[PATCH RFT] tkip: fix iv32 calculation in ieee80211_get_tkip_key()

[PATCH RFT] tkip: fix iv32 calculation in ieee80211_get_tkip_key()

[Pavel Roskin]

Signed-off-by: Pavel Roskin <proski@gnu.org>
---
It's a side product of testing a sparse patch by Linus Torvalds.
Compile tested only.

 net/mac80211/tkip.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)


diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index dddbfd6..b9ecd65 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -231,9 +231,9 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 	iv16 = data[hdr_len] << 8;
 	iv16 += data[hdr_len + 2];
 	iv32 = data[hdr_len + 4] +
-		(data[hdr_len + 5] >> 8) +
-		(data[hdr_len + 6] >> 16) +
-		(data[hdr_len + 7] >> 24);
+		(data[hdr_len + 5] << 8) +
+		(data[hdr_len + 6] << 16) +
+		(data[hdr_len + 7] << 24);
 
 #ifdef CONFIG_TKIP_DEBUG
 	printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",


-- 
Regards,
Pavel Roskin

Re: [PATCH RFT] tkip: fix iv32 calculation in ieee80211_get_tkip_key()

[Tomas Winkler]

On Fri, Apr 25, 2008 at 3:00 AM, Pavel Roskin <proski@gnu.org> wrote:
> Signed-off-by: Pavel Roskin <proski@gnu.org>
>  ---
>  It's a side product of testing a sparse patch by Linus Torvalds.
>  Compile tested only.
>
>   net/mac80211/tkip.c |    6 +++---
>   1 files changed, 3 insertions(+), 3 deletions(-)
>
>
>  diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
>  index dddbfd6..b9ecd65 100644
>  --- a/net/mac80211/tkip.c
>  +++ b/net/mac80211/tkip.c
>  @@ -231,9 +231,9 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
>         iv16 = data[hdr_len] << 8;
>         iv16 += data[hdr_len + 2];
>         iv32 = data[hdr_len + 4] +
>  -               (data[hdr_len + 5] >> 8) +
>  -               (data[hdr_len + 6] >> 16) +
>  -               (data[hdr_len + 7] >> 24);
>  +               (data[hdr_len + 5] << 8) +
>  +               (data[hdr_len + 6] << 16) +
>  +               (data[hdr_len + 7] << 24);
>
>   #ifdef CONFIG_TKIP_DEBUG
>         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
>
>

We've tested TKIP code well and I'm not sure we wouldn't pay attention
to such mistake.
Tomas

>  Regards,
>  Pavel Roskin
>  --
>  To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
>  the body of a message to majordomo@vger.kernel.org
>  More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: [PATCH RFT] tkip: fix iv32 calculation in ieee80211_get_tkip_key()

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 727 bytes --]


> >  It's a side product of testing a sparse patch by Linus Torvalds.
> >  Compile tested only.

> >         iv32 = data[hdr_len + 4] +
> >  -               (data[hdr_len + 5] >> 8) +
> >  -               (data[hdr_len + 6] >> 16) +
> >  -               (data[hdr_len + 7] >> 24);
> >  +               (data[hdr_len + 5] << 8) +
> >  +               (data[hdr_len + 6] << 16) +
> >  +               (data[hdr_len + 7] << 24);
> >
> >   #ifdef CONFIG_TKIP_DEBUG
> >         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
> >
> >
> 
> We've tested TKIP code well and I'm not sure we wouldn't pay attention
> to such mistake.

But the code does look a bit fishy. I'm confused.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

Re: [PATCH RFT] tkip: fix iv32 calculation in ieee80211_get_tkip_key()

[Tomas Winkler]

On Sat, Apr 26, 2008 at 7:10 PM, Johannes Berg
<johannes@sipsolutions.net> wrote:
>
>  > >  It's a side product of testing a sparse patch by Linus Torvalds.
>  > >  Compile tested only.
>
>
> > >         iv32 = data[hdr_len + 4] +
>  > >  -               (data[hdr_len + 5] >> 8) +
>  > >  -               (data[hdr_len + 6] >> 16) +
>  > >  -               (data[hdr_len + 7] >> 24);
>  > >  +               (data[hdr_len + 5] << 8) +
>  > >  +               (data[hdr_len + 6] << 16) +
>  > >  +               (data[hdr_len + 7] << 24);
>  > >
>  > >   #ifdef CONFIG_TKIP_DEBUG
>  > >         printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
>  > >
>  > >
>  >
>  > We've tested TKIP code well and I'm not sure we wouldn't pay attention
>  > to such mistake.
>
>  But the code does look a bit fishy. I'm confused.

It  looks bad. Frankly  Pavel's version looks more correct but as
black box TKIP is working.
Maybe we never tested more then 256 wrapparounds.... will need to dig into more

Thanks
Tomas

>  johannes
>