Skip to contentSkip to conversation

mac80211: Protect Deauthentication frame when using MFP

PATCH Superseded Jouni Malinen 1 participant 2 messages Jun 11, 2010 – Jun 14, 2010 mac80211

lore
Share & tools
lore

Jouni Malinen

author
#0 lore raw

PATCH 1/1 mac80211: Protect Deauthentication frame when using MFP

When management frame protection (IEEE 802.11w) is used, Deauthentication frame needs to be protected when the pairwise key is configured. mac80211 was removing the station entry (and its keys) before actually sending out the Deauthentication frame. Fix this by reordering the code to send the frame before the station entry gets removed. This matches an earlier change that handled the Disassociation frame processing, but missed Deauthentication frames.

Signed-off-by Jouni Malinen <[email protected]>
---
 net/mac80211/mlme.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
net/mac80211/mlme.c +5 -3
@@ -2292,13 +2292,13 @@ int ieee80211_mgd_deauth(struct ieee8021
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 	struct ieee80211_work *wk;
-	const u8 *bssid = req->bss->bssid;
+	u8 bssid[ETH_ALEN];
 
 	mutex_lock(&ifmgd->mtx);
 
+	memcpy(bssid, req->bss->bssid, ETH_ALEN);
 	if (ifmgd->associated == req->bss) {
-		bssid = req->bss->bssid;
-		ieee80211_set_disassoc(sdata, true);
+		ieee80211_set_disassoc(sdata, false);
 		mutex_unlock(&ifmgd->mtx);
 	} else {
 		bool not_auth_yet = false;

@@ -2345,6 +2345,8 @@ int ieee80211_mgd_deauth(struct ieee8021
 	ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
 				       req->reason_code, cookie,
 				       !req->local_state_change);
+	if (ifmgd->associated == req->bss)
+		sta_info_destroy_addr(sdata, bssid);
 
 	ieee80211_recalc_idle(sdata->local);
Signature · 1 line
Jouni Malinen                                            PGP id EFC895FA
author
#1 lore raw

PATCH v2 1/1 mac80211: Protect Deauthentication frame when using MFP

When management frame protection (IEEE 802.11w) is used, Deauthentication frame needs to be protected when the pairwise key is configured. mac80211 was removing the station entry (and its keys) before actually sending out the Deauthentication frame. Fix this by reordering the code to send the frame before the station entry gets removed. This matches an earlier change that handled the Disassociation frame processing, but missed Deauthentication frames.

Signed-off-by Jouni Malinen <[email protected]>
---
 net/mac80211/mlme.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

v2: Fix a bug that left STA entries behind and broke some reassociation
cases.

net/mac80211/mlme.c +7 -3
@@ -2292,14 +2292,16 @@ int ieee80211_mgd_deauth(struct ieee8021
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 	struct ieee80211_work *wk;
-	const u8 *bssid = req->bss->bssid;
+	u8 bssid[ETH_ALEN];
+	bool assoc_bss = false;
 
 	mutex_lock(&ifmgd->mtx);
 
+	memcpy(bssid, req->bss->bssid, ETH_ALEN);
 	if (ifmgd->associated == req->bss) {
-		bssid = req->bss->bssid;
-		ieee80211_set_disassoc(sdata, true);
+		ieee80211_set_disassoc(sdata, false);
 		mutex_unlock(&ifmgd->mtx);
+		assoc_bss = true;
 	} else {
 		bool not_auth_yet = false;
 

@@ -2345,6 +2347,8 @@ int ieee80211_mgd_deauth(struct ieee8021
 	ieee80211_send_deauth_disassoc(sdata, bssid, IEEE80211_STYPE_DEAUTH,
 				       req->reason_code, cookie,
 				       !req->local_state_change);
+	if (assoc_bss)
+		sta_info_destroy_addr(sdata, bssid);
 
 	ieee80211_recalc_idle(sdata->local);
Signature · 1 line
Jouni Malinen                                            PGP id EFC895FA