forked from luck/tmp_suning_uos_patched
mac80211: discard multicast and 4-addr A-MSDUs
In mac80211, multicast A-MSDUs are accepted in many cases that they shouldn't be accepted in: * drop A-MSDUs with a multicast A1 (RA), as required by the spec in 9.11 (802.11-2012 version) * drop A-MSDUs with a 4-addr header, since the fourth address can't actually be useful for them; unless 4-address frame format is actually requested, even though the fourth address is still not useful in this case, but ignored Accepting the first case, in particular, is very problematic since it allows anyone else with possession of a GTK to send unicast frames encapsulated in a multicast A-MSDU, even when the AP has client isolation enabled. Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
parent
6b25e21fa6
commit
ea720935cf
|
@ -2308,16 +2308,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
|
|||
if (!(status->rx_flags & IEEE80211_RX_AMSDU))
|
||||
return RX_CONTINUE;
|
||||
|
||||
if (ieee80211_has_a4(hdr->frame_control) &&
|
||||
rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
|
||||
!rx->sdata->u.vlan.sta)
|
||||
return RX_DROP_UNUSABLE;
|
||||
if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
|
||||
switch (rx->sdata->vif.type) {
|
||||
case NL80211_IFTYPE_AP_VLAN:
|
||||
if (!rx->sdata->u.vlan.sta)
|
||||
return RX_DROP_UNUSABLE;
|
||||
break;
|
||||
case NL80211_IFTYPE_STATION:
|
||||
if (!rx->sdata->u.mgd.use_4addr)
|
||||
return RX_DROP_UNUSABLE;
|
||||
break;
|
||||
default:
|
||||
return RX_DROP_UNUSABLE;
|
||||
}
|
||||
}
|
||||
|
||||
if (is_multicast_ether_addr(hdr->addr1) &&
|
||||
((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
|
||||
rx->sdata->u.vlan.sta) ||
|
||||
(rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
|
||||
rx->sdata->u.mgd.use_4addr)))
|
||||
if (is_multicast_ether_addr(hdr->addr1))
|
||||
return RX_DROP_UNUSABLE;
|
||||
|
||||
skb->dev = dev;
|
||||
|
|
Loading…
Reference in New Issue
Block a user