Commit 3c1032e1 authored by Felix Fietkau's avatar Felix Fietkau

mt76: allow receiving frames with invalid CCMP PN via monitor interfaces

This can be useful for debugging
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 8916e4e5
...@@ -1018,7 +1018,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb, ...@@ -1018,7 +1018,7 @@ mt76_rx_convert(struct mt76_dev *dev, struct sk_buff *skb,
*hw = mt76_phy_hw(dev, mstat.ext_phy); *hw = mt76_phy_hw(dev, mstat.ext_phy);
} }
static int static void
mt76_check_ccmp_pn(struct sk_buff *skb) mt76_check_ccmp_pn(struct sk_buff *skb)
{ {
struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb; struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
...@@ -1028,13 +1028,13 @@ mt76_check_ccmp_pn(struct sk_buff *skb) ...@@ -1028,13 +1028,13 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
int ret; int ret;
if (!(status->flag & RX_FLAG_DECRYPTED)) if (!(status->flag & RX_FLAG_DECRYPTED))
return 0; return;
if (status->flag & RX_FLAG_ONLY_MONITOR) if (status->flag & RX_FLAG_ONLY_MONITOR)
return 0; return;
if (!wcid || !wcid->rx_check_pn) if (!wcid || !wcid->rx_check_pn)
return 0; return;
security_idx = status->qos_ctl & IEEE80211_QOS_CTL_TID_MASK; security_idx = status->qos_ctl & IEEE80211_QOS_CTL_TID_MASK;
if (status->flag & RX_FLAG_8023) if (status->flag & RX_FLAG_8023)
...@@ -1048,7 +1048,7 @@ mt76_check_ccmp_pn(struct sk_buff *skb) ...@@ -1048,7 +1048,7 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
*/ */
if (ieee80211_is_frag(hdr) && if (ieee80211_is_frag(hdr) &&
!ieee80211_is_first_frag(hdr->frame_control)) !ieee80211_is_first_frag(hdr->frame_control))
return 0; return;
} }
/* IEEE 802.11-2020, 12.5.3.4.4 "PN and replay detection" c): /* IEEE 802.11-2020, 12.5.3.4.4 "PN and replay detection" c):
...@@ -1065,15 +1065,15 @@ mt76_check_ccmp_pn(struct sk_buff *skb) ...@@ -1065,15 +1065,15 @@ mt76_check_ccmp_pn(struct sk_buff *skb)
BUILD_BUG_ON(sizeof(status->iv) != sizeof(wcid->rx_key_pn[0])); BUILD_BUG_ON(sizeof(status->iv) != sizeof(wcid->rx_key_pn[0]));
ret = memcmp(status->iv, wcid->rx_key_pn[security_idx], ret = memcmp(status->iv, wcid->rx_key_pn[security_idx],
sizeof(status->iv)); sizeof(status->iv));
if (ret <= 0) if (ret <= 0) {
return -EINVAL; /* replay */ status->flag |= RX_FLAG_ONLY_MONITOR;
return;
}
memcpy(wcid->rx_key_pn[security_idx], status->iv, sizeof(status->iv)); memcpy(wcid->rx_key_pn[security_idx], status->iv, sizeof(status->iv));
if (status->flag & RX_FLAG_IV_STRIPPED) if (status->flag & RX_FLAG_IV_STRIPPED)
status->flag |= RX_FLAG_PN_VALIDATED; status->flag |= RX_FLAG_PN_VALIDATED;
return 0;
} }
static void static void
...@@ -1246,11 +1246,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames, ...@@ -1246,11 +1246,7 @@ void mt76_rx_complete(struct mt76_dev *dev, struct sk_buff_head *frames,
while ((skb = __skb_dequeue(frames)) != NULL) { while ((skb = __skb_dequeue(frames)) != NULL) {
struct sk_buff *nskb = skb_shinfo(skb)->frag_list; struct sk_buff *nskb = skb_shinfo(skb)->frag_list;
if (mt76_check_ccmp_pn(skb)) { mt76_check_ccmp_pn(skb);
dev_kfree_skb(skb);
continue;
}
skb_shinfo(skb)->frag_list = NULL; skb_shinfo(skb)->frag_list = NULL;
mt76_rx_convert(dev, skb, &hw, &sta); mt76_rx_convert(dev, skb, &hw, &sta);
ieee80211_rx_list(hw, sta, skb, &list); ieee80211_rx_list(hw, sta, skb, &list);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment