Annotation of sys/net80211/ieee80211_crypto.c, Revision 1.1.1.1
1.1 nbrk 1: /* $OpenBSD: ieee80211_crypto.c,v 1.31 2007/08/03 16:51:06 damien Exp $ */
2: /* $NetBSD: ieee80211_crypto.c,v 1.5 2003/12/14 09:56:53 dyoung Exp $ */
3:
4: /*-
5: * Copyright (c) 2001 Atsushi Onoe
6: * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7: * Copyright (c) 2007 Damien Bergamini
8: * All rights reserved.
9: *
10: * Redistribution and use in source and binary forms, with or without
11: * modification, are permitted provided that the following conditions
12: * are met:
13: * 1. Redistributions of source code must retain the above copyright
14: * notice, this list of conditions and the following disclaimer.
15: * 2. Redistributions in binary form must reproduce the above copyright
16: * notice, this list of conditions and the following disclaimer in the
17: * documentation and/or other materials provided with the distribution.
18: * 3. The name of the author may not be used to endorse or promote products
19: * derived from this software without specific prior written permission.
20: *
21: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31: */
32:
33: #include "bpfilter.h"
34:
35: #include <sys/param.h>
36: #include <sys/systm.h>
37: #include <sys/mbuf.h>
38: #include <sys/malloc.h>
39: #include <sys/kernel.h>
40: #include <sys/socket.h>
41: #include <sys/sockio.h>
42: #include <sys/endian.h>
43: #include <sys/errno.h>
44: #include <sys/proc.h>
45: #include <sys/sysctl.h>
46:
47: #include <net/if.h>
48: #include <net/if_dl.h>
49: #include <net/if_media.h>
50: #include <net/if_arp.h>
51: #include <net/if_llc.h>
52:
53: #if NBPFILTER > 0
54: #include <net/bpf.h>
55: #endif
56:
57: #ifdef INET
58: #include <netinet/in.h>
59: #include <netinet/if_ether.h>
60: #endif
61:
62: #include <net80211/ieee80211_var.h>
63:
64: #include <dev/rndvar.h>
65: #include <crypto/arc4.h>
66: #include <crypto/md5.h>
67: #include <crypto/sha1.h>
68: #include <crypto/rijndael.h>
69:
70: struct vector {
71: const void *base;
72: size_t len;
73: };
74:
75: void ieee80211_crc_init(void);
76: u_int32_t ieee80211_crc_update(u_int32_t, const u_int8_t *, int);
77: struct mbuf *ieee80211_ccmp_encrypt(struct ieee80211com *, struct mbuf *,
78: struct ieee80211_key *);
79: struct mbuf *ieee80211_ccmp_decrypt(struct ieee80211com *, struct mbuf *,
80: struct ieee80211_key *);
81: struct mbuf *ieee80211_tkip_encrypt(struct ieee80211com *, struct mbuf *,
82: struct ieee80211_key *);
83: struct mbuf *ieee80211_tkip_decrypt(struct ieee80211com *, struct mbuf *,
84: struct ieee80211_key *);
85: void ieee80211_aes_key_wrap(const u_int8_t *, size_t, const u_int8_t *,
86: size_t, u_int8_t *);
87: int ieee80211_aes_key_unwrap(const u_int8_t *, size_t, const u_int8_t *,
88: u_int8_t *, size_t);
89: void ieee80211_hmac_md5_v(const struct vector *, int, const u_int8_t *,
90: size_t, u_int8_t digest[]);
91: void ieee80211_hmac_md5(const u_int8_t *, size_t, const u_int8_t *, size_t,
92: u_int8_t digest[]);
93: void ieee80211_hmac_sha1_v(const struct vector *, int, const u_int8_t *,
94: size_t, u_int8_t digest[]);
95: void ieee80211_hmac_sha1(const u_int8_t *, size_t, const u_int8_t *, size_t,
96: u_int8_t digest[]);
97: void ieee80211_prf(const u_int8_t *, size_t, struct vector *, int,
98: u_int8_t *, size_t);
99: void ieee80211_derive_pmkid(const u_int8_t *, size_t, const u_int8_t *,
100: const u_int8_t *, u_int8_t *);
101: void ieee80211_derive_gtk(const u_int8_t *, size_t, const u_int8_t *,
102: const u_int8_t *, u_int8_t *, size_t);
103:
104: void
105: ieee80211_crypto_attach(struct ifnet *ifp)
106: {
107: struct ieee80211com *ic = (void *)ifp;
108:
109: ieee80211_crc_init();
110:
111: /* initialize 256-bit global key counter to a random value */
112: get_random_bytes(ic->ic_globalcnt, EAPOL_KEY_NONCE_LEN);
113: }
114:
