Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

FT: Omit RSNXE from FT protocol Reassociation Request when needed

Browse Source 
The previous design for adding RSNXE into FT was not backwards
compatible. Move to a new design based on 20/332r3 to avoid that issue
by not include RSNXE in the FT protocol Reassociation Request frame so
that an AP not supporting RSNXE can still validate the FTE MIC
correctly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
This commit is contained in:
Jouni Malinen 2020-03-20 21:45:22 +02:00 committed by Jouni Malinen
parent 35936cd2cf
commit 6140cca819
2 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/rsn_supp/wpa_ft.c
View File

@ -162,6 +162,7 @@ int wpa_sm_set_ft_params(struct wpa_sm *sm, const u8 *ies, size_t ies_len)
* @ric_ies: Optional IE(s), e.g., WMM TSPEC(s), for RIC-Request or %NULL * @ric_ies: Optional IE(s), e.g., WMM TSPEC(s), for RIC-Request or %NULL
* @ric_ies_len: Length of ric_ies buffer in octets * @ric_ies_len: Length of ric_ies buffer in octets
* @ap_mdie: Mobility Domain IE from the target AP * @ap_mdie: Mobility Domain IE from the target AP
* @omit_rsnxe: Whether RSNXE is omitted from Reassociation Request frame
* Returns: Pointer to buffer with IEs or %NULL on failure * Returns: Pointer to buffer with IEs or %NULL on failure
* *
* Caller is responsible for freeing the returned buffer with os_free(); * Caller is responsible for freeing the returned buffer with os_free();
@ -171,7 +172,7 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
const u8 *kck, size_t kck_len, const u8 *kck, size_t kck_len,
const u8 *target_ap, const u8 *target_ap,
const u8 *ric_ies, size_t ric_ies_len, const u8 *ric_ies, size_t ric_ies_len,
const u8 *ap_mdie) const u8 *ap_mdie, int omit_rsnxe)
{ {
size_t buf_len; size_t buf_len;
u8 *buf, *pos, *ftie_len, *ftie_pos, *fte_mic, *elem_count; u8 *buf, *pos, *ftie_len, *ftie_pos, *fte_mic, *elem_count;
@ -375,12 +376,16 @@ static u8 * wpa_ft_gen_req_ies(struct wpa_sm *sm, size_t *len,
pos += ric_ies_len; pos += ric_ies_len;
} }
res = wpa_gen_rsnxe(sm, rsnxe, sizeof(rsnxe)); if (omit_rsnxe) {
if (res < 0) { rsnxe_len = 0;
os_free(buf); } else {
return NULL; res = wpa_gen_rsnxe(sm, rsnxe, sizeof(rsnxe));
if (res < 0) {
os_free(buf);
return NULL;
}
rsnxe_len = res;
} }
rsnxe_len = res;
if (kck) { if (kck) {
/* /*
@ -463,7 +468,7 @@ int wpa_ft_prepare_auth_request(struct wpa_sm *sm, const u8 *mdie)
} }
ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name, ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name,
NULL, 0, sm->bssid, NULL, 0, mdie); NULL, 0, sm->bssid, NULL, 0, mdie, 0);
if (ft_ies) { if (ft_ies) {
wpa_sm_update_ft_ies(sm, sm->mobility_domain, wpa_sm_update_ft_ies(sm, sm->mobility_domain,
ft_ies, ft_ies_len); ft_ies, ft_ies_len);
@ -659,7 +664,8 @@ int wpa_ft_process_response(struct wpa_sm *sm, const u8 *ies, size_t ies_len,
sm->pmk_r1_name, sm->pmk_r1_name,
kck, kck_len, bssid, kck, kck_len, bssid,
ric_ies, ric_ies_len, ric_ies, ric_ies_len,
parse.mdie ? parse.mdie - 2 : NULL); parse.mdie ? parse.mdie - 2 : NULL,
!sm->ap_rsnxe);
if (ft_ies) { if (ft_ies) {
wpa_sm_update_ft_ies(sm, sm->mobility_domain, wpa_sm_update_ft_ies(sm, sm->mobility_domain,
ft_ies, ft_ies_len); ft_ies, ft_ies_len);
@ -1220,7 +1226,7 @@ int wpa_ft_start_over_ds(struct wpa_sm *sm, const u8 *target_ap,
} }
ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name, ft_ies = wpa_ft_gen_req_ies(sm, &ft_ies_len, NULL, sm->pmk_r0_name,
NULL, 0, target_ap, NULL, 0, mdie); NULL, 0, target_ap, NULL, 0, mdie, 0);
if (ft_ies) { if (ft_ies) {
sm->over_the_ds_in_progress = 1; sm->over_the_ds_in_progress = 1;
os_memcpy(sm->target_ap, target_ap, ETH_ALEN); os_memcpy(sm->target_ap, target_ap, ETH_ALEN);

5
wpa_supplicant/sme.c
View File

@ -299,6 +299,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
#ifdef CONFIG_MBO #ifdef CONFIG_MBO
const u8 *mbo_ie; const u8 *mbo_ie;
#endif /* CONFIG_MBO */ #endif /* CONFIG_MBO */
int omit_rsnxe = 0;
if (bss == NULL) { if (bss == NULL) {
wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for " wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
@ -506,6 +507,7 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x", wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
md[0], md[1]); md[0], md[1]);
omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
if (wpa_s->sme.assoc_req_ie_len + 5 < if (wpa_s->sme.assoc_req_ie_len + 5 <
sizeof(wpa_s->sme.assoc_req_ie)) { sizeof(wpa_s->sme.assoc_req_ie)) {
struct rsn_mdie *mdie; struct rsn_mdie *mdie;
@ -614,7 +616,8 @@ static void sme_send_authentication(struct wpa_supplicant *wpa_s,
#endif /* CONFIG_TESTING_OPTIONS */ #endif /* CONFIG_TESTING_OPTIONS */
if (wpa_s->rsnxe_len > 0 && if (wpa_s->rsnxe_len > 0 &&
wpa_s->rsnxe_len <= wpa_s->rsnxe_len <=
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) { sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
!omit_rsnxe) {
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len, os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpa_s->rsnxe, wpa_s->rsnxe_len); wpa_s->rsnxe, wpa_s->rsnxe_len);
wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len; wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;