* Re: [patch] d80211: fix WEP on big endian cpus
2006-09-10 17:36 [patch] d80211: fix WEP on big endian cpus David Kimdon
@ 2006-09-10 18:11 ` Michael Buesch
2006-09-10 21:47 ` Michael Wu
1 sibling, 0 replies; 4+ messages in thread
From: Michael Buesch @ 2006-09-10 18:11 UTC (permalink / raw)
To: David Kimdon; +Cc: John W. Linville, Jiri Benc, netdev
On Sunday 10 September 2006 19:36, David Kimdon wrote:
> The ICV is transmitted on the network as a 4 byte little endian
> quantity. WEP encryption needs to swap the bytes before transmission
> and decryption needs to swap bytes before ICV verification.
Holy shit, this fixes the bug I am hunting for hours at the moment!
I tested this patch and it works. Thanks very much, you saved me hours. ;)
John (Jiri), please apply this one.
Acked-by: Michael Buesch <mb@bu3sch.de>
> Index: wireless-dev/net/d80211/wep.c
> ===================================================================
> --- wireless-dev.orig/net/d80211/wep.c 2006-09-10 14:50:52.073583400 +0000
> +++ wireless-dev/net/d80211/wep.c 2006-09-10 14:51:10.146835848 +0000
> @@ -121,9 +121,11 @@
> {
> struct scatterlist sg;
> u32 *icv;
> + u32 crc;
>
> icv = (u32 *)(data + data_len);
> - *icv = ~crc32_le(~0, data, data_len);
> + crc = ~crc32_le(~0, data, data_len);
> + *icv = cpu_to_le32(crc);
>
> crypto_cipher_setkey(tfm, rc4key, klen);
> sg.page = virt_to_page(data);
> @@ -196,6 +198,7 @@
> crypto_cipher_decrypt(tfm, &sg, &sg, sg.length);
>
> crc = ~crc32_le(~0, data, data_len);
> + crc = cpu_to_le32(crc);
> if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
> /* ICV mismatch */
> return -1;
>
> --
> -
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
Greetings Michael.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [patch] d80211: fix WEP on big endian cpus
2006-09-10 17:36 [patch] d80211: fix WEP on big endian cpus David Kimdon
2006-09-10 18:11 ` Michael Buesch
@ 2006-09-10 21:47 ` Michael Wu
2006-09-21 19:28 ` Jiri Benc
1 sibling, 1 reply; 4+ messages in thread
From: Michael Wu @ 2006-09-10 21:47 UTC (permalink / raw)
To: David Kimdon; +Cc: netdev, John W. Linville, Jiri Benc
[-- Attachment #1: Type: text/plain, Size: 1779 bytes --]
Huh. I assumed crc32_le gave us the result in little endian, but I guess
that's wrong.
I've attached another patch which basically does the same thing but adds some
sparse bitwise annotations to make things clear. Also, it has a signed-off-by
line. :)
d80211: fix WEP on big endian cpus
This patch fixes the endian issues with the ICV in WEP, as pointed out by
David Kimdon <david.kimdon@devicescape.com>, and uses __le32 where
appropriate to make things clear.
Signed-off-by: Michael Wu <flamingice@sourmilk.net>
---
net/d80211/wep.c | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/d80211/wep.c b/net/d80211/wep.c
index c3e4728..22c2e53 100644
--- a/net/d80211/wep.c
+++ b/net/d80211/wep.c
@@ -120,10 +120,10 @@ void ieee80211_wep_encrypt_data(struct c
size_t klen, u8 *data, size_t data_len)
{
struct scatterlist sg;
- u32 *icv;
+ __le32 *icv;
- icv = (u32 *)(data + data_len);
- *icv = ~crc32_le(~0, data, data_len);
+ icv = (__le32 *)(data + data_len);
+ *icv = cpu_to_le32(~crc32_le(~0, data, data_len));
crypto_cipher_setkey(tfm, rc4key, klen);
sg.page = virt_to_page(data);
@@ -187,7 +187,7 @@ int ieee80211_wep_decrypt_data(struct cr
size_t klen, u8 *data, size_t data_len)
{
struct scatterlist sg;
- u32 crc;
+ __le32 crc;
crypto_cipher_setkey(tfm, rc4key, klen);
sg.page = virt_to_page(data);
@@ -195,7 +195,7 @@ int ieee80211_wep_decrypt_data(struct cr
sg.length = data_len + WEP_ICV_LEN;
crypto_cipher_decrypt(tfm, &sg, &sg, sg.length);
- crc = ~crc32_le(~0, data, data_len);
+ crc = cpu_to_le32(~crc32_le(~0, data, data_len));
if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
/* ICV mismatch */
return -1;
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply related [flat|nested] 4+ messages in thread