~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/mac80211/wpa.c

Version: ~ [ linux-5.8-rc3 ] ~ [ linux-5.7.5 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.48 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.129 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.185 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.228 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.228 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

Diff markup

Differences between /net/mac80211/wpa.c (Version linux-5.0.21) and /net/mac80211/wpa.c (Version linux-5.2.21)


                                                   >>   1 // SPDX-License-Identifier: GPL-2.0-only
  1 /*                                                  2 /*
  2  * Copyright 2002-2004, Instant802 Networks, I      3  * Copyright 2002-2004, Instant802 Networks, Inc.
  3  * Copyright 2008, Jouni Malinen <j@w1.fi>          4  * Copyright 2008, Jouni Malinen <j@w1.fi>
  4  * Copyright (C) 2016-2017 Intel Deutschland G      5  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  5  *                                             << 
  6  * This program is free software; you can redi << 
  7  * it under the terms of the GNU General Publi << 
  8  * published by the Free Software Foundation.  << 
  9  */                                                 6  */
 10                                                     7 
 11 #include <linux/netdevice.h>                        8 #include <linux/netdevice.h>
 12 #include <linux/types.h>                            9 #include <linux/types.h>
 13 #include <linux/skbuff.h>                          10 #include <linux/skbuff.h>
 14 #include <linux/compiler.h>                        11 #include <linux/compiler.h>
 15 #include <linux/ieee80211.h>                       12 #include <linux/ieee80211.h>
 16 #include <linux/gfp.h>                             13 #include <linux/gfp.h>
 17 #include <asm/unaligned.h>                         14 #include <asm/unaligned.h>
 18 #include <net/mac80211.h>                          15 #include <net/mac80211.h>
 19 #include <crypto/aes.h>                            16 #include <crypto/aes.h>
 20 #include <crypto/algapi.h>                         17 #include <crypto/algapi.h>
 21                                                    18 
 22 #include "ieee80211_i.h"                           19 #include "ieee80211_i.h"
 23 #include "michael.h"                               20 #include "michael.h"
 24 #include "tkip.h"                                  21 #include "tkip.h"
 25 #include "aes_ccm.h"                               22 #include "aes_ccm.h"
 26 #include "aes_cmac.h"                              23 #include "aes_cmac.h"
 27 #include "aes_gmac.h"                              24 #include "aes_gmac.h"
 28 #include "aes_gcm.h"                               25 #include "aes_gcm.h"
 29 #include "wpa.h"                                   26 #include "wpa.h"
 30                                                    27 
 31 ieee80211_tx_result                                28 ieee80211_tx_result
 32 ieee80211_tx_h_michael_mic_add(struct ieee8021     29 ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 33 {                                                  30 {
 34         u8 *data, *key, *mic;                      31         u8 *data, *key, *mic;
 35         size_t data_len;                           32         size_t data_len;
 36         unsigned int hdrlen;                       33         unsigned int hdrlen;
 37         struct ieee80211_hdr *hdr;                 34         struct ieee80211_hdr *hdr;
 38         struct sk_buff *skb = tx->skb;             35         struct sk_buff *skb = tx->skb;
 39         struct ieee80211_tx_info *info = IEEE8     36         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 40         int tail;                                  37         int tail;
 41                                                    38 
 42         hdr = (struct ieee80211_hdr *)skb->dat     39         hdr = (struct ieee80211_hdr *)skb->data;
 43         if (!tx->key || tx->key->conf.cipher !     40         if (!tx->key || tx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
 44             skb->len < 24 || !ieee80211_is_dat     41             skb->len < 24 || !ieee80211_is_data_present(hdr->frame_control))
 45                 return TX_CONTINUE;                42                 return TX_CONTINUE;
 46                                                    43 
 47         hdrlen = ieee80211_hdrlen(hdr->frame_c     44         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 48         if (skb->len < hdrlen)                     45         if (skb->len < hdrlen)
 49                 return TX_DROP;                    46                 return TX_DROP;
 50                                                    47 
 51         data = skb->data + hdrlen;                 48         data = skb->data + hdrlen;
 52         data_len = skb->len - hdrlen;              49         data_len = skb->len - hdrlen;
 53                                                    50 
 54         if (unlikely(info->flags & IEEE80211_T     51         if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE)) {
 55                 /* Need to use software crypto     52                 /* Need to use software crypto for the test */
 56                 info->control.hw_key = NULL;       53                 info->control.hw_key = NULL;
 57         }                                          54         }
 58                                                    55 
 59         if (info->control.hw_key &&                56         if (info->control.hw_key &&
 60             (info->flags & IEEE80211_TX_CTL_DO     57             (info->flags & IEEE80211_TX_CTL_DONTFRAG ||
 61              ieee80211_hw_check(&tx->local->hw     58              ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG)) &&
 62             !(tx->key->conf.flags & (IEEE80211     59             !(tx->key->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC |
 63                                      IEEE80211     60                                      IEEE80211_KEY_FLAG_PUT_MIC_SPACE))) {
 64                 /* hwaccel - with no need for      61                 /* hwaccel - with no need for SW-generated MMIC or MIC space */
 65                 return TX_CONTINUE;                62                 return TX_CONTINUE;
 66         }                                          63         }
 67                                                    64 
 68         tail = MICHAEL_MIC_LEN;                    65         tail = MICHAEL_MIC_LEN;
 69         if (!info->control.hw_key)                 66         if (!info->control.hw_key)
 70                 tail += IEEE80211_TKIP_ICV_LEN     67                 tail += IEEE80211_TKIP_ICV_LEN;
 71                                                    68 
 72         if (WARN(skb_tailroom(skb) < tail ||       69         if (WARN(skb_tailroom(skb) < tail ||
 73                  skb_headroom(skb) < IEEE80211     70                  skb_headroom(skb) < IEEE80211_TKIP_IV_LEN,
 74                  "mmic: not enough head/tail (     71                  "mmic: not enough head/tail (%d/%d,%d/%d)\n",
 75                  skb_headroom(skb), IEEE80211_     72                  skb_headroom(skb), IEEE80211_TKIP_IV_LEN,
 76                  skb_tailroom(skb), tail))         73                  skb_tailroom(skb), tail))
 77                 return TX_DROP;                    74                 return TX_DROP;
 78                                                    75 
 79         mic = skb_put(skb, MICHAEL_MIC_LEN);       76         mic = skb_put(skb, MICHAEL_MIC_LEN);
 80                                                    77 
 81         if (tx->key->conf.flags & IEEE80211_KE     78         if (tx->key->conf.flags & IEEE80211_KEY_FLAG_PUT_MIC_SPACE) {
 82                 /* Zeroed MIC can help with de     79                 /* Zeroed MIC can help with debug */
 83                 memset(mic, 0, MICHAEL_MIC_LEN     80                 memset(mic, 0, MICHAEL_MIC_LEN);
 84                 return TX_CONTINUE;                81                 return TX_CONTINUE;
 85         }                                          82         }
 86                                                    83 
 87         key = &tx->key->conf.key[NL80211_TKIP_     84         key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
 88         michael_mic(key, hdr, data, data_len,      85         michael_mic(key, hdr, data, data_len, mic);
 89         if (unlikely(info->flags & IEEE80211_T     86         if (unlikely(info->flags & IEEE80211_TX_INTFL_TKIP_MIC_FAILURE))
 90                 mic[0]++;                          87                 mic[0]++;
 91                                                    88 
 92         return TX_CONTINUE;                        89         return TX_CONTINUE;
 93 }                                                  90 }
 94                                                    91 
 95                                                    92 
 96 ieee80211_rx_result                                93 ieee80211_rx_result
 97 ieee80211_rx_h_michael_mic_verify(struct ieee8     94 ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 98 {                                                  95 {
 99         u8 *data, *key = NULL;                     96         u8 *data, *key = NULL;
100         size_t data_len;                           97         size_t data_len;
101         unsigned int hdrlen;                       98         unsigned int hdrlen;
102         u8 mic[MICHAEL_MIC_LEN];                   99         u8 mic[MICHAEL_MIC_LEN];
103         struct sk_buff *skb = rx->skb;            100         struct sk_buff *skb = rx->skb;
104         struct ieee80211_rx_status *status = I    101         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
105         struct ieee80211_hdr *hdr = (struct ie    102         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
106                                                   103 
107         /*                                        104         /*
108          * it makes no sense to check for MIC     105          * it makes no sense to check for MIC errors on anything other
109          * than data frames.                      106          * than data frames.
110          */                                       107          */
111         if (!ieee80211_is_data_present(hdr->fr    108         if (!ieee80211_is_data_present(hdr->frame_control))
112                 return RX_CONTINUE;               109                 return RX_CONTINUE;
113                                                   110 
114         /*                                        111         /*
115          * No way to verify the MIC if the har    112          * No way to verify the MIC if the hardware stripped it or
116          * the IV with the key index. In this     113          * the IV with the key index. In this case we have solely rely
117          * on the driver to set RX_FLAG_MMIC_E    114          * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
118          * MIC failure report.                    115          * MIC failure report.
119          */                                       116          */
120         if (status->flag & (RX_FLAG_MMIC_STRIP    117         if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
121                 if (status->flag & RX_FLAG_MMI    118                 if (status->flag & RX_FLAG_MMIC_ERROR)
122                         goto mic_fail_no_key;     119                         goto mic_fail_no_key;
123                                                   120 
124                 if (!(status->flag & RX_FLAG_I    121                 if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key &&
125                     rx->key->conf.cipher == WL    122                     rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP)
126                         goto update_iv;           123                         goto update_iv;
127                                                   124 
128                 return RX_CONTINUE;               125                 return RX_CONTINUE;
129         }                                         126         }
130                                                   127 
131         /*                                        128         /*
132          * Some hardware seems to generate Mic    129          * Some hardware seems to generate Michael MIC failure reports; even
133          * though, the frame was not encrypted    130          * though, the frame was not encrypted with TKIP and therefore has no
134          * MIC. Ignore the flag them to avoid     131          * MIC. Ignore the flag them to avoid triggering countermeasures.
135          */                                       132          */
136         if (!rx->key || rx->key->conf.cipher !    133         if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
137             !(status->flag & RX_FLAG_DECRYPTED    134             !(status->flag & RX_FLAG_DECRYPTED))
138                 return RX_CONTINUE;               135                 return RX_CONTINUE;
139                                                   136 
140         if (rx->sdata->vif.type == NL80211_IFT    137         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
141                 /*                                138                 /*
142                  * APs with pairwise keys shou    139                  * APs with pairwise keys should never receive Michael MIC
143                  * errors for non-zero keyidx     140                  * errors for non-zero keyidx because these are reserved for
144                  * group keys and only the AP     141                  * group keys and only the AP is sending real multicast
145                  * frames in the BSS.             142                  * frames in the BSS.
146                  */                               143                  */
147                 return RX_DROP_UNUSABLE;          144                 return RX_DROP_UNUSABLE;
148         }                                         145         }
149                                                   146 
150         if (status->flag & RX_FLAG_MMIC_ERROR)    147         if (status->flag & RX_FLAG_MMIC_ERROR)
151                 goto mic_fail;                    148                 goto mic_fail;
152                                                   149 
153         hdrlen = ieee80211_hdrlen(hdr->frame_c    150         hdrlen = ieee80211_hdrlen(hdr->frame_control);
154         if (skb->len < hdrlen + MICHAEL_MIC_LE    151         if (skb->len < hdrlen + MICHAEL_MIC_LEN)
155                 return RX_DROP_UNUSABLE;          152                 return RX_DROP_UNUSABLE;
156                                                   153 
157         if (skb_linearize(rx->skb))               154         if (skb_linearize(rx->skb))
158                 return RX_DROP_UNUSABLE;          155                 return RX_DROP_UNUSABLE;
159         hdr = (void *)skb->data;                  156         hdr = (void *)skb->data;
160                                                   157 
161         data = skb->data + hdrlen;                158         data = skb->data + hdrlen;
162         data_len = skb->len - hdrlen - MICHAEL    159         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
163         key = &rx->key->conf.key[NL80211_TKIP_    160         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
164         michael_mic(key, hdr, data, data_len,     161         michael_mic(key, hdr, data, data_len, mic);
165         if (crypto_memneq(mic, data + data_len    162         if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
166                 goto mic_fail;                    163                 goto mic_fail;
167                                                   164 
168         /* remove Michael MIC from payload */     165         /* remove Michael MIC from payload */
169         skb_trim(skb, skb->len - MICHAEL_MIC_L    166         skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
170                                                   167 
171 update_iv:                                        168 update_iv:
172         /* update IV in key information to be     169         /* update IV in key information to be able to detect replays */
173         rx->key->u.tkip.rx[rx->security_idx].i    170         rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
174         rx->key->u.tkip.rx[rx->security_idx].i    171         rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
175                                                   172 
176         return RX_CONTINUE;                       173         return RX_CONTINUE;
177                                                   174 
178 mic_fail:                                         175 mic_fail:
179         rx->key->u.tkip.mic_failures++;           176         rx->key->u.tkip.mic_failures++;
180                                                   177 
181 mic_fail_no_key:                                  178 mic_fail_no_key:
182         /*                                        179         /*
183          * In some cases the key can be unset     180          * In some cases the key can be unset - e.g. a multicast packet, in
184          * a driver that supports HW encryptio    181          * a driver that supports HW encryption. Send up the key idx only if
185          * the key is set.                        182          * the key is set.
186          */                                       183          */
187         cfg80211_michael_mic_failure(rx->sdata    184         cfg80211_michael_mic_failure(rx->sdata->dev, hdr->addr2,
188                                      is_multic    185                                      is_multicast_ether_addr(hdr->addr1) ?
189                                      NL80211_K    186                                      NL80211_KEYTYPE_GROUP :
190                                      NL80211_K    187                                      NL80211_KEYTYPE_PAIRWISE,
191                                      rx->key ?    188                                      rx->key ? rx->key->conf.keyidx : -1,
192                                      NULL, GFP    189                                      NULL, GFP_ATOMIC);
193         return RX_DROP_UNUSABLE;                  190         return RX_DROP_UNUSABLE;
194 }                                                 191 }
195                                                   192 
196 static int tkip_encrypt_skb(struct ieee80211_t    193 static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
197 {                                                 194 {
198         struct ieee80211_hdr *hdr = (struct ie    195         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
199         struct ieee80211_key *key = tx->key;      196         struct ieee80211_key *key = tx->key;
200         struct ieee80211_tx_info *info = IEEE8    197         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
201         unsigned int hdrlen;                      198         unsigned int hdrlen;
202         int len, tail;                            199         int len, tail;
203         u64 pn;                                   200         u64 pn;
204         u8 *pos;                                  201         u8 *pos;
205                                                   202 
206         if (info->control.hw_key &&               203         if (info->control.hw_key &&
207             !(info->control.hw_key->flags & IE    204             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
208             !(info->control.hw_key->flags & IE    205             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
209                 /* hwaccel - with no need for     206                 /* hwaccel - with no need for software-generated IV */
210                 return 0;                         207                 return 0;
211         }                                         208         }
212                                                   209 
213         hdrlen = ieee80211_hdrlen(hdr->frame_c    210         hdrlen = ieee80211_hdrlen(hdr->frame_control);
214         len = skb->len - hdrlen;                  211         len = skb->len - hdrlen;
215                                                   212 
216         if (info->control.hw_key)                 213         if (info->control.hw_key)
217                 tail = 0;                         214                 tail = 0;
218         else                                      215         else
219                 tail = IEEE80211_TKIP_ICV_LEN;    216                 tail = IEEE80211_TKIP_ICV_LEN;
220                                                   217 
221         if (WARN_ON(skb_tailroom(skb) < tail |    218         if (WARN_ON(skb_tailroom(skb) < tail ||
222                     skb_headroom(skb) < IEEE80    219                     skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
223                 return -1;                        220                 return -1;
224                                                   221 
225         pos = skb_push(skb, IEEE80211_TKIP_IV_    222         pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
226         memmove(pos, pos + IEEE80211_TKIP_IV_L    223         memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
227         pos += hdrlen;                            224         pos += hdrlen;
228                                                   225 
229         /* the HW only needs room for the IV,     226         /* the HW only needs room for the IV, but not the actual IV */
230         if (info->control.hw_key &&               227         if (info->control.hw_key &&
231             (info->control.hw_key->flags & IEE    228             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
232                 return 0;                         229                 return 0;
233                                                   230 
234         /* Increase IV for the frame */           231         /* Increase IV for the frame */
235         pn = atomic64_inc_return(&key->conf.tx    232         pn = atomic64_inc_return(&key->conf.tx_pn);
236         pos = ieee80211_tkip_add_iv(pos, &key-    233         pos = ieee80211_tkip_add_iv(pos, &key->conf, pn);
237                                                   234 
238         /* hwaccel - with software IV */          235         /* hwaccel - with software IV */
239         if (info->control.hw_key)                 236         if (info->control.hw_key)
240                 return 0;                         237                 return 0;
241                                                   238 
242         /* Add room for ICV */                    239         /* Add room for ICV */
243         skb_put(skb, IEEE80211_TKIP_ICV_LEN);     240         skb_put(skb, IEEE80211_TKIP_ICV_LEN);
244                                                   241 
245         return ieee80211_tkip_encrypt_data(tx-    242         return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
246                                            key    243                                            key, skb, pos, len);
247 }                                                 244 }
248                                                   245 
249                                                   246 
250 ieee80211_tx_result                               247 ieee80211_tx_result
251 ieee80211_crypto_tkip_encrypt(struct ieee80211    248 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
252 {                                                 249 {
253         struct sk_buff *skb;                      250         struct sk_buff *skb;
254                                                   251 
255         ieee80211_tx_set_protected(tx);           252         ieee80211_tx_set_protected(tx);
256                                                   253 
257         skb_queue_walk(&tx->skbs, skb) {          254         skb_queue_walk(&tx->skbs, skb) {
258                 if (tkip_encrypt_skb(tx, skb)     255                 if (tkip_encrypt_skb(tx, skb) < 0)
259                         return TX_DROP;           256                         return TX_DROP;
260         }                                         257         }
261                                                   258 
262         return TX_CONTINUE;                       259         return TX_CONTINUE;
263 }                                                 260 }
264                                                   261 
265                                                   262 
266 ieee80211_rx_result                               263 ieee80211_rx_result
267 ieee80211_crypto_tkip_decrypt(struct ieee80211    264 ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
268 {                                                 265 {
269         struct ieee80211_hdr *hdr = (struct ie    266         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
270         int hdrlen, res, hwaccel = 0;             267         int hdrlen, res, hwaccel = 0;
271         struct ieee80211_key *key = rx->key;      268         struct ieee80211_key *key = rx->key;
272         struct sk_buff *skb = rx->skb;            269         struct sk_buff *skb = rx->skb;
273         struct ieee80211_rx_status *status = I    270         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
274                                                   271 
275         hdrlen = ieee80211_hdrlen(hdr->frame_c    272         hdrlen = ieee80211_hdrlen(hdr->frame_control);
276                                                   273 
277         if (!ieee80211_is_data(hdr->frame_cont    274         if (!ieee80211_is_data(hdr->frame_control))
278                 return RX_CONTINUE;               275                 return RX_CONTINUE;
279                                                   276 
280         if (!rx->sta || skb->len - hdrlen < 12    277         if (!rx->sta || skb->len - hdrlen < 12)
281                 return RX_DROP_UNUSABLE;          278                 return RX_DROP_UNUSABLE;
282                                                   279 
283         /* it may be possible to optimize this    280         /* it may be possible to optimize this a bit more */
284         if (skb_linearize(rx->skb))               281         if (skb_linearize(rx->skb))
285                 return RX_DROP_UNUSABLE;          282                 return RX_DROP_UNUSABLE;
286         hdr = (void *)skb->data;                  283         hdr = (void *)skb->data;
287                                                   284 
288         /*                                        285         /*
289          * Let TKIP code verify IV, but skip d    286          * Let TKIP code verify IV, but skip decryption.
290          * In the case where hardware checks t    287          * In the case where hardware checks the IV as well,
291          * we don't even get here, see ieee802    288          * we don't even get here, see ieee80211_rx_h_decrypt()
292          */                                       289          */
293         if (status->flag & RX_FLAG_DECRYPTED)     290         if (status->flag & RX_FLAG_DECRYPTED)
294                 hwaccel = 1;                      291                 hwaccel = 1;
295                                                   292 
296         res = ieee80211_tkip_decrypt_data(rx->    293         res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
297                                           key,    294                                           key, skb->data + hdrlen,
298                                           skb-    295                                           skb->len - hdrlen, rx->sta->sta.addr,
299                                           hdr-    296                                           hdr->addr1, hwaccel, rx->security_idx,
300                                           &rx-    297                                           &rx->tkip_iv32,
301                                           &rx-    298                                           &rx->tkip_iv16);
302         if (res != TKIP_DECRYPT_OK)               299         if (res != TKIP_DECRYPT_OK)
303                 return RX_DROP_UNUSABLE;          300                 return RX_DROP_UNUSABLE;
304                                                   301 
305         /* Trim ICV */                            302         /* Trim ICV */
306         if (!(status->flag & RX_FLAG_ICV_STRIP    303         if (!(status->flag & RX_FLAG_ICV_STRIPPED))
307                 skb_trim(skb, skb->len - IEEE8    304                 skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
308                                                   305 
309         /* Remove IV */                           306         /* Remove IV */
310         memmove(skb->data + IEEE80211_TKIP_IV_    307         memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
311         skb_pull(skb, IEEE80211_TKIP_IV_LEN);     308         skb_pull(skb, IEEE80211_TKIP_IV_LEN);
312                                                   309 
313         return RX_CONTINUE;                       310         return RX_CONTINUE;
314 }                                                 311 }
315                                                   312 
316                                                   313 
317 static void ccmp_special_blocks(struct sk_buff    314 static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
318 {                                                 315 {
319         __le16 mask_fc;                           316         __le16 mask_fc;
320         int a4_included, mgmt;                    317         int a4_included, mgmt;
321         u8 qos_tid;                               318         u8 qos_tid;
322         u16 len_a;                                319         u16 len_a;
323         unsigned int hdrlen;                      320         unsigned int hdrlen;
324         struct ieee80211_hdr *hdr = (struct ie    321         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
325                                                   322 
326         /*                                        323         /*
327          * Mask FC: zero subtype b4 b5 b6 (if     324          * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
328          * Retry, PwrMgt, MoreData; set Protec    325          * Retry, PwrMgt, MoreData; set Protected
329          */                                       326          */
330         mgmt = ieee80211_is_mgmt(hdr->frame_co    327         mgmt = ieee80211_is_mgmt(hdr->frame_control);
331         mask_fc = hdr->frame_control;             328         mask_fc = hdr->frame_control;
332         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    329         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
333                                 IEEE80211_FCTL    330                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
334         if (!mgmt)                                331         if (!mgmt)
335                 mask_fc &= ~cpu_to_le16(0x0070    332                 mask_fc &= ~cpu_to_le16(0x0070);
336         mask_fc |= cpu_to_le16(IEEE80211_FCTL_    333         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
337                                                   334 
338         hdrlen = ieee80211_hdrlen(hdr->frame_c    335         hdrlen = ieee80211_hdrlen(hdr->frame_control);
339         len_a = hdrlen - 2;                       336         len_a = hdrlen - 2;
340         a4_included = ieee80211_has_a4(hdr->fr    337         a4_included = ieee80211_has_a4(hdr->frame_control);
341                                                   338 
342         if (ieee80211_is_data_qos(hdr->frame_c    339         if (ieee80211_is_data_qos(hdr->frame_control))
343                 qos_tid = ieee80211_get_tid(hd    340                 qos_tid = ieee80211_get_tid(hdr);
344         else                                      341         else
345                 qos_tid = 0;                      342                 qos_tid = 0;
346                                                   343 
347         /* In CCM, the initial vectors (IV) us    344         /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
348          * mode authentication are not allowed    345          * mode authentication are not allowed to collide, yet both are derived
349          * from this vector b_0. We only set L    346          * from this vector b_0. We only set L := 1 here to indicate that the
350          * data size can be represented in (L+    347          * data size can be represented in (L+1) bytes. The CCM layer will take
351          * care of storing the data length in     348          * care of storing the data length in the top (L+1) bytes and setting
352          * and clearing the other bits as is r    349          * and clearing the other bits as is required to derive the two IVs.
353          */                                       350          */
354         b_0[0] = 0x1;                             351         b_0[0] = 0x1;
355                                                   352 
356         /* Nonce: Nonce Flags | A2 | PN           353         /* Nonce: Nonce Flags | A2 | PN
357          * Nonce Flags: Priority (b0..b3) | Ma    354          * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
358          */                                       355          */
359         b_0[1] = qos_tid | (mgmt << 4);           356         b_0[1] = qos_tid | (mgmt << 4);
360         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);    357         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
361         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_    358         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
362                                                   359 
363         /* AAD (extra authenticate-only data)     360         /* AAD (extra authenticate-only data) / masked 802.11 header
364          * FC | A1 | A2 | A3 | SC | [A4] | [QC    361          * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
365         put_unaligned_be16(len_a, &aad[0]);       362         put_unaligned_be16(len_a, &aad[0]);
366         put_unaligned(mask_fc, (__le16 *)&aad[    363         put_unaligned(mask_fc, (__le16 *)&aad[2]);
367         memcpy(&aad[4], &hdr->addr1, 3 * ETH_A    364         memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
368                                                   365 
369         /* Mask Seq#, leave Frag# */              366         /* Mask Seq#, leave Frag# */
370         aad[22] = *((u8 *) &hdr->seq_ctrl) & 0    367         aad[22] = *((u8 *) &hdr->seq_ctrl) & 0x0f;
371         aad[23] = 0;                              368         aad[23] = 0;
372                                                   369 
373         if (a4_included) {                        370         if (a4_included) {
374                 memcpy(&aad[24], hdr->addr4, E    371                 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
375                 aad[30] = qos_tid;                372                 aad[30] = qos_tid;
376                 aad[31] = 0;                      373                 aad[31] = 0;
377         } else {                                  374         } else {
378                 memset(&aad[24], 0, ETH_ALEN +    375                 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
379                 aad[24] = qos_tid;                376                 aad[24] = qos_tid;
380         }                                         377         }
381 }                                                 378 }
382                                                   379 
383                                                   380 
384 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn    381 static inline void ccmp_pn2hdr(u8 *hdr, u8 *pn, int key_id)
385 {                                                 382 {
386         hdr[0] = pn[5];                           383         hdr[0] = pn[5];
387         hdr[1] = pn[4];                           384         hdr[1] = pn[4];
388         hdr[2] = 0;                               385         hdr[2] = 0;
389         hdr[3] = 0x20 | (key_id << 6);            386         hdr[3] = 0x20 | (key_id << 6);
390         hdr[4] = pn[3];                           387         hdr[4] = pn[3];
391         hdr[5] = pn[2];                           388         hdr[5] = pn[2];
392         hdr[6] = pn[1];                           389         hdr[6] = pn[1];
393         hdr[7] = pn[0];                           390         hdr[7] = pn[0];
394 }                                                 391 }
395                                                   392 
396                                                   393 
397 static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr    394 static inline void ccmp_hdr2pn(u8 *pn, u8 *hdr)
398 {                                                 395 {
399         pn[0] = hdr[7];                           396         pn[0] = hdr[7];
400         pn[1] = hdr[6];                           397         pn[1] = hdr[6];
401         pn[2] = hdr[5];                           398         pn[2] = hdr[5];
402         pn[3] = hdr[4];                           399         pn[3] = hdr[4];
403         pn[4] = hdr[1];                           400         pn[4] = hdr[1];
404         pn[5] = hdr[0];                           401         pn[5] = hdr[0];
405 }                                                 402 }
406                                                   403 
407                                                   404 
408 static int ccmp_encrypt_skb(struct ieee80211_t    405 static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb,
409                             unsigned int mic_l    406                             unsigned int mic_len)
410 {                                                 407 {
411         struct ieee80211_hdr *hdr = (struct ie    408         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
412         struct ieee80211_key *key = tx->key;      409         struct ieee80211_key *key = tx->key;
413         struct ieee80211_tx_info *info = IEEE8    410         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
414         int hdrlen, len, tail;                    411         int hdrlen, len, tail;
415         u8 *pos;                                  412         u8 *pos;
416         u8 pn[6];                                 413         u8 pn[6];
417         u64 pn64;                                 414         u64 pn64;
418         u8 aad[CCM_AAD_LEN];                      415         u8 aad[CCM_AAD_LEN];
419         u8 b_0[AES_BLOCK_SIZE];                   416         u8 b_0[AES_BLOCK_SIZE];
420                                                   417 
421         if (info->control.hw_key &&               418         if (info->control.hw_key &&
422             !(info->control.hw_key->flags & IE    419             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
423             !(info->control.hw_key->flags & IE    420             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
424             !((info->control.hw_key->flags &      421             !((info->control.hw_key->flags &
425                IEEE80211_KEY_FLAG_GENERATE_IV_    422                IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
426               ieee80211_is_mgmt(hdr->frame_con    423               ieee80211_is_mgmt(hdr->frame_control))) {
427                 /*                                424                 /*
428                  * hwaccel has no need for pre    425                  * hwaccel has no need for preallocated room for CCMP
429                  * header or MIC fields           426                  * header or MIC fields
430                  */                               427                  */
431                 return 0;                         428                 return 0;
432         }                                         429         }
433                                                   430 
434         hdrlen = ieee80211_hdrlen(hdr->frame_c    431         hdrlen = ieee80211_hdrlen(hdr->frame_control);
435         len = skb->len - hdrlen;                  432         len = skb->len - hdrlen;
436                                                   433 
437         if (info->control.hw_key)                 434         if (info->control.hw_key)
438                 tail = 0;                         435                 tail = 0;
439         else                                      436         else
440                 tail = mic_len;                   437                 tail = mic_len;
441                                                   438 
442         if (WARN_ON(skb_tailroom(skb) < tail |    439         if (WARN_ON(skb_tailroom(skb) < tail ||
443                     skb_headroom(skb) < IEEE80    440                     skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
444                 return -1;                        441                 return -1;
445                                                   442 
446         pos = skb_push(skb, IEEE80211_CCMP_HDR    443         pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
447         memmove(pos, pos + IEEE80211_CCMP_HDR_    444         memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
448                                                   445 
449         /* the HW only needs room for the IV,     446         /* the HW only needs room for the IV, but not the actual IV */
450         if (info->control.hw_key &&               447         if (info->control.hw_key &&
451             (info->control.hw_key->flags & IEE    448             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
452                 return 0;                         449                 return 0;
453                                                   450 
454         hdr = (struct ieee80211_hdr *) pos;       451         hdr = (struct ieee80211_hdr *) pos;
455         pos += hdrlen;                            452         pos += hdrlen;
456                                                   453 
457         pn64 = atomic64_inc_return(&key->conf.    454         pn64 = atomic64_inc_return(&key->conf.tx_pn);
458                                                   455 
459         pn[5] = pn64;                             456         pn[5] = pn64;
460         pn[4] = pn64 >> 8;                        457         pn[4] = pn64 >> 8;
461         pn[3] = pn64 >> 16;                       458         pn[3] = pn64 >> 16;
462         pn[2] = pn64 >> 24;                       459         pn[2] = pn64 >> 24;
463         pn[1] = pn64 >> 32;                       460         pn[1] = pn64 >> 32;
464         pn[0] = pn64 >> 40;                       461         pn[0] = pn64 >> 40;
465                                                   462 
466         ccmp_pn2hdr(pos, pn, key->conf.keyidx)    463         ccmp_pn2hdr(pos, pn, key->conf.keyidx);
467                                                   464 
468         /* hwaccel - with software CCMP header    465         /* hwaccel - with software CCMP header */
469         if (info->control.hw_key)                 466         if (info->control.hw_key)
470                 return 0;                         467                 return 0;
471                                                   468 
472         pos += IEEE80211_CCMP_HDR_LEN;            469         pos += IEEE80211_CCMP_HDR_LEN;
473         ccmp_special_blocks(skb, pn, b_0, aad)    470         ccmp_special_blocks(skb, pn, b_0, aad);
474         return ieee80211_aes_ccm_encrypt(key->    471         return ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
475                                          skb_p    472                                          skb_put(skb, mic_len));
476 }                                                 473 }
477                                                   474 
478                                                   475 
479 ieee80211_tx_result                               476 ieee80211_tx_result
480 ieee80211_crypto_ccmp_encrypt(struct ieee80211    477 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx,
481                               unsigned int mic    478                               unsigned int mic_len)
482 {                                                 479 {
483         struct sk_buff *skb;                      480         struct sk_buff *skb;
484                                                   481 
485         ieee80211_tx_set_protected(tx);           482         ieee80211_tx_set_protected(tx);
486                                                   483 
487         skb_queue_walk(&tx->skbs, skb) {          484         skb_queue_walk(&tx->skbs, skb) {
488                 if (ccmp_encrypt_skb(tx, skb,     485                 if (ccmp_encrypt_skb(tx, skb, mic_len) < 0)
489                         return TX_DROP;           486                         return TX_DROP;
490         }                                         487         }
491                                                   488 
492         return TX_CONTINUE;                       489         return TX_CONTINUE;
493 }                                                 490 }
494                                                   491 
495                                                   492 
496 ieee80211_rx_result                               493 ieee80211_rx_result
497 ieee80211_crypto_ccmp_decrypt(struct ieee80211    494 ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
498                               unsigned int mic    495                               unsigned int mic_len)
499 {                                                 496 {
500         struct ieee80211_hdr *hdr = (struct ie    497         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
501         int hdrlen;                               498         int hdrlen;
502         struct ieee80211_key *key = rx->key;      499         struct ieee80211_key *key = rx->key;
503         struct sk_buff *skb = rx->skb;            500         struct sk_buff *skb = rx->skb;
504         struct ieee80211_rx_status *status = I    501         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
505         u8 pn[IEEE80211_CCMP_PN_LEN];             502         u8 pn[IEEE80211_CCMP_PN_LEN];
506         int data_len;                             503         int data_len;
507         int queue;                                504         int queue;
508                                                   505 
509         hdrlen = ieee80211_hdrlen(hdr->frame_c    506         hdrlen = ieee80211_hdrlen(hdr->frame_control);
510                                                   507 
511         if (!ieee80211_is_data(hdr->frame_cont    508         if (!ieee80211_is_data(hdr->frame_control) &&
512             !ieee80211_is_robust_mgmt_frame(sk    509             !ieee80211_is_robust_mgmt_frame(skb))
513                 return RX_CONTINUE;               510                 return RX_CONTINUE;
514                                                   511 
515         if (status->flag & RX_FLAG_DECRYPTED)     512         if (status->flag & RX_FLAG_DECRYPTED) {
516                 if (!pskb_may_pull(rx->skb, hd    513                 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
517                         return RX_DROP_UNUSABL    514                         return RX_DROP_UNUSABLE;
518                 if (status->flag & RX_FLAG_MIC    515                 if (status->flag & RX_FLAG_MIC_STRIPPED)
519                         mic_len = 0;              516                         mic_len = 0;
520         } else {                                  517         } else {
521                 if (skb_linearize(rx->skb))       518                 if (skb_linearize(rx->skb))
522                         return RX_DROP_UNUSABL    519                         return RX_DROP_UNUSABLE;
523         }                                         520         }
524                                                   521 
525         data_len = skb->len - hdrlen - IEEE802    522         data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
526         if (!rx->sta || data_len < 0)             523         if (!rx->sta || data_len < 0)
527                 return RX_DROP_UNUSABLE;          524                 return RX_DROP_UNUSABLE;
528                                                   525 
529         if (!(status->flag & RX_FLAG_PN_VALIDA    526         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
530                 int res;                          527                 int res;
531                                                   528 
532                 ccmp_hdr2pn(pn, skb->data + hd    529                 ccmp_hdr2pn(pn, skb->data + hdrlen);
533                                                   530 
534                 queue = rx->security_idx;         531                 queue = rx->security_idx;
535                                                   532 
536                 res = memcmp(pn, key->u.ccmp.r    533                 res = memcmp(pn, key->u.ccmp.rx_pn[queue],
537                              IEEE80211_CCMP_PN    534                              IEEE80211_CCMP_PN_LEN);
538                 if (res < 0 ||                    535                 if (res < 0 ||
539                     (!res && !(status->flag &     536                     (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
540                         key->u.ccmp.replays++;    537                         key->u.ccmp.replays++;
541                         return RX_DROP_UNUSABL    538                         return RX_DROP_UNUSABLE;
542                 }                                 539                 }
543                                                   540 
544                 if (!(status->flag & RX_FLAG_D    541                 if (!(status->flag & RX_FLAG_DECRYPTED)) {
545                         u8 aad[2 * AES_BLOCK_S    542                         u8 aad[2 * AES_BLOCK_SIZE];
546                         u8 b_0[AES_BLOCK_SIZE]    543                         u8 b_0[AES_BLOCK_SIZE];
547                         /* hardware didn't dec    544                         /* hardware didn't decrypt/verify MIC */
548                         ccmp_special_blocks(sk    545                         ccmp_special_blocks(skb, pn, b_0, aad);
549                                                   546 
550                         if (ieee80211_aes_ccm_    547                         if (ieee80211_aes_ccm_decrypt(
551                                     key->u.ccm    548                                     key->u.ccmp.tfm, b_0, aad,
552                                     skb->data     549                                     skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
553                                     data_len,     550                                     data_len,
554                                     skb->data     551                                     skb->data + skb->len - mic_len))
555                                 return RX_DROP    552                                 return RX_DROP_UNUSABLE;
556                 }                                 553                 }
557                                                   554 
558                 memcpy(key->u.ccmp.rx_pn[queue    555                 memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
559         }                                         556         }
560                                                   557 
561         /* Remove CCMP header and MIC */          558         /* Remove CCMP header and MIC */
562         if (pskb_trim(skb, skb->len - mic_len)    559         if (pskb_trim(skb, skb->len - mic_len))
563                 return RX_DROP_UNUSABLE;          560                 return RX_DROP_UNUSABLE;
564         memmove(skb->data + IEEE80211_CCMP_HDR    561         memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
565         skb_pull(skb, IEEE80211_CCMP_HDR_LEN);    562         skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
566                                                   563 
567         return RX_CONTINUE;                       564         return RX_CONTINUE;
568 }                                                 565 }
569                                                   566 
570 static void gcmp_special_blocks(struct sk_buff    567 static void gcmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *j_0, u8 *aad)
571 {                                                 568 {
572         __le16 mask_fc;                           569         __le16 mask_fc;
573         u8 qos_tid;                               570         u8 qos_tid;
574         struct ieee80211_hdr *hdr = (struct ie    571         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
575                                                   572 
576         memcpy(j_0, hdr->addr2, ETH_ALEN);        573         memcpy(j_0, hdr->addr2, ETH_ALEN);
577         memcpy(&j_0[ETH_ALEN], pn, IEEE80211_G    574         memcpy(&j_0[ETH_ALEN], pn, IEEE80211_GCMP_PN_LEN);
578         j_0[13] = 0;                              575         j_0[13] = 0;
579         j_0[14] = 0;                              576         j_0[14] = 0;
580         j_0[AES_BLOCK_SIZE - 1] = 0x01;           577         j_0[AES_BLOCK_SIZE - 1] = 0x01;
581                                                   578 
582         /* AAD (extra authenticate-only data)     579         /* AAD (extra authenticate-only data) / masked 802.11 header
583          * FC | A1 | A2 | A3 | SC | [A4] | [QC    580          * FC | A1 | A2 | A3 | SC | [A4] | [QC]
584          */                                       581          */
585         put_unaligned_be16(ieee80211_hdrlen(hd    582         put_unaligned_be16(ieee80211_hdrlen(hdr->frame_control) - 2, &aad[0]);
586         /* Mask FC: zero subtype b4 b5 b6 (if     583         /* Mask FC: zero subtype b4 b5 b6 (if not mgmt)
587          * Retry, PwrMgt, MoreData; set Protec    584          * Retry, PwrMgt, MoreData; set Protected
588          */                                       585          */
589         mask_fc = hdr->frame_control;             586         mask_fc = hdr->frame_control;
590         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    587         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY |
591                                 IEEE80211_FCTL    588                                 IEEE80211_FCTL_PM | IEEE80211_FCTL_MOREDATA);
592         if (!ieee80211_is_mgmt(hdr->frame_cont    589         if (!ieee80211_is_mgmt(hdr->frame_control))
593                 mask_fc &= ~cpu_to_le16(0x0070    590                 mask_fc &= ~cpu_to_le16(0x0070);
594         mask_fc |= cpu_to_le16(IEEE80211_FCTL_    591         mask_fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
595                                                   592 
596         put_unaligned(mask_fc, (__le16 *)&aad[    593         put_unaligned(mask_fc, (__le16 *)&aad[2]);
597         memcpy(&aad[4], &hdr->addr1, 3 * ETH_A    594         memcpy(&aad[4], &hdr->addr1, 3 * ETH_ALEN);
598                                                   595 
599         /* Mask Seq#, leave Frag# */              596         /* Mask Seq#, leave Frag# */
600         aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x    597         aad[22] = *((u8 *)&hdr->seq_ctrl) & 0x0f;
601         aad[23] = 0;                              598         aad[23] = 0;
602                                                   599 
603         if (ieee80211_is_data_qos(hdr->frame_c    600         if (ieee80211_is_data_qos(hdr->frame_control))
604                 qos_tid = ieee80211_get_tid(hd    601                 qos_tid = ieee80211_get_tid(hdr);
605         else                                      602         else
606                 qos_tid = 0;                      603                 qos_tid = 0;
607                                                   604 
608         if (ieee80211_has_a4(hdr->frame_contro    605         if (ieee80211_has_a4(hdr->frame_control)) {
609                 memcpy(&aad[24], hdr->addr4, E    606                 memcpy(&aad[24], hdr->addr4, ETH_ALEN);
610                 aad[30] = qos_tid;                607                 aad[30] = qos_tid;
611                 aad[31] = 0;                      608                 aad[31] = 0;
612         } else {                                  609         } else {
613                 memset(&aad[24], 0, ETH_ALEN +    610                 memset(&aad[24], 0, ETH_ALEN + IEEE80211_QOS_CTL_LEN);
614                 aad[24] = qos_tid;                611                 aad[24] = qos_tid;
615         }                                         612         }
616 }                                                 613 }
617                                                   614 
618 static inline void gcmp_pn2hdr(u8 *hdr, const     615 static inline void gcmp_pn2hdr(u8 *hdr, const u8 *pn, int key_id)
619 {                                                 616 {
620         hdr[0] = pn[5];                           617         hdr[0] = pn[5];
621         hdr[1] = pn[4];                           618         hdr[1] = pn[4];
622         hdr[2] = 0;                               619         hdr[2] = 0;
623         hdr[3] = 0x20 | (key_id << 6);            620         hdr[3] = 0x20 | (key_id << 6);
624         hdr[4] = pn[3];                           621         hdr[4] = pn[3];
625         hdr[5] = pn[2];                           622         hdr[5] = pn[2];
626         hdr[6] = pn[1];                           623         hdr[6] = pn[1];
627         hdr[7] = pn[0];                           624         hdr[7] = pn[0];
628 }                                                 625 }
629                                                   626 
630 static inline void gcmp_hdr2pn(u8 *pn, const u    627 static inline void gcmp_hdr2pn(u8 *pn, const u8 *hdr)
631 {                                                 628 {
632         pn[0] = hdr[7];                           629         pn[0] = hdr[7];
633         pn[1] = hdr[6];                           630         pn[1] = hdr[6];
634         pn[2] = hdr[5];                           631         pn[2] = hdr[5];
635         pn[3] = hdr[4];                           632         pn[3] = hdr[4];
636         pn[4] = hdr[1];                           633         pn[4] = hdr[1];
637         pn[5] = hdr[0];                           634         pn[5] = hdr[0];
638 }                                                 635 }
639                                                   636 
640 static int gcmp_encrypt_skb(struct ieee80211_t    637 static int gcmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
641 {                                                 638 {
642         struct ieee80211_hdr *hdr = (struct ie    639         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
643         struct ieee80211_key *key = tx->key;      640         struct ieee80211_key *key = tx->key;
644         struct ieee80211_tx_info *info = IEEE8    641         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
645         int hdrlen, len, tail;                    642         int hdrlen, len, tail;
646         u8 *pos;                                  643         u8 *pos;
647         u8 pn[6];                                 644         u8 pn[6];
648         u64 pn64;                                 645         u64 pn64;
649         u8 aad[GCM_AAD_LEN];                      646         u8 aad[GCM_AAD_LEN];
650         u8 j_0[AES_BLOCK_SIZE];                   647         u8 j_0[AES_BLOCK_SIZE];
651                                                   648 
652         if (info->control.hw_key &&               649         if (info->control.hw_key &&
653             !(info->control.hw_key->flags & IE    650             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
654             !(info->control.hw_key->flags & IE    651             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
655             !((info->control.hw_key->flags &      652             !((info->control.hw_key->flags &
656                IEEE80211_KEY_FLAG_GENERATE_IV_    653                IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
657               ieee80211_is_mgmt(hdr->frame_con    654               ieee80211_is_mgmt(hdr->frame_control))) {
658                 /* hwaccel has no need for pre    655                 /* hwaccel has no need for preallocated room for GCMP
659                  * header or MIC fields           656                  * header or MIC fields
660                  */                               657                  */
661                 return 0;                         658                 return 0;
662         }                                         659         }
663                                                   660 
664         hdrlen = ieee80211_hdrlen(hdr->frame_c    661         hdrlen = ieee80211_hdrlen(hdr->frame_control);
665         len = skb->len - hdrlen;                  662         len = skb->len - hdrlen;
666                                                   663 
667         if (info->control.hw_key)                 664         if (info->control.hw_key)
668                 tail = 0;                         665                 tail = 0;
669         else                                      666         else
670                 tail = IEEE80211_GCMP_MIC_LEN;    667                 tail = IEEE80211_GCMP_MIC_LEN;
671                                                   668 
672         if (WARN_ON(skb_tailroom(skb) < tail |    669         if (WARN_ON(skb_tailroom(skb) < tail ||
673                     skb_headroom(skb) < IEEE80    670                     skb_headroom(skb) < IEEE80211_GCMP_HDR_LEN))
674                 return -1;                        671                 return -1;
675                                                   672 
676         pos = skb_push(skb, IEEE80211_GCMP_HDR    673         pos = skb_push(skb, IEEE80211_GCMP_HDR_LEN);
677         memmove(pos, pos + IEEE80211_GCMP_HDR_    674         memmove(pos, pos + IEEE80211_GCMP_HDR_LEN, hdrlen);
678         skb_set_network_header(skb, skb_networ    675         skb_set_network_header(skb, skb_network_offset(skb) +
679                                     IEEE80211_    676                                     IEEE80211_GCMP_HDR_LEN);
680                                                   677 
681         /* the HW only needs room for the IV,     678         /* the HW only needs room for the IV, but not the actual IV */
682         if (info->control.hw_key &&               679         if (info->control.hw_key &&
683             (info->control.hw_key->flags & IEE    680             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
684                 return 0;                         681                 return 0;
685                                                   682 
686         hdr = (struct ieee80211_hdr *)pos;        683         hdr = (struct ieee80211_hdr *)pos;
687         pos += hdrlen;                            684         pos += hdrlen;
688                                                   685 
689         pn64 = atomic64_inc_return(&key->conf.    686         pn64 = atomic64_inc_return(&key->conf.tx_pn);
690                                                   687 
691         pn[5] = pn64;                             688         pn[5] = pn64;
692         pn[4] = pn64 >> 8;                        689         pn[4] = pn64 >> 8;
693         pn[3] = pn64 >> 16;                       690         pn[3] = pn64 >> 16;
694         pn[2] = pn64 >> 24;                       691         pn[2] = pn64 >> 24;
695         pn[1] = pn64 >> 32;                       692         pn[1] = pn64 >> 32;
696         pn[0] = pn64 >> 40;                       693         pn[0] = pn64 >> 40;
697                                                   694 
698         gcmp_pn2hdr(pos, pn, key->conf.keyidx)    695         gcmp_pn2hdr(pos, pn, key->conf.keyidx);
699                                                   696 
700         /* hwaccel - with software GCMP header    697         /* hwaccel - with software GCMP header */
701         if (info->control.hw_key)                 698         if (info->control.hw_key)
702                 return 0;                         699                 return 0;
703                                                   700 
704         pos += IEEE80211_GCMP_HDR_LEN;            701         pos += IEEE80211_GCMP_HDR_LEN;
705         gcmp_special_blocks(skb, pn, j_0, aad)    702         gcmp_special_blocks(skb, pn, j_0, aad);
706         return ieee80211_aes_gcm_encrypt(key->    703         return ieee80211_aes_gcm_encrypt(key->u.gcmp.tfm, j_0, aad, pos, len,
707                                          skb_p    704                                          skb_put(skb, IEEE80211_GCMP_MIC_LEN));
708 }                                                 705 }
709                                                   706 
710 ieee80211_tx_result                               707 ieee80211_tx_result
711 ieee80211_crypto_gcmp_encrypt(struct ieee80211    708 ieee80211_crypto_gcmp_encrypt(struct ieee80211_tx_data *tx)
712 {                                                 709 {
713         struct sk_buff *skb;                      710         struct sk_buff *skb;
714                                                   711 
715         ieee80211_tx_set_protected(tx);           712         ieee80211_tx_set_protected(tx);
716                                                   713 
717         skb_queue_walk(&tx->skbs, skb) {          714         skb_queue_walk(&tx->skbs, skb) {
718                 if (gcmp_encrypt_skb(tx, skb)     715                 if (gcmp_encrypt_skb(tx, skb) < 0)
719                         return TX_DROP;           716                         return TX_DROP;
720         }                                         717         }
721                                                   718 
722         return TX_CONTINUE;                       719         return TX_CONTINUE;
723 }                                                 720 }
724                                                   721 
725 ieee80211_rx_result                               722 ieee80211_rx_result
726 ieee80211_crypto_gcmp_decrypt(struct ieee80211    723 ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
727 {                                                 724 {
728         struct ieee80211_hdr *hdr = (struct ie    725         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
729         int hdrlen;                               726         int hdrlen;
730         struct ieee80211_key *key = rx->key;      727         struct ieee80211_key *key = rx->key;
731         struct sk_buff *skb = rx->skb;            728         struct sk_buff *skb = rx->skb;
732         struct ieee80211_rx_status *status = I    729         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
733         u8 pn[IEEE80211_GCMP_PN_LEN];             730         u8 pn[IEEE80211_GCMP_PN_LEN];
734         int data_len, queue, mic_len = IEEE802    731         int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN;
735                                                   732 
736         hdrlen = ieee80211_hdrlen(hdr->frame_c    733         hdrlen = ieee80211_hdrlen(hdr->frame_control);
737                                                   734 
738         if (!ieee80211_is_data(hdr->frame_cont    735         if (!ieee80211_is_data(hdr->frame_control) &&
739             !ieee80211_is_robust_mgmt_frame(sk    736             !ieee80211_is_robust_mgmt_frame(skb))
740                 return RX_CONTINUE;               737                 return RX_CONTINUE;
741                                                   738 
742         if (status->flag & RX_FLAG_DECRYPTED)     739         if (status->flag & RX_FLAG_DECRYPTED) {
743                 if (!pskb_may_pull(rx->skb, hd    740                 if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN))
744                         return RX_DROP_UNUSABL    741                         return RX_DROP_UNUSABLE;
745                 if (status->flag & RX_FLAG_MIC    742                 if (status->flag & RX_FLAG_MIC_STRIPPED)
746                         mic_len = 0;              743                         mic_len = 0;
747         } else {                                  744         } else {
748                 if (skb_linearize(rx->skb))       745                 if (skb_linearize(rx->skb))
749                         return RX_DROP_UNUSABL    746                         return RX_DROP_UNUSABLE;
750         }                                         747         }
751                                                   748 
752         data_len = skb->len - hdrlen - IEEE802    749         data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
753         if (!rx->sta || data_len < 0)             750         if (!rx->sta || data_len < 0)
754                 return RX_DROP_UNUSABLE;          751                 return RX_DROP_UNUSABLE;
755                                                   752 
756         if (!(status->flag & RX_FLAG_PN_VALIDA    753         if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
757                 int res;                          754                 int res;
758                                                   755 
759                 gcmp_hdr2pn(pn, skb->data + hd    756                 gcmp_hdr2pn(pn, skb->data + hdrlen);
760                                                   757 
761                 queue = rx->security_idx;         758                 queue = rx->security_idx;
762                                                   759 
763                 res = memcmp(pn, key->u.gcmp.r    760                 res = memcmp(pn, key->u.gcmp.rx_pn[queue],
764                              IEEE80211_GCMP_PN    761                              IEEE80211_GCMP_PN_LEN);
765                 if (res < 0 ||                    762                 if (res < 0 ||
766                     (!res && !(status->flag &     763                     (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {
767                         key->u.gcmp.replays++;    764                         key->u.gcmp.replays++;
768                         return RX_DROP_UNUSABL    765                         return RX_DROP_UNUSABLE;
769                 }                                 766                 }
770                                                   767 
771                 if (!(status->flag & RX_FLAG_D    768                 if (!(status->flag & RX_FLAG_DECRYPTED)) {
772                         u8 aad[2 * AES_BLOCK_S    769                         u8 aad[2 * AES_BLOCK_SIZE];
773                         u8 j_0[AES_BLOCK_SIZE]    770                         u8 j_0[AES_BLOCK_SIZE];
774                         /* hardware didn't dec    771                         /* hardware didn't decrypt/verify MIC */
775                         gcmp_special_blocks(sk    772                         gcmp_special_blocks(skb, pn, j_0, aad);
776                                                   773 
777                         if (ieee80211_aes_gcm_    774                         if (ieee80211_aes_gcm_decrypt(
778                                     key->u.gcm    775                                     key->u.gcmp.tfm, j_0, aad,
779                                     skb->data     776                                     skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
780                                     data_len,     777                                     data_len,
781                                     skb->data     778                                     skb->data + skb->len -
782                                     IEEE80211_    779                                     IEEE80211_GCMP_MIC_LEN))
783                                 return RX_DROP    780                                 return RX_DROP_UNUSABLE;
784                 }                                 781                 }
785                                                   782 
786                 memcpy(key->u.gcmp.rx_pn[queue    783                 memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
787         }                                         784         }
788                                                   785 
789         /* Remove GCMP header and MIC */          786         /* Remove GCMP header and MIC */
790         if (pskb_trim(skb, skb->len - mic_len)    787         if (pskb_trim(skb, skb->len - mic_len))
791                 return RX_DROP_UNUSABLE;          788                 return RX_DROP_UNUSABLE;
792         memmove(skb->data + IEEE80211_GCMP_HDR    789         memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen);
793         skb_pull(skb, IEEE80211_GCMP_HDR_LEN);    790         skb_pull(skb, IEEE80211_GCMP_HDR_LEN);
794                                                   791 
795         return RX_CONTINUE;                       792         return RX_CONTINUE;
796 }                                                 793 }
797                                                   794 
798 static ieee80211_tx_result                        795 static ieee80211_tx_result
799 ieee80211_crypto_cs_encrypt(struct ieee80211_t    796 ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
800                             struct sk_buff *sk    797                             struct sk_buff *skb)
801 {                                                 798 {
802         struct ieee80211_hdr *hdr = (struct ie    799         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
803         struct ieee80211_key *key = tx->key;      800         struct ieee80211_key *key = tx->key;
