[patch] d80211: fix WEP on big endian cpus

[patch] d80211: fix WEP on big endian cpus

[David Kimdon]

[-- Attachment #1: wep-big-endian.patch --]
[-- Type: text/plain, Size: 970 bytes --]

The ICV is transmitted on the network as a 4 byte little endian
quantity.  WEP encryption needs to swap the bytes before transmission
and decryption needs to swap bytes before ICV verification.


Index: wireless-dev/net/d80211/wep.c
===================================================================
--- wireless-dev.orig/net/d80211/wep.c	2006-09-10 14:50:52.073583400 +0000
+++ wireless-dev/net/d80211/wep.c	2006-09-10 14:51:10.146835848 +0000
@@ -121,9 +121,11 @@
 {
 	struct scatterlist sg;
 	u32 *icv;
+	u32 crc;
 
 	icv = (u32 *)(data + data_len);
-	*icv = ~crc32_le(~0, data, data_len);
+	crc = ~crc32_le(~0, data, data_len);
+	*icv = cpu_to_le32(crc);
 
 	crypto_cipher_setkey(tfm, rc4key, klen);
 	sg.page = virt_to_page(data);
@@ -196,6 +198,7 @@
 	crypto_cipher_decrypt(tfm, &sg, &sg, sg.length);
 
 	crc = ~crc32_le(~0, data, data_len);
+	crc = cpu_to_le32(crc);
 	if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
 		/* ICV mismatch */
 		return -1;

--

Re: [patch] d80211: fix WEP on big endian cpus

[Michael Buesch]

On Sunday 10 September 2006 19:36, David Kimdon wrote:
> The ICV is transmitted on the network as a 4 byte little endian
> quantity.  WEP encryption needs to swap the bytes before transmission
> and decryption needs to swap bytes before ICV verification.

Holy shit, this fixes the bug I am hunting for hours at the moment!
I tested this patch and it works. Thanks very much, you saved me hours. ;)

John (Jiri), please apply this one.

Acked-by: Michael Buesch <mb@bu3sch.de>

> Index: wireless-dev/net/d80211/wep.c
> ===================================================================
> --- wireless-dev.orig/net/d80211/wep.c	2006-09-10 14:50:52.073583400 +0000
> +++ wireless-dev/net/d80211/wep.c	2006-09-10 14:51:10.146835848 +0000
> @@ -121,9 +121,11 @@
>  {
>  	struct scatterlist sg;
>  	u32 *icv;
> +	u32 crc;
>  
>  	icv = (u32 *)(data + data_len);
> -	*icv = ~crc32_le(~0, data, data_len);
> +	crc = ~crc32_le(~0, data, data_len);
> +	*icv = cpu_to_le32(crc);
>  
>  	crypto_cipher_setkey(tfm, rc4key, klen);
>  	sg.page = virt_to_page(data);
> @@ -196,6 +198,7 @@
>  	crypto_cipher_decrypt(tfm, &sg, &sg, sg.length);
>  
>  	crc = ~crc32_le(~0, data, data_len);
> +	crc = cpu_to_le32(crc);
>  	if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
>  		/* ICV mismatch */
>  		return -1;
> 
> --
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

-- 
Greetings Michael.

Re: [patch] d80211: fix WEP on big endian cpus

[Michael Wu]

[-- Attachment #1: Type: text/plain, Size: 1779 bytes --]

Huh. I assumed crc32_le gave us the result in little endian, but I guess 
that's wrong.

I've attached another patch which basically does the same thing but adds some 
sparse bitwise annotations to make things clear. Also, it has a signed-off-by 
line. :)

d80211: fix WEP on big endian cpus

This patch fixes the endian issues with the ICV in WEP, as pointed out by 
David Kimdon <david.kimdon@devicescape.com>, and uses __le32 where 
appropriate to make things clear.

Signed-off-by: Michael Wu <flamingice@sourmilk.net>

---

 net/d80211/wep.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/d80211/wep.c b/net/d80211/wep.c
index c3e4728..22c2e53 100644
--- a/net/d80211/wep.c
+++ b/net/d80211/wep.c
@@ -120,10 +120,10 @@ void ieee80211_wep_encrypt_data(struct c
 				size_t klen, u8 *data, size_t data_len)
 {
 	struct scatterlist sg;
-	u32 *icv;
+	__le32 *icv;
 
-	icv = (u32 *)(data + data_len);
-	*icv = ~crc32_le(~0, data, data_len);
+	icv = (__le32 *)(data + data_len);
+	*icv = cpu_to_le32(~crc32_le(~0, data, data_len));
 
 	crypto_cipher_setkey(tfm, rc4key, klen);
 	sg.page = virt_to_page(data);
@@ -187,7 +187,7 @@ int ieee80211_wep_decrypt_data(struct cr
 			       size_t klen, u8 *data, size_t data_len)
 {
 	struct scatterlist sg;
-	u32 crc;
+	__le32 crc;
 
 	crypto_cipher_setkey(tfm, rc4key, klen);
 	sg.page = virt_to_page(data);
@@ -195,7 +195,7 @@ int ieee80211_wep_decrypt_data(struct cr
 	sg.length = data_len + WEP_ICV_LEN;
 	crypto_cipher_decrypt(tfm, &sg, &sg, sg.length);
 
-	crc = ~crc32_le(~0, data, data_len);
+	crc = cpu_to_le32(~crc32_le(~0, data, data_len));
 	if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
 		/* ICV mismatch */
 		return -1;

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [patch] d80211: fix WEP on big endian cpus

[Jiri Benc]

Sun, 10 Sep 2006 17:47:16 -0400, Michael Wu pise:
> This patch fixes the endian issues with the ICV in WEP, as pointed out by 
> David Kimdon <david.kimdon@devicescape.com>, and uses __le32 where 
> appropriate to make things clear.

Applied to my tree. Thanks for the patch!

 Jiri

-- 
Jiri Benc
SUSE Labs