Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1357511
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.4 32/50] mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs |
| Date | 2016-03-14 19:20 +0100 |
| Message-ID | <rcFfY-7qA-23@gated-at.bofh.it> (permalink) |
| References | <rcEWC-73F-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 9acc54beb474c81148e2946603d141cf8716b19f upstream.
Just like for CCMP we need to check that for GCMP the fragments
have PNs that increment by one; the spec was updated to fix this
security issue and now has the following text:
The receiver shall discard MSDUs and MMPDUs whose constituent
MPDU PN values are not incrementing in steps of 1.
Adapt the code for CCMP to work for GCMP as well, luckily the
relevant fields already alias each other so no code duplication
is needed (just check the aliasing with BUILD_BUG_ON.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/ieee80211_i.h | 2 +-
net/mac80211/rx.c | 36 +++++++++++++++++++++++++++---------
2 files changed, 28 insertions(+), 10 deletions(-)
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -92,7 +92,7 @@ struct ieee80211_fragment_entry {
u16 extra_len;
u16 last_frag;
u8 rx_queue;
- bool ccmp; /* Whether fragments were encrypted with CCMP */
+ bool check_sequential_pn; /* needed for CCMP/GCMP */
u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
};
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1754,7 +1754,7 @@ ieee80211_reassemble_add(struct ieee8021
entry->seq = seq;
entry->rx_queue = rx_queue;
entry->last_frag = frag;
- entry->ccmp = 0;
+ entry->check_sequential_pn = false;
entry->extra_len = 0;
return entry;
@@ -1850,15 +1850,27 @@ ieee80211_rx_h_defragment(struct ieee802
rx->seqno_idx, &(rx->skb));
if (rx->key &&
(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
- rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256) &&
+ rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
+ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
+ rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
ieee80211_has_protected(fc)) {
int queue = rx->security_idx;
- /* Store CCMP PN so that we can verify that the next
- * fragment has a sequential PN value. */
- entry->ccmp = 1;
+
+ /* Store CCMP/GCMP PN so that we can verify that the
+ * next fragment has a sequential PN value.
+ */
+ entry->check_sequential_pn = true;
memcpy(entry->last_pn,
rx->key->u.ccmp.rx_pn[queue],
IEEE80211_CCMP_PN_LEN);
+ BUILD_BUG_ON(offsetof(struct ieee80211_key,
+ u.ccmp.rx_pn) !=
+ offsetof(struct ieee80211_key,
+ u.gcmp.rx_pn));
+ BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
+ sizeof(rx->key->u.gcmp.rx_pn[queue]));
+ BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
+ IEEE80211_GCMP_PN_LEN);
}
return RX_QUEUED;
}
@@ -1873,15 +1885,21 @@ ieee80211_rx_h_defragment(struct ieee802
return RX_DROP_MONITOR;
}
- /* Verify that MPDUs within one MSDU have sequential PN values.
- * (IEEE 802.11i, 8.3.3.4.5) */
- if (entry->ccmp) {
+ /* "The receiver shall discard MSDUs and MMPDUs whose constituent
+ * MPDU PN values are not incrementing in steps of 1."
+ * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
+ * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
+ */
+ if (entry->check_sequential_pn) {
int i;
u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
int queue;
+
if (!rx->key ||
(rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
- rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256))
+ rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
+ rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
+ rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
return RX_DROP_UNUSABLE;
memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.4 00/50] 4.4.6-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:10 +0100
[PATCH 4.4 11/50] KVM: MMU: fix reserved bit check for ept=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:10 +0100
[PATCH 4.4 47/50] MIPS: smp.c: Fix uninitialised temp_foreign_map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:10 +0100
[PATCH 4.4 10/50] KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:10 +0100
[PATCH 4.4 14/50] tracing: Fix check for cpu online when event is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:10 +0100
[PATCH 4.4 39/50] Revert "drm/radeon/pm: adjust display configuration after powerstate" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 30/50] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 21/50] ASoC: wm8958: Fix enum ctl accesses in a wrong type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 27/50] iwlwifi: mvm: inc pending frames counter also when txing non-sta Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 43/50] userfaultfd: dont block on the last VM updates at exit time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 32/50] mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 26/50] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 40/50] powerpc: Fix dedotify for binutils >= 2.26 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 28/50] mac80211: minstrel: Change expected throughput unit back to Kbps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 33/50] mac80211: Fix Public Action frame RX in AP mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 41/50] powerpc/powernv: Add a kmsg_dumper that flushes console output on panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 29/50] mac80211: fix use of uninitialised values in RX aggregation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 22/50] ovl: ignore lower entries when checking purity of non-directory entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 04/50] ARM: OMAP2+: hwmod: Introduce ti,no-idle dt property Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 45/50] ovl: fix getcwd() failure after unsuccessful rmdir Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 23/50] ovl: fix working on distributed fs as lower layer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 03/50] ARM: dts: dra7: do not gate cpsw clock due to errata i877 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 02/50] ARM: mvebu: fix overlap of Crypto SRAM with PCIe memory window Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 24/50] wext: fix message delay/ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 06/50] kvm: cap halt polling at exactly halt_poll_ns Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 44/50] ovl: copy new uid/gid into overlayfs runtime inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 35/50] x86/mm: Fix slow_virt_to_phys() for X86_PAE again Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 42/50] powerpc/powernv: Fix OPAL_CONSOLE_FLUSH prototype and usages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 34/50] gpu: ipu-v3: Do not bail out on missing optional port nodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:20 +0100
[PATCH 4.4 15/50] dmaengine: at_xdmac: fix residue computation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:30 +0100
[PATCH 4.4 25/50] cfg80211/wext: fix message ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:30 +0100
[PATCH 4.4 20/50] ASoC: wm8994: Fix enum ctl accesses in a wrong type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:30 +0100
[PATCH 4.4 19/50] ASoC: samsung: Use IRQ safe spin lock calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-14 19:30 +0100
Re: [PATCH 4.4 00/50] 4.4.6-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-03-15 00:20 +0100
Re: [PATCH 4.4 00/50] 4.4.6-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-16 16:50 +0100
Re: [PATCH 4.4 00/50] 4.4.6-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-15 03:40 +0100
Re: [PATCH 4.4 00/50] 4.4.6-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-16 16:50 +0100
csiph-web