Commit 91535613 authored by Avraham Stern's avatar Avraham Stern Committed by Johannes Berg
Browse files

wifi: mac80211: don't drop all unprotected public action frames 



Not all public action frames have a protected variant. When MFP is
enabled drop only public action frames that have a dual protected
variant.

Fixes: 76a3059c ("wifi: mac80211: drop some unprotected action frames")
Signed-off-by: default avatarAvraham Stern <avraham.stern@intel.com>
Signed-off-by: default avatarGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20231016145213.2973e3c8d3bb.I6198b8d3b04cf4a97b06660d346caec3032f232a@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent c434b2be

include/linux/ieee80211.h

+29 −0
Original line number Diff line number Diff line
@@ -4355,6 +4355,35 @@ static inline bool ieee80211_is_public_action(struct ieee80211_hdr *hdr, 
	return mgmt->u.action.category == WLAN_CATEGORY_PUBLIC;

}



/**

 * ieee80211_is_protected_dual_of_public_action - check if skb contains a

 * protected dual of public action management frame

 * @skb: the skb containing the frame, length will be checked

 *

 * Return: true if the skb contains a protected dual of public action

 * management frame, false otherwise.

 */

static inline bool

ieee80211_is_protected_dual_of_public_action(struct sk_buff *skb)

{

	u8 action;



	if (!ieee80211_is_public_action((void *)skb->data, skb->len) ||

	    skb->len < IEEE80211_MIN_ACTION_SIZE + 1)

		return false;



	action = *(u8 *)(skb->data + IEEE80211_MIN_ACTION_SIZE);



	return action != WLAN_PUB_ACTION_20_40_BSS_COEX &&

		action != WLAN_PUB_ACTION_DSE_REG_LOC_ANN &&

		action != WLAN_PUB_ACTION_MSMT_PILOT &&

		action != WLAN_PUB_ACTION_TDLS_DISCOVER_RES &&

		action != WLAN_PUB_ACTION_LOC_TRACK_NOTI &&

		action != WLAN_PUB_ACTION_FTM_REQUEST &&

		action != WLAN_PUB_ACTION_FTM_RESPONSE &&

		action != WLAN_PUB_ACTION_FILS_DISCOVERY;

}



/**

 * _ieee80211_is_group_privacy_action - check if frame is a group addressed

 * privacy action frame

net/mac80211/rx.c

+1 −2
Original line number Diff line number Diff line
@@ -2468,8 +2468,7 @@ static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 


		/* drop unicast public action frames when using MPF */

		if (is_unicast_ether_addr(mgmt->da) &&

		    ieee80211_is_public_action((void *)rx->skb->data,

					       rx->skb->len))

		    ieee80211_is_protected_dual_of_public_action(rx->skb))

			return -EACCES;

	}