Search Linux Wireless

wpa_supplicant/key deletion with all-zeroes mac (was: security question)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

> When I connect to an AP with wpa, then I receive deauth frame, 
> ieee80211_rx_mgmt_deauth will be called, which will call 
> ieee80211_set_associated(dev, ifsta, 0); to disconnect. In function 
> ieee80211_set_associated, it calls wireless_send_event with SIOCGIWAP 
> event and memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN). wpa_supplicant will 
> receives this event then call mac80211 to remove any old security key, 
> the problem it will pass 00:00:00:00:00:00 as station address. 
> ieee80211_set_encryption will fail since there are no station with 
> 00:00:00:00:00:00. This will leave the old key which causes the problems 
> in the next reconnection.

Interesting. I'd think this is a wpa_supplicant bug, Jouni, how is the
security wext stuff supposed to work here?

> diff --git a/net/mac80211/ieee80211_ioctl.c b/net/mac80211/ieee80211_ioctl.c
> index c84a26e..e08df5e 100644
> --- a/net/mac80211/ieee80211_ioctl.c
> +++ b/net/mac80211/ieee80211_ioctl.c
> @@ -97,7 +97,10 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
>  			return -EINVAL;
>  		}
>  
> -		sta = sta_info_get(local, sta_addr);
> +		if (is_zero_ether_addr(sta_addr))
> +			sta = sta_info_get(local, sdata->u.sta.bssid);
> +		else
> +			sta = sta_info_get(local, sta_addr);
>  		if (!sta) {
>  #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
>  			printk(KERN_DEBUG "%s: set_encrypt - unknown addr "
> 

Attachment: signature.asc
Description: This is a digitally signed message part


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux