Messages in this thread | | | Subject | Re: [PATCH] mac80211: fix regression where EAPOL frames were sent in plaintext | From | Thomas Deutschmann <> | Date | Sun, 8 Nov 2020 20:34:22 +0100 |
| |
Hi,
On 2020-10-19 18:01, Mathy Vanhoef wrote: > When sending EAPOL frames via NL80211 they are treated as injected > frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop > injected frames even if normally not allowed") these injected frames > were not assigned a sta context in the function ieee80211_tx_dequeue, > causing certain wireless network cards to always send EAPOL frames in > plaintext. This may cause compatibility issues with some clients or > APs, which for instance can cause the group key handshake to fail and > in turn would cause the station to get disconnected. > > This commit fixes this regression by assigning a sta context in > ieee80211_tx_dequeue to injected frames as well. > > Note that sending EAPOL frames in plaintext is not a security issue > since they contain their own encryption and authentication protection. > > Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") > Reported-by: Thomas Deutschmann <whissi@gentoo.org> > Tested-by: Christian Hesse <list@eworm.de> > Tested-by: Thomas Deutschmann <whissi@gentoo.org> > Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@kuleuven.be> > --- > net/mac80211/tx.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c > index 8ba10a48d..55b41167a 100644 > --- a/net/mac80211/tx.c > +++ b/net/mac80211/tx.c > @@ -3619,13 +3619,14 @@ struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw, > tx.skb = skb; > tx.sdata = vif_to_sdata(info->control.vif); > > - if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) { > + if (txq->sta) { > tx.sta = container_of(txq->sta, struct sta_info, sta); > /* > * Drop unicast frames to unauthorised stations unless they are > - * EAPOL frames from the local station. > + * injected frames or EAPOL frames from the local station. > */ > - if (unlikely(ieee80211_is_data(hdr->frame_control) && > + if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && > + ieee80211_is_data(hdr->frame_control) && > !ieee80211_vif_is_mesh(&tx.sdata->vif) && > tx.sdata->vif.type != NL80211_IFTYPE_OCB && > !is_multicast_ether_addr(hdr->addr1) && >
Can we please get this applied to linux-5.10 and linux-5.9?
Is there anything left to do where I can help with?
Thanks!
-- Regards, Thomas Deutschmann / Gentoo Linux Developer C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5
[unhandled content-type:application/pgp-signature] | |