Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a3e768a authored by Min Liu's avatar Min Liu Committed by Madan Koyyalamudi
Browse files

qcacmn: Filter out beacon with invalid RSN IE 

Filter out beacon / probe response which has RSN IE with
truncated fields.

Change-Id: I747fe83d35fbd9986770c499465e89c14947933f
CRs-Fixed: 2757951
parent 68428937

umac/cmn_services/crypto/src/wlan_crypto_global_api.c

+13 −7
Original line number Diff line number Diff line
@@ -2837,19 +2837,25 @@ QDF_STATUS wlan_crypto_rsnie_check(struct wlan_crypto_params *crypto_params, 
			return QDF_STATUS_E_INVAL;

		}

		/*TODO: Save pmkid in params for further reference */

	} else if (len == 1) {

		crypto_err("PMKID is truncated");

		return QDF_STATUS_E_INVAL;

	}



	/* BIP */

	if (!len &&

	    (crypto_params->rsn_caps & WLAN_CRYPTO_RSN_CAP_MFP_ENABLED)) {

	if (!len) {

		/* when no BIP mentioned and MFP capable use CMAC as default*/

		SET_MGMT_CIPHER(crypto_params, WLAN_CRYPTO_CIPHER_AES_CMAC);

		if (crypto_params->rsn_caps & WLAN_CRYPTO_RSN_CAP_MFP_ENABLED)

			SET_MGMT_CIPHER(crypto_params,

					WLAN_CRYPTO_CIPHER_AES_CMAC);

		return QDF_STATUS_SUCCESS;

	} else if (len >= 4) {

	} else if (len < 4) {

		crypto_err("Mgmt cipher is truncated");

		return QDF_STATUS_E_INVAL;

	}

	w = wlan_crypto_rsn_suite_to_cipher(frm);

	frm += 4, len -= 4;

	SET_MGMT_CIPHER(crypto_params, w);

	}



	return QDF_STATUS_SUCCESS;

}