[linux-block.git] / net / wireless / lib80211_crypt_ccmp.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * lib80211 crypt: host-based CCMP encryption implementation for lib80211
 *
 * Copyright (c) 2003-2004, Jouni Malinen <j@w1.fi>
 * Copyright (c) 2008, John W. Linville <linville@tuxdriver.com>
 */

#include <linux/kernel.h>
#include <linux/err.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/random.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <asm/string.h>
#include <linux/wireless.h>

#include <linux/ieee80211.h>

#include <linux/crypto.h>
#include <crypto/aead.h>

#include <net/lib80211.h>

MODULE_AUTHOR("Jouni Malinen");
MODULE_DESCRIPTION("Host AP crypt: CCMP");
MODULE_LICENSE("GPL");

#define AES_BLOCK_LEN 16
#define CCMP_HDR_LEN 8
#define CCMP_MIC_LEN 8
#define CCMP_TK_LEN 16
#define CCMP_PN_LEN 6

struct lib80211_ccmp_data {
	u8 key[CCMP_TK_LEN];
	int key_set;

	u8 tx_pn[CCMP_PN_LEN];
	u8 rx_pn[CCMP_PN_LEN];

	u32 dot11RSNAStatsCCMPFormatErrors;
	u32 dot11RSNAStatsCCMPReplays;
	u32 dot11RSNAStatsCCMPDecryptErrors;

	int key_idx;

	struct crypto_aead *tfm;

	/* scratch buffers for virt_to_page() (crypto API) */
	u8 tx_aad[2 * AES_BLOCK_LEN];
	u8 rx_aad[2 * AES_BLOCK_LEN];
};

static void *lib80211_ccmp_init(int key_idx)
{
	struct lib80211_ccmp_data *priv;

	priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
	if (priv == NULL)
		goto fail;
	priv->key_idx = key_idx;

	priv->tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
	if (IS_ERR(priv->tfm)) {
		priv->tfm = NULL;
		goto fail;
	}

	return priv;

      fail:
	if (priv) {
		if (priv->tfm)
			crypto_free_aead(priv->tfm);
		kfree(priv);
	}

	return NULL;
}

static void lib80211_ccmp_deinit(void *priv)
{
	struct lib80211_ccmp_data *_priv = priv;
	if (_priv && _priv->tfm)
		crypto_free_aead(_priv->tfm);
	kfree(priv);
}

static int ccmp_init_iv_and_aad(const struct ieee80211_hdr *hdr,
				const u8 *pn, u8 *iv, u8 *aad)
{
	u8 *pos, qc = 0;
	size_t aad_len;
	int a4_included, qc_included;

	a4_included = ieee80211_has_a4(hdr->frame_control);
	qc_included = ieee80211_is_data_qos(hdr->frame_control);

	aad_len = 22;
	if (a4_included)
		aad_len += 6;
	if (qc_included) {
		pos = (u8 *) & hdr->addr4;
		if (a4_included)
			pos += 6;
		qc = *pos & 0x0f;
		aad_len += 2;
	}

	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
	 * mode authentication are not allowed to collide, yet both are derived
	 * from the same vector. We only set L := 1 here to indicate that the
	 * data size can be represented in (L+1) bytes. The CCM layer will take
	 * care of storing the data length in the top (L+1) bytes and setting
	 * and clearing the other bits as is required to derive the two IVs.
	 */
	iv[0] = 0x1;

	/* Nonce: QC | A2 | PN */
	iv[1] = qc;
	memcpy(iv + 2, hdr->addr2, ETH_ALEN);
	memcpy(iv + 8, pn, CCMP_PN_LEN);

	/* AAD:
	 * FC with bits 4..6 and 11..13 masked to zero; 14 is always one
	 * A1 | A2 | A3
	 * SC with bits 4..15 (seq#) masked to zero
	 * A4 (if present)
	 * QC (if present)
	 */
	pos = (u8 *) hdr;
	aad[0] = pos[0] & 0x8f;
	aad[1] = pos[1] & 0xc7;
	memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
	pos = (u8 *) & hdr->seq_ctrl;
	aad[20] = pos[0] & 0x0f;
	aad[21] = 0;		/* all bits masked */
	memset(aad + 22, 0, 8);
	if (a4_included)
		memcpy(aad + 22, hdr->addr4, ETH_ALEN);
	if (qc_included) {
		aad[a4_included ? 28 : 22] = qc;
		/* rest of QC masked */
	}
	return aad_len;
}

static int lib80211_ccmp_hdr(struct sk_buff *skb, int hdr_len,
			      u8 *aeskey, int keylen, void *priv)
{
	struct lib80211_ccmp_data *key = priv;
	int i;
	u8 *pos;

	if (skb_headroom(skb) < CCMP_HDR_LEN || skb->len < hdr_len)
		return -1;

	if (aeskey != NULL && keylen >= CCMP_TK_LEN)
		memcpy(aeskey, key->key, CCMP_TK_LEN);

	pos = skb_push(skb, CCMP_HDR_LEN);
	memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
	pos += hdr_len;

	i = CCMP_PN_LEN - 1;
	while (i >= 0) {
		key->tx_pn[i]++;
		if (key->tx_pn[i] != 0)
			break;
		i--;
	}

	*pos++ = key->tx_pn[5];
	*pos++ = key->tx_pn[4];
	*pos++ = 0;
	*pos++ = (key->key_idx << 6) | (1 << 5) /* Ext IV included */ ;
	*pos++ = key->tx_pn[3];
	*pos++ = key->tx_pn[2];
	*pos++ = key->tx_pn[1];
	*pos++ = key->tx_pn[0];

	return CCMP_HDR_LEN;
}

static int lib80211_ccmp_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
{
	struct lib80211_ccmp_data *key = priv;
	struct ieee80211_hdr *hdr;
	struct aead_request *req;
	struct scatterlist sg[2];
	u8 *aad = key->tx_aad;
	u8 iv[AES_BLOCK_LEN];
	int len, data_len, aad_len;
	int ret;

	if (skb_tailroom(skb) < CCMP_MIC_LEN || skb->len < hdr_len)
		return -1;

	data_len = skb->len - hdr_len;
	len = lib80211_ccmp_hdr(skb, hdr_len, NULL, 0, priv);
	if (len < 0)
		return -1;

	req = aead_request_alloc(key->tfm, GFP_ATOMIC);
	if (!req)
		return -ENOMEM;

	hdr = (struct ieee80211_hdr *)skb->data;
	aad_len = ccmp_init_iv_and_aad(hdr, key->tx_pn, iv, aad);

	skb_put(skb, CCMP_MIC_LEN);

	sg_init_table(sg, 2);
	sg_set_buf(&sg[0], aad, aad_len);
	sg_set_buf(&sg[1], skb->data + hdr_len + CCMP_HDR_LEN,
		   data_len + CCMP_MIC_LEN);

	aead_request_set_callback(req, 0, NULL, NULL);
	aead_request_set_ad(req, aad_len);
	aead_request_set_crypt(req, sg, sg, data_len, iv);

	ret = crypto_aead_encrypt(req);
	aead_request_free(req);

	return ret;
}

/*
 * deal with seq counter wrapping correctly.
 * refer to timer_after() for jiffies wrapping handling
 */
static inline int ccmp_replay_check(u8 *pn_n, u8 *pn_o)
{
	u32 iv32_n, iv16_n;
	u32 iv32_o, iv16_o;

	iv32_n = (pn_n[0] << 24) | (pn_n[1] << 16) | (pn_n[2] << 8) | pn_n[3];
	iv16_n = (pn_n[4] << 8) | pn_n[5];

	iv32_o = (pn_o[0] << 24) | (pn_o[1] << 16) | (pn_o[2] << 8) | pn_o[3];
	iv16_o = (pn_o[4] << 8) | pn_o[5];

	if ((s32)iv32_n - (s32)iv32_o < 0 ||
	    (iv32_n == iv32_o && iv16_n <= iv16_o))
		return 1;
	return 0;
}

static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
{
	struct lib80211_ccmp_data *key = priv;
	u8 keyidx, *pos;
	struct ieee80211_hdr *hdr;
	struct aead_request *req;
	struct scatterlist sg[2];
	u8 *aad = key->rx_aad;
	u8 iv[AES_BLOCK_LEN];
	u8 pn[6];
	int aad_len, ret;
	size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN;

	if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
		key->dot11RSNAStatsCCMPFormatErrors++;
		return -1;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
	pos = skb->data + hdr_len;
	keyidx = pos[3];
	if (!(keyidx & (1 << 5))) {
		net_dbg_ratelimited("CCMP: received packet without ExtIV flag from %pM\n",
				    hdr->addr2);
		key->dot11RSNAStatsCCMPFormatErrors++;
		return -2;
	}
	keyidx >>= 6;
	if (key->key_idx != keyidx) {
		net_dbg_ratelimited("CCMP: RX tkey->key_idx=%d frame keyidx=%d\n",
				    key->key_idx, keyidx);
		return -6;
	}
	if (!key->key_set) {
		net_dbg_ratelimited("CCMP: received packet from %pM with keyid=%d that does not have a configured key\n",
				    hdr->addr2, keyidx);
		return -3;
	}

	pn[0] = pos[7];
	pn[1] = pos[6];
	pn[2] = pos[5];
	pn[3] = pos[4];
	pn[4] = pos[1];
	pn[5] = pos[0];
	pos += 8;

	if (ccmp_replay_check(pn, key->rx_pn)) {
#ifdef CONFIG_LIB80211_DEBUG
		net_dbg_ratelimited("CCMP: replay detected: STA=%pM previous PN %02x%02x%02x%02x%02x%02x received PN %02x%02x%02x%02x%02x%02x\n",
				    hdr->addr2,
				    key->rx_pn[0], key->rx_pn[1], key->rx_pn[2],
				    key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
				    pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
#endif
		key->dot11RSNAStatsCCMPReplays++;
		return -4;
	}

	req = aead_request_alloc(key->tfm, GFP_ATOMIC);
	if (!req)
		return -ENOMEM;

	aad_len = ccmp_init_iv_and_aad(hdr, pn, iv, aad);

	sg_init_table(sg, 2);
	sg_set_buf(&sg[0], aad, aad_len);
	sg_set_buf(&sg[1], pos, data_len);

	aead_request_set_callback(req, 0, NULL, NULL);
	aead_request_set_ad(req, aad_len);
	aead_request_set_crypt(req, sg, sg, data_len, iv);

	ret = crypto_aead_decrypt(req);
	aead_request_free(req);

	if (ret) {
		net_dbg_ratelimited("CCMP: decrypt failed: STA=%pM (%d)\n",
				    hdr->addr2, ret);
		key->dot11RSNAStatsCCMPDecryptErrors++;
		return -5;
	}

	memcpy(key->rx_pn, pn, CCMP_PN_LEN);

	/* Remove hdr and MIC */
	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
	skb_pull(skb, CCMP_HDR_LEN);
	skb_trim(skb, skb->len - CCMP_MIC_LEN);

	return keyidx;
}

static int lib80211_ccmp_set_key(void *key, int len, u8 * seq, void *priv)
{
	struct lib80211_ccmp_data *data = priv;
	int keyidx;
	struct crypto_aead *tfm = data->tfm;

	keyidx = data->key_idx;
	memset(data, 0, sizeof(*data));
	data->key_idx = keyidx;
	data->tfm = tfm;
	if (len == CCMP_TK_LEN) {
		memcpy(data->key, key, CCMP_TK_LEN);
		data->key_set = 1;
		if (seq) {
			data->rx_pn[0] = seq[5];
			data->rx_pn[1] = seq[4];
			data->rx_pn[2] = seq[3];
			data->rx_pn[3] = seq[2];
			data->rx_pn[4] = seq[1];
			data->rx_pn[5] = seq[0];
		}
		if (crypto_aead_setauthsize(data->tfm, CCMP_MIC_LEN) ||
		    crypto_aead_setkey(data->tfm, data->key, CCMP_TK_LEN))
			return -1;
	} else if (len == 0)
		data->key_set = 0;
	else
		return -1;

	return 0;
}

static int lib80211_ccmp_get_key(void *key, int len, u8 * seq, void *priv)
{
	struct lib80211_ccmp_data *data = priv;

	if (len < CCMP_TK_LEN)
		return -1;

	if (!data->key_set)
		return 0;
	memcpy(key, data->key, CCMP_TK_LEN);

	if (seq) {
		seq[0] = data->tx_pn[5];
		seq[1] = data->tx_pn[4];
		seq[2] = data->tx_pn[3];
		seq[3] = data->tx_pn[2];
		seq[4] = data->tx_pn[1];
		seq[5] = data->tx_pn[0];
	}

	return CCMP_TK_LEN;
}

static void lib80211_ccmp_print_stats(struct seq_file *m, void *priv)
{
	struct lib80211_ccmp_data *ccmp = priv;

	seq_printf(m,
		   "key[%d] alg=CCMP key_set=%d "
		   "tx_pn=%02x%02x%02x%02x%02x%02x "
		   "rx_pn=%02x%02x%02x%02x%02x%02x "
		   "format_errors=%d replays=%d decrypt_errors=%d\n",
		   ccmp->key_idx, ccmp->key_set,
		   ccmp->tx_pn[0], ccmp->tx_pn[1], ccmp->tx_pn[2],
		   ccmp->tx_pn[3], ccmp->tx_pn[4], ccmp->tx_pn[5],
		   ccmp->rx_pn[0], ccmp->rx_pn[1], ccmp->rx_pn[2],
		   ccmp->rx_pn[3], ccmp->rx_pn[4], ccmp->rx_pn[5],
		   ccmp->dot11RSNAStatsCCMPFormatErrors,
		   ccmp->dot11RSNAStatsCCMPReplays,
		   ccmp->dot11RSNAStatsCCMPDecryptErrors);
}

static struct lib80211_crypto_ops lib80211_crypt_ccmp = {
	.name = "CCMP",
	.init = lib80211_ccmp_init,
	.deinit = lib80211_ccmp_deinit,
	.encrypt_mpdu = lib80211_ccmp_encrypt,
	.decrypt_mpdu = lib80211_ccmp_decrypt,
	.encrypt_msdu = NULL,
	.decrypt_msdu = NULL,
	.set_key = lib80211_ccmp_set_key,
	.get_key = lib80211_ccmp_get_key,
	.print_stats = lib80211_ccmp_print_stats,
	.extra_mpdu_prefix_len = CCMP_HDR_LEN,
	.extra_mpdu_postfix_len = CCMP_MIC_LEN,
	.owner = THIS_MODULE,
};

static int __init lib80211_crypto_ccmp_init(void)
{
	return lib80211_register_crypto_ops(&lib80211_crypt_ccmp);
}

static void __exit lib80211_crypto_ccmp_exit(void)
{
	lib80211_unregister_crypto_ops(&lib80211_crypt_ccmp);
}

module_init(lib80211_crypto_ccmp_init);
module_exit(lib80211_crypto_ccmp_exit);
Commit	Line	Data
21042e41	1	// SPDX-License-Identifier: GPL-2.0-only
b453872c	2	/*
274bfb8d	3	* lib80211 crypt: host-based CCMP encryption implementation for lib80211
b453872c	4	*
85d32e7b	5	* Copyright (c) 2003-2004, Jouni Malinen <j@w1.fi>
274bfb8d	6	* Copyright (c) 2008, John W. Linville <linville@tuxdriver.com>
b453872c JG	7	*/
b453872c JG	8
172589cc	9	#include <linux/kernel.h>
f12cc209	10	#include <linux/err.h>
b453872c JG	11	#include <linux/module.h>
	12	#include <linux/init.h>
	13	#include <linux/slab.h>
	14	#include <linux/random.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/netdevice.h>
	17	#include <linux/if_ether.h>
	18	#include <linux/if_arp.h>
	19	#include <asm/string.h>
	20	#include <linux/wireless.h>
	21
274bfb8d	22	#include <linux/ieee80211.h>
b453872c	23
b453872c	24	#include <linux/crypto.h>
a11e2f85	25	#include <crypto/aead.h>
b453872c	26
274bfb8d JL	27	#include <net/lib80211.h>
274bfb8d JL	28
b453872c JG	29	MODULE_AUTHOR("Jouni Malinen");
	30	MODULE_DESCRIPTION("Host AP crypt: CCMP");
	31	MODULE_LICENSE("GPL");
	32
	33	#define AES_BLOCK_LEN 16
	34	#define CCMP_HDR_LEN 8
	35	#define CCMP_MIC_LEN 8
	36	#define CCMP_TK_LEN 16
	37	#define CCMP_PN_LEN 6
	38
274bfb8d	39	struct lib80211_ccmp_data {
b453872c JG	40	u8 key[CCMP_TK_LEN];
	41	int key_set;
	42
	43	u8 tx_pn[CCMP_PN_LEN];
	44	u8 rx_pn[CCMP_PN_LEN];
	45
	46	u32 dot11RSNAStatsCCMPFormatErrors;
	47	u32 dot11RSNAStatsCCMPReplays;
	48	u32 dot11RSNAStatsCCMPDecryptErrors;
	49
	50	int key_idx;
	51
a11e2f85	52	struct crypto_aead *tfm;
b453872c JG	53
b453872c JG	54	/* scratch buffers for virt_to_page() (crypto API) */
a11e2f85 AB	55	u8 tx_aad[2 * AES_BLOCK_LEN];
a11e2f85 AB	56	u8 rx_aad[2 * AES_BLOCK_LEN];
b453872c JG	57	};
b453872c JG	58
274bfb8d	59	static void *lib80211_ccmp_init(int key_idx)
b453872c	60	{
274bfb8d	61	struct lib80211_ccmp_data *priv;
b453872c	62
0da974f4	63	priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
b453872c JG	64	if (priv == NULL)
b453872c JG	65	goto fail;
b453872c JG	66	priv->key_idx = key_idx;
b453872c JG	67
a11e2f85	68	priv->tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
f12cc209	69	if (IS_ERR(priv->tfm)) {
f12cc209	70	priv->tfm = NULL;
b453872c JG	71	goto fail;
	72	}
	73
	74	return priv;
	75
0edd5b44	76	fail:
b453872c JG	77	if (priv) {
b453872c JG	78	if (priv->tfm)
a11e2f85	79	crypto_free_aead(priv->tfm);
b453872c JG	80	kfree(priv);
	81	}
	82
	83	return NULL;
	84	}
	85
274bfb8d	86	static void lib80211_ccmp_deinit(void *priv)
b453872c	87	{
274bfb8d	88	struct lib80211_ccmp_data *_priv = priv;
b453872c	89	if (_priv && _priv->tfm)
a11e2f85	90	crypto_free_aead(_priv->tfm);
b453872c JG	91	kfree(priv);
	92	}
	93
a11e2f85 AB	94	static int ccmp_init_iv_and_aad(const struct ieee80211_hdr *hdr,
a11e2f85 AB	95	const u8 pn, u8 iv, u8 *aad)
b453872c JG	96	{
	97	u8 *pos, qc = 0;
	98	size_t aad_len;
b453872c	99	int a4_included, qc_included;
b453872c	100
274bfb8d JL	101	a4_included = ieee80211_has_a4(hdr->frame_control);
	102	qc_included = ieee80211_is_data_qos(hdr->frame_control);
	103
b453872c JG	104	aad_len = 22;
	105	if (a4_included)
	106	aad_len += 6;
	107	if (qc_included) {
0edd5b44	108	pos = (u8 *) & hdr->addr4;
b453872c JG	109	if (a4_included)
	110	pos += 6;
	111	qc = *pos & 0x0f;
	112	aad_len += 2;
	113	}
	114
a11e2f85 AB	115	/* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
	116	* mode authentication are not allowed to collide, yet both are derived
	117	* from the same vector. We only set L := 1 here to indicate that the
	118	* data size can be represented in (L+1) bytes. The CCM layer will take
	119	* care of storing the data length in the top (L+1) bytes and setting
	120	* and clearing the other bits as is required to derive the two IVs.
	121	*/
	122	iv[0] = 0x1;
	123
	124	/* Nonce: QC \| A2 \| PN */
	125	iv[1] = qc;
	126	memcpy(iv + 2, hdr->addr2, ETH_ALEN);
	127	memcpy(iv + 8, pn, CCMP_PN_LEN);
b453872c JG	128
	129	/* AAD:
	130	* FC with bits 4..6 and 11..13 masked to zero; 14 is always one
	131	* A1 \| A2 \| A3
	132	* SC with bits 4..15 (seq#) masked to zero
	133	* A4 (if present)
	134	* QC (if present)
	135	*/
	136	pos = (u8 *) hdr;
a11e2f85 AB	137	aad[0] = pos[0] & 0x8f;
a11e2f85 AB	138	aad[1] = pos[1] & 0xc7;
2aec9099	139	memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
274bfb8d	140	pos = (u8 *) & hdr->seq_ctrl;
a11e2f85 AB	141	aad[20] = pos[0] & 0x0f;
	142	aad[21] = 0; /* all bits masked */
	143	memset(aad + 22, 0, 8);
b453872c	144	if (a4_included)
a11e2f85	145	memcpy(aad + 22, hdr->addr4, ETH_ALEN);
b453872c	146	if (qc_included) {
a11e2f85	147	aad[a4_included ? 28 : 22] = qc;
b453872c JG	148	/* rest of QC masked */
b453872c JG	149	}
a11e2f85	150	return aad_len;
b453872c JG	151	}
b453872c JG	152
274bfb8d	153	static int lib80211_ccmp_hdr(struct sk_buff *skb, int hdr_len,
9184d934	154	u8 aeskey, int keylen, void priv)
b453872c	155	{
274bfb8d	156	struct lib80211_ccmp_data *key = priv;
31b59eae JK	157	int i;
31b59eae JK	158	u8 *pos;
b453872c	159
31b59eae	160	if (skb_headroom(skb) < CCMP_HDR_LEN \|\| skb->len < hdr_len)
b453872c JG	161	return -1;
b453872c JG	162
9184d934 ZY	163	if (aeskey != NULL && keylen >= CCMP_TK_LEN)
	164	memcpy(aeskey, key->key, CCMP_TK_LEN);
	165
b453872c JG	166	pos = skb_push(skb, CCMP_HDR_LEN);
	167	memmove(pos, pos + CCMP_HDR_LEN, hdr_len);
	168	pos += hdr_len;
b453872c JG	169
	170	i = CCMP_PN_LEN - 1;
	171	while (i >= 0) {
	172	key->tx_pn[i]++;
	173	if (key->tx_pn[i] != 0)
	174	break;
	175	i--;
	176	}
	177
	178	*pos++ = key->tx_pn[5];
	179	*pos++ = key->tx_pn[4];
	180	*pos++ = 0;
0edd5b44	181	pos++ = (key->key_idx << 6) \| (1 << 5) / Ext IV included */ ;
b453872c JG	182	*pos++ = key->tx_pn[3];
	183	*pos++ = key->tx_pn[2];
	184	*pos++ = key->tx_pn[1];
	185	*pos++ = key->tx_pn[0];
	186
31b59eae JK	187	return CCMP_HDR_LEN;
	188	}
	189
274bfb8d	190	static int lib80211_ccmp_encrypt(struct sk_buff skb, int hdr_len, void priv)
31b59eae	191	{
274bfb8d	192	struct lib80211_ccmp_data *key = priv;
274bfb8d	193	struct ieee80211_hdr *hdr;
a11e2f85 AB	194	struct aead_request *req;
	195	struct scatterlist sg[2];
	196	u8 *aad = key->tx_aad;
	197	u8 iv[AES_BLOCK_LEN];
	198	int len, data_len, aad_len;
	199	int ret;
31b59eae JK	200
	201	if (skb_tailroom(skb) < CCMP_MIC_LEN \|\| skb->len < hdr_len)
	202	return -1;
	203
	204	data_len = skb->len - hdr_len;
274bfb8d	205	len = lib80211_ccmp_hdr(skb, hdr_len, NULL, 0, priv);
31b59eae JK	206	if (len < 0)
	207	return -1;
	208
a11e2f85 AB	209	req = aead_request_alloc(key->tfm, GFP_ATOMIC);
	210	if (!req)
	211	return -ENOMEM;
	212
274bfb8d	213	hdr = (struct ieee80211_hdr *)skb->data;
a11e2f85	214	aad_len = ccmp_init_iv_and_aad(hdr, key->tx_pn, iv, aad);
b453872c	215
a11e2f85	216	skb_put(skb, CCMP_MIC_LEN);
b453872c	217
a11e2f85 AB	218	sg_init_table(sg, 2);
	219	sg_set_buf(&sg[0], aad, aad_len);
	220	sg_set_buf(&sg[1], skb->data + hdr_len + CCMP_HDR_LEN,
	221	data_len + CCMP_MIC_LEN);
	222
	223	aead_request_set_callback(req, 0, NULL, NULL);
	224	aead_request_set_ad(req, aad_len);
	225	aead_request_set_crypt(req, sg, sg, data_len, iv);
	226
	227	ret = crypto_aead_encrypt(req);
	228	aead_request_free(req);
	229
	230	return ret;
b453872c JG	231	}
b453872c JG	232
b4328d87 ZY	233	/*
	234	* deal with seq counter wrapping correctly.
	235	* refer to timer_after() for jiffies wrapping handling
	236	*/
	237	static inline int ccmp_replay_check(u8 pn_n, u8 pn_o)
	238	{
	239	u32 iv32_n, iv16_n;
	240	u32 iv32_o, iv16_o;
	241
	242	iv32_n = (pn_n[0] << 24) \| (pn_n[1] << 16) \| (pn_n[2] << 8) \| pn_n[3];
	243	iv16_n = (pn_n[4] << 8) \| pn_n[5];
	244
	245	iv32_o = (pn_o[0] << 24) \| (pn_o[1] << 16) \| (pn_o[2] << 8) \| pn_o[3];
	246	iv16_o = (pn_o[4] << 8) \| pn_o[5];
	247
	248	if ((s32)iv32_n - (s32)iv32_o < 0 \|\|
	249	(iv32_n == iv32_o && iv16_n <= iv16_o))
	250	return 1;
	251	return 0;
	252	}
	253
274bfb8d	254	static int lib80211_ccmp_decrypt(struct sk_buff skb, int hdr_len, void priv)
b453872c	255	{
274bfb8d	256	struct lib80211_ccmp_data *key = priv;
b453872c	257	u8 keyidx, *pos;
274bfb8d	258	struct ieee80211_hdr *hdr;
a11e2f85 AB	259	struct aead_request *req;
	260	struct scatterlist sg[2];
	261	u8 *aad = key->rx_aad;
	262	u8 iv[AES_BLOCK_LEN];
b453872c	263	u8 pn[6];
a11e2f85 AB	264	int aad_len, ret;
a11e2f85 AB	265	size_t data_len = skb->len - hdr_len - CCMP_HDR_LEN;
b453872c JG	266
	267	if (skb->len < hdr_len + CCMP_HDR_LEN + CCMP_MIC_LEN) {
	268	key->dot11RSNAStatsCCMPFormatErrors++;
	269	return -1;
	270	}
	271
274bfb8d	272	hdr = (struct ieee80211_hdr *)skb->data;
b453872c JG	273	pos = skb->data + hdr_len;
	274	keyidx = pos[3];
	275	if (!(keyidx & (1 << 5))) {
e87cc472 JP	276	net_dbg_ratelimited("CCMP: received packet without ExtIV flag from %pM\n",
e87cc472 JP	277	hdr->addr2);
b453872c JG	278	key->dot11RSNAStatsCCMPFormatErrors++;
	279	return -2;
	280	}
	281	keyidx >>= 6;
	282	if (key->key_idx != keyidx) {
996bf99c JB	283	net_dbg_ratelimited("CCMP: RX tkey->key_idx=%d frame keyidx=%d\n",
996bf99c JB	284	key->key_idx, keyidx);
b453872c JG	285	return -6;
	286	}
	287	if (!key->key_set) {
e87cc472 JP	288	net_dbg_ratelimited("CCMP: received packet from %pM with keyid=%d that does not have a configured key\n",
e87cc472 JP	289	hdr->addr2, keyidx);
b453872c JG	290	return -3;
	291	}
	292
	293	pn[0] = pos[7];
	294	pn[1] = pos[6];
	295	pn[2] = pos[5];
	296	pn[3] = pos[4];
	297	pn[4] = pos[1];
	298	pn[5] = pos[0];
	299	pos += 8;
	300
b4328d87	301	if (ccmp_replay_check(pn, key->rx_pn)) {
6f16bf3b	302	#ifdef CONFIG_LIB80211_DEBUG
e87cc472 JP	303	net_dbg_ratelimited("CCMP: replay detected: STA=%pM previous PN %02x%02x%02x%02x%02x%02x received PN %02x%02x%02x%02x%02x%02x\n",
	304	hdr->addr2,
	305	key->rx_pn[0], key->rx_pn[1], key->rx_pn[2],
	306	key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
	307	pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
6f16bf3b	308	#endif
b453872c JG	309	key->dot11RSNAStatsCCMPReplays++;
	310	return -4;
	311	}
	312
a11e2f85 AB	313	req = aead_request_alloc(key->tfm, GFP_ATOMIC);
	314	if (!req)
	315	return -ENOMEM;
b453872c	316
a11e2f85 AB	317	aad_len = ccmp_init_iv_and_aad(hdr, pn, iv, aad);
	318
	319	sg_init_table(sg, 2);
	320	sg_set_buf(&sg[0], aad, aad_len);
	321	sg_set_buf(&sg[1], pos, data_len);
	322
	323	aead_request_set_callback(req, 0, NULL, NULL);
	324	aead_request_set_ad(req, aad_len);
	325	aead_request_set_crypt(req, sg, sg, data_len, iv);
	326
	327	ret = crypto_aead_decrypt(req);
	328	aead_request_free(req);
	329
	330	if (ret) {
	331	net_dbg_ratelimited("CCMP: decrypt failed: STA=%pM (%d)\n",
	332	hdr->addr2, ret);
b453872c JG	333	key->dot11RSNAStatsCCMPDecryptErrors++;
	334	return -5;
	335	}
	336
	337	memcpy(key->rx_pn, pn, CCMP_PN_LEN);
	338
	339	/* Remove hdr and MIC */
	340	memmove(skb->data + CCMP_HDR_LEN, skb->data, hdr_len);
	341	skb_pull(skb, CCMP_HDR_LEN);
	342	skb_trim(skb, skb->len - CCMP_MIC_LEN);
	343
	344	return keyidx;
	345	}
	346
274bfb8d	347	static int lib80211_ccmp_set_key(void key, int len, u8 seq, void *priv)
b453872c	348	{
274bfb8d	349	struct lib80211_ccmp_data *data = priv;
b453872c	350	int keyidx;
a11e2f85	351	struct crypto_aead *tfm = data->tfm;
b453872c JG	352
	353	keyidx = data->key_idx;
	354	memset(data, 0, sizeof(*data));
	355	data->key_idx = keyidx;
	356	data->tfm = tfm;
	357	if (len == CCMP_TK_LEN) {
	358	memcpy(data->key, key, CCMP_TK_LEN);
	359	data->key_set = 1;
	360	if (seq) {
	361	data->rx_pn[0] = seq[5];
	362	data->rx_pn[1] = seq[4];
	363	data->rx_pn[2] = seq[3];
	364	data->rx_pn[3] = seq[2];
	365	data->rx_pn[4] = seq[1];
	366	data->rx_pn[5] = seq[0];
	367	}
a11e2f85 AB	368	if (crypto_aead_setauthsize(data->tfm, CCMP_MIC_LEN) \|\|
	369	crypto_aead_setkey(data->tfm, data->key, CCMP_TK_LEN))
	370	return -1;
b453872c JG	371	} else if (len == 0)
	372	data->key_set = 0;
	373	else
	374	return -1;
	375
	376	return 0;
	377	}
	378
274bfb8d	379	static int lib80211_ccmp_get_key(void key, int len, u8 seq, void *priv)
b453872c	380	{
274bfb8d	381	struct lib80211_ccmp_data *data = priv;
b453872c JG	382
	383	if (len < CCMP_TK_LEN)
	384	return -1;
	385
	386	if (!data->key_set)
	387	return 0;
	388	memcpy(key, data->key, CCMP_TK_LEN);
	389
	390	if (seq) {
	391	seq[0] = data->tx_pn[5];
	392	seq[1] = data->tx_pn[4];
	393	seq[2] = data->tx_pn[3];
	394	seq[3] = data->tx_pn[2];
	395	seq[4] = data->tx_pn[1];
	396	seq[5] = data->tx_pn[0];
	397	}
	398
	399	return CCMP_TK_LEN;
	400	}
	401
6bbefe86	402	static void lib80211_ccmp_print_stats(struct seq_file m, void priv)
b453872c	403	{
274bfb8d	404	struct lib80211_ccmp_data *ccmp = priv;
0795af57	405
6bbefe86 DH	406	seq_printf(m,
	407	"key[%d] alg=CCMP key_set=%d "
	408	"tx_pn=%02x%02x%02x%02x%02x%02x "
	409	"rx_pn=%02x%02x%02x%02x%02x%02x "
	410	"format_errors=%d replays=%d decrypt_errors=%d\n",
	411	ccmp->key_idx, ccmp->key_set,
	412	ccmp->tx_pn[0], ccmp->tx_pn[1], ccmp->tx_pn[2],
	413	ccmp->tx_pn[3], ccmp->tx_pn[4], ccmp->tx_pn[5],
	414	ccmp->rx_pn[0], ccmp->rx_pn[1], ccmp->rx_pn[2],
	415	ccmp->rx_pn[3], ccmp->rx_pn[4], ccmp->rx_pn[5],
	416	ccmp->dot11RSNAStatsCCMPFormatErrors,
	417	ccmp->dot11RSNAStatsCCMPReplays,
	418	ccmp->dot11RSNAStatsCCMPDecryptErrors);
b453872c JG	419	}
b453872c JG	420
274bfb8d	421	static struct lib80211_crypto_ops lib80211_crypt_ccmp = {
74079fdc	422	.name = "CCMP",
274bfb8d JL	423	.init = lib80211_ccmp_init,
274bfb8d JL	424	.deinit = lib80211_ccmp_deinit,
274bfb8d JL	425	.encrypt_mpdu = lib80211_ccmp_encrypt,
274bfb8d JL	426	.decrypt_mpdu = lib80211_ccmp_decrypt,
74079fdc JK	427	.encrypt_msdu = NULL,
74079fdc JK	428	.decrypt_msdu = NULL,
274bfb8d JL	429	.set_key = lib80211_ccmp_set_key,
	430	.get_key = lib80211_ccmp_get_key,
	431	.print_stats = lib80211_ccmp_print_stats,
1264fc04 JK	432	.extra_mpdu_prefix_len = CCMP_HDR_LEN,
1264fc04 JK	433	.extra_mpdu_postfix_len = CCMP_MIC_LEN,
74079fdc	434	.owner = THIS_MODULE,
b453872c JG	435	};
b453872c JG	436
274bfb8d	437	static int __init lib80211_crypto_ccmp_init(void)
b453872c	438	{
274bfb8d	439	return lib80211_register_crypto_ops(&lib80211_crypt_ccmp);
b453872c JG	440	}
b453872c JG	441
274bfb8d	442	static void __exit lib80211_crypto_ccmp_exit(void)
b453872c	443	{
274bfb8d	444	lib80211_unregister_crypto_ops(&lib80211_crypt_ccmp);
b453872c JG	445	}
b453872c JG	446
274bfb8d JL	447	module_init(lib80211_crypto_ccmp_init);
274bfb8d JL	448	module_exit(lib80211_crypto_ccmp_exit);