package/madwifi/patches/309-micfail_detect.patch

   1 diff -ur madwifi.old/ath/if_ath.c madwifi.dev/ath/if_ath.c
   2 --- madwifi.old/ath/if_ath.c    2007-06-01 11:39:53.078678000 +0200
   3 +++ madwifi.dev/ath/if_ath.c    2007-06-01 11:50:32.819422992 +0200
   4 @@ -5604,6 +5604,7 @@
   5         u_int phyerr;
   6         u_int processed = 0, early_stop = 0;
   7         u_int rx_limit = dev->quota;
   8 +       u_int mic_fail = 0;
   9
  10         /* Let the 802.11 layer know about the new noise floor */
  11         sc->sc_channoise = ath_hal_get_channel_noise(ah, &(sc->sc_curchan));
  12 @@ -5698,25 +5699,7 @@
  13                         }
  14                         if (rs->rs_status & HAL_RXERR_MIC) {
  15                                 sc->sc_stats.ast_rx_badmic++;
  16 -                               /*
  17 -                                * Do minimal work required to hand off
  18 -                                * the 802.11 header for notification.
  19 -                                */
  20 -                               /* XXX frag's and QoS frames */
  21 -                               len = rs->rs_datalen;
  22 -                               if (len >= sizeof (struct ieee80211_frame)) {
  23 -                                       bus_dma_sync_single(sc->sc_bdev,
  24 -                                           bf->bf_skbaddr, len,
  25 -                                           BUS_DMA_FROMDEVICE);
  26 -#if 0
  27 -/* XXX revalidate MIC, lookup ni to find VAP */
  28 -                                       ieee80211_notify_michael_failure(ic,
  29 -                                           (struct ieee80211_frame *) skb->data,
  30 -                                           sc->sc_splitmic ?
  31 -                                               rs->rs_keyix - 32 : rs->rs_keyix
  32 -                                       );
  33 -#endif
  34 -                               }
  35 +                               mic_fail = 1;
  36                         }
  37                         /*
  38                          * Reject error frames if we have no vaps that
  39 @@ -5774,8 +5757,9 @@
  40                 /*
  41                  * Finished monitor mode handling, now reject
  42                  * error frames before passing to other vaps
  43 +                * Ignore MIC failures here, as we need to recheck them
  44                  */
  45 -               if (rs->rs_status != 0) {
  46 +               if (rs->rs_status & ~(HAL_RXERR_MIC | HAL_RXERR_DECRYPT)) {
  47                         dev_kfree_skb(skb);
  48                         skb = NULL;
  49                         goto rx_next;
  50 @@ -5806,6 +5790,27 @@
  51                                    sc->sc_hwmap[rs->rs_rate].ieeerate,
  52                                    rs->rs_rssi);
  53
  54 +               /* MIC failure. Drop the packet in any case */
  55 +               if (mic_fail) {
  56 +                       /* Drop control frames which are reported with mic error */
  57 +                   if ((((struct ieee80211_frame *)skb->data)->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
  58 +                               dev_kfree_skb(skb);
  59 +                               skb = NULL;
  60 +                               mic_fail = 0;
  61 +                               goto rx_next;
  62 +                       }
  63 +                       ni = ieee80211_find_rxnode(ic,
  64 +                               (const struct ieee80211_frame_min *) skb->data);
  65 +                       if (ni != NULL) {
  66 +                               ieee80211_check_mic(ni, skb);
  67 +                               ieee80211_unref_node(&ni);
  68 +                       }
  69 +                       dev_kfree_skb_any(skb);
  70 +                       skb = NULL;
  71 +                       mic_fail = 0;
  72 +                       goto rx_next;
  73 +               }
  74 +
  75                 /*
  76                  * Locate the node for sender, track state, and then
  77                  * pass the (referenced) node up to the 802.11 layer
  78 diff -ur madwifi.old/net80211/ieee80211_crypto_ccmp.c madwifi.dev/net80211/ieee80211_crypto_ccmp.c
  79 --- madwifi.old/net80211/ieee80211_crypto_ccmp.c        2007-05-30 03:41:18.000000000 +0200
  80 +++ madwifi.dev/net80211/ieee80211_crypto_ccmp.c        2007-06-01 11:45:05.000259080 +0200
  81 @@ -78,7 +78,7 @@
  82  static int ccmp_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
  83  static int ccmp_decap(struct ieee80211_key *, struct sk_buff *, int);
  84  static int ccmp_enmic(struct ieee80211_key *, struct sk_buff *, int);
  85 -static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int);
  86 +static int ccmp_demic(struct ieee80211_key *, struct sk_buff *, int, int);
  87
  88  static const struct ieee80211_cipher ccmp = {
  89         .ic_name        = "AES-CCM",
  90 @@ -298,7 +298,7 @@
  91   * Verify and strip MIC from the frame.
  92   */
  93  static int
  94 -ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
  95 +ccmp_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
  96  {
  97         return 1;
  98  }
  99 diff -ur madwifi.old/net80211/ieee80211_crypto.h madwifi.dev/net80211/ieee80211_crypto.h
 100 --- madwifi.old/net80211/ieee80211_crypto.h     2007-04-16 14:32:29.000000000 +0200
 101 +++ madwifi.dev/net80211/ieee80211_crypto.h     2007-06-01 11:45:05.000259080 +0200
 102 @@ -145,7 +145,7 @@
 103         int (*ic_encap)(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 104         int (*ic_decap)(struct ieee80211_key *, struct sk_buff *, int);
 105         int (*ic_enmic)(struct ieee80211_key *, struct sk_buff *, int);
 106 -       int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int);
 107 +       int (*ic_demic)(struct ieee80211_key *, struct sk_buff *, int, int);
 108  };
 109  extern const struct ieee80211_cipher ieee80211_cipher_none;
 110
 111 @@ -163,10 +163,10 @@
 112   */
 113  static __inline int
 114  ieee80211_crypto_demic(struct ieee80211vap *vap, struct ieee80211_key *k,
 115 -       struct sk_buff *skb, int hdrlen)
 116 +       struct sk_buff *skb, int hdrlen, int force)
 117  {
 118         const struct ieee80211_cipher *cip = k->wk_cipher;
 119 -       return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen) : 1);
 120 +       return (cip->ic_miclen > 0 ? cip->ic_demic(k, skb, hdrlen, force) : 1);
 121  }
 122
 123  /*
 124 diff -ur madwifi.old/net80211/ieee80211_crypto_none.c madwifi.dev/net80211/ieee80211_crypto_none.c
 125 --- madwifi.old/net80211/ieee80211_crypto_none.c        2006-09-20 10:45:13.000000000 +0200
 126 +++ madwifi.dev/net80211/ieee80211_crypto_none.c        2007-06-01 11:45:05.000259080 +0200
 127 @@ -52,7 +52,7 @@
 128  static int none_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 129  static int none_decap(struct ieee80211_key *, struct sk_buff *, int);
 130  static int none_enmic(struct ieee80211_key *, struct sk_buff *, int);
 131 -static int none_demic(struct ieee80211_key *, struct sk_buff *, int);
 132 +static int none_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 133
 134  const struct ieee80211_cipher ieee80211_cipher_none = {
 135         .ic_name        = "NONE",
 136 @@ -137,7 +137,7 @@
 137  }
 138
 139  static int
 140 -none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
 141 +none_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
 142  {
 143         struct ieee80211vap *vap = k->wk_private;
 144
 145 diff -ur madwifi.old/net80211/ieee80211_crypto_tkip.c madwifi.dev/net80211/ieee80211_crypto_tkip.c
 146 --- madwifi.old/net80211/ieee80211_crypto_tkip.c        2007-05-30 03:41:18.000000000 +0200
 147 +++ madwifi.dev/net80211/ieee80211_crypto_tkip.c        2007-06-01 11:45:05.001258928 +0200
 148 @@ -57,7 +57,7 @@
 149  static int tkip_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 150  static int tkip_enmic(struct ieee80211_key *, struct sk_buff *, int);
 151  static int tkip_decap(struct ieee80211_key *, struct sk_buff *, int);
 152 -static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int);
 153 +static int tkip_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 154
 155  static const struct ieee80211_cipher tkip  = {
 156         .ic_name        = "TKIP",
 157 @@ -339,7 +339,7 @@
 158   * Verify and strip MIC from the frame.
 159   */
 160  static int
 161 -tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen)
 162 +tkip_demic(struct ieee80211_key *k, struct sk_buff *skb0, int hdrlen, int force)
 163  {
 164         struct tkip_ctx *ctx = k->wk_private;
 165         struct sk_buff *skb;
 166 @@ -355,7 +355,7 @@
 167         }
 168         wh = (struct ieee80211_frame *) skb0->data;
 169         /* NB: skb left pointing at last in chain */
 170 -       if (k->wk_flags & IEEE80211_KEY_SWMIC) {
 171 +       if ((k->wk_flags & IEEE80211_KEY_SWMIC) || force) {
 172                 struct ieee80211vap *vap = ctx->tc_vap;
 173                 u8 mic[IEEE80211_WEP_MICLEN];
 174                 u8 mic0[IEEE80211_WEP_MICLEN];
 175 diff -ur madwifi.old/net80211/ieee80211_crypto_wep.c madwifi.dev/net80211/ieee80211_crypto_wep.c
 176 --- madwifi.old/net80211/ieee80211_crypto_wep.c 2007-05-29 23:55:25.000000000 +0200
 177 +++ madwifi.dev/net80211/ieee80211_crypto_wep.c 2007-06-01 11:45:05.001258928 +0200
 178 @@ -54,7 +54,7 @@
 179  static int wep_encap(struct ieee80211_key *, struct sk_buff *, u_int8_t);
 180  static int wep_decap(struct ieee80211_key *, struct sk_buff *, int);
 181  static int wep_enmic(struct ieee80211_key *, struct sk_buff *, int);
 182 -static int wep_demic(struct ieee80211_key *, struct sk_buff *, int);
 183 +static int wep_demic(struct ieee80211_key *, struct sk_buff *, int, int);
 184
 185  static const struct ieee80211_cipher wep = {
 186         .ic_name        = "WEP",
 187 @@ -244,7 +244,7 @@
 188   * Verify and strip MIC from the frame.
 189   */
 190  static int
 191 -wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen)
 192 +wep_demic(struct ieee80211_key *k, struct sk_buff *skb, int hdrlen, int force)
 193  {
 194         return 1;
 195  }
 196 diff -ur madwifi.old/net80211/ieee80211_input.c madwifi.dev/net80211/ieee80211_input.c
 197 --- madwifi.old/net80211/ieee80211_input.c      2007-06-01 11:31:46.931583000 +0200
 198 +++ madwifi.dev/net80211/ieee80211_input.c      2007-06-01 11:45:05.003258624 +0200
 199 @@ -632,7 +632,7 @@
 200                  * Next strip any MSDU crypto bits.
 201                  */
 202                 if (key != NULL &&
 203 -                   !ieee80211_crypto_demic(vap, key, skb, hdrspace)) {
 204 +                   !ieee80211_crypto_demic(vap, key, skb, hdrspace, 0)) {
 205                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 206                                 ni->ni_macaddr, "data", "%s", "demic error");
 207                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 208 @@ -3744,6 +3744,47 @@
 209  }
 210  #endif
 211
 212 +/*
 213 + * Process a frame w/ hw detected MIC failure.
 214 + * The frame will be dropped in any case.
 215 + */
 216 +void
 217 +ieee80211_check_mic(struct ieee80211_node *ni, struct sk_buff *skb)
 218 +{
 219 +       struct ieee80211vap *vap = ni->ni_vap;
 220 +
 221 +       struct ieee80211_frame *wh;
 222 +       struct ieee80211_key *key;
 223 +       int hdrspace;
 224 +       struct ieee80211com *ic = vap->iv_ic;
 225 +
 226 +       if (skb->len < sizeof(struct ieee80211_frame_min)) {
 227 +               IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 228 +                   ni->ni_macaddr, NULL,
 229 +                   "too short (1): len %u", skb->len);
 230 +               vap->iv_stats.is_rx_tooshort++;
 231 +               return;
 232 +       }
 233 +
 234 +       wh = (struct ieee80211_frame *)skb->data;
 235 +
 236 +       hdrspace = ieee80211_hdrspace(ic, wh);
 237 +       key = ieee80211_crypto_decap(ni, skb, hdrspace);
 238 +       if (key == NULL) {
 239 +               /* NB: stats+msgs handled in crypto_decap */
 240 +               IEEE80211_NODE_STAT(ni, rx_wepfail);
 241 +               return;
 242 +       }
 243 +
 244 +       if (!ieee80211_crypto_demic(vap, key, skb, hdrspace, 1)) {
 245 +               IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 246 +                       ni->ni_macaddr, "data", "%s", "demic error");
 247 +                       IEEE80211_NODE_STAT(ni, rx_demicfail);
 248 +       }
 249 +       return;
 250 +}
 251 +EXPORT_SYMBOL(ieee80211_check_mic);
 252 +
 253  #ifdef IEEE80211_DEBUG
 254  /*
 255   * Debugging support.
 256 diff -ur madwifi.old/net80211/ieee80211_proto.h madwifi.dev/net80211/ieee80211_proto.h
 257 --- madwifi.old/net80211/ieee80211_proto.h      2007-06-01 11:26:04.172691000 +0200
 258 +++ madwifi.dev/net80211/ieee80211_proto.h      2007-06-01 11:45:05.004258472 +0200
 259 @@ -91,6 +91,7 @@
 260  void ieee80211_set11gbasicrates(struct ieee80211_rateset *, enum ieee80211_phymode);
 261  enum ieee80211_phymode ieee80211_get11gbasicrates(struct ieee80211_rateset *);
 262  void ieee80211_send_pspoll(struct ieee80211_node *);
 263 +void ieee80211_check_mic(struct ieee80211_node *, struct sk_buff *);
 264
 265  /*
 266   * Return the size of the 802.11 header for a management or data frame.
 267 --- madwifi.old/net80211/ieee80211_linux.c      2007-06-02 04:05:42.902538336 +0200
 268 +++ madwifi.dev/net80211/ieee80211_linux.c      2007-06-02 04:05:55.302653232 +0200
 269 @@ -291,8 +291,8 @@
 270         /* TODO: needed parameters: count, keyid, key type, src address, TSC */
 271         snprintf(buf, sizeof(buf), "%s(keyid=%d %scast addr=%s)", tag,
 272                 k->wk_keyix,
 273 -               IEEE80211_IS_MULTICAST(wh->i_addr1) ?  "broad" : "uni",
 274 -               ether_sprintf(wh->i_addr1));
 275 +               IEEE80211_IS_MULTICAST(wh->i_addr2) ?  "broad" : "uni",
 276 +               ether_sprintf(wh->i_addr2));
 277         memset(&wrqu, 0, sizeof(wrqu));
 278         wrqu.data.length = strlen(buf);
 279         wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);