Fix STA flag setting for auto-authorization if 802.1X/WPA is not used

[wpasupplicant] / hostapd / ieee802_11.c

diff --git a/hostapd/ieee802_11.c b/hostapd/ieee802_11.c
index de76f61..584cd31 100644 (file)
--- a/hostapd/ieee802_11.c
+++ b/hostapd/ieee802_11.c
@@ -1287,6 +1287,11 @@ void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
        struct ieee80211_mgmt mgmt;
        u8 *end;
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
+                  MACSTR, MAC2STR(addr));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   trans_id, WLAN_SA_QUERY_TR_ID_LEN);
+
        os_memset(&mgmt, 0, sizeof(mgmt));
        mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
                                          WLAN_FC_STYPE_ACTION);
@@ -1324,6 +1329,12 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
                return;
        }
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
+                  MACSTR, MAC2STR(mgmt->sa));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   mgmt->u.action.u.sa_query_resp.trans_id,
+                   WLAN_SA_QUERY_TR_ID_LEN);
+
        /* MLME-SAQuery.confirm */
 
        sta = ap_get_sta(hapd, mgmt->sa);
@@ -1352,12 +1363,21 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
                       "Reply to pending SA Query received");
        ap_sta_stop_sa_query(hapd, sta);
 }
+
+
+static int robust_action_frame(u8 category)
+{
+       return category != WLAN_ACTION_PUBLIC &&
+               category != WLAN_ACTION_HT;
+}
 #endif /* CONFIG_IEEE80211W */
 
 
 static void handle_action(struct hostapd_data *hapd,
                          struct ieee80211_mgmt *mgmt, size_t len)
 {
+       struct sta_info *sta;
+
        if (len < IEEE80211_HDRLEN + 1) {
                hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
                               HOSTAPD_LEVEL_DEBUG,
@@ -1366,13 +1386,23 @@ static void handle_action(struct hostapd_data *hapd,
                return;
        }
 
+       sta = ap_get_sta(hapd, mgmt->sa);
+#ifdef CONFIG_IEEE80211W
+       if (sta && (sta->flags & WLAN_STA_MFP) &&
+           !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
+             robust_action_frame(mgmt->u.action.category))) {
+               hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+                              HOSTAPD_LEVEL_DEBUG,
+                              "Dropped unprotected Robust Action frame from "
+                              "an MFP STA");
+               return;
+       }
+#endif /* CONFIG_IEEE80211W */
+
        switch (mgmt->u.action.category) {
 #ifdef CONFIG_IEEE80211R
        case WLAN_ACTION_FT:
        {
-               struct sta_info *sta;
-
-               sta = ap_get_sta(hapd, mgmt->sa);
                if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
                        wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
                                   "frame from unassociated STA " MACSTR,
@@ -1585,6 +1615,7 @@ static void handle_assoc_cb(struct hostapd_data *hapd,
        struct ht_cap_ie ht_cap;
 #endif /* CONFIG_IEEE80211N */
        struct ht_cap_ie *ht_cap_ptr = NULL;
+       int set_flags, flags_and, flags_or;
 
        if (!ok) {
                hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
@@ -1669,13 +1700,15 @@ static void handle_assoc_cb(struct hostapd_data *hapd,
                /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
                ap_sta_bind_vlan(hapd, sta, 0);
        }
-       if (sta->flags & WLAN_STA_SHORT_PREAMBLE) {
-               hostapd_sta_set_flags(hapd, sta->addr, sta->flags,
-                                     WLAN_STA_SHORT_PREAMBLE, ~0);
-       } else {
-               hostapd_sta_set_flags(hapd, sta->addr, sta->flags,
-                                     0, ~WLAN_STA_SHORT_PREAMBLE);
-       }
+
+       set_flags = WLAN_STA_SHORT_PREAMBLE | WLAN_STA_WMM | WLAN_STA_MFP;
+       if (!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
+           sta->flags & WLAN_STA_AUTHORIZED)
+               set_flags |= WLAN_STA_AUTHORIZED;
+       flags_or = sta->flags & set_flags;
+       flags_and = sta->flags | ~set_flags;
+       hostapd_sta_set_flags(hapd, sta->addr, sta->flags,
+                             flags_or, flags_and);
 
        if (sta->auth_alg == WLAN_AUTH_FT)
                wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);