Skip to contentSkip to conversation

tkip: fix iv32 calculation in ieee80211_get_tkip_key()

PATCH In review Pavel Roskin 3 participants 4 messages Apr 25, 2008 – Apr 26, 2008 mac80211

lore
Share & tools
lore

Pavel Roskin

author
#0 lore raw

PATCH 1/1 tkip: fix iv32 calculation in ieee80211_get_tkip_key()

Signed-off-by Pavel Roskin <[email protected]>

---
It's a side product of testing a sparse patch by Linus Torvalds. Compile tested only.

 net/mac80211/tkip.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)
net/mac80211/tkip.c +3 -3
index dddbfd6..b9ecd65 100644
@@ -231,9 +231,9 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
 	iv16 = data[hdr_len] << 8;
 	iv16 += data[hdr_len + 2];
 	iv32 = data[hdr_len + 4] +
-		(data[hdr_len + 5] >> 8) +
-		(data[hdr_len + 6] >> 16) +
-		(data[hdr_len + 7] >> 24);
+		(data[hdr_len + 5] << 8) +
+		(data[hdr_len + 6] << 16) +
+		(data[hdr_len + 7] << 24);
 
 #ifdef CONFIG_TKIP_DEBUG
 	printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
Signature · 2 lines
Regards,
Pavel Roskin
#1 lore raw
Quoted 24 lines · Pavel Roskin
Signed-off-by Pavel Roskin <[email protected]>

---
It's a side product of testing a sparse patch by Linus Torvalds. Compile tested only.

  net/mac80211/tkip.c |    6 +++---
  1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index dddbfd6..b9ecd65 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -231,9 +231,9 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,

        iv16 = data[hdr_len] << 8;
        iv16 += data[hdr_len + 2];
        iv32 = data[hdr_len + 4] +
 -               (data[hdr_len + 5] >> 8) +
 -               (data[hdr_len + 6] >> 16) +
 -               (data[hdr_len + 7] >> 24);
 +               (data[hdr_len + 5] << 8) +
 +               (data[hdr_len + 6] << 16) +
 +               (data[hdr_len + 7] << 24);
Quoted 4 lines
  #ifdef CONFIG_TKIP_DEBUG
        printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",

We've tested TKIP code well and I'm not sure we wouldn't pay attention to such mistake.
Tomas

Quoted 7 lines

Regards,
Pavel Roskin
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

maintainer
#2 lore raw
Quoted 12 lines
Quoted 12 lines

It's a side product of testing a sparse patch by Linus Torvalds. Compile tested only.

        iv32 = data[hdr_len + 4] +
 -               (data[hdr_len + 5] >> 8) +
 -               (data[hdr_len + 6] >> 16) +
 -               (data[hdr_len + 7] >> 24);
 +               (data[hdr_len + 5] << 8) +
 +               (data[hdr_len + 6] << 16) +
 +               (data[hdr_len + 7] << 24);
Quoted 7 lines
Quoted 4 lines
  #ifdef CONFIG_TKIP_DEBUG
        printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",

We've tested TKIP code well and I'm not sure we wouldn't pay attention to such mistake.

But the code does look a bit fishy. I'm confused.

johannes

#3 lore raw
Quoted 18 lines · Johannes Berg
Quoted 18 lines
Quoted 17 lines

It's a side product of testing a sparse patch by Linus Torvalds. Compile tested only.

        iv32 = data[hdr_len + 4] +
 -               (data[hdr_len + 5] >> 8) +
 -               (data[hdr_len + 6] >> 16) +
 -               (data[hdr_len + 7] >> 24);
 +               (data[hdr_len + 5] << 8) +
 +               (data[hdr_len + 6] << 16) +
 +               (data[hdr_len + 7] << 24);
  #ifdef CONFIG_TKIP_DEBUG
        printk(KERN_DEBUG "TKIP encrypt: iv16 = 0x%04x, iv32 = 0x%08x\n",
Quoted 4 lines
Quoted 2 lines

We've tested TKIP code well and I'm not sure we wouldn't pay attention to such mistake.

But the code does look a bit fishy. I'm confused.

It looks bad. Frankly Pavel's version looks more correct but as black box TKIP is working.
Maybe we never tested more then 256 wrapparounds.... will need to dig into more

Thanks
Tomas

Quoted 2 lines

johannes