1*4882a593SmuzhiyunFrom 8c07fa9eda13e835f3f968b2e1c9a8be3a851ff9 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Jouni Malinen <j@w1.fi> 3*4882a593SmuzhiyunDate: Thu, 29 Aug 2019 11:52:04 +0300 4*4882a593SmuzhiyunSubject: [PATCH] AP: Silently ignore management frame from unexpected source 5*4882a593Smuzhiyun address 6*4882a593Smuzhiyun 7*4882a593SmuzhiyunDo not process any received Management frames with unexpected/invalid SA 8*4882a593Smuzhiyunso that we do not add any state for unexpected STA addresses or end up 9*4882a593Smuzhiyunsending out frames to unexpected destination. This prevents unexpected 10*4882a593Smuzhiyunsequences where an unprotected frame might end up causing the AP to send 11*4882a593Smuzhiyunout a response to another device and that other device processing the 12*4882a593Smuzhiyununexpected response. 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunIn particular, this prevents some potential denial of service cases 15*4882a593Smuzhiyunwhere the unexpected response frame from the AP might result in a 16*4882a593Smuzhiyunconnected station dropping its association. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunSigned-off-by: Jouni Malinen <j@w1.fi> 19*4882a593Smuzhiyun 20*4882a593SmuzhiyunSigned-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> 21*4882a593Smuzhiyun[Retrieved from: 22*4882a593Smuzhiyunhttps://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch] 23*4882a593Smuzhiyun--- 24*4882a593Smuzhiyun src/ap/drv_callbacks.c | 13 +++++++++++++ 25*4882a593Smuzhiyun src/ap/ieee802_11.c | 12 ++++++++++++ 26*4882a593Smuzhiyun 2 files changed, 25 insertions(+) 27*4882a593Smuzhiyun 28*4882a593Smuzhiyundiff --git a/src/ap/drv_callbacks.c b/src/ap/drv_callbacks.c 29*4882a593Smuzhiyunindex 31587685fe3b..34ca379edc3d 100644 30*4882a593Smuzhiyun--- a/src/ap/drv_callbacks.c 31*4882a593Smuzhiyun+++ b/src/ap/drv_callbacks.c 32*4882a593Smuzhiyun@@ -131,6 +131,19 @@ int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, 33*4882a593Smuzhiyun "hostapd_notif_assoc: Skip event with no address"); 34*4882a593Smuzhiyun return -1; 35*4882a593Smuzhiyun } 36*4882a593Smuzhiyun+ 37*4882a593Smuzhiyun+ if (is_multicast_ether_addr(addr) || 38*4882a593Smuzhiyun+ is_zero_ether_addr(addr) || 39*4882a593Smuzhiyun+ os_memcmp(addr, hapd->own_addr, ETH_ALEN) == 0) { 40*4882a593Smuzhiyun+ /* Do not process any frames with unexpected/invalid SA so that 41*4882a593Smuzhiyun+ * we do not add any state for unexpected STA addresses or end 42*4882a593Smuzhiyun+ * up sending out frames to unexpected destination. */ 43*4882a593Smuzhiyun+ wpa_printf(MSG_DEBUG, "%s: Invalid SA=" MACSTR 44*4882a593Smuzhiyun+ " in received indication - ignore this indication silently", 45*4882a593Smuzhiyun+ __func__, MAC2STR(addr)); 46*4882a593Smuzhiyun+ return 0; 47*4882a593Smuzhiyun+ } 48*4882a593Smuzhiyun+ 49*4882a593Smuzhiyun random_add_randomness(addr, ETH_ALEN); 50*4882a593Smuzhiyun 51*4882a593Smuzhiyun hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 52*4882a593Smuzhiyundiff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c 53*4882a593Smuzhiyunindex c85a28db44b7..e7065372e158 100644 54*4882a593Smuzhiyun--- a/src/ap/ieee802_11.c 55*4882a593Smuzhiyun+++ b/src/ap/ieee802_11.c 56*4882a593Smuzhiyun@@ -4626,6 +4626,18 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len, 57*4882a593Smuzhiyun fc = le_to_host16(mgmt->frame_control); 58*4882a593Smuzhiyun stype = WLAN_FC_GET_STYPE(fc); 59*4882a593Smuzhiyun 60*4882a593Smuzhiyun+ if (is_multicast_ether_addr(mgmt->sa) || 61*4882a593Smuzhiyun+ is_zero_ether_addr(mgmt->sa) || 62*4882a593Smuzhiyun+ os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) { 63*4882a593Smuzhiyun+ /* Do not process any frames with unexpected/invalid SA so that 64*4882a593Smuzhiyun+ * we do not add any state for unexpected STA addresses or end 65*4882a593Smuzhiyun+ * up sending out frames to unexpected destination. */ 66*4882a593Smuzhiyun+ wpa_printf(MSG_DEBUG, "MGMT: Invalid SA=" MACSTR 67*4882a593Smuzhiyun+ " in received frame - ignore this frame silently", 68*4882a593Smuzhiyun+ MAC2STR(mgmt->sa)); 69*4882a593Smuzhiyun+ return 0; 70*4882a593Smuzhiyun+ } 71*4882a593Smuzhiyun+ 72*4882a593Smuzhiyun if (stype == WLAN_FC_STYPE_BEACON) { 73*4882a593Smuzhiyun handle_beacon(hapd, mgmt, len, fi); 74*4882a593Smuzhiyun return 1; 75*4882a593Smuzhiyun-- 76*4882a593Smuzhiyun2.20.1 77*4882a593Smuzhiyun 78