Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37720569 authored by Jouni Malinen's avatar Jouni Malinen Committed by Johannes Berg
Browse files

cfg80211: Fix BIP (AES-CMAC) cipher validation 



This cipher can be used only as a group management frame cipher and as
such, there is no point in validating that it is not used with non-zero
key-index. Instead, verify that it is not used as a pairwise cipher
regardless of the key index.

Signed-off-by: default avatarJouni Malinen <jouni@qca.qualcomm.com>
[change code to use switch statement which is easier to extend]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 3cb10943

net/wireless/util.c

+20 −12
Original line number Diff line number Diff line
@@ -227,18 +227,26 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev, 
	if (pairwise && !mac_addr)

		return -EINVAL;



	/*

	 * Disallow pairwise keys with non-zero index unless it's WEP

	switch (params->cipher) {

	case WLAN_CIPHER_SUITE_TKIP:

	case WLAN_CIPHER_SUITE_CCMP:

		/* Disallow pairwise keys with non-zero index unless it's WEP

		 * or a vendor specific cipher (because current deployments use

	 * pairwise WEP keys with non-zero indices and for vendor specific

	 * ciphers this should be validated in the driver or hardware level

	 * - but 802.11i clearly specifies to use zero)

		 * pairwise WEP keys with non-zero indices and for vendor

		 * specific ciphers this should be validated in the driver or

		 * hardware level - but 802.11i clearly specifies to use zero)

		 */

	if (pairwise && key_idx &&

	    ((params->cipher == WLAN_CIPHER_SUITE_TKIP) ||

	     (params->cipher == WLAN_CIPHER_SUITE_CCMP) ||

	     (params->cipher == WLAN_CIPHER_SUITE_AES_CMAC)))

		if (pairwise && key_idx)

			return -EINVAL;

		break;

	case WLAN_CIPHER_SUITE_AES_CMAC:

		/* Disallow BIP (group-only) cipher as pairwise cipher */

		if (pairwise)

			return -EINVAL;

		break;

	default:

		break;

	}



	switch (params->cipher) {

	case WLAN_CIPHER_SUITE_WEP40: