Commit 50741ae0 authored by Johannes Berg's avatar Johannes Berg Committed by David S. Miller

[PATCH] mac80211: fix TKIP IV update

The TKIP IV should be updated only after MMIC verification,
this patch changes it to be at that spot.
Signed-off-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent fb1c1cd6
......@@ -153,6 +153,8 @@ struct ieee80211_txrx_data {
int sent_ps_buffered;
int queue;
int load;
u32 tkip_iv32;
u16 tkip_iv16;
} rx;
} u;
};
......
......@@ -238,7 +238,8 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
struct ieee80211_key *key,
u8 *payload, size_t payload_len, u8 *ta,
int only_iv, int queue)
int only_iv, int queue,
u32 *out_iv32, u16 *out_iv16)
{
u32 iv32;
u32 iv16;
......@@ -332,11 +333,14 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
res = ieee80211_wep_decrypt_data(tfm, rc4key, 16, pos, payload_len - 12);
done:
if (res == TKIP_DECRYPT_OK) {
/* FIX: these should be updated only after Michael MIC has been
* verified */
/* Record previously received IV */
key->u.tkip.iv32_rx[queue] = iv32;
key->u.tkip.iv16_rx[queue] = iv16;
/*
* Record previously received IV, will be copied into the
* key information after MIC verification. It is possible
* that we don't catch replays of fragments but that's ok
* because the Michael MIC verication will then fail.
*/
*out_iv32 = iv32;
*out_iv16 = iv16;
}
return res;
......
......@@ -31,6 +31,7 @@ enum {
int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
struct ieee80211_key *key,
u8 *payload, size_t payload_len, u8 *ta,
int only_iv, int queue);
int only_iv, int queue,
u32 *out_iv32, u16 *out_iv16);
#endif /* TKIP_H */
......@@ -175,6 +175,10 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_txrx_data *rx)
/* remove Michael MIC from payload */
skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
/* update IV in key information to be able to detect replays */
rx->key->u.tkip.iv32_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv32;
rx->key->u.tkip.iv16_rx[rx->u.rx.queue] = rx->u.rx.tkip_iv16;
return TXRX_CONTINUE;
}
......@@ -315,7 +319,9 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_txrx_data *rx)
res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
key, skb->data + hdrlen,
skb->len - hdrlen, rx->sta->addr,
hwaccel, rx->u.rx.queue);
hwaccel, rx->u.rx.queue,
&rx->u.rx.tkip_iv32,
&rx->u.rx.tkip_iv16);
if (res != TKIP_DECRYPT_OK || wpa_test) {
printk(KERN_DEBUG "%s: TKIP decrypt failed for RX frame from "
"%s (res=%d)\n",
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment