			       skb->data + 24, skb->len - 24,
 875			       mmie->mic, mic_len))
 876		return TX_DROP;
 877
 878	return TX_CONTINUE;
 879}
 880
 881ieee80211_rx_result
 882ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx,
 883				  unsigned int mic_len)
 884{
 885	struct sk_buff *skb = rx->skb;
 886	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 887	struct ieee80211_key *key = rx->key;
 888	struct ieee80211_mmie_var *mmie;
 889	size_t mmie_len;
 890	u8 aad[20], mic[IEEE80211_CMAC_256_MIC_LEN], ipn[6];
 891	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 892
 893	if (!ieee80211_is_mgmt(hdr->frame_control))
 894		return RX_CONTINUE;
 895
 896	mmie_len = sizeof(*mmie) + mic_len;
 897
 898	/* management frames are already linear */
 899
 900	if (skb->len < 24 + mmie_len)
 901		return mic_len == IEEE80211_CMAC_128_MIC_LEN ?
 902			RX_DROP_U_SHORT_CMAC : RX_DROP_U_SHORT_CMAC256;
 903
 904	mmie = (struct ieee80211_mmie_var *)(skb->data + skb->len - mmie_len);
 905	if (mmie->element_id != WLAN_EID_MMIE ||
 906	    mmie->length != mmie_len - 2)
 907		return RX_DROP_U_BAD_MMIE; /* Invalid MMIE */
 908
 909	bip_ipn_swap(ipn, mmie->sequence_number);
 910
 911	if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
 912		key->u.aes_cmac.replays++;
 913		return RX_DROP_U_REPLAY;
 914	}
 915
 916	if (!(status->flag & RX_FLAG_DECRYPTED)) {
 917		/* hardware didn't decrypt/verify MIC */
 918		bip_aad(skb, aad);
 919		if (ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
 920				       skb->data + 24, skb->len - 24,
 921				       mic, mic_len))
 922			return RX_DROP_U_DECRYPT_FAIL;
 923		if (crypto_memneq(mic, mmie->mic, mic_len)) {
 924			key->u.aes_cmac.icverrors++;
 925			return RX_DROP_U_MIC_FAIL;
 926		}
 927	}
 928
 929	memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
 930
 931	/* Remove MMIE */
 932	skb_trim(skb, skb->len - mmie_len);
 933
 934	return RX_CONTINUE;
 935}
 936
 937ieee80211_tx_result
 938ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
 939{
 940	struct sk_buff *skb;
 941	struct ieee80211_tx_info *info;
 942	struct ieee80211_key *key = tx->key;
 943	struct ieee80211_mmie_16 *mmie;
 944	struct ieee80211_hdr *hdr;
 945	u8 aad[GMAC_AAD_LEN];
 946	u64 pn64;
 947	u8 nonce[GMAC_NONCE_LEN];
 948
 949	if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
 950		return TX_DROP;
 951
 952	skb = skb_peek(&tx->skbs);
 953
 954	info = IEEE80211_SKB_CB(skb);
 955
 956	if (info->control.hw_key &&
 957	    !(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIE))
 958		return TX_CONTINUE;
 959
 960	if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
 961		return TX_DROP;
 962
 963	mmie = skb_put(skb, sizeof(*mmie));
 964	mmie->element_id = WLAN_EID_MMIE;
 965	mmie->length = sizeof(*mmie) - 2;
 966	mmie->key_id = cpu_to_le16(key->conf.keyidx);
 967
 968	/* PN = PN + 1 */
 969	pn64 = atomic64_inc_return(&key->conf.tx_pn);
 970
 971	bip_ipn_set64(mmie->sequence_number, pn64);
 972
 973	if (info->control.hw_key)
 974		return TX_CONTINUE;
 975
 976	bip_aad(skb, aad);
 977
 978	hdr = (struct ieee80211_hdr *)skb->data;
 979	memcpy(nonce, hdr->addr2, ETH_ALEN);
 980	bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
 981
 982	/* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
 983	if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
 984			       skb->data + 24, skb->len - 24, mmie->mic) < 0)
 985		return TX_DROP;
 986
 987	return TX_CONTINUE;
 988}
 989
 990ieee80211_rx_result
 991ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
 992{
 993	struct sk_buff *skb = rx->skb;
 994	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 995	struct ieee80211_key *key = rx->key;
 996	struct ieee80211_mmie_16 *mmie;
 997	u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
 998	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 999
1000	if (!ieee80211_is_mgmt(hdr->frame_control))
1001		return RX_CONTINUE;
1002
1003	/* management frames are already linear */
1004
1005	if (skb->len < 24 + sizeof(*mmie))
1006		return RX_DROP_U_SHORT_GMAC;
1007
1008	mmie = (struct ieee80211_mmie_16 *)
1009		(skb->data + skb->len - sizeof(*mmie));
1010	if (mmie->element_id != WLAN_EID_MMIE ||
1011	    mmie->length != sizeof(*mmie) - 2)
1012		return RX_DROP_U_BAD_MMIE; /* Invalid MMIE */
1013
1014	bip_ipn_swap(ipn, mmie->sequence_number);
1015
1016	if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
1017		key->u.aes_gmac.replays++;
1018		return RX_DROP_U_REPLAY;
1019	}
1020
1021	if (!(status->flag & RX_FLAG_DECRYPTED)) {
1022		/* hardware didn't decrypt/verify MIC */
1023		bip_aad(skb, aad);
1024
1025		memcpy(nonce, hdr->addr2, ETH_ALEN);
1026		memcpy(nonce + ETH_ALEN, ipn, 6);
1027
1028		mic = kmalloc(IEEE80211_GMAC_MIC_LEN, GFP_ATOMIC);
1029		if (!mic)
1030			return RX_DROP_U_OOM;
1031		if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1032				       skb->data + 24, skb->len - 24,
1033				       mic) < 0 ||
1034		    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1035			key->u.aes_gmac.icverrors++;
1036			kfree(mic);
1037			return RX_DROP_U_MIC_FAIL;
1038		}
1039		kfree(mic);
1040	}
1041
1042	memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
1043
1044	/* Remove MMIE */
1045	skb_trim(skb, skb->len - sizeof(*mmie));
1046
1047	return RX_CONTINUE;
1048}