diff mbox

mac80211: allow same PN for AMSDU sub-frames

Message ID 1457515785-18795-1-git-send-email-emmanuel.grumbach@intel.com (mailing list archive)
State Changes Requested
Delegated to: Johannes Berg
Headers show

Commit Message

Emmanuel Grumbach March 9, 2016, 9:29 a.m. UTC 
From: Sara Sharon <sara.sharon@intel.com>

Some hardware (iwlwifi an example) de-aggregate AMSDUs and
copy the IV as is to the generated MPDUs, so the same PN
appears in multiple packets without being a replay attack.
Do not increment the PN until all the sub-frames are received
to accommodate to that.

Signed-off-by: Sara Sharon <sara.sharon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
---
 net/mac80211/wpa.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

Comments

Johannes Berg March 29, 2016, 8:09 a.m. UTC | #1 
On Wed, 2016-03-09 at 11:29 +0200, Emmanuel Grumbach wrote:
> From: Sara Sharon <sara.sharon@intel.com>
> 
> Some hardware (iwlwifi an example) de-aggregate AMSDUs and
> copy the IV as is to the generated MPDUs, so the same PN
> appears in multiple packets without being a replay attack.
> Do not increment the PN until all the sub-frames are received
> to accommodate to that.
> 
I'll drop this for now since you found an issue with it :)

johannes
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7e4f265..7ba66b3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -542,8 +542,9 @@  ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
 				    skb->data + skb->len - mic_len, mic_len))
 				return RX_DROP_UNUSABLE;
 		}
-
-		memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
+		if (!(status->flag & RX_FLAG_AMSDU_MORE))
+			memcpy(key->u.ccmp.rx_pn[queue], pn,
+			       IEEE80211_CCMP_PN_LEN);
 	}
 
 	/* Remove CCMP header and MIC */
@@ -769,8 +770,9 @@  ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
 				    IEEE80211_GCMP_MIC_LEN))
 				return RX_DROP_UNUSABLE;
 		}
-
-		memcpy(key->u.gcmp.rx_pn[queue], pn, IEEE80211_GCMP_PN_LEN);
+		if (!(status->flag & RX_FLAG_AMSDU_MORE))
+			memcpy(key->u.gcmp.rx_pn[queue], pn,
+			       IEEE80211_GCMP_PN_LEN);
 	}
 
 	/* Remove GCMP header and MIC */