| From 62506e0346de0976ecb5bfedfb340ac2e6b73de8 Mon Sep 17 00:00:00 2001 |
| From: Jouni Malinen <j@w1.fi> |
| Date: Tue, 7 Jan 2020 17:35:45 +0200 |
| Subject: [PATCH] mac80211: Fix TKIP replay protection immediately after key |
| setup |
| |
| commit 6f601265215a421f425ba3a4850a35861d024643 upstream. |
| |
| TKIP replay protection was skipped for the very first frame received |
| after a new key is configured. While this is potentially needed to avoid |
| dropping a frame in some cases, this does leave a window for replay |
| attacks with group-addressed frames at the station side. Any earlier |
| frame sent by the AP using the same key would be accepted as a valid |
| frame and the internal RSC would then be updated to the TSC from that |
| frame. This would allow multiple previously transmitted group-addressed |
| frames to be replayed until the next valid new group-addressed frame |
| from the AP is received by the station. |
| |
| Fix this by limiting the no-replay-protection exception to apply only |
| for the case where TSC=0, i.e., when this is for the very first frame |
| protected using the new key, and the local RSC had not been set to a |
| higher value when configuring the key (which may happen with GTK). |
| |
| Signed-off-by: Jouni Malinen <j@w1.fi> |
| Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c |
| index 7914b8e3ce8c..2e7bd8b9f43c 100644 |
| --- a/net/mac80211/tkip.c |
| +++ b/net/mac80211/tkip.c |
| @@ -263,9 +263,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm, |
| if ((keyid >> 6) != key->conf.keyidx) |
| return TKIP_DECRYPT_INVALID_KEYIDX; |
| |
| - if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT && |
| - (iv32 < rx_ctx->iv32 || |
| - (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16))) |
| + /* Reject replays if the received TSC is smaller than or equal to the |
| + * last received value in a valid message, but with an exception for |
| + * the case where a new key has been set and no valid frame using that |
| + * key has yet received and the local RSC was initialized to 0. This |
| + * exception allows the very first frame sent by the transmitter to be |
| + * accepted even if that transmitter were to use TSC 0 (IEEE 802.11 |
| + * described TSC to be initialized to 1 whenever a new key is taken into |
| + * use). |
| + */ |
| + if (iv32 < rx_ctx->iv32 || |
| + (iv32 == rx_ctx->iv32 && |
| + (iv16 < rx_ctx->iv16 || |
| + (iv16 == rx_ctx->iv16 && |
| + (rx_ctx->iv32 || rx_ctx->iv16 || |
| + rx_ctx->ctx.state != TKIP_STATE_NOT_INIT))))) |
| return TKIP_DECRYPT_REPLAY; |
| |
| if (only_iv) { |
| -- |
| 2.7.4 |
| |