115: void
116: ieee80211_crypto_detach(struct ifnet *ifp)
117: {
118: struct ieee80211com *ic = (void *)ifp;
119:
120: if (ic->ic_wep_ctx != NULL) {
121: free(ic->ic_wep_ctx, M_DEVBUF);
122: ic->ic_wep_ctx = NULL;
123: }
124: }
125:
126: struct mbuf *
127: ieee80211_encrypt(struct ieee80211com *ic, struct mbuf *m0,
128: struct ieee80211_node *ni)
129: {
130: struct ieee80211_frame *wh;
131: struct ieee80211_key *k;
132:
133: /* select the key for encryption */
134: wh = mtod(m0, struct ieee80211_frame *);
135: if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
136: ni->ni_pairwise_cipher == IEEE80211_CIPHER_USEGROUP)
137: k = &ic->ic_nw_keys[ic->ic_wep_txkey];
138: else
139: k = &ni->ni_pairwise_key;
140:
141: switch (k->k_cipher) {
142: case IEEE80211_CIPHER_WEP40:
143: case IEEE80211_CIPHER_WEP104:
144: m0 = ieee80211_wep_crypt(&ic->ic_if, m0, 1);
145: break;
146: case IEEE80211_CIPHER_TKIP:
147: m0 = ieee80211_tkip_encrypt(ic, m0, k);
148: break;
149: case IEEE80211_CIPHER_CCMP:
150: m0 = ieee80211_ccmp_encrypt(ic, m0, k);
151: break;
152: default:
153: /* should not get there */
154: m_freem(m0);
155: m0 = NULL;
156: }
157: return m0;
158: }
159:
160: struct mbuf *
161: ieee80211_decrypt(struct ieee80211com *ic, struct mbuf *m0,
162: struct ieee80211_node *ni)
163: {
164: struct ieee80211_frame *wh;
165: struct ieee80211_key *k;
166:
167: /* select the key for decryption */
168: wh = mtod(m0, struct ieee80211_frame *);
169: if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
170: ni->ni_pairwise_cipher == IEEE80211_CIPHER_USEGROUP) {
171: size_t hdrlen = sizeof(*wh); /* XXX QoS */
172: u_int8_t *ivp = (u_int8_t *)wh + hdrlen;
173: /* key identifier is always located at the same index */
174: int kid = ivp[IEEE80211_WEP_IVLEN] >> 6;
175: k = &ic->ic_nw_keys[kid];
176: } else
177: k = &ni->ni_pairwise_key;
178:
179: switch (k->k_cipher) {
180: case IEEE80211_CIPHER_WEP40:
181: case IEEE80211_CIPHER_WEP104:
182: m0 = ieee80211_wep_crypt(&ic->ic_if, m0, 0);
183: break;
184: case IEEE80211_CIPHER_TKIP:
185: m0 = ieee80211_tkip_decrypt(ic, m0, k);
186: break;
187: case IEEE80211_CIPHER_CCMP:
188: m0 = ieee80211_ccmp_decrypt(ic, m0, k);
189: break;
190: default:
191: /* should not get there */
192: m_freem(m0);
193: m0 = NULL;
194: }
195: return m0;
196: }
197:
198: #define IEEE80211_CCMP_HDRLEN 8
199: #define IEEE80211_CCMP_MICLEN 8
200:
201: struct mbuf *
202: ieee80211_ccmp_encrypt(struct ieee80211com *ic, struct mbuf *m0,
203: struct ieee80211_key *k)
204: {
205: struct ieee80211_frame *wh;
206: size_t hdrlen = sizeof(*wh); /* XXX QoS */
207: u_int8_t *ivp;
208:
209: M_PREPEND(m0, IEEE80211_CCMP_HDRLEN, M_NOWAIT);
210: if (m0 == NULL)
211: return m0;
212: wh = mtod(m0, struct ieee80211_frame *);
213: ovbcopy(mtod(m0, u_int8_t *) + IEEE80211_CCMP_HDRLEN, wh, hdrlen);
214: ivp = (u_int8_t *)wh + hdrlen;
215:
216: k->k_tsc++; /* increment the 48-bit PN */
217: ivp[0] = k->k_tsc; /* PN0 */
218: ivp[1] = k->k_tsc >> 8; /* PN1 */
219: ivp[2] = 0; /* Rsvd */
220: ivp[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV; /* KeyID | ExtIV */
221: ivp[4] = k->k_tsc >> 16; /* PN2 */
222: ivp[5] = k->k_tsc >> 24; /* PN3 */
223: ivp[6] = k->k_tsc >> 32; /* PN4 */
224: ivp[7] = k->k_tsc >> 40; /* PN5 */
225:
226: /* XXX encrypt payload if HW encryption not supported */
227:
228: return m0;
229: }
230:
231: struct mbuf *
232: ieee80211_ccmp_decrypt(struct ieee80211com *ic, struct mbuf *m0,
233: struct ieee80211_key *k)
234: {
235: struct ieee80211_frame *wh;
236: size_t hdrlen = sizeof(*wh); /* XXX QoS */
237: u_int64_t pn;
238: u_int8_t *ivp;
239:
240: wh = mtod(m0, struct ieee80211_frame *);
241: ivp = (u_int8_t *)wh + hdrlen;
242:
243: /* check that ExtIV bit is be set */
244: if (!(ivp[3] & IEEE80211_WEP_EXTIV)) {
245: m_freem(m0);
246: return NULL;
247: }
248: /* extract the 48-bit PN from the CCMP header */
249: pn = (u_int64_t)ivp[0] |
250: (u_int64_t)ivp[1] << 8 |
251: (u_int64_t)ivp[4] << 16 |
252: (u_int64_t)ivp[5] << 24 |
253: (u_int64_t)ivp[6] << 32 |
254: (u_int64_t)ivp[7] << 40;
255: /* NB: the keys are refreshed, we'll never overflow the 48 bits */
256: if (pn <= k->k_rsc) {
257: /* replayed frame, discard */
258: /* XXX statistics */
259: m_freem(m0);
260: return NULL;
261: }
262:
263: /* XXX decrypt payload if HW encryption not supported */
264:
265: ovbcopy(mtod(m0, u_int8_t *),
266: mtod(m0, u_int8_t *) + IEEE80211_CCMP_HDRLEN, hdrlen);
267: m_adj(m0, IEEE80211_CCMP_HDRLEN);
268: m_adj(m0, -IEEE80211_CCMP_MICLEN);
269:
270: /* update last seen packet number */
271: k->k_rsc = pn;
272:
273: return m0;
274: }
275:
276: #define IEEE80211_TKIP_HDRLEN 8
277: #define IEEE80211_TKIP_MICLEN 8
278: #define IEEE80211_TKIP_ICVLEN 4
279:
280: struct mbuf *
281: ieee80211_tkip_encrypt(struct ieee80211com *ic, struct mbuf *m0,
282: struct ieee80211_key *k)
283: {
284: struct ieee80211_frame *wh;
285: size_t hdrlen = sizeof(*wh); /* XXX QoS */
286: u_int8_t *ivp;
287:
288: M_PREPEND(m0, IEEE80211_TKIP_HDRLEN, M_NOWAIT);
289: if (m0 == NULL)
290: return m0;
291: wh = mtod(m0, struct ieee80211_frame *);
292: ovbcopy(mtod(m0, u_int8_t *) + IEEE80211_TKIP_HDRLEN, wh, hdrlen);
293: ivp = (u_int8_t *)wh + hdrlen;
294:
295: ivp[0] = k->k_tsc >> 8; /* TSC1 */
296: /* WEP Seed = (TSC1 | 0x20) & 0x7f (see 8.3.2.2) */
297: ivp[1] = (ivp[0] | 0x20) & 0x7f;
298: ivp[2] = k->k_tsc; /* TSC0 */
299: ivp[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV; /* KeyID | ExtIV */
300: ivp[4] = k->k_tsc >> 16; /* TSC2 */
301: ivp[5] = k->k_tsc >> 24; /* TSC3 */
302: ivp[6] = k->k_tsc >> 32; /* TSC4 */
303: ivp[7] = k->k_tsc >> 40; /* TSC5 */
304:
305: /* XXX encrypt payload if HW encryption not supported */
306:
307: k->k_tsc++; /* increment the 48-bit TSC */
308:
309: return m0;
310: }
311:
312: struct mbuf *
313: ieee80211_tkip_decrypt(struct ieee80211com *ic, struct mbuf *m0,
314: struct ieee80211_key *k)
315: {
316: struct ieee80211_frame *wh;
317: size_t hdrlen = sizeof(*wh); /* XXX QoS */
318: u_int64_t tsc;
319: u_int8_t *ivp;
320:
321: wh = mtod(m0, struct ieee80211_frame *);
322: ivp = (u_int8_t *)wh + hdrlen;
323:
324: /* check that ExtIV bit is be set */
325: if (!(ivp[3] & IEEE80211_WEP_EXTIV)) {
326: m_freem(m0);
327: return NULL;
328: }
329: /* extract the 48-bit TSC from the TKIP header */
330: tsc = (u_int64_t)ivp[2] |
331: (u_int64_t)ivp[0] << 8 |
332: (u_int64_t)ivp[4] << 16 |
333: (u_int64_t)ivp[5] << 24 |
334: (u_int64_t)ivp[6] << 32 |
335: (u_int64_t)ivp[7] << 40;
336: /* NB: the keys are refreshed, we'll never overflow the 48 bits */
337: if (tsc <= k->k_rsc) {
338: /* replayed frame, discard */
339: /* XXX statistics */
340: m_freem(m0);
341: return NULL;
342: }
343:
344: /* XXX decrypt payload if HW encryption not supported */
345:
346: ovbcopy(mtod(m0, u_int8_t *),
347: mtod(m0, u_int8_t *) + IEEE80211_TKIP_HDRLEN, hdrlen);
348: m_adj(m0, IEEE80211_TKIP_HDRLEN);
349: m_adj(m0, -IEEE80211_TKIP_ICVLEN);
350:
351: /* update last seen packet number */
352: k->k_rsc = tsc;
353:
354: return m0;
355: }
356:
357: /* Round up to a multiple of IEEE80211_WEP_KEYLEN + IEEE80211_WEP_IVLEN */
358: #define klen_round(x) \
359: (((x) + (IEEE80211_WEP_KEYLEN + IEEE80211_WEP_IVLEN - 1)) & \
360: ~(IEEE80211_WEP_KEYLEN + IEEE80211_WEP_IVLEN - 1))
361:
362: struct mbuf *
363: ieee80211_wep_crypt(struct ifnet *ifp, struct mbuf *m0, int txflag)
364: {
365: struct ieee80211com *ic = (void *)ifp;
366: struct mbuf *m, *n, *n0;
367: struct ieee80211_frame *wh;
368: int i, left, len, moff, noff, kid;
369: u_int32_t iv, crc;
370: u_int8_t *ivp;
371: void *ctx;
372: u_int8_t keybuf[klen_round(IEEE80211_WEP_IVLEN + IEEE80211_KEYBUF_SIZE)];
373: u_int8_t crcbuf[IEEE80211_WEP_CRCLEN];
374:
375: n0 = NULL;
376: if ((ctx = ic->ic_wep_ctx) == NULL) {
377: ctx = malloc(sizeof(struct rc4_ctx), M_DEVBUF, M_NOWAIT);
378: if (ctx == NULL) {
379: ic->ic_stats.is_crypto_nomem++;
380: goto fail;
381: }
382: ic->ic_wep_ctx = ctx;
383: }
384: m = m0;
385: left = m->m_pkthdr.len;
386: MGET(n, M_DONTWAIT, m->m_type);
387: n0 = n;
388: if (n == NULL) {
389: if (txflag)
390: ic->ic_stats.is_tx_nombuf++;
391: else
392: ic->ic_stats.is_rx_nombuf++;
393: goto fail;
394: }
395: M_DUP_PKTHDR(n, m);
396: len = IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN + IEEE80211_WEP_CRCLEN;
397: if (txflag) {
398: n->m_pkthdr.len += len;
399: } else {
400: n->m_pkthdr.len -= len;
401: left -= len;
402: }
403: n->m_len = MHLEN;
404: if (n->m_pkthdr.len >= MINCLSIZE) {
405: MCLGET(n, M_DONTWAIT);
406: if (n->m_flags & M_EXT)
407: n->m_len = n->m_ext.ext_size;
408: }
409: wh = mtod(m, struct ieee80211_frame *);
410: if ((wh->i_fc[0] &
411: (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
412: (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS))
413: len = sizeof(struct ieee80211_qosframe);
414: else
415: len = sizeof(struct ieee80211_frame);
416: memcpy(mtod(n, caddr_t), wh, len);
417: wh = mtod(n, struct ieee80211_frame *);
418: left -= len;
419: moff = len;
420: noff = len;
421: if (txflag) {
422: kid = ic->ic_wep_txkey;
423: wh->i_fc[1] |= IEEE80211_FC1_WEP;
424: iv = ic->ic_iv ? ic->ic_iv : arc4random();
425: /*
426: * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
427: * (B, 255, N) with 3 <= B < 8
428: */
429: if (iv >= 0x03ff00 &&
430: (iv & 0xf8ff00) == 0x00ff00)
431: iv += 0x000100;
432: ic->ic_iv = iv + 1;
433: /* put iv in little endian to prepare 802.11i */
434: ivp = mtod(n, u_int8_t *) + noff;
435: for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
436: ivp[i] = iv & 0xff;
437: iv >>= 8;
438: }
439: ivp[IEEE80211_WEP_IVLEN] = kid << 6; /* pad and keyid */
440: noff += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
441: } else {
442: wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
443: ivp = mtod(m, u_int8_t *) + moff;
444: kid = ivp[IEEE80211_WEP_IVLEN] >> 6;
445: moff += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
446: }
447:
448: /*
449: * Copy the IV and the key material. The input key has been padded
450: * with zeros by the ioctl. The output key buffer length is rounded
451: * to a multiple of 64bit to allow variable length keys padded by
452: * zeros.
453: */
454: bzero(&keybuf, sizeof(keybuf));
455: memcpy(keybuf, ivp, IEEE80211_WEP_IVLEN);
456: memcpy(keybuf + IEEE80211_WEP_IVLEN, ic->ic_nw_keys[kid].k_key,
457: ic->ic_nw_keys[kid].k_len);
458: len = klen_round(IEEE80211_WEP_IVLEN + ic->ic_nw_keys[kid].k_len);
459: rc4_keysetup(ctx, keybuf, len);
460:
461: /* encrypt with calculating CRC */
462: crc = ~0;
463: while (left > 0) {
464: len = m->m_len - moff;
465: if (len == 0) {
466: m = m->m_next;
467: moff = 0;
468: continue;
469: }
470: if (len > n->m_len - noff) {
471: len = n->m_len - noff;
472: if (len == 0) {
473: MGET(n->m_next, M_DONTWAIT, n->m_type);
474: if (n->m_next == NULL) {
475: if (txflag)
476: ic->ic_stats.is_tx_nombuf++;
477: else
478: ic->ic_stats.is_rx_nombuf++;
479: goto fail;
480: }
481: n = n->m_next;
482: n->m_len = MLEN;
483: if (left >= MINCLSIZE) {
484: MCLGET(n, M_DONTWAIT);
485: if (n->m_flags & M_EXT)
486: n->m_len = n->m_ext.ext_size;
487: }
488: noff = 0;
489: continue;
490: }
491: }
492: if (len > left)
493: len = left;
494: rc4_crypt(ctx, mtod(m, caddr_t) + moff,
495: mtod(n, caddr_t) + noff, len);
496: if (txflag)
497: crc = ieee80211_crc_update(crc,
498: mtod(m, u_int8_t *) + moff, len);
499: else
500: crc = ieee80211_crc_update(crc,
501: mtod(n, u_int8_t *) + noff, len);
502: left -= len;
503: moff += len;
504: noff += len;
505: }
506: crc = ~crc;
507: if (txflag) {
508: *(u_int32_t *)crcbuf = htole32(crc);
509: if (n->m_len >= noff + sizeof(crcbuf))
510: n->m_len = noff + sizeof(crcbuf);
511: else {
512: n->m_len = noff;
513: MGET(n->m_next, M_DONTWAIT, n->m_type);
514: if (n->m_next == NULL) {
515: ic->ic_stats.is_tx_nombuf++;
516: goto fail;
517: }
518: n = n->m_next;
519: n->m_len = sizeof(crcbuf);
520: noff = 0;
521: }
522: rc4_crypt(ctx, crcbuf, mtod(n, caddr_t) + noff,
523: sizeof(crcbuf));
524: } else {
525: n->m_len = noff;
526: for (noff = 0; noff < sizeof(crcbuf); noff += len) {
527: len = sizeof(crcbuf) - noff;
528: if (len > m->m_len - moff)
529: len = m->m_len - moff;
530: if (len > 0)
531: rc4_crypt(ctx, mtod(m, caddr_t) + moff,
532: crcbuf + noff, len);
533: m = m->m_next;
534: moff = 0;
535: }
536: if (crc != letoh32(*(u_int32_t *)crcbuf)) {
537: #ifdef IEEE80211_DEBUG
538: if (ieee80211_debug) {
539: printf("%s: decrypt CRC error\n",
540: ifp->if_xname);
541: if (ieee80211_debug > 1)
542: ieee80211_dump_pkt(n0->m_data,
543: n0->m_len, -1, -1);
544: }
545: #endif
546: ic->ic_stats.is_rx_decryptcrc++;
547: goto fail;
548: }
549: }
550: m_freem(m0);
551: return n0;
552:
553: fail:
554: m_freem(m0);
555: m_freem(n0);
556: return NULL;
557: }
558:
559: /*
560: * CRC 32 -- routine from RFC 2083
561: */
562:
563: /* Table of CRCs of all 8-bit messages */
564: static u_int32_t ieee80211_crc_table[256];
565:
566: /* Make the table for a fast CRC. */
567: void
568: ieee80211_crc_init(void)
569: {
570: u_int32_t c;
571: int n, k;
572:
573: for (n = 0; n < 256; n++) {
574: c = (u_int32_t)n;
575: for (k = 0; k < 8; k++) {
576: if (c & 1)
577: c = 0xedb88320UL ^ (c >> 1);
578: else
579: c = c >> 1;
580: }
581: ieee80211_crc_table[n] = c;
582: }
583: }
584:
585: /*
586: * Update a running CRC with the bytes buf[0..len-1]--the CRC
587: * should be initialized to all 1's, and the transmitted value
588: * is the 1's complement of the final running CRC
589: */
590: u_int32_t
591: ieee80211_crc_update(u_int32_t crc, const u_int8_t *buf, int len)
592: {
593: const u_int8_t *endbuf;
594:
595: for (endbuf = buf + len; buf < endbuf; buf++)
596: crc = ieee80211_crc_table[(crc ^ *buf) & 0xff] ^ (crc >> 8);
597: return crc;
598: }
599:
600: /*
601: * AES Key Wrap Algorithm (see RFC 3394).
602: */
603: static const u_int8_t aes_key_wrap_iv[8] =
604: { 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6 };
605:
606: void
607: ieee80211_aes_key_wrap(const u_int8_t *kek, size_t kek_len, const u_int8_t *pt,
608: size_t len, u_int8_t *ct)
609: {
610: rijndael_ctx ctx;
611: u_int8_t *a, *r, ar[16];
612: u_int64_t t, b[2];
613: size_t i;
614: int j;
615:
616: /* allow ciphertext and plaintext to overlap (ct == pt) */
617: ovbcopy(pt, ct + 8, len * 8);
618: a = ct;
619: memcpy(a, aes_key_wrap_iv, 8); /* default IV */
620:
621: rijndael_set_key_enc_only(&ctx, (u_int8_t *)kek, kek_len * 8);
622:
623: for (j = 0, t = 1; j < 6; j++) {
624: r = ct + 8;
625: for (i = 0; i < len; i++, t++) {
626: memcpy(ar, a, 8);
627: memcpy(ar + 8, r, 8);
628: rijndael_encrypt(&ctx, ar, (u_int8_t *)b);
629: b[0] ^= htobe64(t);
630: memcpy(a, &b[0], 8);
631: memcpy(r, &b[1], 8);
632:
633: r += 8;
634: }
635: }
636: }
637:
638: int
639: ieee80211_aes_key_unwrap(const u_int8_t *kek, size_t kek_len,
640: const u_int8_t *ct, u_int8_t *pt, size_t len)
641: {
642: rijndael_ctx ctx;
643: u_int8_t a[8], *r, b[16];
644: u_int64_t t, ar[2];
645: size_t i;
646: int j;
647:
648: memcpy(a, ct, 8);
649: /* allow ciphertext and plaintext to overlap (ct == pt) */
650: ovbcopy(ct + 8, pt, len * 8);
651:
652: rijndael_set_key(&ctx, (u_int8_t *)kek, kek_len * 8);
653:
654: for (j = 0, t = 6 * len; j < 6; j++) {
655: r = pt + (len - 1) * 8;
656: for (i = 0; i < len; i++, t--) {
657: memcpy(&ar[0], a, 8);
658: ar[0] ^= htobe64(t);
659: memcpy(&ar[1], r, 8);
660: rijndael_decrypt(&ctx, (u_int8_t *)ar, b);
661: memcpy(a, b, 8);
662: memcpy(r, b + 8, 8);
663:
664: r -= 8;
665: }
666: }
667: return memcmp(a, aes_key_wrap_iv, 8) != 0;
668: }
669:
670: void
671: ieee80211_hmac_md5_v(const struct vector *vec, int vcnt, const u_int8_t *key,
672: size_t key_len, u_int8_t digest[MD5_DIGEST_LENGTH])
673: {
674: MD5_CTX ctx;
675: u_int8_t k_pad[MD5_BLOCK_LENGTH];
676: u_int8_t tk[MD5_DIGEST_LENGTH];
677: int i;
678:
679: if (key_len > MD5_BLOCK_LENGTH) {
680: MD5Init(&ctx);
681: MD5Update(&ctx, (u_int8_t *)key, key_len);
682: MD5Final(tk, &ctx);
683:
684: key = tk;
685: key_len = MD5_DIGEST_LENGTH;
686: }
687:
688: bzero(k_pad, sizeof k_pad);
689: bcopy(key, k_pad, key_len);
690: for (i = 0; i < MD5_BLOCK_LENGTH; i++)
691: k_pad[i] ^= 0x36;
692:
693: MD5Init(&ctx);
694: MD5Update(&ctx, k_pad, MD5_BLOCK_LENGTH);
695: for (i = 0; i < vcnt; i++)
696: MD5Update(&ctx, (u_int8_t *)vec[i].base, vec[i].len);
697: MD5Final(digest, &ctx);
698:
699: bzero(k_pad, sizeof k_pad);
700: bcopy(key, k_pad, key_len);
701: for (i = 0; i < MD5_BLOCK_LENGTH; i++)
702: k_pad[i] ^= 0x5c;
703:
704: MD5Init(&ctx);
705: MD5Update(&ctx, k_pad, MD5_BLOCK_LENGTH);
706: MD5Update(&ctx, digest, MD5_DIGEST_LENGTH);
707: MD5Final(digest, &ctx);
708: }
709:
710: void
711: ieee80211_hmac_md5(const u_int8_t *text, size_t text_len, const u_int8_t *key,
712: size_t key_len, u_int8_t digest[MD5_DIGEST_LENGTH])
713: {
714: struct vector vec;
715: vec.base = text;
716: vec.len = text_len;
717: ieee80211_hmac_md5_v(&vec, 1, key, key_len, digest);
718: }
719:
720: void
721: ieee80211_hmac_sha1_v(const struct vector *vec, int vcnt, const u_int8_t *key,
722: size_t key_len, u_int8_t digest[SHA1_DIGEST_LENGTH])
723: {
724: SHA1_CTX ctx;
725: u_int8_t k_pad[SHA1_BLOCK_LENGTH];
726: u_int8_t tk[SHA1_DIGEST_LENGTH];
727: int i;
728:
729: if (key_len > SHA1_BLOCK_LENGTH) {
730: SHA1Init(&ctx);
731: SHA1Update(&ctx, (u_int8_t *)key, key_len);
732: SHA1Final(tk, &ctx);
733:
734: key = tk;
735: key_len = SHA1_DIGEST_LENGTH;
736: }
737:
738: bzero(k_pad, sizeof k_pad);
739: bcopy(key, k_pad, key_len);
740: for (i = 0; i < SHA1_BLOCK_LENGTH; i++)
741: k_pad[i] ^= 0x36;
742:
743: SHA1Init(&ctx);
744: SHA1Update(&ctx, k_pad, SHA1_BLOCK_LENGTH);
745: for (i = 0; i < vcnt; i++)
746: SHA1Update(&ctx, (u_int8_t *)vec[i].base, vec[i].len);
747: SHA1Final(digest, &ctx);
748:
749: bzero(k_pad, sizeof k_pad);
750: bcopy(key, k_pad, key_len);
751: for (i = 0; i < SHA1_BLOCK_LENGTH; i++)
752: k_pad[i] ^= 0x5c;
753:
754: SHA1Init(&ctx);
755: SHA1Update(&ctx, k_pad, SHA1_BLOCK_LENGTH);
756: SHA1Update(&ctx, digest, SHA1_DIGEST_LENGTH);
757: SHA1Final(digest, &ctx);
758: }
759:
760: void
761: ieee80211_hmac_sha1(const u_int8_t *text, size_t text_len, const u_int8_t *key,
762: size_t key_len, u_int8_t digest[SHA1_DIGEST_LENGTH])
763: {
764: struct vector vec;
765: vec.base = text;
766: vec.len = text_len;
767: ieee80211_hmac_sha1_v(&vec, 1, key, key_len, digest);
768: }
769:
770: /*
771: * SHA1-based Pseudo-Random Function (see 8.5.1.1).
772: */
773: void
774: ieee80211_prf(const u_int8_t *key, size_t key_len, struct vector *vec,
775: int vcnt, u_int8_t *output, size_t len)
776: {
777: u_int8_t hash[SHA1_DIGEST_LENGTH];
778: u_int8_t count = 0;
779:
780: /* single octet count, starts at 0 */
781: vec[vcnt].base = &count;
782: vec[vcnt].len = 1;
783: vcnt++;
784:
785: while (len > SHA1_DIGEST_LENGTH) {
786: ieee80211_hmac_sha1_v(vec, vcnt, key, key_len, output);
787: count++;
788:
789: output += SHA1_DIGEST_LENGTH;
790: len -= SHA1_DIGEST_LENGTH;
791: }
792: if (len > 0) {
793: ieee80211_hmac_sha1_v(vec, vcnt, key, key_len, hash);
794: /* truncate HMAC-SHA1 to len bytes */
795: memcpy(output, hash, len);
796: }
797: }
798:
799: /*
800: * Derive Pairwise Transient Key (PTK) (see 8.5.1.2).
801: */
802: void
803: ieee80211_derive_ptk(const u_int8_t *pmk, size_t pmk_len, const u_int8_t *aa,
804: const u_int8_t *spa, const u_int8_t *anonce, const u_int8_t *snonce,
805: u_int8_t *ptk, size_t ptk_len)
806: {
807: struct vector vec[6]; /* +1 for PRF */
808: int ret;
809:
810: vec[0].base = "Pairwise key expansion";
811: vec[0].len = 23; /* include trailing '\0' */
812:
813: ret = memcmp(aa, spa, IEEE80211_ADDR_LEN) < 0;
814: /* Min(AA,SPA) */
815: vec[1].base = ret ? aa : spa;
816: vec[1].len = IEEE80211_ADDR_LEN;
817: /* Max(AA,SPA) */
818: vec[2].base = ret ? spa : aa;
819: vec[2].len = IEEE80211_ADDR_LEN;
820:
821: ret = memcmp(anonce, snonce, EAPOL_KEY_NONCE_LEN) < 0;
822: /* Min(ANonce,SNonce) */
823: vec[3].base = ret ? anonce : snonce;
824: vec[3].len = EAPOL_KEY_NONCE_LEN;
825: /* Max(ANonce,SNonce) */
826: vec[4].base = ret ? snonce : anonce;
827: vec[4].len = EAPOL_KEY_NONCE_LEN;
828:
829: ieee80211_prf(pmk, pmk_len, vec, 5, ptk, ptk_len);
830: }
831:
832: /*
833: * Derive Pairwise Master Key Identifier (PMKID) (see 8.5.1.2).
834: */
835: void
836: ieee80211_derive_pmkid(const u_int8_t *pmk, size_t pmk_len, const u_int8_t *aa,
837: const u_int8_t *spa, u_int8_t *pmkid)
838: {
839: struct vector vec[3];
840: u_int8_t hash[SHA1_DIGEST_LENGTH];
841:
842: vec[0].base = "PMK Name";
843: vec[0].len = 8; /* does *not* include trailing '\0' */
844: vec[1].base = aa;
845: vec[1].len = IEEE80211_ADDR_LEN;
846: vec[2].base = spa;
847: vec[2].len = IEEE80211_ADDR_LEN;
848:
849: ieee80211_hmac_sha1_v(vec, 3, pmk, pmk_len, hash);
850: /* use the first 128 bits of the HMAC-SHA1 */
851: memcpy(pmkid, hash, IEEE80211_PMKID_LEN);
852: }
853:
854: /*
855: * Derive Group Temporal Key (GTK) (see 8.5.1.3).
856: */
857: void
858: ieee80211_derive_gtk(const u_int8_t *gmk, size_t gmk_len, const u_int8_t *aa,
859: const u_int8_t *gnonce, u_int8_t *gtk, size_t gtk_len)
860: {
861: struct vector vec[4]; /* +1 for PRF */
862:
863: vec[0].base = "Group key expansion";
864: vec[0].len = 20; /* include trailing '\0' */
865: vec[1].base = aa;
866: vec[1].len = IEEE80211_ADDR_LEN;
867: vec[2].base = gnonce;
868: vec[2].len = EAPOL_KEY_NONCE_LEN;
869:
870: ieee80211_prf(gmk, gmk_len, vec, 3, gtk, gtk_len);
871: }
872:
873: /* unaligned big endian access */
874: #define BE_READ_2(p) \
875: ((u_int16_t) \
876: ((((const u_int8_t *)(p))[0] << 8) | \
877: (((const u_int8_t *)(p))[1])))
878:
879: #define BE_WRITE_2(p, v) do { \
880: ((u_int8_t *)(p))[0] = (v) >> 8; \
881: ((u_int8_t *)(p))[1] = (v) & 0xff; \
882: } while (0)
883:
884: /*
885: * Compute the Key MIC field of an EAPOL-Key frame using the specified Key
886: * Confirmation Key (KCK). The hash function can be either HMAC-MD5 or
887: * HMAC-SHA1 depending on the EAPOL-Key Key Descriptor Version.
888: */
889: void
890: ieee80211_eapol_key_mic(struct ieee80211_eapol_key *key, const u_int8_t *kck)
891: {
892: u_int8_t hash[SHA1_DIGEST_LENGTH];
893: u_int16_t len, info;
894:
895: len = BE_READ_2(key->len) + 4;
896: info = BE_READ_2(key->info);
897:
898: switch (info & EAPOL_KEY_VERSION_MASK) {
899: case EAPOL_KEY_DESC_V1:
900: ieee80211_hmac_md5((u_int8_t *)key, len, kck, 16, key->mic);
901: break;
902: case EAPOL_KEY_DESC_V2:
903: ieee80211_hmac_sha1((u_int8_t *)key, len, kck, 16, hash);
904: /* truncate HMAC-SHA1 to its 128 MSBs */
905: memcpy(key->mic, hash, EAPOL_KEY_MIC_LEN);
906: break;
907: }
908: }
909:
910: /*
911: * Check the MIC of a received EAPOL-Key frame using the specified Key
912: * Confirmation Key (KCK).
913: */
914: int
915: ieee80211_eapol_key_check_mic(struct ieee80211_eapol_key *key,
916: const u_int8_t *kck)
917: {
918: u_int8_t mic[EAPOL_KEY_MIC_LEN];
919:
920: memcpy(mic, key->mic, EAPOL_KEY_MIC_LEN);
921: memset(key->mic, 0, EAPOL_KEY_MIC_LEN);
922: ieee80211_eapol_key_mic(key, kck);
923:
924: return memcmp(key->mic, mic, EAPOL_KEY_MIC_LEN) != 0;
925: }
926:
927: /*
928: * Encrypt the Key Data field of an EAPOL-Key frame using the specified Key
929: * Encryption Key (KEK). The encryption algorithm can be either ARC4 or
930: * AES Key Wrap depending on the EAPOL-Key Key Descriptor Version.
931: */
932: void
933: ieee80211_eapol_key_encrypt(struct ieee80211com *ic,
934: struct ieee80211_eapol_key *key, const u_int8_t *kek)
935: {
936: struct rc4_ctx ctx;
937: u_int8_t keybuf[EAPOL_KEY_IV_LEN + 16];
938: u_int16_t len, info;
939: u_int8_t *data;
940: int n;
941:
942: len = BE_READ_2(key->paylen);
943: info = BE_READ_2(key->info);
944: data = (u_int8_t *)(key + 1);
945:
946: switch (info & EAPOL_KEY_VERSION_MASK) {
947: case EAPOL_KEY_DESC_V1:
948: /* set IV to the lower 16 octets of our global key counter */
949: memcpy(key->iv, ic->ic_globalcnt + 16, 16);
950: /* increment our global key counter (256-bit, big-endian) */
951: for (n = 31; n >= 0 && ++ic->ic_globalcnt[n] == 0; n--);
952:
953: /* concatenate the EAPOL-Key IV field and the KEK */
954: memcpy(keybuf, key->iv, EAPOL_KEY_IV_LEN);
955: memcpy(keybuf + EAPOL_KEY_IV_LEN, kek, 16);
956:
957: rc4_keysetup(&ctx, keybuf, sizeof keybuf);
958: /* discard the first 256 octets of the ARC4 key stream */
959: rc4_skip(&ctx, RC4STATE);
960: rc4_crypt(&ctx, data, data, len);
961: break;
962: case EAPOL_KEY_DESC_V2:
963: if (len < 16 || (len & 7) != 0) {
964: /* insert padding */
965: n = (len < 16) ? 16 - len : 8 - (len & 7);
966: data[len++] = IEEE80211_ELEMID_VENDOR;
967: memset(&data[len], 0, n - 1);
968: len += n - 1;
969: }
970: ieee80211_aes_key_wrap(kek, 16, data, len / 8, data);
971: len += 8; /* AES Key Wrap adds 8 bytes */
972: /* update key data length */
973: BE_WRITE_2(key->paylen, len);
974: /* update packet body length */
975: BE_WRITE_2(key->len, sizeof(*key) + len - 4);
976: break;
977: }
978: }
979:
980: /*
981: * Decrypt the Key Data field of an EAPOL-Key frame using the specified Key
982: * Encryption Key (KEK). The encryption algorithm can be either ARC4 or
983: * AES Key Wrap depending on the EAPOL-Key Key Descriptor Version.
984: */
985: int
986: ieee80211_eapol_key_decrypt(struct ieee80211_eapol_key *key,
987: const u_int8_t *kek)
988: {
989: struct rc4_ctx ctx;
990: u_int8_t keybuf[EAPOL_KEY_IV_LEN + 16];
991: u_int16_t len, info;
992: u_int8_t *data;
993:
994: len = BE_READ_2(key->paylen);
995: info = BE_READ_2(key->info);
996: data = (u_int8_t *)(key + 1);
997:
998: switch (info & EAPOL_KEY_VERSION_MASK) {
999: case EAPOL_KEY_DESC_V1:
1000: /* concatenate the EAPOL-Key IV field and the KEK */
1001: memcpy(keybuf, key->iv, EAPOL_KEY_IV_LEN);
1002: memcpy(keybuf + EAPOL_KEY_IV_LEN, kek, 16);
1003:
1004: rc4_keysetup(&ctx, keybuf, sizeof keybuf);
1005: /* discard the first 256 octets of the ARC4 key stream */
1006: rc4_skip(&ctx, RC4STATE);
1007: rc4_crypt(&ctx, data, data, len);
1008: return 0;
1009: case EAPOL_KEY_DESC_V2:
1010: /* Key Data Length must be a multiple of 8 */
1011: if (len < 16 + 8 || (len & 7) != 0)
1012: return 1;
1013: len -= 8; /* AES Key Wrap adds 8 bytes */
1014: return ieee80211_aes_key_unwrap(kek, 16, data, data, len / 8);
1015: }
1016:
1017: return 1; /* unknown Key Descriptor Version */
1018: }
1019:
1020: /*
1021: * Return the length in bytes of a cipher suite key (see Table 60).
1022: */
1023: int
1024: ieee80211_cipher_keylen(enum ieee80211_cipher cipher)
1025: {
1026: switch (cipher) {
1027: case IEEE80211_CIPHER_WEP40:
1028: return 5;
1029: case IEEE80211_CIPHER_TKIP:
1030: return 32;
1031: case IEEE80211_CIPHER_CCMP:
1032: return 16;
1033: case IEEE80211_CIPHER_WEP104:
1034: return 13;
1035: default: /* unknown cipher */
1036: return 0;
1037: }
1038: }
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to ieee80211_crypto.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net80211