cf3948a8d3f476f0b6cdc0f1999e51be5b94cc9a
[openwrt/svn-archive/archive.git] / package / madwifi / patches / 309-micfail_detect.patch
1 Index: madwifi-ng-r2799-20071030/ath/if_ath.c
2 ===================================================================
3 --- madwifi-ng-r2799-20071030.orig/ath/if_ath.c 2007-10-31 14:04:51.797573253 +0100
4 +++ madwifi-ng-r2799-20071030/ath/if_ath.c 2007-10-31 14:04:52.073588984 +0100
5 @@ -5743,6 +5743,7 @@
6 u_int64_t rs_tsf;
7 u_int processed = 0, early_stop = 0;
8 u_int rx_limit = dev->quota;
9 + u_int mic_fail = 0;
10
11 DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s\n", __func__);
12 process_rx_again:
13 @@ -5839,24 +5840,7 @@
14 }
15 if (rs->rs_status & HAL_RXERR_MIC) {
16 sc->sc_stats.ast_rx_badmic++;
17 - /*
18 - * Do minimal work required to hand off
19 - * the 802.11 header for notification.
20 - */
21 - /* XXX frag's and QoS frames */
22 - if (len >= sizeof (struct ieee80211_frame)) {
23 - bus_dma_sync_single(sc->sc_bdev,
24 - bf->bf_skbaddr, len,
25 - BUS_DMA_FROMDEVICE);
26 -#if 0
27 -/* XXX revalidate MIC, lookup ni to find VAP */
28 - ieee80211_notify_michael_failure(ic,
29 - (struct ieee80211_frame *) skb->data,
30 - sc->sc_splitmic ?
31 - rs->rs_keyix - 32 : rs->rs_keyix
32 - );
33 -#endif
34 - }
35 + mic_fail = 1;
36 }
37 /*
38 * Reject error frames if we have no vaps that
39 @@ -5920,8 +5904,9 @@
40 /*
41 * Finished monitor mode handling, now reject
42 * error frames before passing to other vaps
43 + * Ignore MIC failures here, as we need to recheck them
44 */
45 - if (rs->rs_status != 0) {
46 + if (rs->rs_status & ~(HAL_RXERR_MIC | HAL_RXERR_DECRYPT)) {
47 dev_kfree_skb(skb);
48 skb = NULL;
49 goto rx_next;
50 @@ -5952,6 +5937,27 @@
51 sc->sc_hwmap[rs->rs_rate].ieeerate,
52 rs->rs_rssi);
53
54 + /* MIC failure. Drop the packet in any case */
55 + if (mic_fail) {
56 + /* Ignore control frames which are reported with mic error */
57 + if ((((struct ieee80211_frame *)skb->data)->i_fc[0] &
58 + IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
59 + goto drop_micfail;
60 +
61 + ni = ieee80211_find_rxnode(ic, (const struct ieee80211_frame_min *) skb->data);
62 +
63 + if (ni && ni->ni_table) {
64 + ieee80211_check_mic(ni, skb);
65 + ieee80211_unref_node(&ni);
66 + }
67 +
68 +drop_micfail:
69 + dev_kfree_skb_any(skb);
70 + skb = NULL;
71 + mic_fail = 0;
72 + goto rx_next;
73 + }
74 +
75 /*
76 * Locate the node for sender, track state, and then
77 * pass the (referenced) node up to the 802.11 layer
78 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_ccmp.c
79 ===================================================================
80 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_crypto_ccmp.c 2007-10-31 14:04:49.913465886 +0100
81 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_ccmp.c 2007-10-31 14:04:52.073588984 +0100
82 @@ -73,7 +73,7 @@
83 static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
84 static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
85 static int ccmp_enmic(struct ieee80211_key *, struct sk_buff *, int);
86 -static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int);
87 +static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int, int);
88
89 static const struct ieee80211_cipher ccmp = {
90 .ic_name = "AES-CCM",
91 @@ -308,7 +308,7 @@
92 * Verify and strip MIC from the frame.
93 */
94 static int
95 -ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
96 +ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
97 {
98 return 1;
99 }
100 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_crypto.h
101 ===================================================================
102 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_crypto.h 2007-10-31 14:04:46.109249096 +0100
103 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_crypto.h 2007-10-31 14:04:52.073588984 +0100
104 @@ -145,7 +145,7 @@
105 int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
106 int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
107 int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
108 - int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int);
109 + int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int, int);
110 };
111 extern const struct ieee80211_cipher ieee80211_cipher_none;
112
113 @@ -163,10 +163,10 @@
114 */
115 static __inline int
116 ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
117 - struct sk_buff *skb, int hdrlen)
118 + struct sk_buff *skb, int hdrlen, int force)
119 {
120 const struct ieee80211_cipher *cip = k->wk_cipher;
121 - return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen) : 1);
122 + return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen, force) : 1);
123 }
124
125 /*
126 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_none.c
127 ===================================================================
128 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_crypto_none.c 2007-10-31 14:04:46.113249322 +0100
129 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_none.c 2007-10-31 14:04:52.073588984 +0100
130 @@ -52,7 +52,7 @@
131 static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
132 static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
133 static int none_enmic(struct ieee80211_key *, struct sk_buff *, int);
134 -static int none_demic(struct ieee80211_key *, struct sk_buff *, int);
135 +static int none_demic(struct ieee80211_key *, struct sk_buff *, int, int);
136
137 const struct ieee80211_cipher ieee80211_cipher_none = {
138 .ic_name = "NONE",
139 @@ -137,7 +137,7 @@
140 }
141
142 static int
143 -none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
144 +none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
145 {
146 struct ieee80211vap *vap = k->wk_private;
147
148 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_tkip.c
149 ===================================================================
150 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_crypto_tkip.c 2007-10-31 14:04:46.121249780 +0100
151 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_tkip.c 2007-10-31 14:04:52.077589210 +0100
152 @@ -57,7 +57,7 @@
153 static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
154 static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
155 static int tkip_decap(struct ieee80211_key *, struct sk_buff *, int);
156 -static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int);
157 +static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int, int);
158
159 static const struct ieee80211_cipher tkip = {
160 .ic_name = "TKIP",
161 @@ -339,7 +339,7 @@
162 * Verify and strip MIC from the frame.
163 */
164 static int
165 -tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen)
166 +tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen, int force)
167 {
168 struct tkip_ctx *ctx = k->wk_private;
169 struct sk_buff *skb;
170 @@ -355,7 +355,7 @@
171 }
172 wh = (struct ieee80211_frame *) skb0->data;
173 /* NB: skb left pointing at last in chain */
174 - if (k->wk_flags & IEEE80211_KEY_SWMIC) {
175 + if ((k->wk_flags & IEEE80211_KEY_SWMIC) || force) {
176 struct ieee80211vap *vap = ctx->tc_vap;
177 u8 mic[IEEE80211_WEP_MICLEN];
178 u8 mic0[IEEE80211_WEP_MICLEN];
179 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_wep.c
180 ===================================================================
181 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_crypto_wep.c 2007-10-31 14:04:46.129250236 +0100
182 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_crypto_wep.c 2007-10-31 14:04:52.077589210 +0100
183 @@ -54,7 +54,7 @@
184 static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
185 static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
186 static int wep_enmic(struct ieee80211_key *, struct sk_buff *, int);
187 -static int wep_demic(struct ieee80211_key *, struct sk_buff *, int);
188 +static int wep_demic(struct ieee80211_key *, struct sk_buff *, int, int);
189
190 static const struct ieee80211_cipher wep = {
191 .ic_name = "WEP",
192 @@ -244,7 +244,7 @@
193 * Verify and strip MIC from the frame.
194 */
195 static int
196 -wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
197 +wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
198 {
199 return 1;
200 }
201 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_input.c
202 ===================================================================
203 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_input.c 2007-10-31 14:04:51.801573482 +0100
204 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_input.c 2007-10-31 14:04:52.081589439 +0100
205 @@ -632,7 +632,7 @@
206 * Next strip any MSDU crypto bits.
207 */
208 if (key != NULL &&
209 - !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
210 + !ieee80211_crypto_demic(vap, key, skb, hdrspace, 0)) {
211 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
212 ni->ni_macaddr, "data", "%s", "demic error");
213 IEEE80211_NODE_STAT(ni, rx_demicfail);
214 @@ -3781,6 +3781,47 @@
215 }
216 #endif
217
218 +/*
219 + * Process a frame w/ hw detected MIC failure.
220 + * The frame will be dropped in any case.
221 + */
222 +void
223 +ieee80211_check_mic(struct ieee80211_node *ni, struct sk_buff *skb)
224 +{
225 + struct ieee80211vap *vap = ni->ni_vap;
226 +
227 + struct ieee80211_frame *wh;
228 + struct ieee80211_key *key;
229 + int hdrspace;
230 + struct ieee80211com *ic = vap->iv_ic;
231 +
232 + if (skb->len < sizeof(struct ieee80211_frame_min)) {
233 + IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
234 + ni->ni_macaddr, NULL,
235 + "too short (1): len %u", skb->len);
236 + vap->iv_stats.is_rx_tooshort++;
237 + return;
238 + }
239 +
240 + wh = (struct ieee80211_frame *)skb->data;
241 +
242 + hdrspace = ieee80211_hdrspace(ic, wh);
243 + key = ieee80211_crypto_decap(ni, skb, hdrspace);
244 + if (key == NULL) {
245 + /* NB: stats+msgs handled in crypto_decap */
246 + IEEE80211_NODE_STAT(ni, rx_wepfail);
247 + return;
248 + }
249 +
250 + if (!ieee80211_crypto_demic(vap, key, skb, hdrspace, 1)) {
251 + IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
252 + ni->ni_macaddr, "data", "%s", "demic error");
253 + IEEE80211_NODE_STAT(ni, rx_demicfail);
254 + }
255 + return;
256 +}
257 +EXPORT_SYMBOL(ieee80211_check_mic);
258 +
259 #ifdef IEEE80211_DEBUG
260 /*
261 * Debugging support.
262 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_proto.h
263 ===================================================================
264 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_proto.h 2007-10-31 14:04:46.141250920 +0100
265 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_proto.h 2007-10-31 14:04:52.081589439 +0100
266 @@ -91,6 +91,7 @@
267 void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
268 enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
269 void ieee80211_send_pspoll(struct ieee80211_node *);
270 +void ieee80211_check_mic(struct ieee80211_node *, struct sk_buff *);
271
272 /*
273 * Return the size of the 802.11 header for a management or data frame.
274 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_linux.c
275 ===================================================================
276 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_linux.c 2007-10-31 14:04:49.705454030 +0100
277 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_linux.c 2007-10-31 14:04:52.081589439 +0100
278 @@ -339,8 +339,8 @@
279 /* TODO: needed parameters: count, keyid, key type, src address, TSC */
280 snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
281 k->wk_keyix,
282 - IEEE80211_IS_MULTICAST(wh->i_addr1) ? "broad" : "uni",
283 - ether_sprintf(wh->i_addr1));
284 + IEEE80211_IS_MULTICAST(wh->i_addr2) ? "broad" : "uni",
285 + ether_sprintf(wh->i_addr2));
286 memset(&wrqu, 0, sizeof(wrqu));
287 wrqu.data.length = strlen(buf);
288 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
289 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_output.c
290 ===================================================================
291 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_output.c 2007-10-31 14:04:46.157251830 +0100
292 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_output.c 2007-10-31 14:04:52.081589439 +0100
293 @@ -1079,13 +1079,16 @@
294 cip = (struct ieee80211_cipher *) key->wk_cipher;
295 ciphdrsize = cip->ic_header;
296 tailsize += (cip->ic_trailer + cip->ic_miclen);
297 +
298 + /* add the 8 bytes MIC length */
299 + if (cip->ic_cipher == IEEE80211_CIPHER_TKIP)
300 + pktlen += IEEE80211_WEP_MICLEN;
301 }
302
303 pdusize = vap->iv_fragthreshold - (hdrsize_nopad + ciphdrsize);
304 fragcnt = *framecnt =
305 - ((pktlen - (hdrsize_nopad + ciphdrsize)) / pdusize) +
306 - (((pktlen - (hdrsize_nopad + ciphdrsize)) %
307 - pdusize == 0) ? 0 : 1);
308 + ((pktlen - hdrsize_nopad) / pdusize) +
309 + (((pktlen - hdrsize_nopad) % pdusize == 0) ? 0 : 1);
310
311 /*
312 * Allocate sk_buff for each subsequent fragment; First fragment
313 Index: madwifi-ng-r2799-20071030/net80211/ieee80211_node.c
314 ===================================================================
315 --- madwifi-ng-r2799-20071030.orig/net80211/ieee80211_node.c 2007-10-31 14:04:51.805573711 +0100
316 +++ madwifi-ng-r2799-20071030/net80211/ieee80211_node.c 2007-10-31 14:04:52.085589669 +0100
317 @@ -1884,11 +1884,13 @@
318 /* From this point onwards we can no longer find the node,
319 * so no more references are generated
320 */
321 - ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
322 - ieee80211_del_wds_node(nt, ni);
323 - IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
324 - _node_table_leave(nt, ni);
325 - IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
326 + if (nt) {
327 + ieee80211_remove_wds_addr(nt, ni->ni_macaddr);
328 + ieee80211_del_wds_node(nt, ni);
329 + IEEE80211_NODE_TABLE_LOCK_IRQ(nt);
330 + _node_table_leave(nt, ni);
331 + IEEE80211_NODE_TABLE_UNLOCK_IRQ(nt);
332 + }
333
334 /*
335 * If node wasn't previously associated all