[infiniband] Use "%#lx" as format specifier for queue pair numbers
[ipxe.git] / src / net / 80211 / wpa_ccmp.c
1 /*
2 * Copyright (c) 2009 Joshua Oreman <oremanj@rwcr.net>.
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License as
6 * published by the Free Software Foundation; either version 2 of the
7 * License, or any later version.
8 *
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
17 * 02110-1301, USA.
18 */
19
20 FILE_LICENCE ( GPL2_OR_LATER );
21
22 #include <string.h>
23 #include <ipxe/net80211.h>
24 #include <ipxe/crypto.h>
25 #include <ipxe/hmac.h>
26 #include <ipxe/sha1.h>
27 #include <ipxe/aes.h>
28 #include <ipxe/wpa.h>
29 #include <byteswap.h>
30 #include <errno.h>
31
32 /** @file
33 *
34 * Backend for WPA using the CCMP encryption method
35 */
36
37 /** Context for CCMP encryption and decryption */
38 struct ccmp_ctx
39 {
40 /** AES context - only ever used for encryption */
41 u8 aes_ctx[AES_CTX_SIZE];
42
43 /** Most recently sent packet number */
44 u64 tx_seq;
45
46 /** Most recently received packet number */
47 u64 rx_seq;
48 };
49
50 /** Header structure at the beginning of CCMP frame data */
51 struct ccmp_head
52 {
53 u8 pn_lo[2]; /**< Bytes 0 and 1 of packet number */
54 u8 _rsvd; /**< Reserved byte */
55 u8 kid; /**< Key ID and ExtIV byte */
56 u8 pn_hi[4]; /**< Bytes 2-5 (2 first) of packet number */
57 } __attribute__ (( packed ));
58
59
60 /** CCMP header overhead */
61 #define CCMP_HEAD_LEN 8
62
63 /** CCMP MIC trailer overhead */
64 #define CCMP_MIC_LEN 8
65
66 /** CCMP nonce length */
67 #define CCMP_NONCE_LEN 13
68
69 /** CCMP nonce structure */
70 struct ccmp_nonce
71 {
72 u8 prio; /**< Packet priority, 0 for non-QoS */
73 u8 a2[ETH_ALEN]; /**< Address 2 from packet header (sender) */
74 u8 pn[6]; /**< Packet number */
75 } __attribute__ (( packed ));
76
77 /** CCMP additional authentication data length (for non-QoS, non-WDS frames) */
78 #define CCMP_AAD_LEN 22
79
80 /** CCMP additional authentication data structure */
81 struct ccmp_aad
82 {
83 u16 fc; /**< Frame Control field */
84 u8 a1[6]; /**< Address 1 */
85 u8 a2[6]; /**< Address 2 */
86 u8 a3[6]; /**< Address 3 */
87 u16 seq; /**< Sequence Control field */
88 /* Address 4 and QoS Control are included if present */
89 } __attribute__ (( packed ));
90
91 /** Mask for Frame Control field in AAD */
92 #define CCMP_AAD_FC_MASK 0xC38F
93
94 /** Mask for Sequence Control field in AAD */
95 #define CCMP_AAD_SEQ_MASK 0x000F
96
97
98 /**
99 * Convert 6-byte LSB packet number to 64-bit integer
100 *
101 * @v pn Pointer to 6-byte packet number
102 * @ret v 64-bit integer value of @a pn
103 */
104 static u64 pn_to_u64 ( const u8 *pn )
105 {
106 int i;
107 u64 ret = 0;
108
109 for ( i = 5; i >= 0; i-- ) {
110 ret <<= 8;
111 ret |= pn[i];
112 }
113
114 return ret;
115 }
116
117 /**
118 * Convert 64-bit integer to 6-byte packet number
119 *
120 * @v v 64-bit integer
121 * @v msb If TRUE, reverse the output PN to be in MSB order
122 * @ret pn 6-byte packet number
123 *
124 * The PN is stored in LSB order in the packet header and in MSB order
125 * in the nonce. WHYYYYY?
126 */
127 static void u64_to_pn ( u64 v, u8 *pn, int msb )
128 {
129 int i;
130 u8 *pnp = pn + ( msb ? 5 : 0 );
131 int delta = ( msb ? -1 : +1 );
132
133 for ( i = 0; i < 6; i++ ) {
134 *pnp = v & 0xFF;
135 pnp += delta;
136 v >>= 8;
137 }
138 }
139
140 /** Value for @a msb argument of u64_to_pn() for MSB output */
141 #define PN_MSB 1
142
143 /** Value for @a msb argument of u64_to_pn() for LSB output */
144 #define PN_LSB 0
145
146
147
148 /**
149 * Initialise CCMP state and install key
150 *
151 * @v crypto CCMP cryptosystem structure
152 * @v key Pointer to 16-byte temporal key to install
153 * @v keylen Length of key (16 bytes)
154 * @v rsc Initial receive sequence counter
155 */
156 static int ccmp_init ( struct net80211_crypto *crypto, const void *key,
157 int keylen, const void *rsc )
158 {
159 struct ccmp_ctx *ctx = crypto->priv;
160
161 if ( keylen != 16 )
162 return -EINVAL;
163
164 if ( rsc )
165 ctx->rx_seq = pn_to_u64 ( rsc );
166
167 cipher_setkey ( &aes_algorithm, ctx->aes_ctx, key, keylen );
168
169 return 0;
170 }
171
172
173 /**
174 * Encrypt or decrypt data stream using AES in Counter mode
175 *
176 * @v ctx CCMP cryptosystem context
177 * @v nonce Nonce value, 13 bytes
178 * @v srcv Data to encrypt or decrypt
179 * @v len Number of bytes pointed to by @a src
180 * @v msrcv MIC value to encrypt or decrypt (may be NULL)
181 * @ret destv Encrypted or decrypted data
182 * @ret mdestv Encrypted or decrypted MIC value
183 *
184 * This assumes CCMP parameters of L=2 and M=8. The algorithm is
185 * defined in RFC 3610.
186 */
187 static void ccmp_ctr_xor ( struct ccmp_ctx *ctx, const void *nonce,
188 const void *srcv, void *destv, int len,
189 const void *msrcv, void *mdestv )
190 {
191 u8 A[16], S[16];
192 u16 ctr;
193 int i;
194 const u8 *src = srcv, *msrc = msrcv;
195 u8 *dest = destv, *mdest = mdestv;
196
197 A[0] = 0x01; /* flags, L' = L - 1 = 1, other bits rsvd */
198 memcpy ( A + 1, nonce, CCMP_NONCE_LEN );
199
200 if ( msrcv ) {
201 A[14] = A[15] = 0;
202
203 cipher_encrypt ( &aes_algorithm, ctx->aes_ctx, A, S, 16 );
204
205 for ( i = 0; i < 8; i++ ) {
206 *mdest++ = *msrc++ ^ S[i];
207 }
208 }
209
210 for ( ctr = 1 ;; ctr++ ) {
211 A[14] = ctr >> 8;
212 A[15] = ctr & 0xFF;
213
214 cipher_encrypt ( &aes_algorithm, ctx->aes_ctx, A, S, 16 );
215
216 for ( i = 0; i < len && i < 16; i++ )
217 *dest++ = *src++ ^ S[i];
218
219 if ( len <= 16 )
220 break; /* we're done */
221
222 len -= 16;
223 }
224 }
225
226
227 /**
228 * Advance one block in CBC-MAC calculation
229 *
230 * @v aes_ctx AES encryption context with key set
231 * @v B Cleartext block to incorporate (16 bytes)
232 * @v X Previous ciphertext block (16 bytes)
233 * @ret B Clobbered
234 * @ret X New ciphertext block (16 bytes)
235 *
236 * This function does X := E[key] ( X ^ B ).
237 */
238 static void ccmp_feed_cbc_mac ( void *aes_ctx, u8 *B, u8 *X )
239 {
240 int i;
241 for ( i = 0; i < 16; i++ )
242 B[i] ^= X[i];
243 cipher_encrypt ( &aes_algorithm, aes_ctx, B, X, 16 );
244 }
245
246
247 /**
248 * Calculate MIC on plaintext data using CBC-MAC
249 *
250 * @v ctx CCMP cryptosystem context
251 * @v nonce Nonce value, 13 bytes
252 * @v data Data to calculate MIC over
253 * @v datalen Length of @a data
254 * @v aad Additional authentication data, for MIC but not encryption
255 * @ret mic MIC value (unencrypted), 8 bytes
256 *
257 * @a aadlen is assumed to be 22 bytes long, as it always is for
258 * 802.11 use when transmitting non-QoS, not-between-APs frames (the
259 * only type we deal with).
260 */
261 static void ccmp_cbc_mac ( struct ccmp_ctx *ctx, const void *nonce,
262 const void *data, u16 datalen,
263 const void *aad, void *mic )
264 {
265 u8 X[16], B[16];
266
267 /* Zeroth block: flags, nonce, length */
268
269 /* Rsv AAD - M'- - L'-
270 * 0 1 0 1 1 0 0 1 for an 8-byte MAC and 2-byte message length
271 */
272 B[0] = 0x59;
273 memcpy ( B + 1, nonce, CCMP_NONCE_LEN );
274 B[14] = datalen >> 8;
275 B[15] = datalen & 0xFF;
276
277 cipher_encrypt ( &aes_algorithm, ctx->aes_ctx, B, X, 16 );
278
279 /* First block: AAD length field and 14 bytes of AAD */
280 B[0] = 0;
281 B[1] = CCMP_AAD_LEN;
282 memcpy ( B + 2, aad, 14 );
283
284 ccmp_feed_cbc_mac ( ctx->aes_ctx, B, X );
285
286 /* Second block: Remaining 8 bytes of AAD, 8 bytes zero pad */
287 memcpy ( B, aad + 14, 8 );
288 memset ( B + 8, 0, 8 );
289
290 ccmp_feed_cbc_mac ( ctx->aes_ctx, B, X );
291
292 /* Message blocks */
293 while ( datalen ) {
294 if ( datalen >= 16 ) {
295 memcpy ( B, data, 16 );
296 datalen -= 16;
297 } else {
298 memcpy ( B, data, datalen );
299 memset ( B + datalen, 0, 16 - datalen );
300 datalen = 0;
301 }
302
303 ccmp_feed_cbc_mac ( ctx->aes_ctx, B, X );
304
305 data += 16;
306 }
307
308 /* Get MIC from final value of X */
309 memcpy ( mic, X, 8 );
310 }
311
312
313 /**
314 * Encapsulate and encrypt a packet using CCMP
315 *
316 * @v crypto CCMP cryptosystem
317 * @v iob I/O buffer containing cleartext packet
318 * @ret eiob I/O buffer containing encrypted packet
319 */
320 struct io_buffer * ccmp_encrypt ( struct net80211_crypto *crypto,
321 struct io_buffer *iob )
322 {
323 struct ccmp_ctx *ctx = crypto->priv;
324 struct ieee80211_frame *hdr = iob->data;
325 struct io_buffer *eiob;
326 const int hdrlen = IEEE80211_TYP_FRAME_HEADER_LEN;
327 int datalen = iob_len ( iob ) - hdrlen;
328 struct ccmp_head head;
329 struct ccmp_nonce nonce;
330 struct ccmp_aad aad;
331 u8 mic[8], tx_pn[6];
332 void *edata, *emic;
333
334 ctx->tx_seq++;
335 u64_to_pn ( ctx->tx_seq, tx_pn, PN_LSB );
336
337 /* Allocate memory */
338 eiob = alloc_iob ( iob_len ( iob ) + CCMP_HEAD_LEN + CCMP_MIC_LEN );
339 if ( ! eiob )
340 return NULL;
341
342 /* Copy frame header */
343 memcpy ( iob_put ( eiob, hdrlen ), iob->data, hdrlen );
344 hdr = eiob->data;
345 hdr->fc |= IEEE80211_FC_PROTECTED;
346
347 /* Fill in packet number and extended IV */
348 memcpy ( head.pn_lo, tx_pn, 2 );
349 memcpy ( head.pn_hi, tx_pn + 2, 4 );
350 head.kid = 0x20; /* have Extended IV, key ID 0 */
351 head._rsvd = 0;
352 memcpy ( iob_put ( eiob, sizeof ( head ) ), &head, sizeof ( head ) );
353
354 /* Form nonce */
355 nonce.prio = 0;
356 memcpy ( nonce.a2, hdr->addr2, ETH_ALEN );
357 u64_to_pn ( ctx->tx_seq, nonce.pn, PN_MSB );
358
359 /* Form additional authentication data */
360 aad.fc = hdr->fc & CCMP_AAD_FC_MASK;
361 memcpy ( aad.a1, hdr->addr1, 3 * ETH_ALEN ); /* all 3 at once */
362 aad.seq = hdr->seq & CCMP_AAD_SEQ_MASK;
363
364 /* Calculate MIC over the data */
365 ccmp_cbc_mac ( ctx, &nonce, iob->data + hdrlen, datalen, &aad, mic );
366
367 /* Copy and encrypt data and MIC */
368 edata = iob_put ( eiob, datalen );
369 emic = iob_put ( eiob, CCMP_MIC_LEN );
370 ccmp_ctr_xor ( ctx, &nonce,
371 iob->data + hdrlen, edata, datalen,
372 mic, emic );
373
374 /* Done! */
375 DBGC2 ( ctx, "WPA-CCMP %p: encrypted packet %p -> %p\n", ctx,
376 iob, eiob );
377
378 return eiob;
379 }
380
381 /**
382 * Decrypt a packet using CCMP
383 *
384 * @v crypto CCMP cryptosystem
385 * @v eiob I/O buffer containing encrypted packet
386 * @ret iob I/O buffer containing cleartext packet
387 */
388 static struct io_buffer * ccmp_decrypt ( struct net80211_crypto *crypto,
389 struct io_buffer *eiob )
390 {
391 struct ccmp_ctx *ctx = crypto->priv;
392 struct ieee80211_frame *hdr;
393 struct io_buffer *iob;
394 const int hdrlen = IEEE80211_TYP_FRAME_HEADER_LEN;
395 int datalen = iob_len ( eiob ) - hdrlen - CCMP_HEAD_LEN - CCMP_MIC_LEN;
396 struct ccmp_head *head;
397 struct ccmp_nonce nonce;
398 struct ccmp_aad aad;
399 u8 rx_pn[6], their_mic[8], our_mic[8];
400
401 iob = alloc_iob ( hdrlen + datalen );
402 if ( ! iob )
403 return NULL;
404
405 /* Copy frame header */
406 memcpy ( iob_put ( iob, hdrlen ), eiob->data, hdrlen );
407 hdr = iob->data;
408 hdr->fc &= ~IEEE80211_FC_PROTECTED;
409
410 /* Check and update RX packet number */
411 head = eiob->data + hdrlen;
412 memcpy ( rx_pn, head->pn_lo, 2 );
413 memcpy ( rx_pn + 2, head->pn_hi, 4 );
414
415 if ( pn_to_u64 ( rx_pn ) <= ctx->rx_seq ) {
416 DBGC ( ctx, "WPA-CCMP %p: packet received out of order "
417 "(%012llx <= %012llx)\n", ctx, pn_to_u64 ( rx_pn ),
418 ctx->rx_seq );
419 free_iob ( iob );
420 return NULL;
421 }
422
423 ctx->rx_seq = pn_to_u64 ( rx_pn );
424 DBGC2 ( ctx, "WPA-CCMP %p: RX packet number %012llx\n", ctx, ctx->rx_seq );
425
426 /* Form nonce */
427 nonce.prio = 0;
428 memcpy ( nonce.a2, hdr->addr2, ETH_ALEN );
429 u64_to_pn ( ctx->rx_seq, nonce.pn, PN_MSB );
430
431 /* Form additional authentication data */
432 aad.fc = ( hdr->fc & CCMP_AAD_FC_MASK ) | IEEE80211_FC_PROTECTED;
433 memcpy ( aad.a1, hdr->addr1, 3 * ETH_ALEN ); /* all 3 at once */
434 aad.seq = hdr->seq & CCMP_AAD_SEQ_MASK;
435
436 /* Copy-decrypt data and MIC */
437 ccmp_ctr_xor ( ctx, &nonce, eiob->data + hdrlen + sizeof ( *head ),
438 iob_put ( iob, datalen ), datalen,
439 eiob->tail - CCMP_MIC_LEN, their_mic );
440
441 /* Check MIC */
442 ccmp_cbc_mac ( ctx, &nonce, iob->data + hdrlen, datalen, &aad,
443 our_mic );
444
445 if ( memcmp ( their_mic, our_mic, CCMP_MIC_LEN ) != 0 ) {
446 DBGC2 ( ctx, "WPA-CCMP %p: MIC failure\n", ctx );
447 free_iob ( iob );
448 return NULL;
449 }
450
451 DBGC2 ( ctx, "WPA-CCMP %p: decrypted packet %p -> %p\n", ctx,
452 eiob, iob );
453
454 return iob;
455 }
456
457
458 /** CCMP cryptosystem */
459 struct net80211_crypto ccmp_crypto __net80211_crypto = {
460 .algorithm = NET80211_CRYPT_CCMP,
461 .init = ccmp_init,
462 .encrypt = ccmp_encrypt,
463 .decrypt = ccmp_decrypt,
464 .priv_len = sizeof ( struct ccmp_ctx ),
465 };
466
467
468
469
470 /**
471 * Calculate HMAC-SHA1 MIC for EAPOL-Key frame
472 *
473 * @v kck Key Confirmation Key, 16 bytes
474 * @v msg Message to calculate MIC over
475 * @v len Number of bytes to calculate MIC over
476 * @ret mic Calculated MIC, 16 bytes long
477 */
478 static void ccmp_kie_mic ( const void *kck, const void *msg, size_t len,
479 void *mic )
480 {
481 u8 sha1_ctx[SHA1_CTX_SIZE];
482 u8 kckb[16];
483 u8 hash[SHA1_DIGEST_SIZE];
484 size_t kck_len = 16;
485
486 memcpy ( kckb, kck, kck_len );
487
488 hmac_init ( &sha1_algorithm, sha1_ctx, kckb, &kck_len );
489 hmac_update ( &sha1_algorithm, sha1_ctx, msg, len );
490 hmac_final ( &sha1_algorithm, sha1_ctx, kckb, &kck_len, hash );
491
492 memcpy ( mic, hash, 16 );
493 }
494
495 /**
496 * Decrypt key data in EAPOL-Key frame
497 *
498 * @v kek Key Encryption Key, 16 bytes
499 * @v iv Initialisation vector, 16 bytes (unused)
500 * @v msg Message to decrypt
501 * @v len Length of message
502 * @ret msg Decrypted message in place of original
503 * @ret len Adjusted downward for 8 bytes of overhead
504 * @ret rc Return status code
505 *
506 * The returned message may still contain padding of 0xDD followed by
507 * zero or more 0x00 octets. It is impossible to remove the padding
508 * without parsing the IEs in the packet (another design decision that
509 * tends to make one question the 802.11i committee's intelligence...)
510 */
511 static int ccmp_kie_decrypt ( const void *kek, const void *iv __unused,
512 void *msg, u16 *len )
513 {
514 if ( *len % 8 != 0 )
515 return -EINVAL;
516
517 if ( aes_unwrap ( kek, msg, msg, *len / 8 - 1 ) != 0 )
518 return -EINVAL;
519
520 *len -= 8;
521
522 return 0;
523 }
524
525 /** CCMP-style key integrity and encryption handler */
526 struct wpa_kie ccmp_kie __wpa_kie = {
527 .version = EAPOL_KEY_VERSION_WPA2,
528 .mic = ccmp_kie_mic,
529 .decrypt = ccmp_kie_decrypt,
530 };