Commit a0761a30 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: drop data frames without key on encrypted links 



If we know that we have an encrypted link (based on having had
a key configured for TX in the past) then drop all data frames
in the key selection handler if there's no key anymore.

This fixes an issue with mac80211 internal TXQs - there we can
buffer frames for an encrypted link, but then if the key is no
longer there when they're dequeued, the frames are sent without
encryption. This happens if a station is disconnected while the
frames are still on the TXQ.

Detecting that a link should be encrypted based on a first key
having been configured for TX is fine as there are no use cases
for a connection going from with encryption to no encryption.
With extended key IDs, however, there is a case of having a key
configured for only decryption, so we can't just trigger this
behaviour on a key being configured.

Cc: stable@vger.kernel.org
Reported-by: default avatarJouni Malinen <j@w1.fi>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20200326150855.6865c7f28a14.I9fb1d911b064262d33e33dfba730cdeef83926ca@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 575a97ac

net/mac80211/debugfs_sta.c

+2 −1
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>

 * Copyright 2013-2014  Intel Mobile Communications GmbH

 * Copyright(c) 2016 Intel Deutschland GmbH

 * Copyright (C) 2018 - 2019 Intel Corporation

 * Copyright (C) 2018 - 2020 Intel Corporation

 */



#include <linux/debugfs.h>
@@ -78,6 +78,7 @@ static const char * const sta_flag_names[] = { 
	FLAG(MPSP_OWNER),

	FLAG(MPSP_RECIPIENT),

	FLAG(PS_DELIVER),

	FLAG(USES_ENCRYPTION),

#undef FLAG

};

net/mac80211/key.c

+12 −8
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 
 * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>

 * Copyright 2013-2014  Intel Mobile Communications GmbH

 * Copyright 2015-2017	Intel Deutschland GmbH

 * Copyright 2018-2019  Intel Corporation

 * Copyright 2018-2020  Intel Corporation

 */



#include <linux/if_ether.h>
@@ -262,22 +262,29 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key) 
			  sta ? sta->sta.addr : bcast_addr, ret);

}



int ieee80211_set_tx_key(struct ieee80211_key *key)

static int _ieee80211_set_tx_key(struct ieee80211_key *key, bool force)

{

	struct sta_info *sta = key->sta;

	struct ieee80211_local *local = key->local;



	assert_key_lock(local);



	set_sta_flag(sta, WLAN_STA_USES_ENCRYPTION);



	sta->ptk_idx = key->conf.keyidx;



	if (!ieee80211_hw_check(&local->hw, AMPDU_KEYBORDER_SUPPORT))

	if (force || !ieee80211_hw_check(&local->hw, AMPDU_KEYBORDER_SUPPORT))

		clear_sta_flag(sta, WLAN_STA_BLOCK_BA);

	ieee80211_check_fast_xmit(sta);



	return 0;

}



int ieee80211_set_tx_key(struct ieee80211_key *key)

{

	return _ieee80211_set_tx_key(key, false);

}



static void ieee80211_pairwise_rekey(struct ieee80211_key *old,

				     struct ieee80211_key *new)

{
@@ -441,11 +448,8 @@ static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata, 
		if (pairwise) {

			rcu_assign_pointer(sta->ptk[idx], new);

			if (new &&

			    !(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX)) {

				sta->ptk_idx = idx;

				clear_sta_flag(sta, WLAN_STA_BLOCK_BA);

				ieee80211_check_fast_xmit(sta);

			}

			    !(new->conf.flags & IEEE80211_KEY_FLAG_NO_AUTO_TX))

				_ieee80211_set_tx_key(new, true);

		} else {

			rcu_assign_pointer(sta->gtk[idx], new);

		}

net/mac80211/sta_info.h

+1 −0
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ enum ieee80211_sta_info_flags { 
	WLAN_STA_MPSP_OWNER,

	WLAN_STA_MPSP_RECIPIENT,

	WLAN_STA_PS_DELIVER,

	WLAN_STA_USES_ENCRYPTION,



	NUM_WLAN_STA_FLAGS,

};

net/mac80211/tx.c

+9 −3
Original line number Diff line number Diff line
@@ -590,9 +590,12 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) 
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;



	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))

	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {

		tx->key = NULL;

	else if (tx->sta &&

		return TX_CONTINUE;

	}



	if (tx->sta &&

	    (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))

		tx->key = key;

	else if (ieee80211_is_group_privacy_action(tx->skb) &&
@@ -654,6 +657,9 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) 
		if (!skip_hw && tx->key &&

		    tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)

			info->control.hw_key = &tx->key->conf;

	} else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&

		   test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {

		return TX_DROP;

	}



	return TX_CONTINUE;

CRA Git | Maintained and supported by SUSTech CRA and CCSE