| From d211e90e28a074447584729018a39910d691d1a8 Mon Sep 17 00:00:00 2001 |
| From: Jouni Malinen <j@w1.fi> |
| Date: Sun, 28 Mar 2010 22:29:52 -0700 |
| Subject: mac80211: Fix robust management frame handling (MFP) |
| |
| From: Jouni Malinen <j@w1.fi> |
| |
| commit d211e90e28a074447584729018a39910d691d1a8 upstream. |
| |
| Commit e34e09401ee9888dd662b2fca5d607794a56daf2 incorrectly removed |
| use of ieee80211_has_protected() from the management frame case and in |
| practice, made this validation drop all Action frames when MFP is |
| enabled. This should have only been done for frames with Protected |
| field set to zero. |
| |
| Signed-off-by: Jouni Malinen <j@w1.fi> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/mac80211/rx.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/net/mac80211/rx.c |
| +++ b/net/mac80211/rx.c |
| @@ -1220,7 +1220,8 @@ ieee80211_drop_unencrypted(struct ieee80 |
| (rx->key || rx->sdata->drop_unencrypted))) |
| return -EACCES; |
| if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) { |
| - if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && |
| + if (unlikely(!ieee80211_has_protected(fc) && |
| + ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && |
| rx->key)) |
| return -EACCES; |
| /* BIP does not use Protected field, so need to check MMIE */ |
