Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 08:48:31 -05:00
Code Issues Projects Releases Wiki Activity

TDLS: Fix MIC calculation for teardown frame to depend on reason code

Browse Source 
The reason code used for calculating the MIC should correspond to the
reason code with which the teardown frame is sent, as the receiver shall
use the one obtained in the frame for validating the MIC.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Sunil Dutt 2013-02-05 13:36:36 +02:00 committed by Jouni Malinen
parent 3887878e53
commit 0cb12963b6
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/rsn_supp/tdls.c
View File

@ -680,8 +680,11 @@ int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
return -1;
pos = rbuf;
if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) {
/* Overwrite the reason code */
reason_code = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
goto skip_ies;
}
ftie = (struct wpa_tdls_ftie *) pos;
ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
@ -715,8 +718,7 @@ skip_ies:
/* request driver to send Teardown using this FTIE */
wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, rbuf,
pos - rbuf);
reason_code, rbuf, pos - rbuf);
os_free(rbuf);
/* clear the Peerkey statemachine */