security question

PATCH mabbas 3 participants 6 messages Nov 21, 2007 – Nov 24, 2007 mac80211

Share & tools

mabbas

author

2007-11-21 08:01 UTC #0 lore raw

When I connect to an AP with wpa, then I receive deauth frame, ieee80211_rx_mgmt_deauth will be called, which will call ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN). wpa_supplicant will receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address. ieee80211_set_encryption will fail since there are no station with 00:00:00:00:00:00. This will leave the old key which causes the problems in the next reconnection.

Below is the work around to this problem, I am not very familiar with security in mac80211 so I appreciate any comment on how to fix this problem the right way.

Mohamed

net/mac80211/ieee80211_ioctl.c +0 -0

index c84a26e..e08df5e 100644
@@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,

			return -EINVAL;
		}

- sta = sta_info_get(local, sta_addr);
+ if (is_zero_ether_addr(sta_addr))
+ sta = sta_info_get(local, sdata->u.sta.bssid);
+ else

+			sta = sta_info_get(local, sta_addr);
		if (!sta) {

#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
printk(KERN_DEBUG "%s: set_encrypt - unknown addr "

Johannes Berg

maintainer

2007-11-21 15:16 UTC #1 lore raw

wpa_supplicant/key deletion with all-zeroes mac (was: security question)

Hi,

Quoted 10 lines

When I connect to an AP with wpa, then I receive deauth frame, ieee80211_rx_mgmt_deauth will be called, which will call ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN). wpa_supplicant will receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address. ieee80211_set_encryption will fail since there are no station with 00:00:00:00:00:00. This will leave the old key which causes the problems in the next reconnection.

Interesting. I'd think this is a wpa_supplicant bug, Jouni, how is the security wext stuff supposed to work here?

Quoted 17 lines

net/mac80211/ieee80211_ioctl.c +4 -1

index c84a26e..e08df5e 100644
@@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
 			return -EINVAL;
 		}
 
-		sta = sta_info_get(local, sta_addr);
+		if (is_zero_ether_addr(sta_addr))
+			sta = sta_info_get(local, sdata->u.sta.bssid);
+		else
+			sta = sta_info_get(local, sta_addr);
 		if (!sta) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 			printk(KERN_DEBUG "%s: set_encrypt - unknown addr "

Jouni Malinen

2007-11-22 04:37 UTC #2 lore raw

Re: wpa_supplicant/key deletion with all-zeroes mac (was: security question)

Quoted 5 lines · Johannes Berg

Quoted 5 lines
When I connect to an AP with wpa, then I receive deauth frame, ieee80211_rx_mgmt_deauth will be called, which will call ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN).

This sounds correct.

Quoted 3 lines

Quoted 3 lines
wpa_supplicant will
receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address.

This sounds broken. wpa_supplicant should remove the key for the previous BSSID.

Quoted 3 lines

Quoted 3 lines
ieee80211_set_encryption will fail since there are no station with 00:00:00:00:00:00. This will leave the old key which causes the problems in the next reconnection.

This sounds correct behavior.

Quoted 2 lines

Interesting. I'd think this is a wpa_supplicant bug, Jouni, how is the security wext stuff supposed to work here?

Agreed, this sounds like a bug in wpa_supplicant. Unicast keys should be removed with their correct address. I think this used to work, but maybe some of the changes in BSSID processing in disassociation cases caused the old BSSID to be forgotten.

Quoted 7 lines

net/mac80211/ieee80211_ioctl.c static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr, · line 100
Quoted 7 lines
net/mac80211/ieee80211_ioctl.c +4 -1
@@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
-		sta = sta_info_get(local, sta_addr);
+		if (is_zero_ether_addr(sta_addr))
+			sta = sta_info_get(local, sdata->u.sta.bssid);
+		else
+			sta = sta_info_get(local, sta_addr);

NAK. I don't think this is the correct fix here.

Signature · 1 line

Jouni Malinen                                            PGP id EFC895FA

mabbas

author

2007-11-22 05:32 UTC #3 lore raw

Re: wpa_supplicant/key deletion with all-zeroes mac

Quoted 32 lines · Jouni Malinen

Quoted 2 lines · Johannes Berg
Quoted 2 lines
When I connect to an AP with wpa, then I receive deauth frame, ieee80211_rx_mgmt_deauth will be called, which will call ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN).
This sounds correct.
Quoted 2 lines
Quoted 2 lines
wpa_supplicant will receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address.
This sounds broken. wpa_supplicant should remove the key for the previous BSSID.
Quoted 2 lines
Quoted 2 lines
ieee80211_set_encryption will fail since there are no station with 00:00:00:00:00:00. This will leave the old key which causes the problems in the next reconnection.
This sounds correct behavior.
Quoted 3 lines
Interesting. I'd think this is a wpa_supplicant bug, Jouni, how is the security wext stuff supposed to work here?
Agreed, this sounds like a bug in wpa_supplicant. Unicast keys should be removed with their correct address. I think this used to work, but maybe some of the changes in BSSID processing in disassociation cases caused the old BSSID to be forgotten.

Quoted 12 lines

Quoted 8 lines
net/mac80211/ieee80211_ioctl.c static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr, · line 101
Quoted 8 lines
net/mac80211/ieee80211_ioctl.c +4 -1
@@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
-		sta = sta_info_get(local, sta_addr);
+		if (is_zero_ether_addr(sta_addr))
+			sta = sta_info_get(local, sdata->u.sta.bssid);
+		else
+			sta = sta_info_get(local, sta_addr);
 
NAK. I don't think this is the correct fix here.

I agree I just included this workaround to illustrated what I did to make it work.

Johannes Berg

maintainer

2007-11-22 12:56 UTC #4 lore raw

Re: wpa_supplicant/key deletion with all-zeroes mac (was: security question)

In reply to Jouni Malinen

Quoted 9 lines

Quoted 4 lines
Quoted 4 lines
wpa_supplicant will
receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address.
This sounds broken. wpa_supplicant should remove the key for the previous BSSID.

Quoted 7 lines

Quoted 2 lines
Interesting. I'd think this is a wpa_supplicant bug, Jouni, how is the security wext stuff supposed to work here?
Agreed, this sounds like a bug in wpa_supplicant. Unicast keys should be removed with their correct address. I think this used to work, but maybe some of the changes in BSSID processing in disassociation cases caused the old BSSID to be forgotten.

Can you look into it then please?

Thanks,
johannes

Jouni Malinen

2007-11-24 20:00 UTC #5 lore raw

Re: wpa_supplicant/key deletion with all-zeroes mac (was: security question)

Quoted 5 lines · Johannes Berg

Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
wpa_supplicant will
receives this event then call mac80211 to remove any old security key, the problem it will pass 00:00:00:00:00:00 as station address.
Can you look into it then please?

It looks like this was fixed more than a year ago.. Which wpa_supplicant version was used here? Can the problem be reproduced on something more recent (e.g., 0.5.8 or the current 0.6.x snapshot)? If yes, I would like to see debug log from wpa_supplicant showing what exactly happens.

The fix was to reorder clearing of the BSSID:
http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=3103d0a7f91a48ebfa0d08c6599babd0c556e6a9

Signature · 1 line

Jouni Malinen                                            PGP id EFC895FA