Commit f631a77b authored by Sara Sharon's avatar Sara Sharon Committed by Johannes Berg
Browse files

mac80211: allow same PN for AMSDU sub-frames 



Some hardware (iwlwifi an example) de-aggregate AMSDUs and copy the IV
as is to the generated MPDUs, so the same PN appears in multiple
packets without being a replay attack.  Allow driver to explicitly
indicate that a frame is allowed to have the same PN as the previous
frame.

Signed-off-by: default avatarSara Sharon <sara.sharon@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 20eb7ea9

include/net/mac80211.h

+5 −1
Original line number Diff line number Diff line
@@ -1068,6 +1068,9 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) 
 * @RX_FLAG_RADIOTAP_VENDOR_DATA: This frame contains vendor-specific

 *	radiotap data in the skb->data (before the frame) as described by

 *	the &struct ieee80211_vendor_radiotap.

 * @RX_FLAG_ALLOW_SAME_PN: Allow the same PN as same packet before.

 *	This is used for AMSDU subframes which can have the same PN as

 *	the first subframe.

 */

enum mac80211_rx_flags {

	RX_FLAG_MMIC_ERROR		= BIT(0),
@@ -1102,6 +1105,7 @@ enum mac80211_rx_flags { 
	RX_FLAG_AMSDU_MORE		= BIT(30),

	RX_FLAG_RADIOTAP_VENDOR_DATA	= BIT(31),

	RX_FLAG_MIC_STRIPPED		= BIT_ULL(32),

	RX_FLAG_ALLOW_SAME_PN		= BIT_ULL(33),

};



#define RX_FLAG_STBC_SHIFT		26

net/mac80211/wpa.c

+12 −4
Original line number Diff line number Diff line
@@ -519,12 +519,16 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, 
		return RX_DROP_UNUSABLE;



	if (!(status->flag & RX_FLAG_PN_VALIDATED)) {

		int res;



		ccmp_hdr2pn(pn, skb->data + hdrlen);



		queue = rx->security_idx;



		if (memcmp(pn, key->u.ccmp.rx_pn[queue],

			   IEEE80211_CCMP_PN_LEN) <= 0) {

		res = memcmp(pn, key->u.ccmp.rx_pn[queue],

			     IEEE80211_CCMP_PN_LEN);

		if (res < 0 ||

		    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {

			key->u.ccmp.replays++;

			return RX_DROP_UNUSABLE;

		}
@@ -745,12 +749,16 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) 
		return RX_DROP_UNUSABLE;



	if (!(status->flag & RX_FLAG_PN_VALIDATED)) {

		int res;



		gcmp_hdr2pn(pn, skb->data + hdrlen);



		queue = rx->security_idx;



		if (memcmp(pn, key->u.gcmp.rx_pn[queue],

			   IEEE80211_GCMP_PN_LEN) <= 0) {

		res = memcmp(pn, key->u.gcmp.rx_pn[queue],

			     IEEE80211_GCMP_PN_LEN);

		if (res < 0 ||

		    (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) {

			key->u.gcmp.replays++;

			return RX_DROP_UNUSABLE;

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE