package/kernel/mac80211/patches/100-revert_aes_ccm_port.patch

   1 --- a/net/mac80211/Kconfig
   2 +++ b/net/mac80211/Kconfig
   3 @@ -5,7 +5,6 @@ config MAC80211
   4         depends on CRYPTO
   5         depends on CRYPTO_ARC4
   6         depends on CRYPTO_AES
   7 -       select BACKPORT_CRYPTO_CCM
   8         depends on CRC32
   9         select BACKPORT_AVERAGE
  10         ---help---
  11 --- a/net/mac80211/aes_ccm.c
  12 +++ b/net/mac80211/aes_ccm.c
  13 @@ -2,8 +2,6 @@
  14   * Copyright 2003-2004, Instant802 Networks, Inc.
  15   * Copyright 2005-2006, Devicescape Software, Inc.
  16   *
  17 - * Rewrite: Copyright (C) 2013 Linaro Ltd <ard.biesheuvel@linaro.org>
  18 - *
  19   * This program is free software; you can redistribute it and/or modify
  20   * it under the terms of the GNU General Public License version 2 as
  21   * published by the Free Software Foundation.
  22 @@ -19,76 +17,134 @@
  23  #include "key.h"
  24  #include "aes_ccm.h"
  25
  26 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
  27 -                              u8 *data, size_t data_len, u8 *mic)
  28 +static void aes_ccm_prepare(struct crypto_cipher *tfm, u8 *scratch, u8 *a)
  29 +{
  30 +       int i;
  31 +       u8 *b_0, *aad, *b, *s_0;
  32 +
  33 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
  34 +       aad = scratch + 4 * AES_BLOCK_SIZE;
  35 +       b = scratch;
  36 +       s_0 = scratch + AES_BLOCK_SIZE;
  37 +
  38 +       crypto_cipher_encrypt_one(tfm, b, b_0);
  39 +
  40 +       /* Extra Authenticate-only data (always two AES blocks) */
  41 +       for (i = 0; i < AES_BLOCK_SIZE; i++)
  42 +               aad[i] ^= b[i];
  43 +       crypto_cipher_encrypt_one(tfm, b, aad);
  44 +
  45 +       aad += AES_BLOCK_SIZE;
  46 +
  47 +       for (i = 0; i < AES_BLOCK_SIZE; i++)
  48 +               aad[i] ^= b[i];
  49 +       crypto_cipher_encrypt_one(tfm, a, aad);
  50 +
  51 +       /* Mask out bits from auth-only-b_0 */
  52 +       b_0[0] &= 0x07;
  53 +
  54 +       /* S_0 is used to encrypt T (= MIC) */
  55 +       b_0[14] = 0;
  56 +       b_0[15] = 0;
  57 +       crypto_cipher_encrypt_one(tfm, s_0, b_0);
  58 +}
  59 +
  60 +
  61 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
  62 +                              u8 *data, size_t data_len,
  63 +                              u8 *cdata, u8 *mic)
  64  {
  65 -       struct scatterlist assoc, pt, ct[2];
  66 +       int i, j, last_len, num_blocks;
  67 +       u8 *pos, *cpos, *b, *s_0, *e, *b_0;
  68
  69 -       char aead_req_data[sizeof(struct aead_request) +
  70 -                          crypto_aead_reqsize(tfm)]
  71 -               __aligned(__alignof__(struct aead_request));
  72 -       struct aead_request *aead_req = (void *) aead_req_data;
  73 -
  74 -       memset(aead_req, 0, sizeof(aead_req_data));
  75 -
  76 -       sg_init_one(&pt, data, data_len);
  77 -       sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
  78 -       sg_init_table(ct, 2);
  79 -       sg_set_buf(&ct[0], data, data_len);
  80 -       sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
  81 -
  82 -       aead_request_set_tfm(aead_req, tfm);
  83 -       aead_request_set_assoc(aead_req, &assoc, assoc.length);
  84 -       aead_request_set_crypt(aead_req, &pt, ct, data_len, b_0);
  85 +       b = scratch;
  86 +       s_0 = scratch + AES_BLOCK_SIZE;
  87 +       e = scratch + 2 * AES_BLOCK_SIZE;
  88 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
  89 +
  90 +       num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
  91 +       last_len = data_len % AES_BLOCK_SIZE;
  92 +       aes_ccm_prepare(tfm, scratch, b);
  93 +
  94 +       /* Process payload blocks */
  95 +       pos = data;
  96 +       cpos = cdata;
  97 +       for (j = 1; j <= num_blocks; j++) {
  98 +               int blen = (j == num_blocks && last_len) ?
  99 +                       last_len : AES_BLOCK_SIZE;
 100 +
 101 +               /* Authentication followed by encryption */
 102 +               for (i = 0; i < blen; i++)
 103 +                       b[i] ^= pos[i];
 104 +               crypto_cipher_encrypt_one(tfm, b, b);
 105 +
 106 +               b_0[14] = (j >> 8) & 0xff;
 107 +               b_0[15] = j & 0xff;
 108 +               crypto_cipher_encrypt_one(tfm, e, b_0);
 109 +               for (i = 0; i < blen; i++)
 110 +                       *cpos++ = *pos++ ^ e[i];
 111 +       }
 112
 113 -       crypto_aead_encrypt(aead_req);
 114 +       for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++)
 115 +               mic[i] = b[i] ^ s_0[i];
 116  }
 117
 118 -int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
 119 -                             u8 *data, size_t data_len, u8 *mic)
 120 +
 121 +int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
 122 +                             u8 *cdata, size_t data_len, u8 *mic, u8 *data)
 123  {
 124 -       struct scatterlist assoc, pt, ct[2];
 125 -       char aead_req_data[sizeof(struct aead_request) +
 126 -                          crypto_aead_reqsize(tfm)]
 127 -               __aligned(__alignof__(struct aead_request));
 128 -       struct aead_request *aead_req = (void *) aead_req_data;
 129 -
 130 -       memset(aead_req, 0, sizeof(aead_req_data));
 131 -
 132 -       sg_init_one(&pt, data, data_len);
 133 -       sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
 134 -       sg_init_table(ct, 2);
 135 -       sg_set_buf(&ct[0], data, data_len);
 136 -       sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
 137 -
 138 -       aead_request_set_tfm(aead_req, tfm);
 139 -       aead_request_set_assoc(aead_req, &assoc, assoc.length);
 140 -       aead_request_set_crypt(aead_req, ct, &pt,
 141 -                              data_len + IEEE80211_CCMP_MIC_LEN, b_0);
 142 +       int i, j, last_len, num_blocks;
 143 +       u8 *pos, *cpos, *b, *s_0, *a, *b_0;
 144 +
 145 +       b = scratch;
 146 +       s_0 = scratch + AES_BLOCK_SIZE;
 147 +       a = scratch + 2 * AES_BLOCK_SIZE;
 148 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
 149 +
 150 +       num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_SIZE);
 151 +       last_len = data_len % AES_BLOCK_SIZE;
 152 +       aes_ccm_prepare(tfm, scratch, a);
 153 +
 154 +       /* Process payload blocks */
 155 +       cpos = cdata;
 156 +       pos = data;
 157 +       for (j = 1; j <= num_blocks; j++) {
 158 +               int blen = (j == num_blocks && last_len) ?
 159 +                       last_len : AES_BLOCK_SIZE;
 160 +
 161 +               /* Decryption followed by authentication */
 162 +               b_0[14] = (j >> 8) & 0xff;
 163 +               b_0[15] = j & 0xff;
 164 +               crypto_cipher_encrypt_one(tfm, b, b_0);
 165 +               for (i = 0; i < blen; i++) {
 166 +                       *pos = *cpos++ ^ b[i];
 167 +                       a[i] ^= *pos++;
 168 +               }
 169 +               crypto_cipher_encrypt_one(tfm, a, a);
 170 +       }
 171 +
 172 +       for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++) {
 173 +               if ((mic[i] ^ s_0[i]) != a[i])
 174 +                       return -1;
 175 +       }
 176
 177 -       return crypto_aead_decrypt(aead_req);
 178 +       return 0;
 179  }
 180
 181 -struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[])
 182 +
 183 +struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 184  {
 185 -       struct crypto_aead *tfm;
 186 -       int err;
 187 +       struct crypto_cipher *tfm;
 188
 189 -       tfm = crypto_alloc_aead("ccm(aes)", 0, CRYPTO_ALG_ASYNC);
 190 -       if (IS_ERR(tfm))
 191 -               return tfm;
 192 -
 193 -       err = crypto_aead_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 194 -       if (!err)
 195 -               err = crypto_aead_setauthsize(tfm, IEEE80211_CCMP_MIC_LEN);
 196 -       if (!err)
 197 -               return tfm;
 198 +       tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
 199 +       if (!IS_ERR(tfm))
 200 +               crypto_cipher_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 201
 202 -       crypto_free_aead(tfm);
 203 -       return ERR_PTR(err);
 204 +       return tfm;
 205  }
 206
 207 -void ieee80211_aes_key_free(struct crypto_aead *tfm)
 208 +
 209 +void ieee80211_aes_key_free(struct crypto_cipher *tfm)
 210  {
 211 -       crypto_free_aead(tfm);
 212 +       crypto_free_cipher(tfm);
 213  }
 214 --- a/net/mac80211/aes_ccm.h
 215 +++ b/net/mac80211/aes_ccm.h
 216 @@ -12,11 +12,13 @@
 217
 218  #include <linux/crypto.h>
 219
 220 -struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[]);
 221 -void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
 222 -                              u8 *data, size_t data_len, u8 *mic);
 223 -int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
 224 -                             u8 *data, size_t data_len, u8 *mic);
 225 -void ieee80211_aes_key_free(struct crypto_aead *tfm);
 226 +struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[]);
 227 +void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
 228 +                              u8 *data, size_t data_len,
 229 +                              u8 *cdata, u8 *mic);
 230 +int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
 231 +                             u8 *cdata, size_t data_len,
 232 +                             u8 *mic, u8 *data);
 233 +void ieee80211_aes_key_free(struct crypto_cipher *tfm);
 234
 235  #endif /* AES_CCM_H */
 236 --- a/net/mac80211/key.h
 237 +++ b/net/mac80211/key.h
 238 @@ -84,7 +84,7 @@ struct ieee80211_key {
 239                          * Management frames.
 240                          */
 241                         u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
 242 -                       struct crypto_aead *tfm;
 243 +                       struct crypto_cipher *tfm;
 244                         u32 replays; /* dot11RSNAStatsCCMPReplays */
 245                 } ccmp;
 246                 struct {
 247 --- a/net/mac80211/wpa.c
 248 +++ b/net/mac80211/wpa.c
 249 @@ -302,15 +302,22 @@ ieee80211_crypto_tkip_decrypt(struct iee
 250  }
 251
 252
 253 -static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *b_0, u8 *aad)
 254 +static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
 255 +                               int encrypted)
 256  {
 257         __le16 mask_fc;
 258         int a4_included, mgmt;
 259         u8 qos_tid;
 260 -       u16 len_a;
 261 +       u8 *b_0, *aad;
 262 +       u16 data_len, len_a;
 263         unsigned int hdrlen;
 264         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 265
 266 +       memset(scratch, 0, 6 * AES_BLOCK_SIZE);
 267 +
 268 +       b_0 = scratch + 3 * AES_BLOCK_SIZE;
 269 +       aad = scratch + 4 * AES_BLOCK_SIZE;
 270 +
 271         /*
 272          * Mask FC: zero subtype b4 b5 b6 (if not mgmt)
 273          * Retry, PwrMgt, MoreData; set Protected
 274 @@ -332,21 +339,20 @@ static void ccmp_special_blocks(struct s
 275         else
 276                 qos_tid = 0;
 277
 278 -       /* In CCM, the initial vectors (IV) used for CTR mode encryption and CBC
 279 -        * mode authentication are not allowed to collide, yet both are derived
 280 -        * from this vector b_0. We only set L := 1 here to indicate that the
 281 -        * data size can be represented in (L+1) bytes. The CCM layer will take
 282 -        * care of storing the data length in the top (L+1) bytes and setting
 283 -        * and clearing the other bits as is required to derive the two IVs.
 284 -        */
 285 -       b_0[0] = 0x1;
 286 +       data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN;
 287 +       if (encrypted)
 288 +               data_len -= IEEE80211_CCMP_MIC_LEN;
 289
 290 +       /* First block, b_0 */
 291 +       b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
 292         /* Nonce: Nonce Flags | A2 | PN
 293          * Nonce Flags: Priority (b0..b3) | Management (b4) | Reserved (b5..b7)
 294          */
 295         b_0[1] = qos_tid | (mgmt << 4);
 296         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
 297         memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
 298 +       /* l(m) */
 299 +       put_unaligned_be16(data_len, &b_0[14]);
 300
 301         /* AAD (extra authenticate-only data) / masked 802.11 header
 302          * FC | A1 | A2 | A3 | SC | [A4] | [QC] */
 303 @@ -402,8 +408,7 @@ static int ccmp_encrypt_skb(struct ieee8
 304         u8 *pos;
 305         u8 pn[6];
 306         u64 pn64;
 307 -       u8 aad[2 * AES_BLOCK_SIZE];
 308 -       u8 b_0[AES_BLOCK_SIZE];
 309 +       u8 scratch[6 * AES_BLOCK_SIZE];
 310
 311         if (info->control.hw_key &&
 312             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
 313 @@ -457,9 +462,9 @@ static int ccmp_encrypt_skb(struct ieee8
 314                 return 0;
 315
 316         pos += IEEE80211_CCMP_HDR_LEN;
 317 -       ccmp_special_blocks(skb, pn, b_0, aad);
 318 -       ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, b_0, aad, pos, len,
 319 -                                 skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 320 +       ccmp_special_blocks(skb, pn, scratch, 0);
 321 +       ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, pos, len,
 322 +                                 pos, skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 323
 324         return 0;
 325  }
 326 @@ -522,16 +527,16 @@ ieee80211_crypto_ccmp_decrypt(struct iee
 327         }
 328
 329         if (!(status->flag & RX_FLAG_DECRYPTED)) {
 330 -               u8 aad[2 * AES_BLOCK_SIZE];
 331 -               u8 b_0[AES_BLOCK_SIZE];
 332 +               u8 scratch[6 * AES_BLOCK_SIZE];
 333                 /* hardware didn't decrypt/verify MIC */
 334 -               ccmp_special_blocks(skb, pn, b_0, aad);
 335 +               ccmp_special_blocks(skb, pn, scratch, 1);
 336
 337                 if (ieee80211_aes_ccm_decrypt(
 338 -                           key->u.ccmp.tfm, b_0, aad,
 339 +                           key->u.ccmp.tfm, scratch,
 340                             skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
 341                             data_len,
 342 -                           skb->data + skb->len - IEEE80211_CCMP_MIC_LEN))
 343 +                           skb->data + skb->len - IEEE80211_CCMP_MIC_LEN,
 344 +                           skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN))
 345                         return RX_DROP_UNUSABLE;
 346         }
 347