update madwifi to latest rev - works around some crashiness
[openwrt/svn-archive/archive.git] / package / madwifi / patches / 309-micfail_detect.patch
1 Index: madwifi-ng-r2834-20071106/ath/if_ath.c
2 ===================================================================
3 --- madwifi-ng-r2834-20071106.orig/ath/if_ath.c 2007-11-07 14:02:05.345675505 +0100
4 +++ madwifi-ng-r2834-20071106/ath/if_ath.c 2007-11-07 14:02:05.625691466 +0100
5 @@ -5743,6 +5743,7 @@
6 u_int64_t rs_tsf;
7 u_int processed = 0, early_stop = 0;
8 u_int rx_limit = dev->quota;
9 + u_int mic_fail = 0;
10
11 DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
12 process_rx_again:
13 @@ -5839,24 +5840,8 @@
14 }
15 if (rs->rs_status & HAL_RXERR_MIC) {
16 sc->sc_stats.ast_rx_badmic++;
17 - /*
18 - * Do minimal work required to hand off
19 - * the 802.11 header for notification.
20 - */
21 - /* XXX frag's and QoS frames */
22 - if (len >= sizeof (struct ieee80211_frame)) {
23 - bus_dma_sync_single(sc->sc_bdev,
24 - bf->bf_skbaddr, len,
25 - BUS_DMA_FROMDEVICE);
26 -#if 0
27 -/* XXX revalidate MIC, lookup ni to find VAP */
28 - ieee80211_notify_michael_failure(ic,
29 - (struct ieee80211_frame *) skb->data,
30 - sc->sc_splitmic ?
31 - rs->rs_keyix - 32 : rs->rs_keyix
32 - );
33 -#endif
34 - }
35 + mic_fail = 1;
36 + goto rx_accept;
37 }
38 /*
39 * Reject error frames if we have no vaps that
40 @@ -5920,8 +5905,9 @@
41 /*
42 * Finished monitor mode handling, now reject
43 * error frames before passing to other vaps
44 + * Ignore MIC failures here, as we need to recheck them
45 */
46 - if (rs->rs_status != 0) {
47 + if (rs->rs_status & ~(HAL_RXERR_MIC | HAL_RXERR_DECRYPT)) {
48 dev_kfree_skb(skb);
49 skb = NULL;
50 goto rx_next;
51 @@ -5930,6 +5916,26 @@
52 /* remove the CRC */
53 skb_trim(skb, skb->len - IEEE80211_CRC_LEN);
54
55 + if (mic_fail) {
56 + /* Ignore control frames which are reported with mic error */
57 + if ((((struct ieee80211_frame *)skb->data)->i_fc[0] &
58 + IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
59 + goto drop_micfail;
60 +
61 + ni = ieee80211_find_rxnode(ic, (const struct ieee80211_frame_min *) skb->data);
62 +
63 + if (ni && ni->ni_table) {
64 + ieee80211_check_mic(ni, skb);
65 + ieee80211_unref_node(&ni);
66 + }
67 +
68 +drop_micfail:
69 + dev_kfree_skb_any(skb);
70 + skb = NULL;
71 + mic_fail = 0;
72 + goto rx_next;
73 + }
74 +
75 /*
76 * From this point on we assume the frame is at least
77 * as large as ieee80211_frame_min; verify that.
78 @@ -5952,6 +5958,7 @@
79 sc->sc_hwmap[rs->rs_rate].ieeerate,
80 rs->rs_rssi);
81
82 + /* MIC failure. Drop the packet in any case */
83 /*
84 * Locate the node for sender, track state, and then
85 * pass the (referenced) node up to the 802.11 layer
86 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_ccmp.c
87 ===================================================================
88 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_ccmp.c 2007-11-07 14:02:03.345561529 +0100
89 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_ccmp.c 2007-11-07 14:02:05.625691466 +0100
90 @@ -73,7 +73,7 @@
91 static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
92 static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
93 static int ccmp_enmic(struct ieee80211_key *, struct sk_buff *, int);
94 -static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int);
95 +static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int, int);
96
97 static const struct ieee80211_cipher ccmp = {
98 .ic_name = "AES-CCM",
99 @@ -308,7 +308,7 @@
100 * Verify and strip MIC from the frame.
101 */
102 static int
103 -ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
104 +ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
105 {
106 return 1;
107 }
108 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto.h
109 ===================================================================
110 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto.h 2007-11-07 14:01:58.929309860 +0100
111 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto.h 2007-11-07 14:02:05.633691920 +0100
112 @@ -145,7 +145,7 @@
113 int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
114 int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
115 int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
116 - int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int);
117 + int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int, int);
118 };
119 extern const struct ieee80211_cipher ieee80211_cipher_none;
120
121 @@ -163,10 +163,10 @@
122 */
123 static __inline int
124 ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
125 - struct sk_buff *skb, int hdrlen)
126 + struct sk_buff *skb, int hdrlen, int force)
127 {
128 const struct ieee80211_cipher *cip = k->wk_cipher;
129 - return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen) : 1);
130 + return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen, force) : 1);
131 }
132
133 /*
134 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_none.c
135 ===================================================================
136 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_none.c 2007-11-07 14:01:58.937310316 +0100
137 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_none.c 2007-11-07 14:02:05.633691920 +0100
138 @@ -52,7 +52,7 @@
139 static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
140 static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
141 static int none_enmic(struct ieee80211_key *, struct sk_buff *, int);
142 -static int none_demic(struct ieee80211_key *, struct sk_buff *, int);
143 +static int none_demic(struct ieee80211_key *, struct sk_buff *, int, int);
144
145 const struct ieee80211_cipher ieee80211_cipher_none = {
146 .ic_name = "NONE",
147 @@ -137,7 +137,7 @@
148 }
149
150 static int
151 -none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
152 +none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
153 {
154 struct ieee80211vap *vap = k->wk_private;
155
156 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_tkip.c
157 ===================================================================
158 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_tkip.c 2007-11-07 14:01:58.945310770 +0100
159 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_tkip.c 2007-11-07 14:02:05.633691920 +0100
160 @@ -57,7 +57,7 @@
161 static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
162 static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
163 static int tkip_decap(struct ieee80211_key *, struct sk_buff *, int);
164 -static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int);
165 +static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int, int);
166
167 static const struct ieee80211_cipher tkip = {
168 .ic_name = "TKIP",
169 @@ -339,7 +339,7 @@
170 * Verify and strip MIC from the frame.
171 */
172 static int
173 -tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen)
174 +tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen, int force)
175 {
176 struct tkip_ctx *ctx = k->wk_private;
177 struct sk_buff *skb;
178 @@ -355,7 +355,7 @@
179 }
180 wh = (struct ieee80211_frame *) skb0->data;
181 /* NB: skb left pointing at last in chain */
182 - if (k->wk_flags & IEEE80211_KEY_SWMIC) {
183 + if ((k->wk_flags & IEEE80211_KEY_SWMIC) || force) {
184 struct ieee80211vap *vap = ctx->tc_vap;
185 u8 mic[IEEE80211_WEP_MICLEN];
186 u8 mic0[IEEE80211_WEP_MICLEN];
187 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_wep.c
188 ===================================================================
189 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_crypto_wep.c 2007-11-07 14:01:58.953311229 +0100
190 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_crypto_wep.c 2007-11-07 14:02:05.633691920 +0100
191 @@ -54,7 +54,7 @@
192 static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
193 static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
194 static int wep_enmic(struct ieee80211_key *, struct sk_buff *, int);
195 -static int wep_demic(struct ieee80211_key *, struct sk_buff *, int);
196 +static int wep_demic(struct ieee80211_key *, struct sk_buff *, int, int);
197
198 static const struct ieee80211_cipher wep = {
199 .ic_name = "WEP",
200 @@ -244,7 +244,7 @@
201 * Verify and strip MIC from the frame.
202 */
203 static int
204 -wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
205 +wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
206 {
207 return 1;
208 }
209 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_input.c
210 ===================================================================
211 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_input.c 2007-11-07 14:02:05.349675734 +0100
212 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_input.c 2007-11-07 14:02:05.637692150 +0100
213 @@ -632,7 +632,7 @@
214 * Next strip any MSDU crypto bits.
215 */
216 if (key != NULL &&
217 - !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
218 + !ieee80211_crypto_demic(vap, key, skb, hdrspace, 0)) {
219 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
220 ni->ni_macaddr, "data", "%s", "demic error");
221 IEEE80211_NODE_STAT(ni, rx_demicfail);
222 @@ -3781,6 +3781,47 @@
223 }
224 #endif
225
226 +/*
227 + * Process a frame w/ hw detected MIC failure.
228 + * The frame will be dropped in any case.
229 + */
230 +void
231 +ieee80211_check_mic(struct ieee80211_node *ni, struct sk_buff *skb)
232 +{
233 + struct ieee80211vap *vap = ni->ni_vap;
234 +
235 + struct ieee80211_frame *wh;
236 + struct ieee80211_key *key;
237 + int hdrspace;
238 + struct ieee80211com *ic = vap->iv_ic;
239 +
240 + if (skb->len < sizeof(struct ieee80211_frame_min)) {
241 + IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
242 + ni->ni_macaddr, NULL,
243 + "too short (1): len %u", skb->len);
244 + vap->iv_stats.is_rx_tooshort++;
245 + return;
246 + }
247 +
248 + wh = (struct ieee80211_frame *)skb->data;
249 +
250 + hdrspace = ieee80211_hdrspace(ic, wh);
251 + key = ieee80211_crypto_decap(ni, skb, hdrspace);
252 + if (key == NULL) {
253 + /* NB: stats+msgs handled in crypto_decap */
254 + IEEE80211_NODE_STAT(ni, rx_wepfail);
255 + return;
256 + }
257 +
258 + if (!ieee80211_crypto_demic(vap, key, skb, hdrspace, 1)) {
259 + IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
260 + ni->ni_macaddr, "data", "%s", "demic error");
261 + IEEE80211_NODE_STAT(ni, rx_demicfail);
262 + }
263 + return;
264 +}
265 +EXPORT_SYMBOL(ieee80211_check_mic);
266 +
267 #ifdef IEEE80211_DEBUG
268 /*
269 * Debugging support.
270 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_proto.h
271 ===================================================================
272 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_proto.h 2007-11-07 14:01:58.965311910 +0100
273 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_proto.h 2007-11-07 14:02:05.637692150 +0100
274 @@ -91,6 +91,7 @@
275 void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
276 enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
277 void ieee80211_send_pspoll(struct ieee80211_node *);
278 +void ieee80211_check_mic(struct ieee80211_node *, struct sk_buff *);
279
280 /*
281 * Return the size of the 802.11 header for a management or data frame.
282 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_linux.c
283 ===================================================================
284 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_linux.c 2007-11-07 14:02:03.137549672 +0100
285 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_linux.c 2007-11-07 14:02:05.641692376 +0100
286 @@ -339,8 +339,8 @@
287 /* TODO: needed parameters: count, keyid, key type, src address, TSC */
288 snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
289 k->wk_keyix,
290 - IEEE80211_IS_MULTICAST(wh->i_addr1) ? "broad" : "uni",
291 - ether_sprintf(wh->i_addr1));
292 + IEEE80211_IS_MULTICAST(wh->i_addr2) ? "broad" : "uni",
293 + ether_sprintf(wh->i_addr2));
294 memset(&wrqu, 0, sizeof(wrqu));
295 wrqu.data.length = strlen(buf);
296 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
297 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_output.c
298 ===================================================================
299 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_output.c 2007-11-07 14:01:58.981312821 +0100
300 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_output.c 2007-11-07 14:02:05.641692376 +0100
301 @@ -1079,13 +1079,16 @@
302 cip = (struct ieee80211_cipher *) key->wk_cipher;
303 ciphdrsize = cip->ic_header;
304 tailsize += (cip->ic_trailer + cip->ic_miclen);
305 +
306 + /* add the 8 bytes MIC length */
307 + if (cip->ic_cipher == IEEE80211_CIPHER_TKIP)
308 + pktlen += IEEE80211_WEP_MICLEN;
309 }
310
311 pdusize = vap->iv_fragthreshold - (hdrsize_nopad + ciphdrsize);
312 fragcnt = *framecnt =
313 - ((pktlen - (hdrsize_nopad + ciphdrsize)) / pdusize) +
314 - (((pktlen - (hdrsize_nopad + ciphdrsize)) %
315 - pdusize == 0) ? 0 : 1);
316 + ((pktlen - hdrsize_nopad) / pdusize) +
317 + (((pktlen - hdrsize_nopad) % pdusize == 0) ? 0 : 1);
318
319 /*
320 * Allocate sk_buff for each subsequent fragment; First fragment
321 Index: madwifi-ng-r2834-20071106/net80211/ieee80211_node.c
322 ===================================================================
323 --- madwifi-ng-r2834-20071106.orig/net80211/ieee80211_node.c 2007-11-07 14:02:05.357676193 +0100
324 +++ madwifi-ng-r2834-20071106/net80211/ieee80211_node.c 2007-11-07 14:02:05.645692605 +0100
325 @@ -1899,11 +1899,13 @@
326 /* From this point onwards we can no longer find the node,
327 * so no more references are generated
328 */
329 - ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
330 - ieee80211_del_wds_node(nt, ni);
331 - IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
332 - _node_table_leave(nt, ni);
333 - IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
334 + if (nt) {
335 + ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
336 + ieee80211_del_wds_node(nt, ni);
337 + IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
338 + _node_table_leave(nt, ni);
339 + IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
340 + }
341
342 /*
343 * If node wasn't previously associated all