diff options
| author | Stefan Sperling <stsp@cvs.openbsd.org> | 2021-05-18 08:10:46 +0000 |
|---|---|---|
| committer | Stefan Sperling <stsp@cvs.openbsd.org> | 2021-05-18 08:10:46 +0000 |
| commit | 603ad7d4a9dfd02bd08512274b075598804a2055 (patch) | |
| tree | c06f456b42b0b68eb76c70c5602e5092b3a83621 /sys/net80211 | |
| parent | f9f9266361e5cfeade26dab0aac110c9ebfc23ef (diff) | |
Drop fragmented 802.11 frames.
Fragmented frames were never of any practical use to us anyway, given that
our net80211 stack does not (yet?) re-assemble them.
Counter-measure against attacks where an arbitrary packet is injected in a
fragment with attacker-controlled content (via an AP which supports fragments).
See https://papers.mathyvanhoef.com/usenix2021.pdf
Section 6.8 "Treating fragments as full frames"
ok mpi@
Diffstat (limited to 'sys/net80211')
| -rw-r--r-- | sys/net80211/ieee80211_input.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c index 41e8bd6cca1..e66a661a1a4 100644 --- a/sys/net80211/ieee80211_input.c +++ b/sys/net80211/ieee80211_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_input.c,v 1.236 2021/05/17 11:44:22 stsp Exp $ */ +/* $OpenBSD: ieee80211_input.c,v 1.237 2021/05/18 08:10:45 stsp Exp $ */ /*- * Copyright (c) 2001 Atsushi Onoe @@ -384,6 +384,20 @@ ieee80211_inputm(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni, } } + /* + * We do not yet support fragments. Drop any fragmented packets. + * Counter-measure against attacks where an arbitrary packet is + * injected via a fragment with attacker-controlled content. + * See https://papers.mathyvanhoef.com/usenix2021.pdf + * Section 6.8 "Treating fragments as full frames" + */ + if (ieee80211_has_seq(wh)) { + uint16_t rxseq = letoh16(*(const u_int16_t *)wh->i_seq); + if ((wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG) || + (rxseq & IEEE80211_SEQ_FRAG_MASK)) + goto err; + } + /* duplicate detection (see 9.2.9) */ if (ieee80211_has_seq(wh) && ic->ic_state != IEEE80211_S_SCAN) { |