fbf8c1b456
Upstream advisory: https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt Details and the paper: https://www.krackattacks.com/ - hostapd: Avoid key reinstallation in FT handshake (CVE-2017-13082) - Fix PTK rekeying to generate a new ANonce - Prevent reinstallation of an already in-use group key and extend protection of GTK/IGTK reinstallation of WNM-Sleep Mode cases (CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088) - Prevent installation of an all-zero TK - TDLS: Reject TPK-TK reconfiguration - WNM: Ignore WNM-Sleep Mode Response without pending request - FT: Do not allow multiple Reassociation Response frames
44 lines
1.6 KiB
Diff
44 lines
1.6 KiB
Diff
From 53c5eb58e95004f86e65ee9fbfccbc291b139057 Mon Sep 17 00:00:00 2001
|
|
From: Jouni Malinen <j@w1.fi>
|
|
Date: Fri, 22 Sep 2017 11:25:02 +0300
|
|
Subject: [PATCH 7/8] WNM: Ignore WNM-Sleep Mode Response without pending
|
|
request
|
|
|
|
Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
|
|
Mode Response if WNM-Sleep Mode has not been used') started ignoring the
|
|
response when no WNM-Sleep Mode Request had been used during the
|
|
association. This can be made tighter by clearing the used flag when
|
|
successfully processing a response. This adds an additional layer of
|
|
protection against unexpected retransmissions of the response frame.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
wpa_supplicant/wnm_sta.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
|
|
index 1b3409c..67a07ff 100644
|
|
--- a/wpa_supplicant/wnm_sta.c
|
|
+++ b/wpa_supplicant/wnm_sta.c
|
|
@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
|
|
|
|
if (!wpa_s->wnmsleep_used) {
|
|
wpa_printf(MSG_DEBUG,
|
|
- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
|
|
+ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
|
|
return;
|
|
}
|
|
|
|
@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
|
|
return;
|
|
}
|
|
|
|
+ wpa_s->wnmsleep_used = 0;
|
|
+
|
|
if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
|
|
wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
|
|
wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
|
|
--
|
|
2.7.4
|
|
|