Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   3)  * Software WEP encryption implementation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   4)  * Copyright 2002, Jouni Malinen <jkmaline@cc.hut.fi>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   5)  * Copyright 2003, Instant802 Networks, Inc.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   6)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   7) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   8) #include <linux/netdevice.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   9) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  10) #include <linux/random.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  11) #include <linux/compiler.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  12) #include <linux/crc32.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  13) #include <linux/crypto.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  14) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  15) #include <linux/mm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  16) #include <linux/scatterlist.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  17) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  18) #include <asm/unaligned.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  19) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  20) #include <net/mac80211.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  21) #include "ieee80211_i.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  22) #include "wep.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  23) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  24) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  25) void ieee80211_wep_init(struct ieee80211_local *local)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  26) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  27) 	/* start WEP IV from a random value */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  28) 	get_random_bytes(&local->wep_iv, IEEE80211_WEP_IV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  29) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  30) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  31) static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  32) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  33) 	/*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  34) 	 * Fluhrer, Mantin, and Shamir have reported weaknesses in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  35) 	 * key scheduling algorithm of RC4. At least IVs (KeyByte + 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  36) 	 * 0xff, N) can be used to speedup attacks, so avoid using them.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  37) 	 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  38) 	if ((iv & 0xff00) == 0xff00) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  39) 		u8 B = (iv >> 16) & 0xff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  40) 		if (B >= 3 && B < 3 + keylen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  41) 			return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  42) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  43) 	return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  44) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  45) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  46) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  47) static void ieee80211_wep_get_iv(struct ieee80211_local *local,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  48) 				 int keylen, int keyidx, u8 *iv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  49) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  50) 	local->wep_iv++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  51) 	if (ieee80211_wep_weak_iv(local->wep_iv, keylen))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  52) 		local->wep_iv += 0x0100;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  53) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  54) 	if (!iv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  55) 		return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  56) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  57) 	*iv++ = (local->wep_iv >> 16) & 0xff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  58) 	*iv++ = (local->wep_iv >> 8) & 0xff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  59) 	*iv++ = local->wep_iv & 0xff;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  60) 	*iv++ = keyidx << 6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  61) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  62) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  63) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  64) static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  65) 				struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  66) 				int keylen, int keyidx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  67) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  68) 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  69) 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  70) 	unsigned int hdrlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  71) 	u8 *newhdr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  72) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  73) 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  74) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  75) 	if (WARN_ON(skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  76) 		return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  77) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  78) 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  79) 	newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  80) 	memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  81) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  82) 	/* the HW only needs room for the IV, but not the actual IV */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  83) 	if (info->control.hw_key &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  84) 	    (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  85) 		return newhdr + hdrlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  86) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  87) 	ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  88) 	return newhdr + hdrlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  89) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  90) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  91) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  92) static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  93) 				    struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  94) 				    struct ieee80211_key *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  95) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  96) 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  97) 	unsigned int hdrlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  98) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  99) 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) 	memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) 	skb_pull(skb, IEEE80211_WEP_IV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) /* Perform WEP encryption using given key. data buffer must have tailroom
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)  * for 4-byte ICV. data_len must not include this ICV. Note: this function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107)  * does _not_ add IV. data = RC4(data | CRC32(data)) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) int ieee80211_wep_encrypt_data(struct arc4_ctx *ctx, u8 *rc4key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) 			       size_t klen, u8 *data, size_t data_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) 	__le32 icv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) 	icv = cpu_to_le32(~crc32_le(~0, data, data_len));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) 	put_unaligned(icv, (__le32 *)(data + data_len));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) 	arc4_setkey(ctx, rc4key, klen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) 	arc4_crypt(ctx, data, data, data_len + IEEE80211_WEP_ICV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) 	memzero_explicit(ctx, sizeof(*ctx));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) /* Perform WEP encryption on given skb. 4 bytes of extra space (IV) in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125)  * beginning of the buffer 4 bytes of extra space (ICV) in the end of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)  * buffer will be added. Both IV and ICV will be transmitted, so the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)  * payload length increases with 8 bytes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)  * WEP frame payload: IV + TX key idx, RC4(data), ICV = RC4(CRC32(data))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) int ieee80211_wep_encrypt(struct ieee80211_local *local,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) 			  struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) 			  const u8 *key, int keylen, int keyidx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) 	u8 *iv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) 	size_t len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) 	u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) 	if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) 	iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) 	if (!iv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) 	len = skb->len - (iv + IEEE80211_WEP_IV_LEN - skb->data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) 	/* Prepend 24-bit IV to RC4 key */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) 	memcpy(rc4key, iv, 3);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) 	/* Copy rest of the WEP key (the secret part) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) 	memcpy(rc4key + 3, key, keylen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) 	/* Add room for ICV */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) 	skb_put(skb, IEEE80211_WEP_ICV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) 	return ieee80211_wep_encrypt_data(&local->wep_tx_ctx, rc4key, keylen + 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) 					  iv + IEEE80211_WEP_IV_LEN, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) /* Perform WEP decryption using given key. data buffer includes encrypted
