linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: mabbas <mabbas@linux.intel.com>
To: linux-wireless@vger.kernel.org
Cc: Dan Williams <dcbw@redhat.com>,
	linville@tuxdriver.com, Johannes Berg <johannes@sipsolutions.net>
Subject: security question
Date: Wed, 21 Nov 2007 00:01:35 -0800	[thread overview]
Message-ID: <4743E5DF.9040603@linux.intel.com> (raw)

Hi

When I connect to an AP with wpa, then I receive deauth frame, 
ieee80211_rx_mgmt_deauth will be called, which will call 
ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function 
ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP 
event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN). wpa_supplicant will 
receives this event then call mac80211 to remove any old security key, 
the problem it will pass 00:00:00:00:00:00 as station address. 
ieee80211_set_encryption will fail since there are no station with 
00:00:00:00:00:00. This will leave the old key which causes the problems 
in the next reconnection.

Below is the work around to this problem, I am not very familiar with 
security in mac80211 so I appreciate any comment on how to fix this 
problem the right way.

Mohamed

diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
index c84a26e..e08df5e 100644
--- a/net/mac80211/ieee80211_ioctl.c
+++ b/net/mac80211/ieee80211_ioctl.c
@@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
 			return -EINVAL;
 		}
 
-		sta = sta_info_get(local, sta_addr);
+		if (is_zero_ether_addr(sta_addr))
+			sta = sta_info_get(local, sdata->u.sta.bssid);
+		else
+			sta = sta_info_get(local, sta_addr);
 		if (!sta) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 			printk(KERN_DEBUG "%s: set_encrypt - unknown addr "

             reply	other threads:[~2007-11-21  8:01 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-11-21  8:01 mabbas [this message]
2007-11-21 15:17 ` wpa_supplicant/key deletion with all-zeroes mac (was: security question) Johannes Berg
2007-11-22  4:37   ` Jouni Malinen
2007-11-22  5:30     ` wpa_supplicant/key deletion with all-zeroes mac mabbas
2007-11-22 12:55     ` wpa_supplicant/key deletion with all-zeroes mac (was: security question) Johannes Berg
2007-11-24 20:00       ` Jouni Malinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4743E5DF.9040603@linux.intel.com \
    --to=mabbas@linux.intel.com \
    --cc=dcbw@redhat.com \
    --cc=johannes@sipsolutions.net \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).