package/kernel/mac80211/patches/100-revert_aes_ccm_port.patch

   1 --- a/net/mac80211/Kconfig
   2 +++ b/net/mac80211/Kconfig
   3 @@ -5,7 +5,6 @@ config MAC80211
   4         depends on CRYPTO
   5         depends on CRYPTO_ARC4
   6         depends on CRYPTO_AES
   7 -       depends on CRYPTO_CCM
   8         depends on CRC32
   9         select BACKPORT_AVERAGE
  10         ---help---
  11 --- a/net/mac80211/aes_ccm.c
  12 +++ b/net/mac80211/aes_ccm.c
  13 @@ -2,8 +2,6 @@
  14   * Copyright 2003-2004, Instant802 Networks, Inc.
  15   * Copyright 2005-2006, Devicescape Software, Inc.
  16   *
  17 - * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
  18 - *
  19   * This program is free software; you can redistribute it and/or modify
  20   * it under the terms of the GNU General Public License version 2 as
  21   * published by the Free Software Foundation.
  22 @@ -19,75 +17,134 @@
  23  #include "key.h"
  24  #include "aes_ccm.h"
  25
  26 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
  27 -                              u8 *data, size_t data_len, u8 *mic)
  28 +static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *scratch, u8 *a)
  29  {
  30 -       struct scatterlist assoc, pt, ct[2];
  31 -       struct {
  32 -               struct aead_request     req;
  33 -               u8                      priv[crypto_aead_reqsize(tfm)];
  34 -       } aead_req;
  35 -
  36 -       memset(&aead_req, 0, sizeof(aead_req));
  37 -
  38 -       sg_init_one(&pt, data, data_len);
  39 -       sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
  40 -       sg_init_table(ct, 2);
  41 -       sg_set_buf(&ct[0], data, data_len);
  42 -       sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
  43 -
  44 -       aead_request_set_tfm(&aead_req.req, tfm);
  45 -       aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
  46 -       aead_request_set_crypt(&aead_req.req, &pt, ct, data_len, b_0);
  47 +       int i;
  48 +       u8 *b_0, *aad, *b, *s_0;
  49
  50 -       crypto_aead_encrypt(&aead_req.req);
  51 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
  52 +       aad = scratch + 4 * AES_BLOCK_SIZE;
  53 +       b = scratch;
  54 +       s_0 = scratch + AES_BLOCK_SIZE;
  55 +
  56 +       crypto_cipher_encrypt_one(tfm, b, b_0);
  57 +
  58 +       /* Extra Authenticate-only data (always two AES blocks) */
  59 +       for (i = 0; i < AES_BLOCK_SIZE; i++)
  60 +               aad[i] ^= b[i];
  61 +       crypto_cipher_encrypt_one(tfm, b, aad);
  62 +
  63 +       aad += AES_BLOCK_SIZE;
  64 +
  65 +       for (i = 0; i < AES_BLOCK_SIZE; i++)
  66 +               aad[i] ^= b[i];
  67 +       crypto_cipher_encrypt_one(tfm, a, aad);
  68 +
  69 +       /* Mask out bits from auth-only-b_0 */
  70 +       b_0[0] &= 0x07;
  71 +
  72 +       /* S_0 is used to encrypt T (= MIC) */
  73 +       b_0[14] = 0;
  74 +       b_0[15] = 0;
  75 +       crypto_cipher_encrypt_one(tfm, s_0, b_0);
  76  }
  77
  78 -int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
  79 -                             u8 *data, size_t data_len, u8 *mic)
  80 +
  81 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
  82 +                              u8 *data, size_t data_len,
  83 +                              u8 *cdata, u8 *mic)
  84  {
  85 -       struct scatterlist assoc, pt, ct[2];
  86 -       struct {
  87 -               struct aead_request     req;
  88 -               u8                      priv[crypto_aead_reqsize(tfm)];
  89 -       } aead_req;
  90 -
  91 -       memset(&aead_req, 0, sizeof(aead_req));
  92 -
  93 -       sg_init_one(&pt, data, data_len);
  94 -       sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
  95 -       sg_init_table(ct, 2);
  96 -       sg_set_buf(&ct[0], data, data_len);
  97 -       sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
  98 -
  99 -       aead_request_set_tfm(&aead_req.req, tfm);
 100 -       aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
 101 -       aead_request_set_crypt(&aead_req.req, ct, &pt,
 102 -                              data_len + IEEE80211_CCMP_MIC_LEN, b_0);
 103 +       int i, j, last_len, num_blocks;
 104 +       u8 *pos, *cpos, *b, *s_0, *e, *b_0;
 105 +
 106 +       b = scratch;
 107 +       s_0 = scratch + AES_BLOCK_SIZE;
 108 +       e = scratch + 2 * AES_BLOCK_SIZE;
 109 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
 110 +
 111 +       num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 112 +       last_len = data_len % AES_BLOCK_SIZE;
 113 +       aes_ccm_prepare(tfm, scratch, b);
 114 +
 115 +       /* Process payload blocks */
 116 +       pos = data;
 117 +       cpos = cdata;
 118 +       for (j = 1; j <= num_blocks; j++) {
 119 +               int blen = (j == num_blocks && last_len) ?
 120 +                       last_len : AES_BLOCK_SIZE;
 121 +
 122 +               /* Authentication followed by encryption */
 123 +               for (i = 0; i < blen; i++)
 124 +                       b[i] ^= pos[i];
 125 +               crypto_cipher_encrypt_one(tfm, b, b);
 126 +
 127 +               b_0[14] = (j >> 8) & 0xff;
 128 +               b_0[15] = j & 0xff;
 129 +               crypto_cipher_encrypt_one(tfm, e, b_0);
 130 +               for (i = 0; i < blen; i++)
 131 +                       *cpos++ = *pos++ ^ e[i];
 132 +       }
 133
 134 -       return crypto_aead_decrypt(&aead_req.req);
 135 +       for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++)
 136 +               mic[i] = b[i] ^ s_0[i];
 137  }
 138
 139 -struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[])
 140 +
 141 +int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
 142 +                             u8 *cdata, size_t data_len, u8 *mic, u8 *data)
 143  {
 144 -       struct crypto_aead *tfm;
 145 -       int err;
 146 +       int i, j, last_len, num_blocks;
 147 +       u8 *pos, *cpos, *b, *s_0, *a, *b_0;
 148
 149 -       tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
 150 -       if (IS_ERR(tfm))
 151 -               return tfm;
 152 -
 153 -       err = crypto_aead_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 154 -       if (!err)
 155 -               err = crypto_aead_setauthsize(tfm, IEEE80211_CCMP_MIC_LEN);
 156 -       if (!err)
 157 -               return tfm;
 158 +       b = scratch;
 159 +       s_0 = scratch + AES_BLOCK_SIZE;
 160 +       a = scratch + 2 * AES_BLOCK_SIZE;
 161 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
 162 +
 163 +       num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 164 +       last_len = data_len % AES_BLOCK_SIZE;
 165 +       aes_ccm_prepare(tfm, scratch, a);
 166 +
 167 +       /* Process payload blocks */
 168 +       cpos = cdata;
 169 +       pos = data;
 170 +       for (j = 1; j <= num_blocks; j++) {
 171 +               int blen = (j == num_blocks && last_len) ?
 172 +                       last_len : AES_BLOCK_SIZE;
 173 +
 174 +               /* Decryption followed by authentication */
 175 +               b_0[14] = (j >> 8) & 0xff;
 176 +               b_0[15] = j & 0xff;
 177 +               crypto_cipher_encrypt_one(tfm, b, b_0);
 178 +               for (i = 0; i < blen; i++) {
 179 +                       *pos = *cpos++ ^ b[i];
 180 +                       a[i] ^= *pos++;
 181 +               }
 182 +               crypto_cipher_encrypt_one(tfm, a, a);
 183 +       }
 184 +
 185 +       for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++) {
 186 +               if ((mic[i] ^ s_0[i]) != a[i])
 187 +                       return -1;
 188 +       }
 189
 190 -       crypto_free_aead(tfm);
 191 -       return ERR_PTR(err);
 192 +       return 0;
 193  }
 194
 195 -void ieee80211_aes_key_free(struct crypto_aead *tfm)
 196 +
 197 +struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 198 +{
 199 +       struct crypto_cipher *tfm;
 200 +
 201 +       tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
 202 +       if (!IS_ERR(tfm))
 203 +               crypto_cipher_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 204 +
 205 +       return tfm;
 206 +}
 207 +
 208 +
 209 +void ieee80211_aes_key_free(struct crypto_cipher *tfm)
 210  {
 211 -       crypto_free_aead(tfm);
 212 +       crypto_free_cipher(tfm);
 213  }
 214 --- a/net/mac80211/aes_ccm.h
 215 +++ b/net/mac80211/aes_ccm.h
 216 @@ -12,11 +12,13 @@
 217
 218  #include <linux/crypto.h>
 219
 220 -struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[]);
 221 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
 222 -                              u8 *data, size_t data_len, u8 *mic);
 223 -int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
 224 -                             u8 *data, size_t data_len, u8 *mic);
 225 -void ieee80211_aes_key_free(struct crypto_aead *tfm);
 226 +struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[]);
 227 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
 228 +                              u8 *data, size_t data_len,
 229 +                              u8 *cdata, u8 *mic);
 230 +int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
 231 +                             u8 *cdata, size_t data_len,
 232 +                             u8 *mic, u8 *data);
 233 +void ieee80211_aes_key_free(struct crypto_cipher *tfm);
 234
 235  #endif /* AES_CCM_H */
 236 --- a/net/mac80211/key.h
 237 +++ b/net/mac80211/key.h
 238 @@ -83,7 +83,7 @@ struct ieee80211_key {
 239                          * Management frames.
 240                          */
 241                         u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
 242 -                       struct crypto_aead *tfm;
 243 +                       struct crypto_cipher *tfm;
 244                         u32 replays; /* dot11RSNAStatsCCMPReplays */
 245                 } ccmp;
 246                 struct {
 247 --- a/net/mac80211/wpa.c
 248 +++ b/net/mac80211/wpa.c
 249 @@ -301,16 +301,22 @@ ieee80211_crypto_tkip_decrypt(struct iee
 250  }
 251
 252
 253 -static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad,
 254 +static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
 255                                 int encrypted)
 256  {
 257         __le16 mask_fc;
 258         int a4_included, mgmt;
 259         u8 qos_tid;
 260 -       u16 len_a;
 261 +       u8 *b_0, *aad;
 262 +       u16 data_len, len_a;
 263         unsigned int hdrlen;
 264         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 265
 266 +       memset(scratch, 0, 6 * AES_BLOCK_SIZE);
 267 +
 268 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
 269 +       aad = scratch + 4 * AES_BLOCK_SIZE;
 270 +
 271         /*
 272          * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
 273          * Retry, PwrMgt, MoreData; set Protected
 274 @@ -332,21 +338,20 @@ static void ccmp_special_blocks(struct s
 275         else
 276                 qos_tid = 0;
 277
 278 -       /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
 279 -        * mode authentication are not allowed to collide, yet both are derived
 280 -        * from this vector b_0. We only set L := 1 here to indicate that the
 281 -        * data size can be represented in (L+1) bytes. The CCM layer will take
 282 -        * care of storing the data length in the top (L+1) bytes and setting
 283 -        * and clearing the other bits as is required to derive the two IVs.
 284 -        */
 285 -       b_0[0] = 0x1;
 286 +       data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN;
 287 +       if (encrypted)
 288 +               data_len -= IEEE80211_CCMP_MIC_LEN;
 289
 290 +       /* First block, b_0 */
 291 +       b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
 292         /* Nonce: Nonce Flags | A2 | PN
 293          * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
 294          */
 295         b_0[1] = qos_tid | (mgmt << 4);
 296         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
 297         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
 298 +       /* l(m) */
 299 +       put_unaligned_be16(data_len, &b_0[14]);
 300
 301         /* AAD (extra authenticate-only data) / masked 802.11 header
 302          * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
 303 @@ -402,8 +407,7 @@ static int ccmp_encrypt_skb(struct ieee8
 304         u8 *pos;
 305         u8 pn[6];
 306         u64 pn64;
 307 -       u8 aad[2 * AES_BLOCK_SIZE];
 308 -       u8 b_0[AES_BLOCK_SIZE];
 309 +       u8 scratch[6 * AES_BLOCK_SIZE];
 310
 311         if (info->control.hw_key &&
 312             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
 313 @@ -456,9 +460,9 @@ static int ccmp_encrypt_skb(struct ieee8
 314                 return 0;
 315
 316         pos += IEEE80211_CCMP_HDR_LEN;
 317 -       ccmp_special_blocks(skb, pn, b_0, aad, 0);
 318 -       ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
 319 -                                 skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 320 +       ccmp_special_blocks(skb, pn, scratch, 0);
 321 +       ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, pos, len,
 322 +                                 pos, skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 323
 324         return 0;
 325  }
 326 @@ -521,16 +525,16 @@ ieee80211_crypto_ccmp_decrypt(struct iee
 327         }
 328
 329         if (!(status->flag & RX_FLAG_DECRYPTED)) {
 330 -               u8 aad[2 * AES_BLOCK_SIZE];
 331 -               u8 b_0[AES_BLOCK_SIZE];
 332 +               u8 scratch[6 * AES_BLOCK_SIZE];
 333                 /* hardware didn't decrypt/verify MIC */
 334 -               ccmp_special_blocks(skb, pn, b_0, aad, 1);
 335 +               ccmp_special_blocks(skb, pn, scratch, 1);
 336
 337                 if (ieee80211_aes_ccm_decrypt(
 338 -                           key->u.ccmp.tfm, b_0, aad,
 339 +                           key->u.ccmp.tfm, scratch,
 340                             skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
 341                             data_len,
 342 -                           skb->data + skb->len - IEEE80211_CCMP_MIC_LEN))
 343 +                           skb->data + skb->len - IEEE80211_CCMP_MIC_LEN,
 344 +                           skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN))
 345                         return RX_DROP_UNUSABLE;
 346         }
 347