mac80211: simplify RX PN/IV handling
The current rx->queue value is slightly confusing. It is set to 16 on non-QoS frames, including data, and then used for sequence number and PN/IV checks. Until recently, we had a TKIP IV checking bug that had been introduced in 2008 to fix a seqno issue. Before that, we always used TID 0 for checking the PN or IV on non-QoS packets. Go back to the old status for PN/IV checks using the TID 0 counter for non-QoS by splitting up the rx->queue value into "seqno_idx" and "security_idx" in order to avoid confusion in the future. They each have special rules on the value used for non- QoS data frames. Since the handling is now unified, also revert the special TKIP handling from my patch "mac80211: fix TKIP replay vulnerability". Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
1d738e64f3
commit
9e26297a56
|
@ -202,7 +202,22 @@ struct ieee80211_rx_data {
|
||||||
struct ieee80211_key *key;
|
struct ieee80211_key *key;
|
||||||
|
|
||||||
unsigned int flags;
|
unsigned int flags;
|
||||||
int queue;
|
|
||||||
|
/*
|
||||||
|
* Index into sequence numbers array, 0..16
|
||||||
|
* since the last (16) is used for non-QoS,
|
||||||
|
* will be 16 on non-QoS frames.
|
||||||
|
*/
|
||||||
|
int seqno_idx;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Index into the security IV/PN arrays, 0..16
|
||||||
|
* since the last (16) is used for CCMP-encrypted
|
||||||
|
* management frames, will be set to 16 on mgmt
|
||||||
|
* frames and 0 on non-QoS frames.
|
||||||
|
*/
|
||||||
|
int security_idx;
|
||||||
|
|
||||||
u32 tkip_iv32;
|
u32 tkip_iv32;
|
||||||
u16 tkip_iv16;
|
u16 tkip_iv16;
|
||||||
};
|
};
|
||||||
|
|
|
@ -29,7 +29,7 @@
|
||||||
#define TKIP_IV_LEN 8
|
#define TKIP_IV_LEN 8
|
||||||
#define TKIP_ICV_LEN 4
|
#define TKIP_ICV_LEN 4
|
||||||
|
|
||||||
#define NUM_RX_DATA_QUEUES 17
|
#define NUM_RX_DATA_QUEUES 16
|
||||||
|
|
||||||
struct ieee80211_local;
|
struct ieee80211_local;
|
||||||
struct ieee80211_sub_if_data;
|
struct ieee80211_sub_if_data;
|
||||||
|
|
|
@ -331,7 +331,7 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
|
||||||
{
|
{
|
||||||
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
|
struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
|
||||||
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
|
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
|
||||||
int tid;
|
int tid, seqno_idx, security_idx;
|
||||||
|
|
||||||
/* does the frame have a qos control field? */
|
/* does the frame have a qos control field? */
|
||||||
if (ieee80211_is_data_qos(hdr->frame_control)) {
|
if (ieee80211_is_data_qos(hdr->frame_control)) {
|
||||||
|
@ -340,6 +340,9 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
|
||||||
tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
|
tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
|
||||||
if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
|
if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
|
||||||
status->rx_flags |= IEEE80211_RX_AMSDU;
|
status->rx_flags |= IEEE80211_RX_AMSDU;
|
||||||
|
|
||||||
|
seqno_idx = tid;
|
||||||
|
security_idx = tid;
|
||||||
} else {
|
} else {
|
||||||
/*
|
/*
|
||||||
* IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
|
* IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
|
||||||
|
@ -352,10 +355,15 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
|
||||||
*
|
*
|
||||||
* We also use that counter for non-QoS STAs.
|
* We also use that counter for non-QoS STAs.
|
||||||
*/
|
*/
|
||||||
tid = NUM_RX_DATA_QUEUES - 1;
|
seqno_idx = NUM_RX_DATA_QUEUES;
|
||||||
|
security_idx = 0;
|
||||||
|
if (ieee80211_is_mgmt(hdr->frame_control))
|
||||||
|
security_idx = NUM_RX_DATA_QUEUES;
|
||||||
|
tid = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
rx->queue = tid;
|
rx->seqno_idx = seqno_idx;
|
||||||
|
rx->security_idx = security_idx;
|
||||||
/* Set skb->priority to 1d tag if highest order bit of TID is not set.
|
/* Set skb->priority to 1d tag if highest order bit of TID is not set.
|
||||||
* For now, set skb->priority to 0 for other cases. */
|
* For now, set skb->priority to 0 for other cases. */
|
||||||
rx->skb->priority = (tid > 7) ? 0 : tid;
|
rx->skb->priority = (tid > 7) ? 0 : tid;
|
||||||
|
@ -810,7 +818,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
|
||||||
/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
|
/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
|
||||||
if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
|
if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
|
||||||
if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
|
if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
|
||||||
rx->sta->last_seq_ctrl[rx->queue] ==
|
rx->sta->last_seq_ctrl[rx->seqno_idx] ==
|
||||||
hdr->seq_ctrl)) {
|
hdr->seq_ctrl)) {
|
||||||
if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
|
if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
|
||||||
rx->local->dot11FrameDuplicateCount++;
|
rx->local->dot11FrameDuplicateCount++;
|
||||||
|
@ -818,7 +826,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
|
||||||
}
|
}
|
||||||
return RX_DROP_UNUSABLE;
|
return RX_DROP_UNUSABLE;
|
||||||
} else
|
} else
|
||||||
rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
|
rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (unlikely(rx->skb->len < 16)) {
|
if (unlikely(rx->skb->len < 16)) {
|
||||||
|
@ -1374,11 +1382,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
|
||||||
if (frag == 0) {
|
if (frag == 0) {
|
||||||
/* This is the first fragment of a new frame. */
|
/* This is the first fragment of a new frame. */
|
||||||
entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
|
entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
|
||||||
rx->queue, &(rx->skb));
|
rx->seqno_idx, &(rx->skb));
|
||||||
if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
|
if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
|
||||||
ieee80211_has_protected(fc)) {
|
ieee80211_has_protected(fc)) {
|
||||||
int queue = ieee80211_is_mgmt(fc) ?
|
int queue = rx->security_idx;
|
||||||
NUM_RX_DATA_QUEUES : rx->queue;
|
|
||||||
/* Store CCMP PN so that we can verify that the next
|
/* Store CCMP PN so that we can verify that the next
|
||||||
* fragment has a sequential PN value. */
|
* fragment has a sequential PN value. */
|
||||||
entry->ccmp = 1;
|
entry->ccmp = 1;
|
||||||
|
@ -1392,7 +1399,8 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
|
||||||
/* This is a fragment for a frame that should already be pending in
|
/* This is a fragment for a frame that should already be pending in
|
||||||
* fragment cache. Add this fragment to the end of the pending entry.
|
* fragment cache. Add this fragment to the end of the pending entry.
|
||||||
*/
|
*/
|
||||||
entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
|
entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
|
||||||
|
rx->seqno_idx, hdr);
|
||||||
if (!entry) {
|
if (!entry) {
|
||||||
I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
|
I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
|
||||||
return RX_DROP_MONITOR;
|
return RX_DROP_MONITOR;
|
||||||
|
@ -1412,8 +1420,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
|
||||||
if (pn[i])
|
if (pn[i])
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
queue = ieee80211_is_mgmt(fc) ?
|
queue = rx->security_idx;
|
||||||
NUM_RX_DATA_QUEUES : rx->queue;
|
|
||||||
rpn = rx->key->u.ccmp.rx_pn[queue];
|
rpn = rx->key->u.ccmp.rx_pn[queue];
|
||||||
if (memcmp(pn, rpn, CCMP_PN_LEN))
|
if (memcmp(pn, rpn, CCMP_PN_LEN))
|
||||||
return RX_DROP_UNUSABLE;
|
return RX_DROP_UNUSABLE;
|
||||||
|
@ -2590,7 +2597,9 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
|
||||||
.sta = sta,
|
.sta = sta,
|
||||||
.sdata = sta->sdata,
|
.sdata = sta->sdata,
|
||||||
.local = sta->local,
|
.local = sta->local,
|
||||||
.queue = tid,
|
/* This is OK -- must be QoS data frame */
|
||||||
|
.security_idx = tid,
|
||||||
|
.seqno_idx = tid,
|
||||||
.flags = 0,
|
.flags = 0,
|
||||||
};
|
};
|
||||||
struct tid_ampdu_rx *tid_agg_rx;
|
struct tid_ampdu_rx *tid_agg_rx;
|
||||||
|
|
|
@ -287,7 +287,8 @@ struct sta_info {
|
||||||
unsigned long rx_dropped;
|
unsigned long rx_dropped;
|
||||||
int last_signal;
|
int last_signal;
|
||||||
struct ewma avg_signal;
|
struct ewma avg_signal;
|
||||||
__le16 last_seq_ctrl[NUM_RX_DATA_QUEUES];
|
/* Plus 1 for non-QoS frames */
|
||||||
|
__le16 last_seq_ctrl[NUM_RX_DATA_QUEUES + 1];
|
||||||
|
|
||||||
/* Updated from TX status path only, no locking requirements */
|
/* Updated from TX status path only, no locking requirements */
|
||||||
unsigned long tx_filtered_count;
|
unsigned long tx_filtered_count;
|
||||||
|
|
|
@ -149,8 +149,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
|
||||||
|
|
||||||
update_iv:
|
update_iv:
|
||||||
/* update IV in key information to be able to detect replays */
|
/* update IV in key information to be able to detect replays */
|
||||||
rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
|
rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32;
|
||||||
rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
|
rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16;
|
||||||
|
|
||||||
return RX_CONTINUE;
|
return RX_CONTINUE;
|
||||||
|
|
||||||
|
@ -263,7 +263,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
|
||||||
res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
|
res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
|
||||||
key, skb->data + hdrlen,
|
key, skb->data + hdrlen,
|
||||||
skb->len - hdrlen, rx->sta->sta.addr,
|
skb->len - hdrlen, rx->sta->sta.addr,
|
||||||
hdr->addr1, hwaccel, rx->queue,
|
hdr->addr1, hwaccel, rx->security_idx,
|
||||||
&rx->tkip_iv32,
|
&rx->tkip_iv32,
|
||||||
&rx->tkip_iv16);
|
&rx->tkip_iv16);
|
||||||
if (res != TKIP_DECRYPT_OK)
|
if (res != TKIP_DECRYPT_OK)
|
||||||
|
@ -478,8 +478,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
|
||||||
|
|
||||||
ccmp_hdr2pn(pn, skb->data + hdrlen);
|
ccmp_hdr2pn(pn, skb->data + hdrlen);
|
||||||
|
|
||||||
queue = ieee80211_is_mgmt(hdr->frame_control) ?
|
queue = rx->security_idx;
|
||||||
NUM_RX_DATA_QUEUES : rx->queue;
|
|
||||||
|
|
||||||
if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) {
|
if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) {
|
||||||
key->u.ccmp.replays++;
|
key->u.ccmp.replays++;
|
||||||
|
|
Loading…
Reference in New Issue