Commit 981d94a8 authored by Johannes Berg's avatar Johannes Berg

mac80211: support device/driver PN check for CCMP/GCMP

When there are multiple RX queues, the PN checks in mac80211 cannot be
used since packets might be processed out of order on different CPUs.

Allow the driver to report that the PN has been checked, drivers that
will use multi-queue RX will have to set this flag.

For now, the flag is only valid when the frame has been decrypted, in
theory that restriction doesn't have to be there, but in practice the
hardware will have decrypted the frame already.
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 77c96404
...@@ -973,6 +973,10 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) ...@@ -973,6 +973,10 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
* @RX_FLAG_IV_STRIPPED: The IV/ICV are stripped from this frame. * @RX_FLAG_IV_STRIPPED: The IV/ICV are stripped from this frame.
* If this flag is set, the stack cannot do any replay detection * If this flag is set, the stack cannot do any replay detection
* hence the driver or hardware will have to do that. * hence the driver or hardware will have to do that.
* @RX_FLAG_PN_VALIDATED: Currently only valid for CCMP/GCMP frames, this
* flag indicates that the PN was verified for replay protection.
* Note that this flag is also currently only supported when a frame
* is also decrypted (ie. @RX_FLAG_DECRYPTED must be set)
* @RX_FLAG_FAILED_FCS_CRC: Set this flag if the FCS check failed on * @RX_FLAG_FAILED_FCS_CRC: Set this flag if the FCS check failed on
* the frame. * the frame.
* @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on * @RX_FLAG_FAILED_PLCP_CRC: Set this flag if the PCLP check failed on
...@@ -1036,7 +1040,8 @@ enum mac80211_rx_flags { ...@@ -1036,7 +1040,8 @@ enum mac80211_rx_flags {
RX_FLAG_NO_SIGNAL_VAL = BIT(12), RX_FLAG_NO_SIGNAL_VAL = BIT(12),
RX_FLAG_HT_GF = BIT(13), RX_FLAG_HT_GF = BIT(13),
RX_FLAG_AMPDU_DETAILS = BIT(14), RX_FLAG_AMPDU_DETAILS = BIT(14),
/* bits 15/16 free */ RX_FLAG_PN_VALIDATED = BIT(15),
/* bit 16 free */
RX_FLAG_AMPDU_LAST_KNOWN = BIT(17), RX_FLAG_AMPDU_LAST_KNOWN = BIT(17),
RX_FLAG_AMPDU_IS_LAST = BIT(18), RX_FLAG_AMPDU_IS_LAST = BIT(18),
RX_FLAG_AMPDU_DELIM_CRC_ERROR = BIT(19), RX_FLAG_AMPDU_DELIM_CRC_ERROR = BIT(19),
......
...@@ -516,11 +516,13 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, ...@@ -516,11 +516,13 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }
if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
ccmp_hdr2pn(pn, skb->data + hdrlen); ccmp_hdr2pn(pn, skb->data + hdrlen);
queue = rx->security_idx; queue = rx->security_idx;
if (memcmp(pn, key->u.ccmp.rx_pn[queue], IEEE80211_CCMP_PN_LEN) <= 0) { if (memcmp(pn, key->u.ccmp.rx_pn[queue],
IEEE80211_CCMP_PN_LEN) <= 0) {
key->u.ccmp.replays++; key->u.ccmp.replays++;
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }
...@@ -540,6 +542,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, ...@@ -540,6 +542,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
} }
memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN); memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
}
/* Remove CCMP header and MIC */ /* Remove CCMP header and MIC */
if (pskb_trim(skb, skb->len - mic_len)) if (pskb_trim(skb, skb->len - mic_len))
...@@ -739,11 +742,13 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) ...@@ -739,11 +742,13 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }
if (!(status->flag & RX_FLAG_PN_VALIDATED)) {
gcmp_hdr2pn(pn, skb->data + hdrlen); gcmp_hdr2pn(pn, skb->data + hdrlen);
queue = rx->security_idx; queue = rx->security_idx;
if (memcmp(pn, key->u.gcmp.rx_pn[queue], IEEE80211_GCMP_PN_LEN) <= 0) { if (memcmp(pn, key->u.gcmp.rx_pn[queue],
IEEE80211_GCMP_PN_LEN) <= 0) {
key->u.gcmp.replays++; key->u.gcmp.replays++;
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }
...@@ -758,11 +763,13 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) ...@@ -758,11 +763,13 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
key->u.gcmp.tfm, j_0, aad, key->u.gcmp.tfm, j_0, aad,
skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN, skb->data + hdrlen + IEEE80211_GCMP_HDR_LEN,
data_len, data_len,
skb->data + skb->len - IEEE80211_GCMP_MIC_LEN)) skb->data + skb->len -
IEEE80211_GCMP_MIC_LEN))
return RX_DROP_UNUSABLE; return RX_DROP_UNUSABLE;
} }
memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN); memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
}
/* Remove GCMP header and MIC */ /* Remove GCMP header and MIC */
if (pskb_trim(skb, skb->len - IEEE80211_GCMP_MIC_LEN)) if (pskb_trim(skb, skb->len - IEEE80211_GCMP_MIC_LEN))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment