dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

mac80211: MFP - Drop unprotected Action frames prior key setup 

When management frame protection (IEEE 802.11w) is used, unprotected
Robust Action frames are not allowed prior to key configuration.
However, unprotected Deauthentication and Disassociation frames are
allowed at that point, but not after key configuration.

Make ieee80211_drop_unencrypted() handle the special cases for MFP by
separating the basic Data frame case from Management frame processing
and handle the Management frames only if MFP has been negotiated. In
addition, do not use sdata->drop_unencrypted for Management frames
since the decision on whether to accept the frame depends on the key
being configured.

Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Jouni Malinen 2009-05-08 12:36:03 +03:00 committed by John W. Linville
parent 0c7c10c7cc
commit f2ca3ea484
1 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
net/mac80211/rx.c
View File

@ -1221,17 +1221,27 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
/* Drop unencrypted frames if key is set. */
if (unlikely(!ieee80211_has_protected(fc) &&
!ieee80211_is_nullfunc(fc) &&
(!ieee80211_is_mgmt(fc) ||
(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
(rx->key || rx->sdata->drop_unencrypted)))
return -EACCES;
/* BIP does not use Protected field, so need to check MMIE */
if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
ieee80211_is_data(fc) &&
(rx->key || rx->sdata->drop_unencrypted)))
return -EACCES;
if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
rx->key))
return -EACCES;
/* BIP does not use Protected field, so need to check MMIE */
if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
&& ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
rx->key))
return -EACCES;
/*
* When using MFP, Action frames are not allowed prior to
* having configured keys.
*/
if (unlikely(ieee80211_is_action(fc) && !rx->key &&
ieee80211_is_robust_mgmt_frame(
(struct ieee80211_hdr *) rx->skb->data)))
return -EACCES;
}
return 0;
}