Changeset 1357

Timestamp:

12/14/05 11:36:27 (6 years ago)

Author:

mrenzmann

Message:

As reported by Jouni Malinen in #132, MadWifi reported only one IE
even if the AP announced both WPA IE (WPA) and RSN IE (WPA2). In
such cases MadWifi preferred WPA2, which prevents the userspace
supplicant from being able to do proper downgrade attack protection
and restricts configuration options for the user.

This is now fixed by saving and reporting both IEs if
necessary.

Signed-off-by: Charles Bovy <charles@bovy.nl>

Files:

• trunk/net80211/ieee80211_input.c (modified) (22 diffs)
• trunk/net80211/ieee80211_node.c (modified) (3 diffs)
• trunk/net80211/ieee80211_node.h (modified) (1 diff)
• trunk/net80211/ieee80211_scan.h (modified) (2 diffs)
• trunk/net80211/ieee80211_scan_sta.c (modified) (1 diff)
• trunk/net80211/ieee80211_wireless.c (modified) (1 diff)

trunk/net80211/ieee80211_input.c

@@ -1641 +1641 @@
-static int
-ieee80211_parse_wpa(struct ieee80211vap *vap, u_int8_t *frm,
-
+_parm
-{
-        u_int8_t len = frm[1];
@@ -1677 +1677 @@
-
-        /* multicast/group cipher */
-
-
+_parm
+_parm
-                IEEE80211_DISCARD_IE(vap,
-                    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
-                    wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
-
+_parm
-                return IEEE80211_REASON_IE_INVALID;
-        }
@@ -1699 +1699 @@
-        w = 0;
-        for (; n > 0; n--) {
-
+_parm
-                frm += 4, len -= 4;
-        }
-
+_parm
-        if (w == 0) {
-                IEEE80211_DISCARD_IE(vap,
@@ -1710 +1710 @@
-        }
-        if (w & (1<<IEEE80211_CIPHER_TKIP))
-
+_parm
-        else
-
+_parm
-
-        /* key management algorithms */
@@ -1729 +1729 @@
-                frm += 4, len -= 4;
-        }
-
+_parm
-        if (w == 0) {
-                IEEE80211_DISCARD_IE(vap,
@@ -1737 +1737 @@
-        }
-        if (w & WPA_ASE_8021X_UNSPEC)
-
+_parm
-        else
-
+_parm
-
-        if (len > 2)            /* optional capabilities */
-
+_parm
-
-        return 0;
@@ -1809 +1809 @@
-static int
-ieee80211_parse_rsn(struct ieee80211vap *vap, u_int8_t *frm,
-
+_parm
-{
-        u_int8_t len = frm[1];
@@ -1844 +1844 @@
-
-        /* multicast/group cipher */
-
-
+_parm
+_parm
-                IEEE80211_DISCARD_IE(vap,
-                    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
-                    wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
-
+_parm
-                return IEEE80211_REASON_IE_INVALID;
-        }
@@ -1866 +1866 @@
-        w = 0;
-        for (; n > 0; n--) {
-
+_parm
-                frm += 4, len -= 4;
-        }
-
+_parm
-        if (w == 0) {
-                IEEE80211_DISCARD_IE(vap,
@@ -1877 +1877 @@
-        }
-        if (w & (1<<IEEE80211_CIPHER_TKIP))
-
+_parm
-        else
-
+_parm
-
-        /* key management algorithms */
@@ -1896 +1896 @@
-                frm += 4, len -= 4;
-        }
-
+_parm
-        if (w == 0) {
-                IEEE80211_DISCARD_IE(vap,
@@ -1904 +1904 @@
-        }
-        if (w & RSN_ASE_8021X_UNSPEC)
-
+_parm
-        else
-
+_parm
-
-        /* optional RSN capabilities */
-        if (len > 2)
-
+_parm
-        /* XXXPMKID */
-
@@ -2201 +2201 @@
-        struct ieee80211_frame *wh;
-        u_int8_t *frm, *efrm;
-
+rsn, *
-        u_int8_t rate;
-        int reassoc, resp, allocbs;
@@ -2299 +2299 @@
-                                break;
-                        case IEEE80211_ELEMID_RSN:
-wpa
+rsn
-                                break;
-                        case IEEE80211_ELEMID_VENDOR:
@@ -2674 +2674 @@
-        case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
-                u_int16_t capinfo, bintval;
-
+_parm
-                u_int8_t reason;
-
@@ -2716 +2716 @@
-                if (reassoc)
-                        frm += 6;       /* ignore current AP info */
-
+rsn = 
-                while (frm < efrm) {
-                        switch (*frm) {
@@ -2731 +2731 @@
-                        case IEEE80211_ELEMID_RSN:
-                                if (vap->iv_flags & IEEE80211_F_WPA2)
-wpa
+rsn
-                                else
-                                        IEEE80211_DPRINTF(vap,
@@ -2790 +2790 @@
-                }
-                                
-wpa
+rsn
-                        /*
-                         * Parse WPA information element.  Note that
@@ -2798 +2798 @@
-                         * installed below after the association is assured.
-                         */
-
-wpa
-wpa, &rsn
+_parm
+rsn
+rsn, &rsn_parm
-                        else
-wpa, &rsn
+rsn, &rsn_parm
-                        if (reason != 0) {
-                                IEEE80211_SEND_MGMT(ni,
@@ -2815 +2815 @@
-                            wh->i_addr2,
-                            "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
-wpa
-.rsn_mcastcipher, rsn
-.rsn_ucastcipher, rsn
-.rsn_keymgmt, rsn
+rsn
+_parm.rsn_mcastcipher, rsn_parm
+_parm.rsn_ucastcipher, rsn_parm
+_parm.rsn_keymgmt, rsn_parm
-                }
-                /* discard challenge after association */
@@ -2887 +2887 @@
-                         * for applications that require it.
-                         */
-                        ni->ni_rsn = rsn;
-                        ieee80211_saveie(&ni->ni_wpa_ie, wpa);
-                } else if (ni->ni_wpa_ie != NULL) {
@@ -2895 +2894 @@
-                        FREE(ni->ni_wpa_ie, M_DEVBUF);
-                        ni->ni_wpa_ie = NULL;
+                }
+                if (rsn != NULL) {
+                        /*
+                         * Record WPA/RSN parameters for station, mark
+                         * node as using WPA and record information element
+                         * for applications that require it.
+                         */
+                        ni->ni_rsn = rsn_parm;
+                        ieee80211_saveie(&ni->ni_rsn_ie, rsn);
+                } else if (ni->ni_rsn_ie != NULL) {
+                        /*
+                         * Flush any state from a previous association.
+                         */
+                        FREE(ni->ni_rsn_ie, M_DEVBUF);
+                        ni->ni_rsn_ie = NULL;
-                }
-                if (wme != NULL) {

trunk/net80211/ieee80211_node.c

@@ -647 +647 @@
-        if (se->se_wpa_ie != NULL)
-                ieee80211_saveie(&ni->ni_wpa_ie, se->se_wpa_ie);
+        if (se->se_rsn_ie != NULL)
+                ieee80211_saveie(&ni->ni_rsn_ie, se->se_rsn_ie);
-        if (se->se_wme_ie != NULL)
-                ieee80211_saveie(&ni->ni_wme_ie, se->se_wme_ie);
@@ -792 +794 @@
-        if (ni->ni_wpa_ie != NULL)
-                FREE(ni->ni_wpa_ie, M_DEVBUF);
+        if (ni->ni_rsn_ie != NULL)
+                FREE(ni->ni_rsn_ie, M_DEVBUF);
-        if (ni->ni_wme_ie != NULL)
-                FREE(ni->ni_wme_ie, M_DEVBUF);
@@ -1178 +1182 @@
-                if (sp->wpa != NULL)
-                        ieee80211_saveie(&ni->ni_wpa_ie, sp->wpa);
+                if (sp->rsn != NULL)
+                        ieee80211_saveie(&ni->ni_rsn_ie, sp->rsn);
-                if (sp->ath != NULL)
-                        ieee80211_saveath(ni, sp->ath);

trunk/net80211/ieee80211_node.h

@@ -123 +123 @@
-        u_int16_t               ni_vlan;        /* vlan tag */
-        u_int32_t               *ni_challenge;  /* shared-key challenge */
-
+
+
-        u_int8_t                *ni_wme_ie;     /* captured WME ie */
-        u_int8_t                *ni_ath_ie;     /* captured Atheros ie */

trunk/net80211/ieee80211_scan.h

@@ -145 +145 @@
-        u_int8_t        *doth;
-        u_int8_t        *wpa;
+        u_int8_t        *rsn;
-        u_int8_t        *wme;
-        u_int8_t        *ath;
@@ -173 +174 @@
-        int8_t          se_rssi;        /* avg'd recv ssi */
-        u_int8_t        se_dtimperiod;  /* DTIM period */
-
+
+
-        u_int8_t        *se_wme_ie;     /* captured WME ie */
-        u_int8_t        *se_ath_ie;     /* captured Atheros ie */

trunk/net80211/ieee80211_scan_sta.c

@@ -273 +273 @@
-        saveie(&ise->se_wme_ie, sp->wme);
-        saveie(&ise->se_wpa_ie, sp->wpa);
+        saveie(&ise->se_rsn_ie, sp->rsn);
-        saveie(&ise->se_ath_ie, sp->ath);
-

trunk/net80211/ieee80211_wireless.c

@@ -1433 +1433 @@
-        current_ev = iwe_stream_add_point(current_ev, end_buf, &iwe, buf);
-
-wpa
+rsn
-                static const char rsn_leader[] = "rsn_ie=";
-                static const char wpa_leader[] = "wpa_ie=";
-
-                memset(&iwe, 0, sizeof(iwe));
-                iwe.cmd = IWEVCUSTOM;
-wpa
+rsn
-                        iwe.u.data.length = encode_ie(buf, sizeof(buf),
-wpa_ie, se->se_wpa
+rsn_ie, se->se_rsn
-                                rsn_leader, sizeof(rsn_leader)-1);
-
+
+
+
+
+
+
+
+
+
-                        iwe.u.data.length = encode_ie(buf, sizeof(buf),
-                                se->se_wpa_ie, se->se_wpa_ie[1]+2,