Drop unprotected Robust Action frames from MFP STAs

[wpasupplicant] / hostapd / ieee802_11.c

diff --git a/hostapd/ieee802_11.c b/hostapd/ieee802_11.c
index f60c72d..907aa9b 100644 (file)
--- a/hostapd/ieee802_11.c
+++ b/hostapd/ieee802_11.c
@@ -1287,6 +1287,11 @@ void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
        struct ieee80211_mgmt mgmt;
        u8 *end;
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
+                  MACSTR, MAC2STR(addr));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   trans_id, WLAN_SA_QUERY_TR_ID_LEN);
+
        os_memset(&mgmt, 0, sizeof(mgmt));
        mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
                                          WLAN_FC_STYPE_ACTION);
@@ -1324,6 +1329,12 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
                return;
        }
 
+       wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
+                  MACSTR, MAC2STR(mgmt->sa));
+       wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
+                   mgmt->u.action.u.sa_query_resp.trans_id,
+                   WLAN_SA_QUERY_TR_ID_LEN);
+
        /* MLME-SAQuery.confirm */
 
        sta = ap_get_sta(hapd, mgmt->sa);
@@ -1355,9 +1366,18 @@ static void hostapd_sa_query_action(struct hostapd_data *hapd,
 #endif /* CONFIG_IEEE80211W */
 
 
+static int robust_action_frame(u8 category)
+{
+       return category != WLAN_ACTION_PUBLIC &&
+               category != WLAN_ACTION_HT;
+}
+
+
 static void handle_action(struct hostapd_data *hapd,
                          struct ieee80211_mgmt *mgmt, size_t len)
 {
+       struct sta_info *sta;
+
        if (len < IEEE80211_HDRLEN + 1) {
                hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
                               HOSTAPD_LEVEL_DEBUG,
@@ -1366,13 +1386,23 @@ static void handle_action(struct hostapd_data *hapd,
                return;
        }
 
+       sta = ap_get_sta(hapd, mgmt->sa);
+#ifdef CONFIG_IEEE80211W
+       if (sta && (sta->flags & WLAN_STA_MFP) &&
+           !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
+             robust_action_frame(mgmt->u.action.category))) {
+               hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
+                              HOSTAPD_LEVEL_DEBUG,
+                              "Dropped unprotected Robust Action frame from "
+                              "an MFP STA");
+               return;
+       }
+#endif /* CONFIG_IEEE80211W */
+
        switch (mgmt->u.action.category) {
 #ifdef CONFIG_IEEE80211R
        case WLAN_ACTION_FT:
        {
-               struct sta_info *sta;
-
-               sta = ap_get_sta(hapd, mgmt->sa);
                if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
                        wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
                                   "frame from unassociated STA " MACSTR,
@@ -1446,9 +1476,6 @@ void ieee802_11_mgmt(struct hostapd_data *hapd, u8 *buf, size_t len, u16 stype,
                return;
        }
 
-       if (fi && fi->passive_scan)
-               return;
-
        broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
                mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
                mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;