804         struct ieee80211_tx_info *info = IEEE8    801         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
805         int hdrlen;                               802         int hdrlen;
806         u8 *pos, iv_len = key->conf.iv_len;       803         u8 *pos, iv_len = key->conf.iv_len;
807                                                   804 
808         if (info->control.hw_key &&               805         if (info->control.hw_key &&
809             !(info->control.hw_key->flags & IE    806             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
810                 /* hwaccel has no need for pre    807                 /* hwaccel has no need for preallocated head room */
811                 return TX_CONTINUE;               808                 return TX_CONTINUE;
812         }                                         809         }
813                                                   810 
814         if (unlikely(skb_headroom(skb) < iv_le    811         if (unlikely(skb_headroom(skb) < iv_len &&
815                      pskb_expand_head(skb, iv_    812                      pskb_expand_head(skb, iv_len, 0, GFP_ATOMIC)))
816                 return TX_DROP;                   813                 return TX_DROP;
817                                                   814 
818         hdrlen = ieee80211_hdrlen(hdr->frame_c    815         hdrlen = ieee80211_hdrlen(hdr->frame_control);
819                                                   816 
820         pos = skb_push(skb, iv_len);              817         pos = skb_push(skb, iv_len);
821         memmove(pos, pos + iv_len, hdrlen);       818         memmove(pos, pos + iv_len, hdrlen);
822                                                   819 
823         return TX_CONTINUE;                       820         return TX_CONTINUE;
824 }                                                 821 }
825                                                   822 
826 static inline int ieee80211_crypto_cs_pn_compa    823 static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
827 {                                                 824 {
828         int i;                                    825         int i;
829                                                   826 
830         /* pn is little endian */                 827         /* pn is little endian */
831         for (i = len - 1; i >= 0; i--) {          828         for (i = len - 1; i >= 0; i--) {
832                 if (pn1[i] < pn2[i])              829                 if (pn1[i] < pn2[i])
833                         return -1;                830                         return -1;
834                 else if (pn1[i] > pn2[i])         831                 else if (pn1[i] > pn2[i])
835                         return 1;                 832                         return 1;
836         }                                         833         }
837                                                   834 
838         return 0;                                 835         return 0;
839 }                                                 836 }
840                                                   837 
841 static ieee80211_rx_result                        838 static ieee80211_rx_result
842 ieee80211_crypto_cs_decrypt(struct ieee80211_r    839 ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
843 {                                                 840 {
844         struct ieee80211_key *key = rx->key;      841         struct ieee80211_key *key = rx->key;
845         struct ieee80211_hdr *hdr = (struct ie    842         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
846         const struct ieee80211_cipher_scheme *    843         const struct ieee80211_cipher_scheme *cs = NULL;
847         int hdrlen = ieee80211_hdrlen(hdr->fra    844         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
848         struct ieee80211_rx_status *status = I    845         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
849         int data_len;                             846         int data_len;
850         u8 *rx_pn;                                847         u8 *rx_pn;
851         u8 *skb_pn;                               848         u8 *skb_pn;
852         u8 qos_tid;                               849         u8 qos_tid;
853                                                   850 
854         if (!rx->sta || !rx->sta->cipher_schem    851         if (!rx->sta || !rx->sta->cipher_scheme ||
855             !(status->flag & RX_FLAG_DECRYPTED    852             !(status->flag & RX_FLAG_DECRYPTED))
856                 return RX_DROP_UNUSABLE;          853                 return RX_DROP_UNUSABLE;
857                                                   854 
858         if (!ieee80211_is_data(hdr->frame_cont    855         if (!ieee80211_is_data(hdr->frame_control))
859                 return RX_CONTINUE;               856                 return RX_CONTINUE;
860                                                   857 
861         cs = rx->sta->cipher_scheme;              858         cs = rx->sta->cipher_scheme;
862                                                   859 
863         data_len = rx->skb->len - hdrlen - cs-    860         data_len = rx->skb->len - hdrlen - cs->hdr_len;
864                                                   861 
865         if (data_len < 0)                         862         if (data_len < 0)
866                 return RX_DROP_UNUSABLE;          863                 return RX_DROP_UNUSABLE;
867                                                   864 
868         if (ieee80211_is_data_qos(hdr->frame_c    865         if (ieee80211_is_data_qos(hdr->frame_control))
869                 qos_tid = ieee80211_get_tid(hd    866                 qos_tid = ieee80211_get_tid(hdr);
870         else                                      867         else
871                 qos_tid = 0;                      868                 qos_tid = 0;
872                                                   869 
873         if (skb_linearize(rx->skb))               870         if (skb_linearize(rx->skb))
874                 return RX_DROP_UNUSABLE;          871                 return RX_DROP_UNUSABLE;
875                                                   872 
876         hdr = (struct ieee80211_hdr *)rx->skb-    873         hdr = (struct ieee80211_hdr *)rx->skb->data;
877                                                   874 
878         rx_pn = key->u.gen.rx_pn[qos_tid];        875         rx_pn = key->u.gen.rx_pn[qos_tid];
879         skb_pn = rx->skb->data + hdrlen + cs->    876         skb_pn = rx->skb->data + hdrlen + cs->pn_off;
880                                                   877 
881         if (ieee80211_crypto_cs_pn_compare(skb    878         if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
882                 return RX_DROP_UNUSABLE;          879                 return RX_DROP_UNUSABLE;
883                                                   880 
884         memcpy(rx_pn, skb_pn, cs->pn_len);        881         memcpy(rx_pn, skb_pn, cs->pn_len);
885                                                   882 
886         /* remove security header and MIC */      883         /* remove security header and MIC */
887         if (pskb_trim(rx->skb, rx->skb->len -     884         if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
888                 return RX_DROP_UNUSABLE;          885                 return RX_DROP_UNUSABLE;
889                                                   886 
890         memmove(rx->skb->data + cs->hdr_len, r    887         memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
891         skb_pull(rx->skb, cs->hdr_len);           888         skb_pull(rx->skb, cs->hdr_len);
892                                                   889 
893         return RX_CONTINUE;                       890         return RX_CONTINUE;
894 }                                                 891 }
895                                                   892 
896 static void bip_aad(struct sk_buff *skb, u8 *a    893 static void bip_aad(struct sk_buff *skb, u8 *aad)
897 {                                                 894 {
898         __le16 mask_fc;                           895         __le16 mask_fc;
899         struct ieee80211_hdr *hdr = (struct ie    896         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
900                                                   897 
901         /* BIP AAD: FC(masked) || A1 || A2 ||     898         /* BIP AAD: FC(masked) || A1 || A2 || A3 */
902                                                   899 
903         /* FC type/subtype */                     900         /* FC type/subtype */
904         /* Mask FC Retry, PwrMgt, MoreData fla    901         /* Mask FC Retry, PwrMgt, MoreData flags to zero */
905         mask_fc = hdr->frame_control;             902         mask_fc = hdr->frame_control;
906         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL    903         mask_fc &= ~cpu_to_le16(IEEE80211_FCTL_RETRY | IEEE80211_FCTL_PM |
907                                 IEEE80211_FCTL    904                                 IEEE80211_FCTL_MOREDATA);
908         put_unaligned(mask_fc, (__le16 *) &aad    905         put_unaligned(mask_fc, (__le16 *) &aad[0]);
909         /* A1 || A2 || A3 */                      906         /* A1 || A2 || A3 */
910         memcpy(aad + 2, &hdr->addr1, 3 * ETH_A    907         memcpy(aad + 2, &hdr->addr1, 3 * ETH_ALEN);
911 }                                                 908 }
912                                                   909 
913                                                   910 
914 static inline void bip_ipn_set64(u8 *d, u64 pn    911 static inline void bip_ipn_set64(u8 *d, u64 pn)
915 {                                                 912 {
916         *d++ = pn;                                913         *d++ = pn;
917         *d++ = pn >> 8;                           914         *d++ = pn >> 8;
918         *d++ = pn >> 16;                          915         *d++ = pn >> 16;
919         *d++ = pn >> 24;                          916         *d++ = pn >> 24;
920         *d++ = pn >> 32;                          917         *d++ = pn >> 32;
921         *d = pn >> 40;                            918         *d = pn >> 40;
922 }                                                 919 }
923                                                   920 
924 static inline void bip_ipn_swap(u8 *d, const u    921 static inline void bip_ipn_swap(u8 *d, const u8 *s)
925 {                                                 922 {
926         *d++ = s[5];                              923         *d++ = s[5];
927         *d++ = s[4];                              924         *d++ = s[4];
928         *d++ = s[3];                              925         *d++ = s[3];
929         *d++ = s[2];                              926         *d++ = s[2];
930         *d++ = s[1];                              927         *d++ = s[1];
931         *d = s[0];                                928         *d = s[0];
932 }                                                 929 }
933                                                   930 
934                                                   931 
935 ieee80211_tx_result                               932 ieee80211_tx_result
936 ieee80211_crypto_aes_cmac_encrypt(struct ieee8    933 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
937 {                                                 934 {
938         struct sk_buff *skb;                      935         struct sk_buff *skb;
939         struct ieee80211_tx_info *info;           936         struct ieee80211_tx_info *info;
940         struct ieee80211_key *key = tx->key;      937         struct ieee80211_key *key = tx->key;
941         struct ieee80211_mmie *mmie;              938         struct ieee80211_mmie *mmie;
942         u8 aad[20];                               939         u8 aad[20];
943         u64 pn64;                                 940         u64 pn64;
944                                                   941 
945         if (WARN_ON(skb_queue_len(&tx->skbs) !    942         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
946                 return TX_DROP;                   943                 return TX_DROP;
947                                                   944 
948         skb = skb_peek(&tx->skbs);                945         skb = skb_peek(&tx->skbs);
949                                                   946 
950         info = IEEE80211_SKB_CB(skb);             947         info = IEEE80211_SKB_CB(skb);
951                                                   948 
952         if (info->control.hw_key)                 949         if (info->control.hw_key)
953                 return TX_CONTINUE;               950                 return TX_CONTINUE;
954                                                   951 
955         if (WARN_ON(skb_tailroom(skb) < sizeof    952         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
956                 return TX_DROP;                   953                 return TX_DROP;
957                                                   954 
958         mmie = skb_put(skb, sizeof(*mmie));       955         mmie = skb_put(skb, sizeof(*mmie));
959         mmie->element_id = WLAN_EID_MMIE;         956         mmie->element_id = WLAN_EID_MMIE;
960         mmie->length = sizeof(*mmie) - 2;         957         mmie->length = sizeof(*mmie) - 2;
961         mmie->key_id = cpu_to_le16(key->conf.k    958         mmie->key_id = cpu_to_le16(key->conf.keyidx);
962                                                   959 
963         /* PN = PN + 1 */                         960         /* PN = PN + 1 */
964         pn64 = atomic64_inc_return(&key->conf.    961         pn64 = atomic64_inc_return(&key->conf.tx_pn);
965                                                   962 
966         bip_ipn_set64(mmie->sequence_number, p    963         bip_ipn_set64(mmie->sequence_number, pn64);
967                                                   964 
968         bip_aad(skb, aad);                        965         bip_aad(skb, aad);
969                                                   966 
970         /*                                        967         /*
971          * MIC = AES-128-CMAC(IGTK, AAD || Man    968          * MIC = AES-128-CMAC(IGTK, AAD || Management Frame Body || MMIE, 64)
972          */                                       969          */
973         ieee80211_aes_cmac(key->u.aes_cmac.tfm    970         ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
974                            skb->data + 24, skb    971                            skb->data + 24, skb->len - 24, mmie->mic);
975                                                   972 
976         return TX_CONTINUE;                       973         return TX_CONTINUE;
977 }                                                 974 }
978                                                   975 
979 ieee80211_tx_result                               976 ieee80211_tx_result
980 ieee80211_crypto_aes_cmac_256_encrypt(struct i    977 ieee80211_crypto_aes_cmac_256_encrypt(struct ieee80211_tx_data *tx)
981 {                                                 978 {
982         struct sk_buff *skb;                      979         struct sk_buff *skb;
983         struct ieee80211_tx_info *info;           980         struct ieee80211_tx_info *info;
984         struct ieee80211_key *key = tx->key;      981         struct ieee80211_key *key = tx->key;
985         struct ieee80211_mmie_16 *mmie;           982         struct ieee80211_mmie_16 *mmie;
986         u8 aad[20];                               983         u8 aad[20];
987         u64 pn64;                                 984         u64 pn64;
988                                                   985 
989         if (WARN_ON(skb_queue_len(&tx->skbs) !    986         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
990                 return TX_DROP;                   987                 return TX_DROP;
991                                                   988 
992         skb = skb_peek(&tx->skbs);                989         skb = skb_peek(&tx->skbs);
993                                                   990 
994         info = IEEE80211_SKB_CB(skb);             991         info = IEEE80211_SKB_CB(skb);
995                                                   992 
996         if (info->control.hw_key)                 993         if (info->control.hw_key)
997                 return TX_CONTINUE;               994                 return TX_CONTINUE;
998                                                   995 
999         if (WARN_ON(skb_tailroom(skb) < sizeof    996         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1000                 return TX_DROP;                  997                 return TX_DROP;
1001                                                  998 
1002         mmie = skb_put(skb, sizeof(*mmie));      999         mmie = skb_put(skb, sizeof(*mmie));
1003         mmie->element_id = WLAN_EID_MMIE;        1000         mmie->element_id = WLAN_EID_MMIE;
1004         mmie->length = sizeof(*mmie) - 2;        1001         mmie->length = sizeof(*mmie) - 2;
1005         mmie->key_id = cpu_to_le16(key->conf.    1002         mmie->key_id = cpu_to_le16(key->conf.keyidx);
1006                                                  1003 
1007         /* PN = PN + 1 */                        1004         /* PN = PN + 1 */
1008         pn64 = atomic64_inc_return(&key->conf    1005         pn64 = atomic64_inc_return(&key->conf.tx_pn);
1009                                                  1006 
1010         bip_ipn_set64(mmie->sequence_number,     1007         bip_ipn_set64(mmie->sequence_number, pn64);
1011                                                  1008 
1012         bip_aad(skb, aad);                       1009         bip_aad(skb, aad);
1013                                                  1010 
1014         /* MIC = AES-256-CMAC(IGTK, AAD || Ma    1011         /* MIC = AES-256-CMAC(IGTK, AAD || Management Frame Body || MMIE, 128)
1015          */                                      1012          */
1016         ieee80211_aes_cmac_256(key->u.aes_cma    1013         ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1017                                skb->data + 24    1014                                skb->data + 24, skb->len - 24, mmie->mic);
1018                                                  1015 
1019         return TX_CONTINUE;                      1016         return TX_CONTINUE;
1020 }                                                1017 }
1021                                                  1018 
1022 ieee80211_rx_result                              1019 ieee80211_rx_result
1023 ieee80211_crypto_aes_cmac_decrypt(struct ieee    1020 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
1024 {                                                1021 {
1025         struct sk_buff *skb = rx->skb;           1022         struct sk_buff *skb = rx->skb;
1026         struct ieee80211_rx_status *status =     1023         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1027         struct ieee80211_key *key = rx->key;     1024         struct ieee80211_key *key = rx->key;
1028         struct ieee80211_mmie *mmie;             1025         struct ieee80211_mmie *mmie;
1029         u8 aad[20], mic[8], ipn[6];              1026         u8 aad[20], mic[8], ipn[6];
1030         struct ieee80211_hdr *hdr = (struct i    1027         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1031                                                  1028 
1032         if (!ieee80211_is_mgmt(hdr->frame_con    1029         if (!ieee80211_is_mgmt(hdr->frame_control))
1033                 return RX_CONTINUE;              1030                 return RX_CONTINUE;
1034                                                  1031 
1035         /* management frames are already line    1032         /* management frames are already linear */
1036                                                  1033 
1037         if (skb->len < 24 + sizeof(*mmie))       1034         if (skb->len < 24 + sizeof(*mmie))
1038                 return RX_DROP_UNUSABLE;         1035                 return RX_DROP_UNUSABLE;
1039                                                  1036 
1040         mmie = (struct ieee80211_mmie *)         1037         mmie = (struct ieee80211_mmie *)
1041                 (skb->data + skb->len - sizeo    1038                 (skb->data + skb->len - sizeof(*mmie));
1042         if (mmie->element_id != WLAN_EID_MMIE    1039         if (mmie->element_id != WLAN_EID_MMIE ||
1043             mmie->length != sizeof(*mmie) - 2    1040             mmie->length != sizeof(*mmie) - 2)
1044                 return RX_DROP_UNUSABLE; /* I    1041                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1045                                                  1042 
1046         bip_ipn_swap(ipn, mmie->sequence_numb    1043         bip_ipn_swap(ipn, mmie->sequence_number);
1047                                                  1044 
1048         if (memcmp(ipn, key->u.aes_cmac.rx_pn    1045         if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1049                 key->u.aes_cmac.replays++;       1046                 key->u.aes_cmac.replays++;
1050                 return RX_DROP_UNUSABLE;         1047                 return RX_DROP_UNUSABLE;
1051         }                                        1048         }
1052                                                  1049 
1053         if (!(status->flag & RX_FLAG_DECRYPTE    1050         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1054                 /* hardware didn't decrypt/ve    1051                 /* hardware didn't decrypt/verify MIC */
1055                 bip_aad(skb, aad);               1052                 bip_aad(skb, aad);
1056                 ieee80211_aes_cmac(key->u.aes    1053                 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
1057                                    skb->data     1054                                    skb->data + 24, skb->len - 24, mic);
1058                 if (crypto_memneq(mic, mmie->    1055                 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1059                         key->u.aes_cmac.icver    1056                         key->u.aes_cmac.icverrors++;
1060                         return RX_DROP_UNUSAB    1057                         return RX_DROP_UNUSABLE;
1061                 }                                1058                 }
1062         }                                        1059         }
1063                                                  1060 
1064         memcpy(key->u.aes_cmac.rx_pn, ipn, 6)    1061         memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1065                                                  1062 
1066         /* Remove MMIE */                        1063         /* Remove MMIE */
1067         skb_trim(skb, skb->len - sizeof(*mmie    1064         skb_trim(skb, skb->len - sizeof(*mmie));
1068                                                  1065 
1069         return RX_CONTINUE;                      1066         return RX_CONTINUE;
1070 }                                                1067 }
1071                                                  1068 
1072 ieee80211_rx_result                              1069 ieee80211_rx_result
1073 ieee80211_crypto_aes_cmac_256_decrypt(struct     1070 ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
1074 {                                                1071 {
1075         struct sk_buff *skb = rx->skb;           1072         struct sk_buff *skb = rx->skb;
1076         struct ieee80211_rx_status *status =     1073         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1077         struct ieee80211_key *key = rx->key;     1074         struct ieee80211_key *key = rx->key;
1078         struct ieee80211_mmie_16 *mmie;          1075         struct ieee80211_mmie_16 *mmie;
1079         u8 aad[20], mic[16], ipn[6];             1076         u8 aad[20], mic[16], ipn[6];
1080         struct ieee80211_hdr *hdr = (struct i    1077         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1081                                                  1078 
1082         if (!ieee80211_is_mgmt(hdr->frame_con    1079         if (!ieee80211_is_mgmt(hdr->frame_control))
1083                 return RX_CONTINUE;              1080                 return RX_CONTINUE;
1084                                                  1081 
1085         /* management frames are already line    1082         /* management frames are already linear */
1086                                                  1083 
1087         if (skb->len < 24 + sizeof(*mmie))       1084         if (skb->len < 24 + sizeof(*mmie))
1088                 return RX_DROP_UNUSABLE;         1085                 return RX_DROP_UNUSABLE;
1089                                                  1086 
1090         mmie = (struct ieee80211_mmie_16 *)      1087         mmie = (struct ieee80211_mmie_16 *)
1091                 (skb->data + skb->len - sizeo    1088                 (skb->data + skb->len - sizeof(*mmie));
1092         if (mmie->element_id != WLAN_EID_MMIE    1089         if (mmie->element_id != WLAN_EID_MMIE ||
1093             mmie->length != sizeof(*mmie) - 2    1090             mmie->length != sizeof(*mmie) - 2)
1094                 return RX_DROP_UNUSABLE; /* I    1091                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1095                                                  1092 
1096         bip_ipn_swap(ipn, mmie->sequence_numb    1093         bip_ipn_swap(ipn, mmie->sequence_number);
1097                                                  1094 
1098         if (memcmp(ipn, key->u.aes_cmac.rx_pn    1095         if (memcmp(ipn, key->u.aes_cmac.rx_pn, 6) <= 0) {
1099                 key->u.aes_cmac.replays++;       1096                 key->u.aes_cmac.replays++;
1100                 return RX_DROP_UNUSABLE;         1097                 return RX_DROP_UNUSABLE;
1101         }                                        1098         }
1102                                                  1099 
1103         if (!(status->flag & RX_FLAG_DECRYPTE    1100         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1104                 /* hardware didn't decrypt/ve    1101                 /* hardware didn't decrypt/verify MIC */
1105                 bip_aad(skb, aad);               1102                 bip_aad(skb, aad);
1106                 ieee80211_aes_cmac_256(key->u    1103                 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
1107                                        skb->d    1104                                        skb->data + 24, skb->len - 24, mic);
1108                 if (crypto_memneq(mic, mmie->    1105                 if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1109                         key->u.aes_cmac.icver    1106                         key->u.aes_cmac.icverrors++;
1110                         return RX_DROP_UNUSAB    1107                         return RX_DROP_UNUSABLE;
1111                 }                                1108                 }
1112         }                                        1109         }
1113                                                  1110 
