mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2024-10-19 22:18:16 +02:00
bbda81ce30
Fixes: - CERT case ID: VU#228519 - CVE-2017-13077 - CVE-2017-13078 - CVE-2017-13079 - CVE-2017-13080 - CVE-2017-13081 - CVE-2017-13082 - CVE-2017-13086 - CVE-2017-13087 - CVE-2017-13088 For more information see: https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt Signed-off-by: Felix Fietkau <nbd@nbd.name>
36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
From: Jouni Malinen <j@w1.fi>
|
|
Date: Fri, 22 Sep 2017 11:25:02 +0300
|
|
Subject: [PATCH] WNM: Ignore WNM-Sleep Mode Response without pending
|
|
request
|
|
|
|
Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
|
|
Mode Response if WNM-Sleep Mode has not been used') started ignoring the
|
|
response when no WNM-Sleep Mode Request had been used during the
|
|
association. This can be made tighter by clearing the used flag when
|
|
successfully processing a response. This adds an additional layer of
|
|
protection against unexpected retransmissions of the response frame.
|
|
|
|
Signed-off-by: Jouni Malinen <j@w1.fi>
|
|
---
|
|
|
|
--- a/wpa_supplicant/wnm_sta.c
|
|
+++ b/wpa_supplicant/wnm_sta.c
|
|
@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(
|
|
|
|
if (!wpa_s->wnmsleep_used) {
|
|
wpa_printf(MSG_DEBUG,
|
|
- "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
|
|
+ "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
|
|
return;
|
|
}
|
|
|
|
@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(
|
|
return;
|
|
}
|
|
|
|
+ wpa_s->wnmsleep_used = 0;
|
|
+
|
|
if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
|
|
wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
|
|
wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
|