package/madwifi/patches/309-micfail_detect.patch

   1 diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
   2 --- madwifi.old/ath/if_ath.c    2007-05-21 07:53:37.247279824 +0200
   3 +++ madwifi.dev/ath/if_ath.c    2007-05-21 07:55:23.290158856 +0200
   4 @@ -5598,6 +5598,7 @@
   5         u_int phyerr;
   6         int processed = 0, early_stop = 0;
   7         int rx_limit = dev->quota;
   8 +       int mic_fail = 0;
   9
  10         /* Let the 802.11 layer know about the new noise floor */
  11         ic->ic_channoise = sc->sc_channoise;
  12 @@ -5692,31 +5693,16 @@
  13                         }
  14                         if (rs->rs_status & HAL_RXERR_MIC) {
  15                                 sc->sc_stats.ast_rx_badmic++;
  16 -                               /*
  17 -                                * Do minimal work required to hand off
  18 -                                * the 802.11 header for notification.
  19 -                                */
  20 -                               /* XXX frag's and QoS frames */
  21 -                               len = rs->rs_datalen;
  22 -                               if (len >= sizeof (struct ieee80211_frame)) {
  23 -                                       bus_dma_sync_single(sc->sc_bdev,
  24 -                                           bf->bf_skbaddr, len,
  25 -                                           BUS_DMA_FROMDEVICE);
  26 -#if 0
  27 -/* XXX revalidate MIC, lookup ni to find VAP */
  28 -                                       ieee80211_notify_michael_failure(ic,
  29 -                                           (struct ieee80211_frame *) skb->data,
  30 -                                           sc->sc_splitmic ?
  31 -                                               rs->rs_keyix - 32 : rs->rs_keyix
  32 -                                       );
  33 -#endif
  34 -                               }
  35 +                               mic_fail = 1;
  36                         }
  37                         /*
  38                          * Reject error frames if we have no vaps that
  39                          * are operating in monitor mode.
  40                          */
  41 -                       if(sc->sc_nmonvaps == 0) goto rx_next;
  42 +                       if ((rs->rs_status & ~HAL_RXERR_MIC) &&
  43 +                               ((rs->rs_status &~ HAL_RXERR_DECRYPT) ||
  44 +                            (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)))
  45 +                                       goto rx_next;
  46                 }
  47  rx_accept:
  48                 /*
  49 @@ -5800,6 +5786,20 @@
  50                                    rs->rs_rssi);
  51                 }
  52
  53 +               /* MIC failure. Drop the packet in any case */
  54 +               if (mic_fail) {
  55 +                       ni = ieee80211_find_rxnode(ic,
  56 +                               (const struct ieee80211_frame_min *) skb->data);
  57 +                       if (ni != NULL) {
  58 +                               ieee80211_check_mic(ni, skb);
  59 +                               ieee80211_unref_node(&ni);
  60 +                       }
  61 +                       dev_kfree_skb_any(skb);
  62 +                       skb = NULL;
  63 +                       mic_fail = 0;
  64 +                       goto rx_next;
  65 +               }
  66 +
  67                 /*
  68                  * Locate the node for sender, track state, and then
  69                  * pass the (referenced) node up to the 802.11 layer
  70 diff -ur madwifi.old/net80211/ieee80211_crypto_ccmp.c madwifi.dev/net80211/ieee80211_crypto_ccmp.c
  71 --- madwifi.old/net80211/ieee80211_crypto_ccmp.c        2007-05-18 13:19:16.000000000 +0200
  72 +++ madwifi.dev/net80211/ieee80211_crypto_ccmp.c        2007-05-21 07:54:24.892036720 +0200
  73 @@ -78,7 +78,7 @@
  74  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  75  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
  76  static int ccmp_enmic(struct ieee80211_key *, struct sk_buff *, int);
  77 -static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int);
  78 +static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int, int);
  79
  80  static const struct ieee80211_cipher ccmp = {
  81         .ic_name        = "AES-CCM",
  82 @@ -298,7 +298,7 @@
  83   * Verify and strip MIC from the frame.
  84   */
  85  static int
  86 -ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
  87 +ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
  88  {
  89         return 1;
  90  }
  91 diff -ur madwifi.old/net80211/ieee80211_crypto.h madwifi.dev/net80211/ieee80211_crypto.h
  92 --- madwifi.old/net80211/ieee80211_crypto.h     2007-05-04 15:45:58.000000000 +0200
  93 +++ madwifi.dev/net80211/ieee80211_crypto.h     2007-05-21 07:54:24.893036568 +0200
  94 @@ -145,7 +145,7 @@
  95         int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  96         int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
  97         int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
  98 -       int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int);
  99 +       int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int, int);
 100  };
 101  extern const struct ieee80211_cipher ieee80211_cipher_none;
 102
 103 @@ -163,10 +163,10 @@
 104   */
 105  static __inline int
 106  ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
 107 -       struct sk_buff *skb, int hdrlen)
 108 +       struct sk_buff *skb, int hdrlen, int force)
 109  {
 110         const struct ieee80211_cipher *cip = k->wk_cipher;
 111 -       return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen) : 1);
 112 +       return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen, force) : 1);
 113  }
 114
 115  /*
 116 diff -ur madwifi.old/net80211/ieee80211_crypto_none.c madwifi.dev/net80211/ieee80211_crypto_none.c
 117 --- madwifi.old/net80211/ieee80211_crypto_none.c        2006-09-20 10:45:13.000000000 +0200
 118 +++ madwifi.dev/net80211/ieee80211_crypto_none.c        2007-05-21 07:54:24.893036568 +0200
 119 @@ -52,7 +52,7 @@
 120  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 121  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
 122  static int none_enmic(struct ieee80211_key *, struct sk_buff *, int);
 123 -static int none_demic(struct ieee80211_key *, struct sk_buff *, int);
 124 +static int none_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 125
 126  const struct ieee80211_cipher ieee80211_cipher_none = {
 127         .ic_name        = "NONE",
 128 @@ -137,7 +137,7 @@
 129  }
 130
 131  static int
 132 -none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
 133 +none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
 134  {
 135         struct ieee80211vap *vap = k->wk_private;
 136
 137 diff -ur madwifi.old/net80211/ieee80211_crypto_tkip.c madwifi.dev/net80211/ieee80211_crypto_tkip.c
 138 --- madwifi.old/net80211/ieee80211_crypto_tkip.c        2007-05-18 13:19:16.000000000 +0200
 139 +++ madwifi.dev/net80211/ieee80211_crypto_tkip.c        2007-05-21 07:54:24.893036568 +0200
 140 @@ -57,7 +57,7 @@
 141  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 142  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
 143  static int tkip_decap(struct ieee80211_key *, struct sk_buff *, int);
 144 -static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int);
 145 +static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 146
 147  static const struct ieee80211_cipher tkip  = {
 148         .ic_name        = "TKIP",
 149 @@ -339,7 +339,7 @@
 150   * Verify and strip MIC from the frame.
 151   */
 152  static int
 153 -tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen)
 154 +tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen, int force)
 155  {
 156         struct tkip_ctx *ctx = k->wk_private;
 157         struct sk_buff *skb;
 158 @@ -355,7 +355,7 @@
 159         }
 160         wh = (struct ieee80211_frame *) skb0->data;
 161         /* NB: skb left pointing at last in chain */
 162 -       if (k->wk_flags & IEEE80211_KEY_SWMIC) {
 163 +       if ((k->wk_flags & IEEE80211_KEY_SWMIC) || force) {
 164                 struct ieee80211vap *vap = ctx->tc_vap;
 165                 u8 mic[IEEE80211_WEP_MICLEN];
 166                 u8 mic0[IEEE80211_WEP_MICLEN];
 167 diff -ur madwifi.old/net80211/ieee80211_crypto_wep.c madwifi.dev/net80211/ieee80211_crypto_wep.c
 168 --- madwifi.old/net80211/ieee80211_crypto_wep.c 2006-09-20 10:45:13.000000000 +0200
 169 +++ madwifi.dev/net80211/ieee80211_crypto_wep.c 2007-05-21 07:54:24.894036416 +0200
 170 @@ -54,7 +54,7 @@
 171  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 172  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
 173  static int wep_enmic(struct ieee80211_key *, struct sk_buff *, int);
 174 -static int wep_demic(struct ieee80211_key *, struct sk_buff *, int);
 175 +static int wep_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 176
 177  static const struct ieee80211_cipher wep = {
 178         .ic_name        = "WEP",
 179 @@ -244,7 +244,7 @@
 180   * Verify and strip MIC from the frame.
 181   */
 182  static int
 183 -wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
 184 +wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
 185  {
 186         return 1;
 187  }
 188 diff -ur madwifi.old/net80211/ieee80211_input.c madwifi.dev/net80211/ieee80211_input.c
 189 --- madwifi.old/net80211/ieee80211_input.c      2007-05-21 07:53:37.249279520 +0200
 190 +++ madwifi.dev/net80211/ieee80211_input.c      2007-05-21 07:54:24.895036264 +0200
 191 @@ -654,7 +654,7 @@
 192                  * Next strip any MSDU crypto bits.
 193                  */
 194                 if (key != NULL &&
 195 -                   !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
 196 +                   !ieee80211_crypto_demic(vap, key, skb, hdrspace, 0)) {
 197                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 198                                 ni->ni_macaddr, "data", "%s", "demic error");
 199                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 200 @@ -3778,6 +3778,47 @@
 201  }
 202  #endif
 203
 204 +/*
 205 + * Process a frame w/ hw detected MIC failure.
 206 + * The frame will be dropped in any case.
 207 + */
 208 +void
 209 +ieee80211_check_mic(struct ieee80211_node *ni, struct sk_buff *skb)
 210 +{
 211 +       struct ieee80211vap *vap = ni->ni_vap;
 212 +
 213 +       struct ieee80211_frame *wh;
 214 +       struct ieee80211_key *key;
 215 +       int hdrspace;
 216 +       struct ieee80211com *ic = vap->iv_ic;
 217 +
 218 +       if (skb->len < sizeof(struct ieee80211_frame_min)) {
 219 +               IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 220 +                   ni->ni_macaddr, NULL,
 221 +                   "too short (1): len %u", skb->len);
 222 +               vap->iv_stats.is_rx_tooshort++;
 223 +               return;
 224 +       }
 225 +
 226 +       wh = (struct ieee80211_frame *)skb->data;
 227 +
 228 +       hdrspace = ieee80211_hdrspace(ic, wh);
 229 +       key = ieee80211_crypto_decap(ni, skb, hdrspace);
 230 +       if (key == NULL) {
 231 +               /* NB: stats+msgs handled in crypto_decap */
 232 +               IEEE80211_NODE_STAT(ni, rx_wepfail);
 233 +               return;
 234 +       }
 235 +
 236 +       if (!ieee80211_crypto_demic(vap, key, skb, hdrspace, 1)) {
 237 +               IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 238 +                       ni->ni_macaddr, "data", "%s", "demic error");
 239 +                       IEEE80211_NODE_STAT(ni, rx_demicfail);
 240 +       }
 241 +       return;
 242 +}
 243 +EXPORT_SYMBOL(ieee80211_check_mic);
 244 +
 245  #ifdef IEEE80211_DEBUG
 246  /*
 247   * Debugging support.
 248 diff -ur madwifi.old/net80211/ieee80211_linux.c madwifi.dev/net80211/ieee80211_linux.c
 249 --- madwifi.old/net80211/ieee80211_linux.c      2007-05-21 07:49:54.528138280 +0200
 250 +++ madwifi.dev/net80211/ieee80211_linux.c      2007-05-21 07:54:24.896036112 +0200
 251 @@ -311,8 +311,8 @@
 252
 253         /* TODO: needed parameters: count, keyid, key type, src address, TSC */
 254         snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
 255 -               keyix, IEEE80211_IS_MULTICAST(wh->i_addr1) ?  "broad" : "uni",
 256 -               ether_sprintf(wh->i_addr1));
 257 +               keyix, IEEE80211_IS_MULTICAST(wh->i_addr2) ?  "broad" : "uni",
 258 +               ether_sprintf(wh->i_addr2));
 259         memset(&wrqu, 0, sizeof(wrqu));
 260         wrqu.data.length = strlen(buf);
 261         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 262 diff -ur madwifi.old/net80211/ieee80211_proto.h madwifi.dev/net80211/ieee80211_proto.h
 263 --- madwifi.old/net80211/ieee80211_proto.h      2007-05-21 07:49:54.574131288 +0200
 264 +++ madwifi.dev/net80211/ieee80211_proto.h      2007-05-21 07:54:24.896036112 +0200
 265 @@ -91,6 +91,7 @@
 266  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
 267  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
 268  void ieee80211_send_pspoll(struct ieee80211_node *);
 269 +void ieee80211_check_mic(struct ieee80211_node *, struct sk_buff *);
 270
 271  /*
 272   * Return the size of the 802.11 header for a management or data frame.