1114         memcpy(key->u.aes_cmac.rx_pn, ipn, 6)    1111         memcpy(key->u.aes_cmac.rx_pn, ipn, 6);
1115                                                  1112 
1116         /* Remove MMIE */                        1113         /* Remove MMIE */
1117         skb_trim(skb, skb->len - sizeof(*mmie    1114         skb_trim(skb, skb->len - sizeof(*mmie));
1118                                                  1115 
1119         return RX_CONTINUE;                      1116         return RX_CONTINUE;
1120 }                                                1117 }
1121                                                  1118 
1122 ieee80211_tx_result                              1119 ieee80211_tx_result
1123 ieee80211_crypto_aes_gmac_encrypt(struct ieee    1120 ieee80211_crypto_aes_gmac_encrypt(struct ieee80211_tx_data *tx)
1124 {                                                1121 {
1125         struct sk_buff *skb;                     1122         struct sk_buff *skb;
1126         struct ieee80211_tx_info *info;          1123         struct ieee80211_tx_info *info;
1127         struct ieee80211_key *key = tx->key;     1124         struct ieee80211_key *key = tx->key;
1128         struct ieee80211_mmie_16 *mmie;          1125         struct ieee80211_mmie_16 *mmie;
1129         struct ieee80211_hdr *hdr;               1126         struct ieee80211_hdr *hdr;
1130         u8 aad[GMAC_AAD_LEN];                    1127         u8 aad[GMAC_AAD_LEN];
1131         u64 pn64;                                1128         u64 pn64;
1132         u8 nonce[GMAC_NONCE_LEN];                1129         u8 nonce[GMAC_NONCE_LEN];
1133                                                  1130 
1134         if (WARN_ON(skb_queue_len(&tx->skbs)     1131         if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
1135                 return TX_DROP;                  1132                 return TX_DROP;
1136                                                  1133 
1137         skb = skb_peek(&tx->skbs);               1134         skb = skb_peek(&tx->skbs);
1138                                                  1135 
1139         info = IEEE80211_SKB_CB(skb);            1136         info = IEEE80211_SKB_CB(skb);
1140                                                  1137 
1141         if (info->control.hw_key)                1138         if (info->control.hw_key)
1142                 return TX_CONTINUE;              1139                 return TX_CONTINUE;
1143                                                  1140 
1144         if (WARN_ON(skb_tailroom(skb) < sizeo    1141         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
1145                 return TX_DROP;                  1142                 return TX_DROP;
1146                                                  1143 
1147         mmie = skb_put(skb, sizeof(*mmie));      1144         mmie = skb_put(skb, sizeof(*mmie));
1148         mmie->element_id = WLAN_EID_MMIE;        1145         mmie->element_id = WLAN_EID_MMIE;
1149         mmie->length = sizeof(*mmie) - 2;        1146         mmie->length = sizeof(*mmie) - 2;
1150         mmie->key_id = cpu_to_le16(key->conf.    1147         mmie->key_id = cpu_to_le16(key->conf.keyidx);
1151                                                  1148 
1152         /* PN = PN + 1 */                        1149         /* PN = PN + 1 */
1153         pn64 = atomic64_inc_return(&key->conf    1150         pn64 = atomic64_inc_return(&key->conf.tx_pn);
1154                                                  1151 
1155         bip_ipn_set64(mmie->sequence_number,     1152         bip_ipn_set64(mmie->sequence_number, pn64);
1156                                                  1153 
1157         bip_aad(skb, aad);                       1154         bip_aad(skb, aad);
1158                                                  1155 
1159         hdr = (struct ieee80211_hdr *)skb->da    1156         hdr = (struct ieee80211_hdr *)skb->data;
1160         memcpy(nonce, hdr->addr2, ETH_ALEN);     1157         memcpy(nonce, hdr->addr2, ETH_ALEN);
1161         bip_ipn_swap(nonce + ETH_ALEN, mmie->    1158         bip_ipn_swap(nonce + ETH_ALEN, mmie->sequence_number);
1162                                                  1159 
1163         /* MIC = AES-GMAC(IGTK, AAD || Manage    1160         /* MIC = AES-GMAC(IGTK, AAD || Management Frame Body || MMIE, 128) */
1164         if (ieee80211_aes_gmac(key->u.aes_gma    1161         if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1165                                skb->data + 24    1162                                skb->data + 24, skb->len - 24, mmie->mic) < 0)
1166                 return TX_DROP;                  1163                 return TX_DROP;
1167                                                  1164 
1168         return TX_CONTINUE;                      1165         return TX_CONTINUE;
1169 }                                                1166 }
1170                                                  1167 
1171 ieee80211_rx_result                              1168 ieee80211_rx_result
1172 ieee80211_crypto_aes_gmac_decrypt(struct ieee    1169 ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
1173 {                                                1170 {
1174         struct sk_buff *skb = rx->skb;           1171         struct sk_buff *skb = rx->skb;
1175         struct ieee80211_rx_status *status =     1172         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1176         struct ieee80211_key *key = rx->key;     1173         struct ieee80211_key *key = rx->key;
1177         struct ieee80211_mmie_16 *mmie;          1174         struct ieee80211_mmie_16 *mmie;
1178         u8 aad[GMAC_AAD_LEN], mic[GMAC_MIC_LE !! 1175         u8 aad[GMAC_AAD_LEN], *mic, ipn[6], nonce[GMAC_NONCE_LEN];
1179         struct ieee80211_hdr *hdr = (struct i    1176         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1180                                                  1177 
1181         if (!ieee80211_is_mgmt(hdr->frame_con    1178         if (!ieee80211_is_mgmt(hdr->frame_control))
1182                 return RX_CONTINUE;              1179                 return RX_CONTINUE;
1183                                                  1180 
1184         /* management frames are already line    1181         /* management frames are already linear */
1185                                                  1182 
1186         if (skb->len < 24 + sizeof(*mmie))       1183         if (skb->len < 24 + sizeof(*mmie))
1187                 return RX_DROP_UNUSABLE;         1184                 return RX_DROP_UNUSABLE;
1188                                                  1185 
1189         mmie = (struct ieee80211_mmie_16 *)      1186         mmie = (struct ieee80211_mmie_16 *)
1190                 (skb->data + skb->len - sizeo    1187                 (skb->data + skb->len - sizeof(*mmie));
1191         if (mmie->element_id != WLAN_EID_MMIE    1188         if (mmie->element_id != WLAN_EID_MMIE ||
1192             mmie->length != sizeof(*mmie) - 2    1189             mmie->length != sizeof(*mmie) - 2)
1193                 return RX_DROP_UNUSABLE; /* I    1190                 return RX_DROP_UNUSABLE; /* Invalid MMIE */
1194                                                  1191 
1195         bip_ipn_swap(ipn, mmie->sequence_numb    1192         bip_ipn_swap(ipn, mmie->sequence_number);
1196                                                  1193 
1197         if (memcmp(ipn, key->u.aes_gmac.rx_pn    1194         if (memcmp(ipn, key->u.aes_gmac.rx_pn, 6) <= 0) {
1198                 key->u.aes_gmac.replays++;       1195                 key->u.aes_gmac.replays++;
1199                 return RX_DROP_UNUSABLE;         1196                 return RX_DROP_UNUSABLE;
1200         }                                        1197         }
1201                                                  1198 
1202         if (!(status->flag & RX_FLAG_DECRYPTE    1199         if (!(status->flag & RX_FLAG_DECRYPTED)) {
1203                 /* hardware didn't decrypt/ve    1200                 /* hardware didn't decrypt/verify MIC */
1204                 bip_aad(skb, aad);               1201                 bip_aad(skb, aad);
1205                                                  1202 
1206                 memcpy(nonce, hdr->addr2, ETH    1203                 memcpy(nonce, hdr->addr2, ETH_ALEN);
1207                 memcpy(nonce + ETH_ALEN, ipn,    1204                 memcpy(nonce + ETH_ALEN, ipn, 6);
1208                                                  1205 
                                                   >> 1206                 mic = kmalloc(GMAC_MIC_LEN, GFP_ATOMIC);
                                                   >> 1207                 if (!mic)
                                                   >> 1208                         return RX_DROP_UNUSABLE;
1209                 if (ieee80211_aes_gmac(key->u    1209                 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
1210                                        skb->d    1210                                        skb->data + 24, skb->len - 24,
1211                                        mic) <    1211                                        mic) < 0 ||
1212                     crypto_memneq(mic, mmie->    1212                     crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
1213                         key->u.aes_gmac.icver    1213                         key->u.aes_gmac.icverrors++;
                                                   >> 1214                         kfree(mic);
1214                         return RX_DROP_UNUSAB    1215                         return RX_DROP_UNUSABLE;
1215                 }                                1216                 }
                                                   >> 1217                 kfree(mic);
1216         }                                        1218         }
1217                                                  1219 
1218         memcpy(key->u.aes_gmac.rx_pn, ipn, 6)    1220         memcpy(key->u.aes_gmac.rx_pn, ipn, 6);
1219                                                  1221 
1220         /* Remove MMIE */                        1222         /* Remove MMIE */
1221         skb_trim(skb, skb->len - sizeof(*mmie    1223         skb_trim(skb, skb->len - sizeof(*mmie));
1222                                                  1224 
1223         return RX_CONTINUE;                      1225         return RX_CONTINUE;
1224 }                                                1226 }
1225                                                  1227 
1226 ieee80211_tx_result                              1228 ieee80211_tx_result
1227 ieee80211_crypto_hw_encrypt(struct ieee80211_    1229 ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
1228 {                                                1230 {
1229         struct sk_buff *skb;                     1231         struct sk_buff *skb;
1230         struct ieee80211_tx_info *info = NULL    1232         struct ieee80211_tx_info *info = NULL;
1231         ieee80211_tx_result res;                 1233         ieee80211_tx_result res;
1232                                                  1234 
1233         skb_queue_walk(&tx->skbs, skb) {         1235         skb_queue_walk(&tx->skbs, skb) {
1234                 info  = IEEE80211_SKB_CB(skb)    1236                 info  = IEEE80211_SKB_CB(skb);
1235                                                  1237 
1236                 /* handle hw-only algorithm *    1238                 /* handle hw-only algorithm */
1237                 if (!info->control.hw_key)       1239                 if (!info->control.hw_key)
1238                         return TX_DROP;          1240                         return TX_DROP;
1239                                                  1241 
1240                 if (tx->key->flags & KEY_FLAG    1242                 if (tx->key->flags & KEY_FLAG_CIPHER_SCHEME) {
1241                         res = ieee80211_crypt    1243                         res = ieee80211_crypto_cs_encrypt(tx, skb);
1242                         if (res != TX_CONTINU    1244                         if (res != TX_CONTINUE)
1243                                 return res;      1245                                 return res;
1244                 }                                1246                 }
1245         }                                        1247         }
1246                                                  1248 
1247         ieee80211_tx_set_protected(tx);          1249         ieee80211_tx_set_protected(tx);
1248                                                  1250 
1249         return TX_CONTINUE;                      1251         return TX_CONTINUE;
1250 }                                                1252 }
1251                                                  1253 
1252 ieee80211_rx_result                              1254 ieee80211_rx_result
1253 ieee80211_crypto_hw_decrypt(struct ieee80211_    1255 ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
1254 {                                                1256 {
1255         if (rx->sta && rx->sta->cipher_scheme    1257         if (rx->sta && rx->sta->cipher_scheme)
1256                 return ieee80211_crypto_cs_de    1258                 return ieee80211_crypto_cs_decrypt(rx);
1257                                                  1259 
1258         return RX_DROP_UNUSABLE;                 1260         return RX_DROP_UNUSABLE;
1259 }                                                1261 }
1260                                                  1262 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp