From nobody Tue Mar 15 18:16:17 2022 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 8B56E1A24DF0; Tue, 15 Mar 2022 18:16:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KJ1nF3LkGz58nB; Tue, 15 Mar 2022 18:16:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1647368177; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RIrsLgAwS0T5X/I4Zq1xs+Fl/qw0rpsfEwvODsJTrFA=; b=gbx8Nb32Zfrou0f3cgLmK5PsEBb+qytw3RlR+cwkTmz96HlAYajpsoOFtx6uKJOH9nNO+T eNoZh4voGAnPG5lMry8pB0vXgwW7qGiM8tJEgXx99YB6i7YBjONbXsMQAhaSQwoEAKrXoD bi2V3Gt7P8M0aQk8w8Bs+94zkrQke4uKDTJ9nOKf6w8Nb11l/SdSbZ/UH9baaNnZm1sjiJ KkSUWjzbIfA5dnE3ksXuVYH+80/YsZli/p1O7121T+r0wvd23Ljcd3DnSI7X469nRgfAj+ ywqhkPdfRUf8ef18daKMfmYFOSKLoON/5nBCmxEUI6IT7dyvf4BkMJTIkkIyqQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 50B6326B92; Tue, 15 Mar 2022 18:16:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 22FIGH0q075670; Tue, 15 Mar 2022 18:16:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 22FIGHI7075669; Tue, 15 Mar 2022 18:16:17 GMT (envelope-from git) Date: Tue, 15 Mar 2022 18:16:17 GMT Message-Id: <202203151816.22FIGHI7075669@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 1c136ac8a969 - releng/12.3 - net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/12.3 X-Git-Reftype: branch X-Git-Commit: 1c136ac8a969a0c39962371a0b187845373015c1 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1647368177; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=RIrsLgAwS0T5X/I4Zq1xs+Fl/qw0rpsfEwvODsJTrFA=; b=mfsIt9hF55J8SIF+P3Skin7M0xbIrstZqz0icUzZN1avFA4/C1Ux/smALegPoE/knlVsIZ BoN/WgrSDPmJ5uvu7iP7vEG/o0Nnn6p9GQ7lkEd+KR3h94SmfBG8p/no6iruJiNJU6smil I0xOShsNG+LoYIfrrOtEjWiCxmS4/joHkLBK9V1YV2YA4l4oI0IhanjbjAMV3udHIKotp8 BZWLoYGTDPXLhA3KPSy6RvZp8y8IdcjRaS9jAIbpXCNRp1OPaI4KYGSQqBeY/BAxKB38pU 8MdbwkbFCRY5eBj/fEjsLy8pBSMZr10ovpfhppLUG9L9fiAbDeFvZiEaBiYtoQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1647368177; a=rsa-sha256; cv=none; b=FewJtS788IVx11mCLyNg2i9bWCDHLWuuq2KTH6wBpRXO2D4l6gLW7Xq9rorEh/yrTJKFQT /OjOebF+GzrcQBKXnVkHPWFsyU7EoIDTe1lSoXyo3LwdsGF0xXD1QZy0offciHBV6IdJrJ irKozKIOLjDGHBRbsL0Ogi6t9+tboycL6fL+NER728RLlTTK3aIS6wLwHNhXsnQS7SO6Du Hczc7lnudOtGsXWBlpNjxWpGMrcb+rHtLVGRNuljGNUaWSmvu7AtAPd+mDk9iuszU7nwER iKTyWzOQ7Ds/6jVVwsmi4zl4w7FcMMSRt5f7Ffjb8ugoTKEhUW3iJK3c8CuDag== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch releng/12.3 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1c136ac8a969a0c39962371a0b187845373015c1 commit 1c136ac8a969a0c39962371a0b187845373015c1 Author: Mathy Vanhoef AuthorDate: 2021-06-06 22:10:56 +0000 Commit: Mark Johnston CommitDate: 2022-03-15 18:16:01 +0000 net80211: prevent plaintext injection by A-MSDU RFC1042/EAPOL frames No longer accept plaintext A-MSDU frames that start with an RFC1042 header with EtherType EAPOL. This is done by only accepting EAPOL packets that are included in non-aggregated 802.11 frames. Note that before this patch, FreeBSD also only accepted EAPOL frames that are sent in a non-aggregated 802.11 frame due to bugs in processing EAPOL packets inside A-MSDUs. In other words, compatibility with legitimate devices remains the same. This relates to section 6.5 in the 2021 Usenix "FragAttacks" (Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation) paper. Submitted by: Mathy Vanhoef (Mathy.Vanhoef kuleuven.be) Security: CVE-2020-26144 PR: 256120 (cherry picked from commit ffc19cf52da5546973965f78cf32aa0f2c9657f8) (cherry picked from commit 8b2ba742cc2c732bc4bc1d43f8256adce06657d0) (cherry picked from commit 2d09e4366b67dd719ebae5390436868e5430d833) Approved by: so Security: FreeBSD-SA-22:02.wifi --- sys/net80211/ieee80211_adhoc.c | 18 ++++++++++++------ sys/net80211/ieee80211_hostap.c | 18 ++++++++++++------ sys/net80211/ieee80211_sta.c | 18 ++++++++++++------ sys/net80211/ieee80211_wds.c | 18 ++++++++++++------ 4 files changed, 48 insertions(+), 24 deletions(-) diff --git a/sys/net80211/ieee80211_adhoc.c b/sys/net80211/ieee80211_adhoc.c index e2164bbb46a1..150515222268 100644 --- a/sys/net80211/ieee80211_adhoc.c +++ b/sys/net80211/ieee80211_adhoc.c @@ -571,7 +571,10 @@ adhoc_input(struct ieee80211_node *ni, struct mbuf *m, IEEE80211_NODE_STAT(ni, rx_decap); goto err; } - eh = mtod(m, struct ether_header *); + if (!(qos & IEEE80211_QOS_AMSDU)) + eh = mtod(m, struct ether_header *); + else + eh = NULL; if (!ieee80211_node_is_authorized(ni)) { /* * Deny any non-PAE frames received prior to @@ -581,11 +584,13 @@ adhoc_input(struct ieee80211_node *ni, struct mbuf *m, * the port is not marked authorized by the * authenticator until the handshake has completed. */ - if (eh->ether_type != htons(ETHERTYPE_PAE)) { + if (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE)) { IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, - eh->ether_shost, "data", - "unauthorized port: ether type 0x%x len %u", - eh->ether_type, m->m_pkthdr.len); + ni->ni_macaddr, "data", "unauthorized or " + "unknown port: ether type 0x%x len %u", + eh == NULL ? -1 : eh->ether_type, + m->m_pkthdr.len); vap->iv_stats.is_rx_unauth++; IEEE80211_NODE_STAT(ni, rx_unauth); goto err; @@ -598,7 +603,8 @@ adhoc_input(struct ieee80211_node *ni, struct mbuf *m, if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) && (is_hw_decrypted == 0) && - eh->ether_type != htons(ETHERTYPE_PAE)) { + (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE))) { /* * Drop unencrypted frames. */ diff --git a/sys/net80211/ieee80211_hostap.c b/sys/net80211/ieee80211_hostap.c index 8183d3e9b25a..3f86fd785a91 100644 --- a/sys/net80211/ieee80211_hostap.c +++ b/sys/net80211/ieee80211_hostap.c @@ -757,7 +757,10 @@ hostap_input(struct ieee80211_node *ni, struct mbuf *m, IEEE80211_NODE_STAT(ni, rx_decap); goto err; } - eh = mtod(m, struct ether_header *); + if (!(qos & IEEE80211_QOS_AMSDU)) + eh = mtod(m, struct ether_header *); + else + eh = NULL; if (!ieee80211_node_is_authorized(ni)) { /* * Deny any non-PAE frames received prior to @@ -767,11 +770,13 @@ hostap_input(struct ieee80211_node *ni, struct mbuf *m, * the port is not marked authorized by the * authenticator until the handshake has completed. */ - if (eh->ether_type != htons(ETHERTYPE_PAE)) { + if (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE)) { IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, - eh->ether_shost, "data", - "unauthorized port: ether type 0x%x len %u", - eh->ether_type, m->m_pkthdr.len); + ni->ni_macaddr, "data", "unauthorized or " + "unknown port: ether type 0x%x len %u", + eh == NULL ? -1 : eh->ether_type, + m->m_pkthdr.len); vap->iv_stats.is_rx_unauth++; IEEE80211_NODE_STAT(ni, rx_unauth); goto err; @@ -784,7 +789,8 @@ hostap_input(struct ieee80211_node *ni, struct mbuf *m, if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) && (is_hw_decrypted == 0) && - eh->ether_type != htons(ETHERTYPE_PAE)) { + (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE))) { /* * Drop unencrypted frames. */ diff --git a/sys/net80211/ieee80211_sta.c b/sys/net80211/ieee80211_sta.c index 42a377f12857..18177f85d758 100644 --- a/sys/net80211/ieee80211_sta.c +++ b/sys/net80211/ieee80211_sta.c @@ -840,7 +840,10 @@ sta_input(struct ieee80211_node *ni, struct mbuf *m, IEEE80211_NODE_STAT(ni, rx_decap); goto err; } - eh = mtod(m, struct ether_header *); + if (!(qos & IEEE80211_QOS_AMSDU)) + eh = mtod(m, struct ether_header *); + else + eh = NULL; if (!ieee80211_node_is_authorized(ni)) { /* * Deny any non-PAE frames received prior to @@ -850,11 +853,13 @@ sta_input(struct ieee80211_node *ni, struct mbuf *m, * the port is not marked authorized by the * authenticator until the handshake has completed. */ - if (eh->ether_type != htons(ETHERTYPE_PAE)) { + if (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE)) { IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, - eh->ether_shost, "data", - "unauthorized port: ether type 0x%x len %u", - eh->ether_type, m->m_pkthdr.len); + ni->ni_macaddr, "data", "unauthorized or " + "unknown port: ether type 0x%x len %u", + eh == NULL ? -1 : eh->ether_type, + m->m_pkthdr.len); vap->iv_stats.is_rx_unauth++; IEEE80211_NODE_STAT(ni, rx_unauth); goto err; @@ -867,7 +872,8 @@ sta_input(struct ieee80211_node *ni, struct mbuf *m, if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) && (is_hw_decrypted == 0) && - eh->ether_type != htons(ETHERTYPE_PAE)) { + (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE))) { /* * Drop unencrypted frames. */ diff --git a/sys/net80211/ieee80211_wds.c b/sys/net80211/ieee80211_wds.c index dc0d9f8e1afd..e479cee5ddde 100644 --- a/sys/net80211/ieee80211_wds.c +++ b/sys/net80211/ieee80211_wds.c @@ -632,7 +632,10 @@ wds_input(struct ieee80211_node *ni, struct mbuf *m, IEEE80211_NODE_STAT(ni, rx_decap); goto err; } - eh = mtod(m, struct ether_header *); + if (!(qos & IEEE80211_QOS_AMSDU)) + eh = mtod(m, struct ether_header *); + else + eh = NULL; if (!ieee80211_node_is_authorized(ni)) { /* * Deny any non-PAE frames received prior to @@ -642,11 +645,13 @@ wds_input(struct ieee80211_node *ni, struct mbuf *m, * the port is not marked authorized by the * authenticator until the handshake has completed. */ - if (eh->ether_type != htons(ETHERTYPE_PAE)) { + if (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE)) { IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, - eh->ether_shost, "data", - "unauthorized port: ether type 0x%x len %u", - eh->ether_type, m->m_pkthdr.len); + ni->ni_macaddr, "data", "unauthorized or " + "unknown port: ether type 0x%x len %u", + eh == NULL ? -1 : eh->ether_type, + m->m_pkthdr.len); vap->iv_stats.is_rx_unauth++; IEEE80211_NODE_STAT(ni, rx_unauth); goto err; @@ -659,7 +664,8 @@ wds_input(struct ieee80211_node *ni, struct mbuf *m, if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) && (is_hw_decrypted == 0) && - eh->ether_type != htons(ETHERTYPE_PAE)) { + (eh == NULL || + eh->ether_type != htons(ETHERTYPE_PAE))) { /* * Drop unencrypted frames. */