kern/143163: Radiotap bug in ieee80211_sta.c:sta_input

[Alexander Egorenkov]

>Number:         143163
>Category:       kern
>Synopsis:       Radiotap bug in ieee80211_sta.c:sta_input
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jan 24 13:30:01 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator:     Alexander Egorenkov
>Release:        FreeBSD 8.0 STABLE
>Organization:
>Environment:
FreeBSD dantooine 8.0-RELEASE FreeBSD 8.0-RELEASE #2: Tue Dec 15 17:56:06 CET 2009     root at dantooine:/usr/obj/usr/src/sys/MYKERNEL  i386
>Description:
I have found a bug in ieee80211_sta.c:sta_input which causes some problems with wireshark.

Here is a code fragment:

------------------------------------------------------

        /* copy to listener after decrypt */
	if (ieee80211_radiotap_active_vap(vap))
		ieee80211_radiotap_tx(vap, m);   <------- Bug
	need_tap = 0;
------------------------------------------------------
>How-To-Repeat:
I have found this bug by analyzing data packets with wireshark.
It causes wireshark to display wrong data.

Sniff some incoming packets with wireshark on a WLAN NIC.
>Fix:
he function sta_input handles incoming packets in STA mode in net80211 stack.
Thus, the right thing to do would be to call

       ieee80211_radiotap_rx(vap, m)
and not
       ieee80211_radiotap_tx(vap, m)

>Release-Note:
>Audit-Trail:
>Unformatted: