Drop unprotected Robust Action frames from MFP STAs

[wpasupplicant] / hostapd / ieee802_11.c

diff --git a/hostapd/ieee802_11.c b/hostapd/ieee802_11.c
index 0ef02c1..907aa9b 100644 (file)
--- a/hostapd/ieee802_11.c
+++ b/hostapd/ieee802_11.c
@@ -357,7 +357,7 @@ void ieee802_11_send_deauth(struct hostapd_data *hapd, u8 *addr, u16 reason)
        os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
        mgmt.u.deauth.reason_code = host_to_le16(reason);
        if (hostapd_send_mgmt_frame(hapd, &mgmt, IEEE80211_HDRLEN +
-                                   sizeof(mgmt.u.deauth), 0) < 0)
+                                   sizeof(mgmt.u.deauth)) < 0)
                perror("ieee802_11_send_deauth: send");
 }
 
@@ -452,7 +452,7 @@ static void send_auth_reply(struct hostapd_data *hapd,
                   " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
                   MAC2STR(dst), auth_alg, auth_transaction,
                   resp, (unsigned long) ies_len);
-       if (hostapd_send_mgmt_frame(hapd, reply, rlen, 0) < 0)
+       if (hostapd_send_mgmt_frame(hapd, reply, rlen) < 0)
                perror("send_auth_reply: send");
 
        os_free(buf);
@@ -1170,7 +1170,7 @@ static void handle_assoc(struct hostapd_data *hapd,
                send_len += p - reply->u.assoc_resp.variable;
        }
 
-       if (hostapd_send_mgmt_frame(hapd, reply, send_len, 0) < 0)
+       if (hostapd_send_mgmt_frame(hapd, reply, send_len) < 0)
                perror("handle_assoc: send");
 }
 
@@ -1287,6 +1287,11 @@ void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
        struct ieee80211_mgmt mgmt;
        u8 *end;
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
+                  MACSTR, MAC2STR(addr));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   trans_id, WLAN_SA_QUERY_TR_ID_LEN);
+
        os_memset(&mgmt, 0, sizeof(mgmt));
        mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
                                          WLAN_FC_STYPE_ACTION);
@@ -1298,7 +1303,7 @@ void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
        os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
                  WLAN_SA_QUERY_TR_ID_LEN);
        end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
-       if (hostapd_send_mgmt_frame(hapd, &mgmt, end - (u8 *) &mgmt, 0) < 0)
+       if (hostapd_send_mgmt_frame(hapd, &mgmt, end - (u8 *) &mgmt) < 0)
                perror("ieee802_11_send_sa_query_req: send");
 }
 
@@ -1324,6 +1329,12 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
                return;
        }
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
+                  MACSTR, MAC2STR(mgmt->sa));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   mgmt->u.action.u.sa_query_resp.trans_id,
+                   WLAN_SA_QUERY_TR_ID_LEN);
+
        /* MLME-SAQuery.confirm */
 
        sta = ap_get_sta(hapd, mgmt->sa);
@@ -1355,9 +1366,18 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
 #endif /* CONFIG_IEEE80211W */
 
 
+static int robust_action_frame(u8 category)
+{
+       return category != WLAN_ACTION_PUBLIC &&
+               category != WLAN_ACTION_HT;
+}
+
+
 static void handle_action(struct hostapd_data *hapd,
                          struct ieee80211_mgmt *mgmt, size_t len)
 {
+       struct sta_info *sta;
+
        if (len < IEEE80211_HDRLEN + 1) {
                hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
                               HOSTAPD_LEVEL_DEBUG,
@@ -1366,13 +1386,23 @@ static void handle_action(struct hostapd_data *hapd,
                return;
        }
 
+       sta = ap_get_sta(hapd, mgmt->sa);
+#ifdef CONFIG_IEEE80211W
+       if (sta && (sta->flags & WLAN_STA_MFP) &&
+           !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
+             robust_action_frame(mgmt->u.action.category))) {
+               hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+                              HOSTAPD_LEVEL_DEBUG,
+                              "Dropped unprotected Robust Action frame from "
+                              "an MFP STA");
+               return;
+       }
+#endif /* CONFIG_IEEE80211W */
+
        switch (mgmt->u.action.category) {
 #ifdef CONFIG_IEEE80211R
        case WLAN_ACTION_FT:
        {
-               struct sta_info *sta;
-
-               sta = ap_get_sta(hapd, mgmt->sa);
                if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
                        wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
                                   "frame from unassociated STA " MACSTR,
@@ -1416,7 +1446,7 @@ static void handle_action(struct hostapd_data *hapd,
                os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
                mgmt->u.action.category |= 0x80;
 
-               hostapd_send_mgmt_frame(hapd, mgmt, len, 0);
+               hostapd_send_mgmt_frame(hapd, mgmt, len);
        }
 }
 
@@ -1446,9 +1476,6 @@ void ieee802_11_mgmt(struct hostapd_data *hapd, u8 *buf, size_t len, u16 stype,
                return;
        }
 
-       if (fi && fi->passive_scan)
-               return;
-
        broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
                mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
                mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
@@ -1630,6 +1657,10 @@ static void handle_assoc_cb(struct hostapd_data *hapd,
        if (sta->flags & WLAN_STA_ASSOC)
                new_assoc = 0;
        sta->flags |= WLAN_STA_ASSOC;
+       if (!hapd->conf->ieee802_1x && !hapd->conf->wpa) {
+               /* Open or static WEP; no separate authorization */
+               sta->flags |= WLAN_STA_AUTHORIZED;
+       }
 
        if (reassoc)
                mlme_reassociate_indication(hapd, sta);