mac80211: check PN correctly for GCMP-encrypted fragmented MPDUs
Just like for CCMP we need to check that for GCMP the fragments have PNs that increment by one; the spec was updated to fix this security issue and now has the following text: The receiver shall discard MSDUs and MMPDUs whose constituent MPDU PN values are not incrementing in steps of 1. Adapt the code for CCMP to work for GCMP as well, luckily the relevant fields already alias each other so no code duplication is needed (just check the aliasing with BUILD_BUG_ON.) Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
@@ -92,7 +92,7 @@ struct ieee80211_fragment_entry {
|
||||
u16 extra_len;
|
||||
u16 last_frag;
|
||||
u8 rx_queue;
|
||||
bool ccmp; /* Whether fragments were encrypted with CCMP */
|
||||
bool check_sequential_pn; /* needed for CCMP/GCMP */
|
||||
u8 last_pn[6]; /* PN of the last fragment if CCMP was used */
|
||||
};
|
||||
|
||||
|
Reference in New Issue
Block a user