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163)  * payload, including 4-byte ICV, but _not_ IV. data_len must not include ICV.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164)  * Return 0 on success and -1 on ICV mismatch. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) int ieee80211_wep_decrypt_data(struct arc4_ctx *ctx, u8 *rc4key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) 			       size_t klen, u8 *data, size_t data_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) 	__le32 crc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) 	arc4_setkey(ctx, rc4key, klen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) 	arc4_crypt(ctx, data, data, data_len + IEEE80211_WEP_ICV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) 	memzero_explicit(ctx, sizeof(*ctx));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) 	crc = cpu_to_le32(~crc32_le(~0, data, data_len));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) 	if (memcmp(&crc, data + data_len, IEEE80211_WEP_ICV_LEN) != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) 		/* ICV mismatch */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) /* Perform WEP decryption on given skb. Buffer includes whole WEP part of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184)  * the frame: IV (4 bytes), encrypted payload (including SNAP header),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)  * ICV (4 bytes). skb->len includes both IV and ICV.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187)  * Returns 0 if frame was decrypted successfully and ICV was correct and -1 on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188)  * failure. If frame is OK, IV and ICV will be removed, i.e., decrypted payload
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189)  * is moved to the beginning of the skb and skb length will be reduced.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) static int ieee80211_wep_decrypt(struct ieee80211_local *local,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) 				 struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) 				 struct ieee80211_key *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) 	u32 klen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) 	u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) 	u8 keyidx;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) 	unsigned int hdrlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) 	size_t len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) 	int ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) 	if (!ieee80211_has_protected(hdr->frame_control))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) 	if (skb->len < hdrlen + IEEE80211_WEP_IV_LEN + IEEE80211_WEP_ICV_LEN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) 	len = skb->len - hdrlen - IEEE80211_WEP_IV_LEN - IEEE80211_WEP_ICV_LEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) 	keyidx = skb->data[hdrlen + 3] >> 6;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) 	if (!key || keyidx != key->conf.keyidx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) 		return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) 	klen = 3 + key->conf.keylen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) 	/* Prepend 24-bit IV to RC4 key */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) 	memcpy(rc4key, skb->data + hdrlen, 3);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) 	/* Copy rest of the WEP key (the secret part) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) 	memcpy(rc4key + 3, key->conf.key, key->conf.keylen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) 	if (ieee80211_wep_decrypt_data(&local->wep_rx_ctx, rc4key, klen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) 				       skb->data + hdrlen +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) 				       IEEE80211_WEP_IV_LEN, len))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) 		ret = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) 	/* Trim ICV */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) 	skb_trim(skb, skb->len - IEEE80211_WEP_ICV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) 	/* Remove IV */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) 	memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) 	skb_pull(skb, IEEE80211_WEP_IV_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) 	return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) ieee80211_rx_result
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) 	struct sk_buff *skb = rx->skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) 	__le16 fc = hdr->frame_control;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) 	if (!ieee80211_is_data(fc) && !ieee80211_is_auth(fc))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) 		return RX_CONTINUE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) 	if (!(status->flag & RX_FLAG_DECRYPTED)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) 		if (skb_linearize(rx->skb))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) 			return RX_DROP_UNUSABLE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) 		if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) 			return RX_DROP_UNUSABLE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) 	} else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) 		if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) 					    IEEE80211_WEP_IV_LEN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) 			return RX_DROP_UNUSABLE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) 		ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) 		/* remove ICV */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) 		if (!(status->flag & RX_FLAG_ICV_STRIPPED) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) 		    pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) 			return RX_DROP_UNUSABLE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) 	return RX_CONTINUE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) static int wep_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) 	struct ieee80211_key_conf *hw_key = info->control.hw_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) 	if (!hw_key) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) 		if (ieee80211_wep_encrypt(tx->local, skb, tx->key->conf.key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) 					  tx->key->conf.keylen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) 					  tx->key->conf.keyidx))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) 			return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) 	} else if ((hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) 		   (hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) 		if (!ieee80211_wep_add_iv(tx->local, skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) 					  tx->key->conf.keylen,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) 					  tx->key->conf.keyidx))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) 			return -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) 	return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) ieee80211_tx_result
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) ieee80211_crypto_wep_encrypt(struct ieee80211_tx_data *tx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) 	struct sk_buff *skb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) 	ieee80211_tx_set_protected(tx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) 	skb_queue_walk(&tx->skbs, skb) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) 		if (wep_encrypt_skb(tx, skb) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) 			I802_DEBUG_INC(tx->local->tx_handlers_drop_wep);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) 			return TX_DROP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) 		}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) 	}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) 	return TX_CONTINUE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) }