Does mac80211 guarantee no data frames are sent to driver until encryption is setup?

A certain firmware tries to do EAPOL inspection and only allow data pkts to be sent after the 4-way M4 has been sent, for instance.

This was breaking .11r because in that case you don't do the 4-way after roaming, so the firmware was waiting forever for an M4 to be sent and thus all tx data was hung.

I managed to get this working by just removing all of the EAPOL inspection from the firmware,
but I am thinking that if the stack will send data packets to the driver before 4-way auth is completed and keys are set, then maybe I would be opening up a race where un-encrypted frames could hit the air.

Any idea what protections, if any, the mac80211 stack provides for this case?

Quoted 13 lines · Ben Greear

A certain firmware tries to do EAPOL inspection and only allow data pkts to be sent after the 4-way M4 has been sent, for instance.

This was breaking .11r because in that case you don't do the 4-way after roaming, so the firmware was waiting forever for an M4 to be sent and thus all tx data was hung.

I managed to get this working by just removing all of the EAPOL inspection from the firmware,
but I am thinking that if the stack will send data packets to the driver before 4-way auth is completed and keys are set, then maybe I would be opening up a race where un-encrypted frames could hit the air.

Quoted 3 lines

Any idea what protections, if any, the mac80211 stack provides for this case?

Check WLAN_STA_AUTHORIZED in mac80211.