xref: /openbsd-src/sys/net80211/ieee80211_crypto_ccmp.c (revision 43003dfe3ad45d1698bed8a37f2b0f5b14f20d4f) 
1 /*	$OpenBSD: ieee80211_crypto_ccmp.c,v 1.10 2009/09/24 16:03:10 damien Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 Damien Bergamini <damien.bergamini@free.fr>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * This code implements the CTR with CBC-MAC protocol (CCMP) defined in
21  * IEEE Std 802.11-2007 section 8.3.3.
22  */
23 
24 #include <sys/param.h>
25 #include <sys/systm.h>
26 #include <sys/mbuf.h>
27 #include <sys/malloc.h>
28 #include <sys/kernel.h>
29 #include <sys/socket.h>
30 #include <sys/endian.h>
31 
32 #include <net/if.h>
33 #include <net/if_dl.h>
34 #include <net/if_media.h>
35 #include <net/if_arp.h>
36 #include <net/if_llc.h>
37 
38 #ifdef INET
39 #include <netinet/in.h>
40 #include <netinet/if_ether.h>
41 #endif
42 
43 #include <net80211/ieee80211_var.h>
44 #include <net80211/ieee80211_crypto.h>
45 
46 #include <crypto/rijndael.h>
47 
48 /* CCMP software crypto context */
49 struct ieee80211_ccmp_ctx {
50 	rijndael_ctx	rijndael;
51 };
52 
53 /*
54  * Initialize software crypto context.  This function can be overridden
55  * by drivers doing hardware crypto.
56  */
57 int
58 ieee80211_ccmp_set_key(struct ieee80211com *ic, struct ieee80211_key *k)
59 {
60 	struct ieee80211_ccmp_ctx *ctx;
61 
62 	ctx = malloc(sizeof(*ctx), M_DEVBUF, M_NOWAIT | M_ZERO);
63 	if (ctx == NULL)
64 		return ENOMEM;
65 	rijndael_set_key_enc_only(&ctx->rijndael, k->k_key, 128);
66 	k->k_priv = ctx;
67 	return 0;
68 }
69 
70 void
71 ieee80211_ccmp_delete_key(struct ieee80211com *ic, struct ieee80211_key *k)
72 {
73 	if (k->k_priv != NULL)
74 		free(k->k_priv, M_DEVBUF);
75 	k->k_priv = NULL;
76 }
77 
78 /*-
79  * Counter with CBC-MAC (CCM) - see RFC3610.
80  * CCMP uses the following CCM parameters: M = 8, L = 2
81  */
82 static void
83 ieee80211_ccmp_phase1(rijndael_ctx *ctx, const struct ieee80211_frame *wh,
84     u_int64_t pn, int lm, u_int8_t b[16], u_int8_t a[16], u_int8_t s0[16])
85 {
86 	u_int8_t auth[32], nonce[13];
87 	u_int8_t *aad;
88 	u_int8_t tid = 0;
89 	int la, i;
90 
91 	/* construct AAD (additional authenticated data) */
92 	aad = &auth[2];	/* skip l(a), will be filled later */
93 	*aad = wh->i_fc[0];
94 	/* 11w: conditionnally mask subtype field */
95 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
96 	    IEEE80211_FC0_TYPE_DATA)
97 		*aad &= ~IEEE80211_FC0_SUBTYPE_MASK;
98 	aad++;
99 	/* protected bit is already set in wh */
100 	*aad = wh->i_fc[1];
101 	*aad &= ~(IEEE80211_FC1_RETRY | IEEE80211_FC1_PWR_MGT |
102 	    IEEE80211_FC1_MORE_DATA);
103 	/* 11n: conditionnally mask order bit */
104 	if (ieee80211_has_htc(wh))
105 		*aad &= ~IEEE80211_FC1_ORDER;
106 	aad++;
107 	IEEE80211_ADDR_COPY(aad, wh->i_addr1); aad += IEEE80211_ADDR_LEN;
108 	IEEE80211_ADDR_COPY(aad, wh->i_addr2); aad += IEEE80211_ADDR_LEN;
109 	IEEE80211_ADDR_COPY(aad, wh->i_addr3); aad += IEEE80211_ADDR_LEN;
110 	*aad++ = wh->i_seq[0] & ~0xf0;
111 	*aad++ = 0;
112 	if (ieee80211_has_addr4(wh)) {
113 		IEEE80211_ADDR_COPY(aad,
114 		    ((const struct ieee80211_frame_addr4 *)wh)->i_addr4);
115 		aad += IEEE80211_ADDR_LEN;
116 	}
117 	if (ieee80211_has_qos(wh)) {
118 		*aad++ = tid = ieee80211_get_qos(wh) & IEEE80211_QOS_TID;
119 		*aad++ = 0;
120 	}
121 
122 	/* construct CCM nonce */
123 	nonce[ 0] = tid;
124 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
125 	    IEEE80211_FC0_TYPE_MGT)
126 		nonce[0] |= 1 << 4;	/* 11w: set management bit */
127 	IEEE80211_ADDR_COPY(&nonce[1], wh->i_addr2);
128 	nonce[ 7] = pn >> 40;	/* PN5 */
129 	nonce[ 8] = pn >> 32;	/* PN4 */
130 	nonce[ 9] = pn >> 24;	/* PN3 */
131 	nonce[10] = pn >> 16;	/* PN2 */
132 	nonce[11] = pn >> 8;	/* PN1 */
133 	nonce[12] = pn;		/* PN0 */
134 
135 	/* add 2 authentication blocks (including l(a) and padded AAD) */
136 	la = aad - &auth[2];		/* fill l(a) */
137 	auth[0] = la >> 8;
138 	auth[1] = la & 0xff;
139 	memset(aad, 0, 30 - la);	/* pad AAD with zeros */
140 
141 	/* construct first block B_0 */
142 	b[ 0] = 89;	/* Flags = 64*Adata + 8*((M-2)/2) + (L-1) */
143 	memcpy(&b[1], nonce, 13);
144 	b[14] = lm >> 8;
145 	b[15] = lm & 0xff;
146 	rijndael_encrypt(ctx, b, b);
147 
148 	for (i = 0; i < 16; i++)
149 		b[i] ^= auth[i];
150 	rijndael_encrypt(ctx, b, b);
151 	for (i = 0; i < 16; i++)
152 		b[i] ^= auth[16 + i];
153 	rijndael_encrypt(ctx, b, b);
154 
155 	/* construct S_0 */
156 	a[ 0] = 1;	/* Flags = L' = (L-1) */
157 	memcpy(&a[1], nonce, 13);
158 	a[14] = a[15] = 0;
159 	rijndael_encrypt(ctx, a, s0);
160 }
161 
162 struct mbuf *
163 ieee80211_ccmp_encrypt(struct ieee80211com *ic, struct mbuf *m0,
164     struct ieee80211_key *k)
165 {
166 	struct ieee80211_ccmp_ctx *ctx = k->k_priv;
167 	const struct ieee80211_frame *wh;
168 	const u_int8_t *src;
169 	u_int8_t *ivp, *mic, *dst;
170 	u_int8_t a[16], b[16], s0[16], s[16];
171 	struct mbuf *n0, *m, *n;
172 	int hdrlen, left, moff, noff, len;
173 	u_int16_t ctr;
174 	int i, j;
175 
176 	MGET(n0, M_DONTWAIT, m0->m_type);
177 	if (n0 == NULL)
178 		goto nospace;
179 	if (m_dup_pkthdr(n0, m0))
180 		goto nospace;
181 	n0->m_pkthdr.len += IEEE80211_CCMP_HDRLEN;
182 	n0->m_len = MHLEN;
183 	if (n0->m_pkthdr.len >= MINCLSIZE - IEEE80211_CCMP_MICLEN) {
184 		MCLGET(n0, M_DONTWAIT);
185 		if (n0->m_flags & M_EXT)
186 			n0->m_len = n0->m_ext.ext_size;
187 	}
188 	if (n0->m_len > n0->m_pkthdr.len)
189 		n0->m_len = n0->m_pkthdr.len;
190 
191 	/* copy 802.11 header */
192 	wh = mtod(m0, struct ieee80211_frame *);
193 	hdrlen = ieee80211_get_hdrlen(wh);
194 	memcpy(mtod(n0, caddr_t), wh, hdrlen);
195 
196 	k->k_tsc++;	/* increment the 48-bit PN */
197 
198 	/* construct CCMP header */
199 	ivp = mtod(n0, u_int8_t *) + hdrlen;
200 	ivp[0] = k->k_tsc;		/* PN0 */
201 	ivp[1] = k->k_tsc >> 8;		/* PN1 */
202 	ivp[2] = 0;			/* Rsvd */
203 	ivp[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV;	/* KeyID | ExtIV */
204 	ivp[4] = k->k_tsc >> 16;	/* PN2 */
205 	ivp[5] = k->k_tsc >> 24;	/* PN3 */
206 	ivp[6] = k->k_tsc >> 32;	/* PN4 */
207 	ivp[7] = k->k_tsc >> 40;	/* PN5 */
208 
209 	/* construct initial B, A and S_0 blocks */
210 	ieee80211_ccmp_phase1(&ctx->rijndael, wh, k->k_tsc,
211 	    m0->m_pkthdr.len - hdrlen, b, a, s0);
212 
213 	/* construct S_1 */
214 	ctr = 1;
215 	a[14] = ctr >> 8;
216 	a[15] = ctr & 0xff;
217 	rijndael_encrypt(&ctx->rijndael, a, s);
218 
219 	/* encrypt frame body and compute MIC */
220 	j = 0;
221 	m = m0;
222 	n = n0;
223 	moff = hdrlen;
224 	noff = hdrlen + IEEE80211_CCMP_HDRLEN;
225 	left = m0->m_pkthdr.len - moff;
226 	while (left > 0) {
227 		if (moff == m->m_len) {
228 			/* nothing left to copy from m */
229 			m = m->m_next;
230 			moff = 0;
231 		}
232 		if (noff == n->m_len) {
233 			/* n is full and there's more data to copy */
234 			MGET(n->m_next, M_DONTWAIT, n->m_type);
235 			if (n->m_next == NULL)
236 				goto nospace;
237 			n = n->m_next;
238 			n->m_len = MLEN;
239 			if (left >= MINCLSIZE - IEEE80211_CCMP_MICLEN) {
240 				MCLGET(n, M_DONTWAIT);
241 				if (n->m_flags & M_EXT)
242 					n->m_len = n->m_ext.ext_size;
243 			}
244 			if (n->m_len > left)
245 				n->m_len = left;
246 			noff = 0;
247 		}
248 		len = min(m->m_len - moff, n->m_len - noff);
249 
250 		src = mtod(m, u_int8_t *) + moff;
251 		dst = mtod(n, u_int8_t *) + noff;
252 		for (i = 0; i < len; i++) {
253 			/* update MIC with clear text */
254 			b[j] ^= src[i];
255 			/* encrypt message */
256 			dst[i] = src[i] ^ s[j];
257 			if (++j < 16)
258 				continue;
259 			/* we have a full block, encrypt MIC */
260 			rijndael_encrypt(&ctx->rijndael, b, b);
261 			/* construct a new S_ctr block */
262 			ctr++;
263 			a[14] = ctr >> 8;
264 			a[15] = ctr & 0xff;
265 			rijndael_encrypt(&ctx->rijndael, a, s);
266 			j = 0;
267 		}
268 
269 		moff += len;
270 		noff += len;
271 		left -= len;
272 	}
273 	if (j != 0)	/* partial block, encrypt MIC */
274 		rijndael_encrypt(&ctx->rijndael, b, b);
275 
276 	/* reserve trailing space for MIC */
277 	if (M_TRAILINGSPACE(n) < IEEE80211_CCMP_MICLEN) {
278 		MGET(n->m_next, M_DONTWAIT, n->m_type);
279 		if (n->m_next == NULL)
280 			goto nospace;
281 		n = n->m_next;
282 		n->m_len = 0;
283 	}
284 	/* finalize MIC, U := T XOR first-M-bytes( S_0 ) */
285 	mic = mtod(n, u_int8_t *) + n->m_len;
286 	for (i = 0; i < IEEE80211_CCMP_MICLEN; i++)
287 		mic[i] = b[i] ^ s0[i];
288 	n->m_len += IEEE80211_CCMP_MICLEN;
289 	n0->m_pkthdr.len += IEEE80211_CCMP_MICLEN;
290 
291 	m_freem(m0);
292 	return n0;
293  nospace:
294 	ic->ic_stats.is_tx_nombuf++;
295 	m_freem(m0);
296 	if (n0 != NULL)
297 		m_freem(n0);
298 	return NULL;
299 }
300 
301 struct mbuf *
302 ieee80211_ccmp_decrypt(struct ieee80211com *ic, struct mbuf *m0,
303     struct ieee80211_key *k)
304 {
305 	struct ieee80211_ccmp_ctx *ctx = k->k_priv;
306 	struct ieee80211_frame *wh;
307 	u_int64_t pn, *prsc;
308 	const u_int8_t *ivp, *src;
309 	u_int8_t *dst;
310 	u_int8_t mic0[IEEE80211_CCMP_MICLEN];
311 	u_int8_t a[16], b[16], s0[16], s[16];
312 	struct mbuf *n0, *m, *n;
313 	int hdrlen, left, moff, noff, len;
314 	u_int16_t ctr;
315 	int i, j;
316 
317 	wh = mtod(m0, struct ieee80211_frame *);
318 	hdrlen = ieee80211_get_hdrlen(wh);
319 	ivp = (u_int8_t *)wh + hdrlen;
320 
321 	if (m0->m_pkthdr.len < hdrlen + IEEE80211_CCMP_HDRLEN +
322 	    IEEE80211_CCMP_MICLEN) {
323 		m_freem(m0);
324 		return NULL;
325 	}
326 	/* check that ExtIV bit is set */
327 	if (!(ivp[3] & IEEE80211_WEP_EXTIV)) {
328 		m_freem(m0);
329 		return NULL;
330 	}
331 
332 	/* retrieve last seen packet number for this frame type/priority */
333 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
334 	    IEEE80211_FC0_TYPE_DATA) {
335 		u_int8_t tid = ieee80211_has_qos(wh) ?
336 		    ieee80211_get_qos(wh) & IEEE80211_QOS_TID : 0;
337 		prsc = &k->k_rsc[tid];
338 	} else	/* 11w: management frames have their own counters */
339 		prsc = &k->k_mgmt_rsc;
340 
341 	/* extract the 48-bit PN from the CCMP header */
342 	pn = (u_int64_t)ivp[0]       |
343 	     (u_int64_t)ivp[1] <<  8 |
344 	     (u_int64_t)ivp[4] << 16 |
345 	     (u_int64_t)ivp[5] << 24 |
346 	     (u_int64_t)ivp[6] << 32 |
347 	     (u_int64_t)ivp[7] << 40;
348 	if (pn <= *prsc) {
349 		/* replayed frame, discard */
350 		ic->ic_stats.is_ccmp_replays++;
351 		m_freem(m0);
352 		return NULL;
353 	}
354 
355 	MGET(n0, M_DONTWAIT, m0->m_type);
356 	if (n0 == NULL)
357 		goto nospace;
358 	if (m_dup_pkthdr(n0, m0))
359 		goto nospace;
360 	n0->m_pkthdr.len -= IEEE80211_CCMP_HDRLEN + IEEE80211_CCMP_MICLEN;
361 	n0->m_len = MHLEN;
362 	if (n0->m_pkthdr.len >= MINCLSIZE) {
363 		MCLGET(n0, M_DONTWAIT);
364 		if (n0->m_flags & M_EXT)
365 			n0->m_len = n0->m_ext.ext_size;
366 	}
367 	if (n0->m_len > n0->m_pkthdr.len)
368 		n0->m_len = n0->m_pkthdr.len;
369 
370 	/* construct initial B, A and S_0 blocks */
371 	ieee80211_ccmp_phase1(&ctx->rijndael, wh, pn,
372 	    n0->m_pkthdr.len - hdrlen, b, a, s0);
373 
374 	/* copy 802.11 header and clear protected bit */
375 	memcpy(mtod(n0, caddr_t), wh, hdrlen);
376 	wh = mtod(n0, struct ieee80211_frame *);
377 	wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
378 
379 	/* construct S_1 */
380 	ctr = 1;
381 	a[14] = ctr >> 8;
382 	a[15] = ctr & 0xff;
383 	rijndael_encrypt(&ctx->rijndael, a, s);
384 
385 	/* decrypt frame body and compute MIC */
386 	j = 0;
387 	m = m0;
388 	n = n0;
389 	moff = hdrlen + IEEE80211_CCMP_HDRLEN;
390 	noff = hdrlen;
391 	left = n0->m_pkthdr.len - noff;
392 	while (left > 0) {
393 		if (moff == m->m_len) {
394 			/* nothing left to copy from m */
395 			m = m->m_next;
396 			moff = 0;
397 		}
398 		if (noff == n->m_len) {
399 			/* n is full and there's more data to copy */
400 			MGET(n->m_next, M_DONTWAIT, n->m_type);
401 			if (n->m_next == NULL)
402 				goto nospace;
403 			n = n->m_next;
404 			n->m_len = MLEN;
405 			if (left >= MINCLSIZE) {
406 				MCLGET(n, M_DONTWAIT);
407 				if (n->m_flags & M_EXT)
408 					n->m_len = n->m_ext.ext_size;
409 			}
410 			if (n->m_len > left)
411 				n->m_len = left;
412 			noff = 0;
413 		}
414 		len = min(m->m_len - moff, n->m_len - noff);
415 
416 		src = mtod(m, u_int8_t *) + moff;
417 		dst = mtod(n, u_int8_t *) + noff;
418 		for (i = 0; i < len; i++) {
419 			/* decrypt message */
420 			dst[i] = src[i] ^ s[j];
421 			/* update MIC with clear text */
422 			b[j] ^= dst[i];
423 			if (++j < 16)
424 				continue;
425 			/* we have a full block, encrypt MIC */
426 			rijndael_encrypt(&ctx->rijndael, b, b);
427 			/* construct a new S_ctr block */
428 			ctr++;
429 			a[14] = ctr >> 8;
430 			a[15] = ctr & 0xff;
431 			rijndael_encrypt(&ctx->rijndael, a, s);
432 			j = 0;
433 		}
434 
435 		moff += len;
436 		noff += len;
437 		left -= len;
438 	}
439 	if (j != 0)	/* partial block, encrypt MIC */
440 		rijndael_encrypt(&ctx->rijndael, b, b);
441 
442 	/* finalize MIC, U := T XOR first-M-bytes( S_0 ) */
443 	for (i = 0; i < IEEE80211_CCMP_MICLEN; i++)
444 		b[i] ^= s0[i];
445 
446 	/* check that it matches the MIC in received frame */
447 	m_copydata(m, moff, IEEE80211_CCMP_MICLEN, mic0);
448 	if (memcmp(mic0, b, IEEE80211_CCMP_MICLEN) != 0) {
449 		ic->ic_stats.is_ccmp_dec_errs++;
450 		m_freem(m0);
451 		m_freem(n0);
452 		return NULL;
453 	}
454 
455 	/* update last seen packet number (MIC is validated) */
456 	*prsc = pn;
457 
458 	m_freem(m0);
459 	return n0;
460  nospace:
461 	ic->ic_stats.is_rx_nombuf++;
462 	m_freem(m0);
463 	if (n0 != NULL)
464 		m_freem(n0);
465 	return NULL;
466 }
467